drivers/staging/rtl8188eu/core/rtw_mlme_ext.c

   1 /******************************************************************************
   2  *
   3  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  ******************************************************************************/
  15 #define _RTW_MLME_EXT_C_
  16
  17 #include <linux/ieee80211.h>
  18 #include <asm/unaligned.h>
  19
  20 #include <osdep_service.h>
  21 #include <drv_types.h>
  22 #include <wifi.h>
  23 #include <rtw_mlme_ext.h>
  24 #include <wlan_bssdef.h>
  25 #include <mlme_osdep.h>
  26 #include <recv_osdep.h>
  27
  28 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  29
  30 /**************************************************
  31 OUI definitions for the vendor specific IE
  32 ***************************************************/
  33 unsigned char   RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  34 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  35 unsigned char   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  36 unsigned char   P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  37 unsigned char   WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  38
  39 unsigned char   WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  40 unsigned char   WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  41
  42 unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
  43 unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
  44
  45 extern unsigned char REALTEK_96B_IE[];
  46
  47 /********************************************************
  48 MCS rate definitions
  49 *********************************************************/
  50 unsigned char   MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  51
  52 /********************************************************
  53 ChannelPlan definitions
  54 *********************************************************/
  55 static struct rt_channel_plan_2g RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  56         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  57         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  58         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  59         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  60         {{10, 11, 12, 13}, 4},                                  /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  61         {{}, 0},                                                                        /*  0x05, RT_CHANNEL_DOMAIN_2G_NULL */
  62 };
  63
  64 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  65         /*  0x00 ~ 0x1F , Old Define ===== */
  66         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  67         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  68         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  69         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  70         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  71         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  72         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  73         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  74         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  75         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  76         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  77         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  78         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  79         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  80         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  81         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  82         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
  83         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
  84         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  85         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
  86         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
  87         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
  88         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
  89         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  90         {0x05}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
  91         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
  92         {0x00}, /* 0x1A, */
  93         {0x00}, /* 0x1B, */
  94         {0x00}, /* 0x1C, */
  95         {0x00}, /* 0x1D, */
  96         {0x00}, /* 0x1E, */
  97         {0x05}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
  98         /*  0x20 ~ 0x7F , New Define ===== */
  99         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 100         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 101         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 102         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 103         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 104         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 105         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 106         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 107         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 108         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 109         {0x00}, /* 0x2A, */
 110         {0x00}, /* 0x2B, */
 111         {0x00}, /* 0x2C, */
 112         {0x00}, /* 0x2D, */
 113         {0x00}, /* 0x2E, */
 114         {0x00}, /* 0x2F, */
 115         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 116         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 117         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 118         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 119         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 120         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 121         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 122         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 123         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 124         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 125         {0x00}, /* 0x3A, */
 126         {0x00}, /* 0x3B, */
 127         {0x00}, /* 0x3C, */
 128         {0x00}, /* 0x3D, */
 129         {0x00}, /* 0x3E, */
 130         {0x00}, /* 0x3F, */
 131         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 132         {0x03}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G */
 133 };
 134
 135 static const struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {
 136         0x03
 137 }; /* use the combination for max channel numbers */
 138
 139 /*
 140  * Search the @param channel_num in given @param channel_set
 141  * @ch_set: the given channel set
 142  * @ch: the given channel number
 143  *
 144  * return the index of channel_num in channel_set, -1 if not found
 145  */
 146 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 147 {
 148         int i;
 149
 150         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 151                 if (ch == ch_set[i].ChannelNum)
 152                         break;
 153         }
 154
 155         if (i >= ch_set[i].ChannelNum)
 156                 return -1;
 157         return i;
 158 }
 159
 160 struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
 161 {
 162         struct xmit_frame                       *pmgntframe;
 163         struct xmit_buf                         *pxmitbuf;
 164
 165         pmgntframe = rtw_alloc_xmitframe(pxmitpriv);
 166         if (pmgntframe == NULL) {
 167                 DBG_88E("%s, alloc xmitframe fail\n", __func__);
 168                 return NULL;
 169         }
 170
 171         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
 172         if (pxmitbuf == NULL) {
 173                 DBG_88E("%s, alloc xmitbuf fail\n", __func__);
 174                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
 175                 return NULL;
 176         }
 177         pmgntframe->frame_tag = MGNT_FRAMETAG;
 178         pmgntframe->pxmitbuf = pxmitbuf;
 179         pmgntframe->buf_addr = pxmitbuf->pbuf;
 180         pxmitbuf->priv_data = pmgntframe;
 181         return pmgntframe;
 182 }
 183
 184 /****************************************************************************
 185
 186 Following are some TX functions for WiFi MLME
 187
 188 *****************************************************************************/
 189
 190 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
 191 {
 192         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 193
 194         pmlmeext->tx_rate = rate;
 195         DBG_88E("%s(): rate = %x\n", __func__, rate);
 196 }
 197
 198 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
 199 {
 200         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 201
 202         memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
 203
 204         pattrib->hdrlen = 24;
 205         pattrib->nr_frags = 1;
 206         pattrib->priority = 7;
 207         pattrib->mac_id = 0;
 208         pattrib->qsel = 0x12;
 209
 210         pattrib->pktlen = 0;
 211
 212         if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
 213                 pattrib->raid = 6;/* b mode */
 214         else
 215                 pattrib->raid = 5;/* a/g mode */
 216
 217         pattrib->encrypt = _NO_PRIVACY_;
 218         pattrib->bswenc = false;
 219
 220         pattrib->qos_en = false;
 221         pattrib->ht_en = false;
 222         pattrib->bwmode = HT_CHANNEL_WIDTH_20;
 223         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 224         pattrib->sgi = false;
 225
 226         pattrib->seqnum = pmlmeext->mgnt_seq;
 227
 228         pattrib->retry_ctrl = true;
 229 }
 230
 231 static void dump_mgntframe(struct adapter *padapter,
 232                            struct xmit_frame *pmgntframe)
 233 {
 234         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 235                 return;
 236
 237         rtw_hal_mgnt_xmit(padapter, pmgntframe);
 238 }
 239
 240 static s32 dump_mgntframe_and_wait(struct adapter *padapter,
 241                                    struct xmit_frame *pmgntframe,
 242                                    int timeout_ms)
 243 {
 244         s32 ret = _FAIL;
 245         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
 246         struct submit_ctx sctx;
 247
 248         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 249                 return ret;
 250
 251         rtw_sctx_init(&sctx, timeout_ms);
 252         pxmitbuf->sctx = &sctx;
 253
 254         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
 255
 256         if (ret == _SUCCESS)
 257                 ret = rtw_sctx_wait(&sctx);
 258
 259         return ret;
 260 }
 261
 262 static s32 dump_mgntframe_and_wait_ack(struct adapter *padapter,
 263                                        struct xmit_frame *pmgntframe)
 264 {
 265         s32 ret = _FAIL;
 266         u32 timeout_ms = 500;/*   500ms */
 267         struct xmit_priv        *pxmitpriv = &padapter->xmitpriv;
 268
 269         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 270                 return -1;
 271
 272         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex))
 273                 return _FAIL;
 274         pxmitpriv->ack_tx = true;
 275
 276         pmgntframe->ack_report = 1;
 277         if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
 278                 ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
 279
 280         pxmitpriv->ack_tx = false;
 281         mutex_unlock(&pxmitpriv->ack_tx_mutex);
 282
 283         return ret;
 284 }
 285
 286 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
 287 {
 288         u8 *ssid_ie;
 289         uint ssid_len_ori;
 290         int len_diff = 0;
 291
 292         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
 293
 294         if (ssid_ie && ssid_len_ori > 0) {
 295                 switch (hidden_ssid_mode) {
 296                 case 1: {
 297                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
 298                         u32 remain_len = 0;
 299
 300                         remain_len = ies_len - (next_ie - ies);
 301
 302                         ssid_ie[1] = 0;
 303                         memcpy(ssid_ie+2, next_ie, remain_len);
 304                         len_diff -= ssid_len_ori;
 305
 306                         break;
 307                 }
 308                 case 2:
 309                         memset(&ssid_ie[2], 0, ssid_len_ori);
 310                         break;
 311                 default:
 312                         break;
 313                 }
 314         }
 315
 316         return len_diff;
 317 }
 318
 319 static void issue_beacon(struct adapter *padapter, int timeout_ms)
 320 {
 321         struct xmit_frame       *pmgntframe;
 322         struct pkt_attrib       *pattrib;
 323         unsigned char   *pframe;
 324         struct ieee80211_hdr *pwlanhdr;
 325         __le16 *fctrl;
 326         unsigned int    rate_len;
 327         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 328         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 329         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 330         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 331         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 332         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 333
 334         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 335         if (pmgntframe == NULL) {
 336                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 337                 return;
 338         }
 339 #if defined(CONFIG_88EU_AP_MODE)
 340         spin_lock_bh(&pmlmepriv->bcn_update_lock);
 341 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 342
 343         /* update attribute */
 344         pattrib = &pmgntframe->attrib;
 345         update_mgntframe_attrib(padapter, pattrib);
 346         pattrib->qsel = 0x10;
 347
 348         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 349
 350         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 351         pwlanhdr = (struct ieee80211_hdr *)pframe;
 352
 353
 354         fctrl = &pwlanhdr->frame_control;
 355         *(fctrl) = 0;
 356
 357         ether_addr_copy(pwlanhdr->addr1, bc_addr);
 358         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
 359         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
 360
 361         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
 362         /* pmlmeext->mgnt_seq++; */
 363         SetFrameSubType(pframe, WIFI_BEACON);
 364
 365         pframe += sizeof(struct ieee80211_hdr_3addr);
 366         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 367
 368         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 369                 int len_diff;
 370                 u8 *wps_ie;
 371                 uint wps_ielen;
 372                 u8 sr = 0;
 373
 374                 memcpy(pframe, cur_network->IEs, cur_network->IELength);
 375                 len_diff = update_hidden_ssid(
 376                         pframe+_BEACON_IE_OFFSET_
 377                         , cur_network->IELength-_BEACON_IE_OFFSET_
 378                         , pmlmeinfo->hidden_ssid_mode
 379                         );
 380                 pframe += (cur_network->IELength+len_diff);
 381                 pattrib->pktlen += (cur_network->IELength+len_diff);
 382                 wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
 383                         pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
 384                 if (wps_ie && wps_ielen > 0)
 385                         rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
 386                 if (sr != 0)
 387                         set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
 388                 else
 389                         _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
 390
 391                 goto _issue_bcn;
 392         }
 393
 394         /* below for ad-hoc mode */
 395
 396         /* timestamp will be inserted by hardware */
 397         pframe += 8;
 398         pattrib->pktlen += 8;
 399
 400         /*  beacon interval: 2 bytes */
 401
 402         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 403
 404         pframe += 2;
 405         pattrib->pktlen += 2;
 406
 407         /*  capability info: 2 bytes */
 408
 409         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 410
 411         pframe += 2;
 412         pattrib->pktlen += 2;
 413
 414         /*  SSID */
 415         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 416
 417         /*  supported rates... */
 418         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 419         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 420
 421         /*  DS parameter set */
 422         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 423
 424         {
 425                 u8 erpinfo = 0;
 426                 u32 ATIMWindow;
 427                 /*  IBSS Parameter Set... */
 428                 ATIMWindow = 0;
 429                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 430
 431                 /* ERP IE */
 432                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 433         }
 434
 435         /*  EXTERNDED SUPPORTED RATE */
 436         if (rate_len > 8)
 437                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 438         /* todo:HT for adhoc */
 439 _issue_bcn:
 440
 441 #if defined(CONFIG_88EU_AP_MODE)
 442         pmlmepriv->update_bcn = false;
 443
 444         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
 445 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 446
 447         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
 448                 DBG_88E("beacon frame too large\n");
 449                 return;
 450         }
 451
 452         pattrib->last_txcmdsz = pattrib->pktlen;
 453
 454         /* DBG_88E("issue bcn_sz=%d\n", pattrib->last_txcmdsz); */
 455         if (timeout_ms > 0)
 456                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
 457         else
 458                 dump_mgntframe(padapter, pmgntframe);
 459 }
 460
 461 static void issue_probersp(struct adapter *padapter, unsigned char *da)
 462 {
 463         struct xmit_frame                       *pmgntframe;
 464         struct pkt_attrib                       *pattrib;
 465         unsigned char                                   *pframe;
 466         struct ieee80211_hdr *pwlanhdr;
 467         __le16 *fctrl;
 468         unsigned char                                   *mac, *bssid;
 469         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 470 #if defined(CONFIG_88EU_AP_MODE)
 471         u8 *pwps_ie;
 472         uint wps_ielen;
 473         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 474 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 475         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 476         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 477         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 478         unsigned int    rate_len;
 479
 480         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 481         if (pmgntframe == NULL) {
 482                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 483                 return;
 484         }
 485
 486         /* update attribute */
 487         pattrib = &pmgntframe->attrib;
 488         update_mgntframe_attrib(padapter, pattrib);
 489
 490         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 491
 492         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 493         pwlanhdr = (struct ieee80211_hdr *)pframe;
 494
 495         mac = myid(&(padapter->eeprompriv));
 496         bssid = cur_network->MacAddress;
 497
 498         fctrl = &pwlanhdr->frame_control;
 499         *(fctrl) = 0;
 500         ether_addr_copy(pwlanhdr->addr1, da);
 501         ether_addr_copy(pwlanhdr->addr2, mac);
 502         ether_addr_copy(pwlanhdr->addr3, bssid);
 503
 504         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 505         pmlmeext->mgnt_seq++;
 506         SetFrameSubType(fctrl, WIFI_PROBERSP);
 507
 508         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 509         pattrib->pktlen = pattrib->hdrlen;
 510         pframe += pattrib->hdrlen;
 511
 512         if (cur_network->IELength > MAX_IE_SZ)
 513                 return;
 514
 515 #if defined(CONFIG_88EU_AP_MODE)
 516         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 517                 pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
 518
 519                 /* inerset & update wps_probe_resp_ie */
 520                 if ((pmlmepriv->wps_probe_resp_ie != NULL) && pwps_ie && (wps_ielen > 0)) {
 521                         uint wps_offset, remainder_ielen;
 522                         u8 *premainder_ie;
 523
 524                         wps_offset = (uint)(pwps_ie - cur_network->IEs);
 525
 526                         premainder_ie = pwps_ie + wps_ielen;
 527
 528                         remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
 529
 530                         memcpy(pframe, cur_network->IEs, wps_offset);
 531                         pframe += wps_offset;
 532                         pattrib->pktlen += wps_offset;
 533
 534                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
 535                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
 536                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
 537                                 pframe += wps_ielen+2;
 538                                 pattrib->pktlen += wps_ielen+2;
 539                         }
 540
 541                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
 542                                 memcpy(pframe, premainder_ie, remainder_ielen);
 543                                 pframe += remainder_ielen;
 544                                 pattrib->pktlen += remainder_ielen;
 545                         }
 546                 } else {
 547                         memcpy(pframe, cur_network->IEs, cur_network->IELength);
 548                         pframe += cur_network->IELength;
 549                         pattrib->pktlen += cur_network->IELength;
 550                 }
 551         } else
 552 #endif
 553         {
 554                 /* timestamp will be inserted by hardware */
 555                 pframe += 8;
 556                 pattrib->pktlen += 8;
 557
 558                 /*  beacon interval: 2 bytes */
 559
 560                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 561
 562                 pframe += 2;
 563                 pattrib->pktlen += 2;
 564
 565                 /*  capability info: 2 bytes */
 566
 567                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 568
 569                 pframe += 2;
 570                 pattrib->pktlen += 2;
 571
 572                 /* below for ad-hoc mode */
 573
 574                 /*  SSID */
 575                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 576
 577                 /*  supported rates... */
 578                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 579                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 580
 581                 /*  DS parameter set */
 582                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 583
 584                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 585                         u8 erpinfo = 0;
 586                         u32 ATIMWindow;
 587                         /*  IBSS Parameter Set... */
 588                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
 589                         ATIMWindow = 0;
 590                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 591
 592                         /* ERP IE */
 593                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 594                 }
 595
 596
 597                 /*  EXTERNDED SUPPORTED RATE */
 598                 if (rate_len > 8)
 599                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 600                 /* todo:HT for adhoc */
 601         }
 602
 603         pattrib->last_txcmdsz = pattrib->pktlen;
 604
 605         dump_mgntframe(padapter, pmgntframe);
 606 }
 607
 608 static int issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, bool wait_ack)
 609 {
 610         int ret = _FAIL;
 611         struct xmit_frame               *pmgntframe;
 612         struct pkt_attrib               *pattrib;
 613         unsigned char                   *pframe;
 614         struct ieee80211_hdr *pwlanhdr;
 615         __le16 *fctrl;
 616         unsigned char                   *mac;
 617         unsigned char                   bssrate[NumRates];
 618         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
 619         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 620         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 621         int     bssrate_len = 0;
 622         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 623
 624         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+issue_probereq\n"));
 625
 626         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 627         if (pmgntframe == NULL)
 628                 goto exit;
 629
 630         /* update attribute */
 631         pattrib = &pmgntframe->attrib;
 632         update_mgntframe_attrib(padapter, pattrib);
 633
 634
 635         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 636
 637         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 638         pwlanhdr = (struct ieee80211_hdr *)pframe;
 639
 640         mac = myid(&(padapter->eeprompriv));
 641
 642         fctrl = &pwlanhdr->frame_control;
 643         *(fctrl) = 0;
 644
 645         if (da) {
 646                 /*      unicast probe request frame */
 647                 ether_addr_copy(pwlanhdr->addr1, da);
 648                 ether_addr_copy(pwlanhdr->addr3, da);
 649         } else {
 650                 /*      broadcast probe request frame */
 651                 ether_addr_copy(pwlanhdr->addr1, bc_addr);
 652                 ether_addr_copy(pwlanhdr->addr3, bc_addr);
 653         }
 654
 655         ether_addr_copy(pwlanhdr->addr2, mac);
 656
 657         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 658         pmlmeext->mgnt_seq++;
 659         SetFrameSubType(pframe, WIFI_PROBEREQ);
 660
 661         pframe += sizeof(struct ieee80211_hdr_3addr);
 662         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 663
 664         if (pssid)
 665                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
 666         else
 667                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
 668
 669         get_rate_set(padapter, bssrate, &bssrate_len);
 670
 671         if (bssrate_len > 8) {
 672                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
 673                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
 674         } else {
 675                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
 676         }
 677
 678         /* add wps_ie for wps2.0 */
 679         if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
 680                 memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
 681                 pframe += pmlmepriv->wps_probe_req_ie_len;
 682                 pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
 683         }
 684
 685         pattrib->last_txcmdsz = pattrib->pktlen;
 686
 687         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
 688                  ("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
 689
 690         if (wait_ack) {
 691                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
 692         } else {
 693                 dump_mgntframe(padapter, pmgntframe);
 694                 ret = _SUCCESS;
 695         }
 696
 697 exit:
 698         return ret;
 699 }
 700
 701 static int issue_probereq_ex(struct adapter *padapter,
 702                              struct ndis_802_11_ssid *pssid, u8 *da,
 703                              int try_cnt, int wait_ms)
 704 {
 705         int ret;
 706         int i = 0;
 707         unsigned long start = jiffies;
 708
 709         do {
 710                 ret = issue_probereq(padapter, pssid, da, wait_ms > 0 ? true : false);
 711
 712                 i++;
 713
 714                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
 715                         break;
 716
 717                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
 718                         msleep(wait_ms);
 719
 720         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
 721
 722         if (ret != _FAIL) {
 723                 ret = _SUCCESS;
 724                 goto exit;
 725         }
 726
 727         if (try_cnt && wait_ms) {
 728                 if (da)
 729                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
 730                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
 731                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 732                                 jiffies_to_msecs(jiffies - start));
 733                 else
 734                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
 735                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
 736                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 737                                 jiffies_to_msecs(jiffies - start));
 738         }
 739 exit:
 740         return ret;
 741 }
 742
 743 /*  if psta == NULL, indicate we are station(client) now... */
 744 static void issue_auth(struct adapter *padapter, struct sta_info *psta,
 745                        unsigned short status)
 746 {
 747         struct xmit_frame *pmgntframe;
 748         struct pkt_attrib *pattrib;
 749         unsigned char *pframe;
 750         struct ieee80211_hdr *pwlanhdr;
 751         __le16 *fctrl;
 752         unsigned int val32;
 753         u16 val16;
 754 #ifdef CONFIG_88EU_AP_MODE
 755         __le16 le_val16;
 756 #endif
 757         int use_shared_key = 0;
 758         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 759         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 760         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 761         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
 762
 763         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 764         if (pmgntframe == NULL)
 765                 return;
 766
 767         /* update attribute */
 768         pattrib = &pmgntframe->attrib;
 769         update_mgntframe_attrib(padapter, pattrib);
 770
 771         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 772
 773         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 774         pwlanhdr = (struct ieee80211_hdr *)pframe;
 775
 776         fctrl = &pwlanhdr->frame_control;
 777         *(fctrl) = 0;
 778
 779         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 780         pmlmeext->mgnt_seq++;
 781         SetFrameSubType(pframe, WIFI_AUTH);
 782
 783         pframe += sizeof(struct ieee80211_hdr_3addr);
 784         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 785
 786
 787         if (psta) {/*  for AP mode */
 788 #ifdef CONFIG_88EU_AP_MODE
 789
 790                 ether_addr_copy(pwlanhdr->addr1, psta->hwaddr);
 791                 ether_addr_copy(pwlanhdr->addr2,
 792                                 myid(&(padapter->eeprompriv)));
 793                 ether_addr_copy(pwlanhdr->addr3,
 794                                 myid(&(padapter->eeprompriv)));
 795
 796
 797                 /*  setting auth algo number */
 798                 val16 = (u16)psta->authalg;
 799
 800                 if (status != _STATS_SUCCESSFUL_)
 801                         val16 = 0;
 802
 803                 if (val16) {
 804                         le_val16 = cpu_to_le16(val16);
 805                         use_shared_key = 1;
 806                 } else {
 807                         le_val16 = 0;
 808                 }
 809
 810                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_val16,
 811                                           &pattrib->pktlen);
 812
 813                 /*  setting auth seq number */
 814                 val16 = (u16)psta->auth_seq;
 815                 le_val16 = cpu_to_le16(val16);
 816                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_val16,
 817                                           &pattrib->pktlen);
 818
 819                 /*  setting status code... */
 820                 val16 = status;
 821                 le_val16 = cpu_to_le16(val16);
 822                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_,
 823                                           &le_val16, &pattrib->pktlen);
 824
 825                 /*  added challenging text... */
 826                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
 827                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
 828 #endif
 829         } else {
 830                 __le32 le_tmp32;
 831                 __le16 le_tmp16;
 832
 833                 ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
 834                 ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
 835                 ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
 836
 837                 /*  setting auth algo number */
 838                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
 839                 if (val16)
 840                         use_shared_key = 1;
 841
 842                 /* setting IV for auth seq #3 */
 843                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 844                         val32 = (pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30);
 845                         le_tmp32 = cpu_to_le32(val32);
 846                         pframe = rtw_set_fixed_ie(pframe, 4, &le_tmp32,
 847                                                   &pattrib->pktlen);
 848
 849                         pattrib->iv_len = 4;
 850                 }
 851
 852                 le_tmp16 = cpu_to_le16(val16);
 853                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_tmp16,
 854                                           &pattrib->pktlen);
 855
 856                 /*  setting auth seq number */
 857                 val16 = pmlmeinfo->auth_seq;
 858                 le_tmp16 = cpu_to_le16(val16);
 859                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_tmp16,
 860                                           &pattrib->pktlen);
 861
 862
 863                 /*  setting status code... */
 864                 le_tmp16 = cpu_to_le16(status);
 865                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &le_tmp16,
 866                                           &pattrib->pktlen);
 867
 868                 /*  then checking to see if sending challenging text... */
 869                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 870                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
 871
 872                         SetPrivacy(fctrl);
 873
 874                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 875
 876                         pattrib->encrypt = _WEP40_;
 877
 878                         pattrib->icv_len = 4;
 879
 880                         pattrib->pktlen += pattrib->icv_len;
 881                 }
 882         }
 883
 884         pattrib->last_txcmdsz = pattrib->pktlen;
 885
 886         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
 887         DBG_88E("%s\n", __func__);
 888         dump_mgntframe(padapter, pmgntframe);
 889 }
 890
 891
 892 #ifdef CONFIG_88EU_AP_MODE
 893 static void issue_asocrsp(struct adapter *padapter, unsigned short status,
 894                           struct sta_info *pstat, int pkt_type)
 895 {
 896         struct xmit_frame       *pmgntframe;
 897         struct ieee80211_hdr *pwlanhdr;
 898         struct pkt_attrib *pattrib;
 899         unsigned char   *pbuf, *pframe;
 900         unsigned short val;
 901         __le16 *fctrl;
 902         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 903         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 904         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 905         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 906         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
 907         u8 *ie = pnetwork->IEs;
 908         __le16 lestatus, leval;
 909
 910         DBG_88E("%s\n", __func__);
 911
 912         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 913         if (pmgntframe == NULL)
 914                 return;
 915
 916         /* update attribute */
 917         pattrib = &pmgntframe->attrib;
 918         update_mgntframe_attrib(padapter, pattrib);
 919
 920
 921         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 922
 923         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 924         pwlanhdr = (struct ieee80211_hdr *)pframe;
 925
 926         fctrl = &pwlanhdr->frame_control;
 927         *(fctrl) = 0;
 928
 929         ether_addr_copy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr);
 930         ether_addr_copy((void *)GetAddr2Ptr(pwlanhdr),
 931                         myid(&(padapter->eeprompriv)));
 932         ether_addr_copy((void *)GetAddr3Ptr(pwlanhdr), pnetwork->MacAddress);
 933
 934
 935         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 936         pmlmeext->mgnt_seq++;
 937         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
 938                 SetFrameSubType(pwlanhdr, pkt_type);
 939         else
 940                 return;
 941
 942         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 943         pattrib->pktlen += pattrib->hdrlen;
 944         pframe += pattrib->hdrlen;
 945
 946         /* capability */
 947         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
 948
 949         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, &val, &pattrib->pktlen);
 950
 951         lestatus = cpu_to_le16(status);
 952         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &lestatus,
 953                                   &pattrib->pktlen);
 954
 955         leval = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
 956         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, &leval, &pattrib->pktlen);
 957
 958         if (pstat->bssratelen <= 8) {
 959                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
 960         } else {
 961                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
 962                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
 963         }
 964
 965         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
 966                 uint ie_len = 0;
 967
 968                 /* FILL HT CAP INFO IE */
 969                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 970                 if (pbuf && ie_len > 0) {
 971                         memcpy(pframe, pbuf, ie_len+2);
 972                         pframe += (ie_len+2);
 973                         pattrib->pktlen += (ie_len+2);
 974                 }
 975
 976                 /* FILL HT ADD INFO IE */
 977                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 978                 if (pbuf && ie_len > 0) {
 979                         memcpy(pframe, pbuf, ie_len+2);
 980                         pframe += (ie_len+2);
 981                         pattrib->pktlen += (ie_len+2);
 982                 }
 983         }
 984
 985         /* FILL WMM IE */
 986         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
 987                 uint ie_len = 0;
 988                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
 989
 990                 for (pbuf = ie + _BEACON_IE_OFFSET_;; pbuf += (ie_len + 2)) {
 991                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
 992                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
 993                                 memcpy(pframe, pbuf, ie_len+2);
 994                                 pframe += (ie_len+2);
 995                                 pattrib->pktlen += (ie_len+2);
 996                                 break;
 997                         }
 998
 999                         if ((pbuf == NULL) || (ie_len == 0))
1000                                 break;
1001                 }
1002         }
1003
1004         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1005                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
1006
1007         /* add WPS IE ie for wps 2.0 */
1008         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
1009                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
1010
1011                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
1012                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
1013         }
1014
1015         pattrib->last_txcmdsz = pattrib->pktlen;
1016         dump_mgntframe(padapter, pmgntframe);
1017 }
1018 #endif /* CONFIG_88EU_AP_MODE */
1019
1020 static void issue_assocreq(struct adapter *padapter)
1021 {
1022         int ret = _FAIL;
1023         struct xmit_frame       *pmgntframe;
1024         struct pkt_attrib       *pattrib;
1025         unsigned char           *pframe, *p;
1026         struct ieee80211_hdr *pwlanhdr;
1027         __le16 *fctrl;
1028         unsigned int    i, j, ie_len, index = 0;
1029         unsigned char bssrate[NumRates], sta_bssrate[NumRates];
1030         struct ndis_802_11_var_ie *pIE;
1031         struct registry_priv    *pregpriv = &padapter->registrypriv;
1032         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
1033         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1034         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1035         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1036         int     bssrate_len = 0, sta_bssrate_len = 0;
1037         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1038
1039         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1040         if (pmgntframe == NULL)
1041                 goto exit;
1042
1043         /* update attribute */
1044         pattrib = &pmgntframe->attrib;
1045         update_mgntframe_attrib(padapter, pattrib);
1046
1047         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1048         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1049         pwlanhdr = (struct ieee80211_hdr *)pframe;
1050
1051         fctrl = &pwlanhdr->frame_control;
1052         *(fctrl) = 0;
1053         ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
1054         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1055         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1056
1057         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1058         pmlmeext->mgnt_seq++;
1059         SetFrameSubType(pframe, WIFI_ASSOCREQ);
1060
1061         pframe += sizeof(struct ieee80211_hdr_3addr);
1062         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1063
1064         /* caps */
1065
1066         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
1067
1068         pframe += 2;
1069         pattrib->pktlen += 2;
1070
1071         /* listen interval */
1072         /* todo: listen interval for power saving */
1073         put_unaligned_le16(3, pframe);
1074         pframe += 2;
1075         pattrib->pktlen += 2;
1076
1077         /* SSID */
1078         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
1079
1080         /* supported rate & extended supported rate */
1081
1082         /*  Check if the AP's supported rates are also supported by STA. */
1083         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
1084
1085         if (pmlmeext->cur_channel == 14)/*  for JAPAN, channel 14 can only uses B Mode(CCK) */
1086                 sta_bssrate_len = 4;
1087
1088         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1089                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1090                         break;
1091                 DBG_88E("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
1092         }
1093
1094         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1095                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1096                         break;
1097
1098                 /*  Check if the AP's supported rates are also supported by STA. */
1099                 for (j = 0; j < sta_bssrate_len; j++) {
1100                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
1101                         if ((pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
1102                                         == (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK))
1103                                 break;
1104                 }
1105
1106                 if (j == sta_bssrate_len) {
1107                         /*  the rate is not supported by STA */
1108                         DBG_88E("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
1109                 } else {
1110                         /*  the rate is supported by STA */
1111                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
1112                 }
1113         }
1114
1115         bssrate_len = index;
1116         DBG_88E("bssrate_len=%d\n", bssrate_len);
1117
1118         if (bssrate_len == 0) {
1119                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
1120                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1121                 goto exit; /* don't connect to AP if no joint supported rate */
1122         }
1123
1124
1125         if (bssrate_len > 8) {
1126                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
1127                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
1128         } else {
1129                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
1130         }
1131
1132         /* RSN */
1133         p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1134         if (p != NULL)
1135                 pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
1136
1137         /* HT caps */
1138         if (padapter->mlmepriv.htpriv.ht_option) {
1139                 p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1140                 if ((p != NULL) && (!(is_ap_in_tkip(padapter)))) {
1141                         memcpy(&pmlmeinfo->HT_caps, p + 2, sizeof(struct ieee80211_ht_cap));
1142
1143                         /* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
1144                         if (pregpriv->cbw40_enable == 0)
1145                                 pmlmeinfo->HT_caps.cap_info &= cpu_to_le16(~(BIT(6) | BIT(1)));
1146                         else
1147                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(BIT(1));
1148
1149                         /* todo: disable SM power save mode */
1150                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x000c);
1151
1152                         if (pregpriv->rx_stbc)
1153                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0100);/* RX STBC One spatial stream */
1154                         memcpy((u8 *)&pmlmeinfo->HT_caps.mcs, MCS_rate_1R, 16);
1155                         pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
1156                 }
1157         }
1158
1159         /* vendor specific IE, such as WPA, WMM, WPS */
1160         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pmlmeinfo->network.IELength; i += (pIE->Length + 2)) {
1161                 pIE = (struct ndis_802_11_var_ie *)(pmlmeinfo->network.IEs + i);
1162
1163                 switch (pIE->ElementID) {
1164                 case _VENDOR_SPECIFIC_IE_:
1165                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
1166                             (!memcmp(pIE->data, WMM_OUI, 4)) ||
1167                             (!memcmp(pIE->data, WPS_OUI, 4))) {
1168                                 if (!padapter->registrypriv.wifi_spec) {
1169                                         /* Commented by Kurt 20110629 */
1170                                         /* In some older APs, WPS handshake */
1171                                         /* would be fail if we append vender extensions informations to AP */
1172                                         if (!memcmp(pIE->data, WPS_OUI, 4))
1173                                                 pIE->Length = 14;
1174                                 }
1175                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
1176                         }
1177                         break;
1178                 default:
1179                         break;
1180                 }
1181         }
1182
1183         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1184                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
1185
1186         pattrib->last_txcmdsz = pattrib->pktlen;
1187         dump_mgntframe(padapter, pmgntframe);
1188
1189         ret = _SUCCESS;
1190
1191 exit:
1192         if (ret == _SUCCESS)
1193                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
1194         else
1195                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
1196 }
1197
1198 /* when wait_ack is true, this function should be called at process context */
1199 static int _issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int wait_ack)
1200 {
1201         int ret = _FAIL;
1202         struct xmit_frame                       *pmgntframe;
1203         struct pkt_attrib                       *pattrib;
1204         unsigned char                                   *pframe;
1205         struct ieee80211_hdr *pwlanhdr;
1206         __le16 *fctrl;
1207         struct xmit_priv        *pxmitpriv;
1208         struct mlme_ext_priv    *pmlmeext;
1209         struct mlme_ext_info    *pmlmeinfo;
1210         struct wlan_bssid_ex    *pnetwork;
1211
1212         if (!padapter)
1213                 goto exit;
1214
1215         pxmitpriv = &(padapter->xmitpriv);
1216         pmlmeext = &(padapter->mlmeextpriv);
1217         pmlmeinfo = &(pmlmeext->mlmext_info);
1218         pnetwork = &(pmlmeinfo->network);
1219
1220         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1221         if (pmgntframe == NULL)
1222                 goto exit;
1223
1224         /* update attribute */
1225         pattrib = &pmgntframe->attrib;
1226         update_mgntframe_attrib(padapter, pattrib);
1227         pattrib->retry_ctrl = false;
1228
1229         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1230
1231         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1232         pwlanhdr = (struct ieee80211_hdr *)pframe;
1233
1234         fctrl = &pwlanhdr->frame_control;
1235         *(fctrl) = 0;
1236
1237         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1238                 SetFrDs(fctrl);
1239         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1240                 SetToDs(fctrl);
1241
1242         if (power_mode)
1243                 SetPwrMgt(fctrl);
1244
1245         ether_addr_copy(pwlanhdr->addr1, da);
1246         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1247         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1248
1249         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1250         pmlmeext->mgnt_seq++;
1251         SetFrameSubType(pframe, WIFI_DATA_NULL);
1252
1253         pframe += sizeof(struct ieee80211_hdr_3addr);
1254         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1255
1256         pattrib->last_txcmdsz = pattrib->pktlen;
1257
1258         if (wait_ack) {
1259                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1260         } else {
1261                 dump_mgntframe(padapter, pmgntframe);
1262                 ret = _SUCCESS;
1263         }
1264
1265 exit:
1266         return ret;
1267 }
1268
1269
1270 /* when wait_ms > 0 , this function should be called at process context */
1271 /* da == NULL for station mode */
1272 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
1273 {
1274         int ret;
1275         int i = 0;
1276         unsigned long start = jiffies;
1277         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1278         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1279         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1280
1281         /* da == NULL, assume it's null data for sta to ap*/
1282         if (da == NULL)
1283                 da = pnetwork->MacAddress;
1284
1285         do {
1286                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0 ? true : false);
1287
1288                 i++;
1289
1290                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1291                         break;
1292
1293                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1294                         msleep(wait_ms);
1295         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1296
1297         if (ret != _FAIL) {
1298                 ret = _SUCCESS;
1299                 goto exit;
1300         }
1301
1302         if (try_cnt && wait_ms) {
1303                 if (da)
1304                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1305                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1306                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1307                                 jiffies_to_msecs(jiffies - start));
1308                 else
1309                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1310                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1311                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1312                                 jiffies_to_msecs(jiffies - start));
1313         }
1314 exit:
1315         return ret;
1316 }
1317
1318 /* when wait_ack is true, this function should be called at process context */
1319 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int wait_ack)
1320 {
1321         int ret = _FAIL;
1322         struct xmit_frame                       *pmgntframe;
1323         struct pkt_attrib                       *pattrib;
1324         unsigned char                                   *pframe;
1325         struct ieee80211_hdr *pwlanhdr;
1326         __le16 *fctrl;
1327         unsigned short *qc;
1328         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1329         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1330         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1331         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1332
1333         DBG_88E("%s\n", __func__);
1334
1335         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1336         if (pmgntframe == NULL)
1337                 goto exit;
1338
1339         /* update attribute */
1340         pattrib = &pmgntframe->attrib;
1341         update_mgntframe_attrib(padapter, pattrib);
1342
1343         pattrib->hdrlen += 2;
1344         pattrib->qos_en = true;
1345         pattrib->eosp = 1;
1346         pattrib->ack_policy = 0;
1347         pattrib->mdata = 0;
1348
1349         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1350
1351         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1352         pwlanhdr = (struct ieee80211_hdr *)pframe;
1353
1354         fctrl = &pwlanhdr->frame_control;
1355         *(fctrl) = 0;
1356
1357         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1358                 SetFrDs(fctrl);
1359         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1360                 SetToDs(fctrl);
1361
1362         if (pattrib->mdata)
1363                 SetMData(fctrl);
1364
1365         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
1366
1367         SetPriority(qc, tid);
1368
1369         SetEOSP(qc, pattrib->eosp);
1370
1371         SetAckpolicy(qc, pattrib->ack_policy);
1372
1373         ether_addr_copy(pwlanhdr->addr1, da);
1374         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1375         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1376
1377         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1378         pmlmeext->mgnt_seq++;
1379         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
1380
1381         pframe += sizeof(struct ieee80211_qos_hdr);
1382         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
1383
1384         pattrib->last_txcmdsz = pattrib->pktlen;
1385
1386         if (wait_ack) {
1387                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1388         } else {
1389                 dump_mgntframe(padapter, pmgntframe);
1390                 ret = _SUCCESS;
1391         }
1392
1393 exit:
1394         return ret;
1395 }
1396
1397 /* when wait_ms > 0 , this function should be called at process context */
1398 /* da == NULL for station mode */
1399 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
1400 {
1401         int ret;
1402         int i = 0;
1403         unsigned long start = jiffies;
1404         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1405         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1406         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1407
1408         /* da == NULL, assume it's null data for sta to ap*/
1409         if (da == NULL)
1410                 da = pnetwork->MacAddress;
1411
1412         do {
1413                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0 ? true : false);
1414
1415                 i++;
1416
1417                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1418                         break;
1419
1420                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1421                         msleep(wait_ms);
1422         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1423
1424         if (ret != _FAIL) {
1425                 ret = _SUCCESS;
1426                 goto exit;
1427         }
1428
1429         if (try_cnt && wait_ms) {
1430                 if (da)
1431                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1432                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1433                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1434                                 jiffies_to_msecs(jiffies - start));
1435                 else
1436                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1437                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1438                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1439                                 jiffies_to_msecs(jiffies - start));
1440         }
1441 exit:
1442         return ret;
1443 }
1444
1445 static int _issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason, u8 wait_ack)
1446 {
1447         struct xmit_frame                       *pmgntframe;
1448         struct pkt_attrib                       *pattrib;
1449         unsigned char                                   *pframe;
1450         struct ieee80211_hdr *pwlanhdr;
1451         __le16 *fctrl;
1452         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1453         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1454         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1455         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1456         int ret = _FAIL;
1457         __le16 le_tmp;
1458
1459         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1460         if (pmgntframe == NULL)
1461                 goto exit;
1462
1463         /* update attribute */
1464         pattrib = &pmgntframe->attrib;
1465         update_mgntframe_attrib(padapter, pattrib);
1466         pattrib->retry_ctrl = false;
1467
1468         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1469
1470         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1471         pwlanhdr = (struct ieee80211_hdr *)pframe;
1472
1473         fctrl = &pwlanhdr->frame_control;
1474         *(fctrl) = 0;
1475
1476         ether_addr_copy(pwlanhdr->addr1, da);
1477         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1478         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1479
1480         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1481         pmlmeext->mgnt_seq++;
1482         SetFrameSubType(pframe, WIFI_DEAUTH);
1483
1484         pframe += sizeof(struct ieee80211_hdr_3addr);
1485         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1486
1487         le_tmp = cpu_to_le16(reason);
1488         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, &le_tmp,
1489                                   &pattrib->pktlen);
1490
1491         pattrib->last_txcmdsz = pattrib->pktlen;
1492
1493
1494         if (wait_ack) {
1495                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1496         } else {
1497                 dump_mgntframe(padapter, pmgntframe);
1498                 ret = _SUCCESS;
1499         }
1500
1501 exit:
1502         return ret;
1503 }
1504
1505 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
1506 {
1507         DBG_88E("%s to %pM\n", __func__, da);
1508         return _issue_deauth(padapter, da, reason, false);
1509 }
1510
1511 static int issue_deauth_ex(struct adapter *padapter, u8 *da,
1512                            unsigned short reason, int try_cnt,
1513                            int wait_ms)
1514 {
1515         int ret;
1516         int i = 0;
1517         unsigned long start = jiffies;
1518
1519         do {
1520                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0 ? true : false);
1521
1522                 i++;
1523
1524                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1525                         break;
1526
1527                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1528                         msleep(wait_ms);
1529         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1530
1531         if (ret != _FAIL) {
1532                 ret = _SUCCESS;
1533                 goto exit;
1534         }
1535
1536         if (try_cnt && wait_ms) {
1537                 if (da)
1538                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1539                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1540                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1541                                 jiffies_to_msecs(jiffies - start));
1542                 else
1543                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1544                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1545                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1546                                 jiffies_to_msecs(jiffies - start));
1547         }
1548 exit:
1549         return ret;
1550 }
1551
1552 static void issue_action_BA(struct adapter *padapter, unsigned char *raddr,
1553                             unsigned char action, unsigned short status)
1554 {
1555         u8 category = RTW_WLAN_CATEGORY_BACK;
1556         u16 start_seq;
1557         u16 BA_para_set;
1558         u16 reason_code;
1559         u16 BA_timeout_value;
1560         __le16  le_tmp;
1561         u16 BA_starting_seqctrl = 0;
1562         enum ht_cap_ampdu_factor max_rx_ampdu_factor;
1563         struct xmit_frame *pmgntframe;
1564         struct pkt_attrib *pattrib;
1565         u8 *pframe;
1566         struct ieee80211_hdr *pwlanhdr;
1567         __le16 *fctrl;
1568         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
1569         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1570         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1571         struct sta_info *psta;
1572         struct sta_priv *pstapriv = &padapter->stapriv;
1573         struct registry_priv *pregpriv = &padapter->registrypriv;
1574         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1575
1576         DBG_88E("%s, category=%d, action=%d, status=%d\n", __func__, category, action, status);
1577
1578         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1579         if (pmgntframe == NULL)
1580                 return;
1581
1582         /* update attribute */
1583         pattrib = &pmgntframe->attrib;
1584         update_mgntframe_attrib(padapter, pattrib);
1585
1586         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1587
1588         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1589         pwlanhdr = (struct ieee80211_hdr *)pframe;
1590
1591         fctrl = &pwlanhdr->frame_control;
1592         *(fctrl) = 0;
1593
1594         ether_addr_copy(pwlanhdr->addr1, raddr);
1595         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1596         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1597
1598         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1599         pmlmeext->mgnt_seq++;
1600         SetFrameSubType(pframe, WIFI_ACTION);
1601
1602         pframe += sizeof(struct ieee80211_hdr_3addr);
1603         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1604
1605         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1606         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1607
1608         if (category == 3) {
1609                 switch (action) {
1610                 case 0: /* ADDBA req */
1611                         do {
1612                                 pmlmeinfo->dialogToken++;
1613                         } while (pmlmeinfo->dialogToken == 0);
1614                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
1615
1616                         BA_para_set = 0x1002 | ((status & 0xf) << 2); /* immediate ack & 64 buffer size */
1617                         le_tmp = cpu_to_le16(BA_para_set);
1618                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1619                                                   &pattrib->pktlen);
1620
1621                         BA_timeout_value = 5000;/*  5ms */
1622                         le_tmp = cpu_to_le16(BA_timeout_value);
1623                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1624                                                   &pattrib->pktlen);
1625
1626                         psta = rtw_get_stainfo(pstapriv, raddr);
1627                         if (psta != NULL) {
1628                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
1629
1630                                 DBG_88E("BA_starting_seqctrl=%d for TID=%d\n", start_seq, status & 0x07);
1631
1632                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
1633
1634                                 BA_starting_seqctrl = start_seq << 4;
1635                         }
1636                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
1637                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1638                                                   &pattrib->pktlen);
1639                         break;
1640                 case 1: /* ADDBA rsp */
1641                 {
1642                         struct ADDBA_request *ADDBA_req = &pmlmeinfo->ADDBA_req;
1643
1644                         pframe = rtw_set_fixed_ie(pframe, 1,
1645                                                   &ADDBA_req->dialog_token,
1646                                                   &pattrib->pktlen);
1647                         pframe = rtw_set_fixed_ie(pframe, 2, &status,
1648                                                   &pattrib->pktlen);
1649
1650                         BA_para_set = le16_to_cpu(ADDBA_req->BA_para_set) &
1651                                       0x3f;
1652                         rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
1653                         switch (max_rx_ampdu_factor) {
1654                         case MAX_AMPDU_FACTOR_64K:
1655                                 BA_para_set |= 0x1000; /* 64 buffer size */
1656                                 break;
1657                         case MAX_AMPDU_FACTOR_32K:
1658                                 BA_para_set |= 0x0800; /* 32 buffer size */
1659                                 break;
1660                         case MAX_AMPDU_FACTOR_16K:
1661                                 BA_para_set |= 0x0400; /* 16 buffer size */
1662                                 break;
1663                         case MAX_AMPDU_FACTOR_8K:
1664                                 BA_para_set |= 0x0200; /* 8 buffer size */
1665                                 break;
1666                         default:
1667                                 BA_para_set |= 0x1000; /* 64 buffer size */
1668                                 break;
1669                         }
1670
1671                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
1672                                 BA_para_set = BA_para_set & ~BIT(0);
1673                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
1674                                 BA_para_set = BA_para_set | BIT(0);
1675                         le_tmp = cpu_to_le16(BA_para_set);
1676
1677                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1678                                                   &pattrib->pktlen);
1679                         pframe = rtw_set_fixed_ie(pframe, 2,
1680                                                   &ADDBA_req->BA_timeout_value,
1681                                                   &pattrib->pktlen);
1682                         break;
1683                 }
1684                 case 2:/* DELBA */
1685                         BA_para_set = (status & 0x1F) << 3;
1686                         le_tmp = cpu_to_le16(BA_para_set);
1687                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1688                                                   &pattrib->pktlen);
1689
1690                         reason_code = 37;/* Requested from peer STA as it does not want to use the mechanism */
1691                         le_tmp = cpu_to_le16(reason_code);
1692                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1693                                                   &pattrib->pktlen);
1694                         break;
1695                 default:
1696                         break;
1697                 }
1698         }
1699
1700         pattrib->last_txcmdsz = pattrib->pktlen;
1701
1702         dump_mgntframe(padapter, pmgntframe);
1703 }
1704
1705 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
1706 {
1707         struct list_head *plist, *phead;
1708         unsigned char category, action;
1709         struct xmit_frame                       *pmgntframe;
1710         struct pkt_attrib                       *pattrib;
1711         unsigned char                           *pframe;
1712         struct ieee80211_hdr *pwlanhdr;
1713         __le16 *fctrl;
1714         struct  wlan_network    *pnetwork = NULL;
1715         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1716         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1717         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1718         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1719         struct __queue *queue   = &(pmlmepriv->scanned_queue);
1720         u8 InfoContent[16] = {0};
1721         u8 ICS[8][15];
1722         struct wlan_bssid_ex  *cur_network   = &(pmlmeinfo->network);
1723
1724         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
1725                 return;
1726
1727         if (pmlmeinfo->bwmode_updated)
1728                 return;
1729
1730
1731         DBG_88E("%s\n", __func__);
1732
1733
1734         category = RTW_WLAN_CATEGORY_PUBLIC;
1735         action = ACT_PUBLIC_BSSCOEXIST;
1736
1737         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1738         if (pmgntframe == NULL)
1739                 return;
1740
1741         /* update attribute */
1742         pattrib = &pmgntframe->attrib;
1743         update_mgntframe_attrib(padapter, pattrib);
1744
1745         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1746
1747         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1748         pwlanhdr = (struct ieee80211_hdr *)pframe;
1749
1750         fctrl = &pwlanhdr->frame_control;
1751         *(fctrl) = 0;
1752
1753         ether_addr_copy(pwlanhdr->addr1, cur_network->MacAddress);
1754         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1755         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
1756
1757         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1758         pmlmeext->mgnt_seq++;
1759         SetFrameSubType(pframe, WIFI_ACTION);
1760
1761         pframe += sizeof(struct ieee80211_hdr_3addr);
1762         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1763
1764         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1765         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1766
1767
1768         /*  */
1769         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
1770                 u8 iedata = 0;
1771
1772                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
1773
1774                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
1775         }
1776
1777
1778         /*  */
1779         memset(ICS, 0, sizeof(ICS));
1780         if (pmlmepriv->num_sta_no_ht > 0) {
1781                 int i;
1782
1783                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1784
1785                 phead = get_list_head(queue);
1786                 plist = phead->next;
1787
1788                 while (phead != plist) {
1789                         uint len;
1790                         u8 *p;
1791                         struct wlan_bssid_ex *pbss_network;
1792
1793                         pnetwork = container_of(plist, struct wlan_network, list);
1794
1795                         plist = plist->next;
1796
1797                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
1798
1799                         p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
1800                         if ((p == NULL) || (len == 0)) { /* non-HT */
1801                                 if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
1802                                         continue;
1803
1804                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
1805
1806                                 if (ICS[0][0] == 0)
1807                                         ICS[0][0] = 1;
1808                         }
1809                 }
1810                 spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
1811
1812                 for (i = 0; i < 8; i++) {
1813                         if (ICS[i][0] == 1) {
1814                                 int j, k = 0;
1815
1816                                 InfoContent[k] = i;
1817                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
1818                                 k++;
1819
1820                                 for (j = 1; j <= 14; j++) {
1821                                         if (ICS[i][j] == 1) {
1822                                                 if (k < 16) {
1823                                                         InfoContent[k] = j; /* channel number */
1824                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
1825                                                         k++;
1826                                                 }
1827                                         }
1828                                 }
1829
1830                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
1831                         }
1832                 }
1833         }
1834
1835
1836         pattrib->last_txcmdsz = pattrib->pktlen;
1837
1838         dump_mgntframe(padapter, pmgntframe);
1839 }
1840
1841 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
1842 {
1843         struct sta_priv *pstapriv = &padapter->stapriv;
1844         struct sta_info *psta = NULL;
1845         /* struct recv_reorder_ctrl *preorder_ctrl; */
1846         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1847         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1848         u16 tid;
1849
1850         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1851                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1852                         return _SUCCESS;
1853
1854         psta = rtw_get_stainfo(pstapriv, addr);
1855         if (psta == NULL)
1856                 return _SUCCESS;
1857
1858         if (initiator == 0) { /*  recipient */
1859                 for (tid = 0; tid < MAXTID; tid++) {
1860                         if (psta->recvreorder_ctrl[tid].enable) {
1861                                 DBG_88E("rx agg disable tid(%d)\n", tid);
1862                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1863                                 psta->recvreorder_ctrl[tid].enable = false;
1864                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
1865                         }
1866                 }
1867         } else if (initiator == 1) { /*  originator */
1868                 for (tid = 0; tid < MAXTID; tid++) {
1869                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
1870                                 DBG_88E("tx agg disable tid(%d)\n", tid);
1871                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1872                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1873                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1874                         }
1875                 }
1876         }
1877
1878         return _SUCCESS;
1879 }
1880
1881 unsigned int send_beacon(struct adapter *padapter)
1882 {
1883         u8 bxmitok = false;
1884         int     issue = 0;
1885         int poll = 0;
1886
1887         unsigned long start = jiffies;
1888
1889         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
1890         do {
1891                 issue_beacon(padapter, 100);
1892                 issue++;
1893                 do {
1894                         yield();
1895                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
1896                         poll++;
1897                 } while ((poll%10) != 0 && !bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1898         } while (!bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1899
1900         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
1901                 return _FAIL;
1902         if (!bxmitok) {
1903                 DBG_88E("%s fail! %u ms\n", __func__,
1904                         jiffies_to_msecs(jiffies - start));
1905                 return _FAIL;
1906         } else {
1907                 u32 passing_time = jiffies_to_msecs(jiffies - start);
1908
1909                 if (passing_time > 100 || issue > 3)
1910                         DBG_88E("%s success, issue:%d, poll:%d, %u ms\n",
1911                                 __func__, issue, poll,
1912                                 jiffies_to_msecs(jiffies - start));
1913                 return _SUCCESS;
1914         }
1915 }
1916
1917 /****************************************************************************
1918
1919 Following are some utility functions for WiFi MLME
1920
1921 *****************************************************************************/
1922
1923 static void site_survey(struct adapter *padapter)
1924 {
1925         unsigned char           survey_channel = 0, val8;
1926         enum rt_scan_type ScanType = SCAN_PASSIVE;
1927         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1928         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1929         u32 initialgain = 0;
1930         struct rtw_ieee80211_channel *ch;
1931
1932         if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
1933                 ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
1934                 survey_channel = ch->hw_value;
1935                 ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
1936         }
1937
1938
1939         if (survey_channel != 0) {
1940                 /* PAUSE 4-AC Queue when site_survey */
1941                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1942                 /* val8 |= 0x0f; */
1943                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1944                 if (pmlmeext->sitesurvey_res.channel_idx == 0)
1945                         set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
1946                 else
1947                         SelectChannel(padapter, survey_channel);
1948
1949                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
1950                         int i;
1951
1952                         for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
1953                                 if (pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
1954                                         /* todo: to issue two probe req??? */
1955                                         issue_probereq(padapter,
1956                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1957                                                                 NULL, false);
1958                                         /* msleep(SURVEY_TO>>1); */
1959                                         issue_probereq(padapter,
1960                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1961                                                                 NULL, false);
1962                                 }
1963                         }
1964
1965                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1966                                 /* todo: to issue two probe req??? */
1967                                 issue_probereq(padapter, NULL, NULL, false);
1968                                 /* msleep(SURVEY_TO>>1); */
1969                                 issue_probereq(padapter, NULL, NULL, false);
1970                         }
1971
1972                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1973                                 /* todo: to issue two probe req??? */
1974                                 issue_probereq(padapter, NULL, NULL, false);
1975                                 /* msleep(SURVEY_TO>>1); */
1976                                 issue_probereq(padapter, NULL, NULL, false);
1977                         }
1978                 }
1979
1980                 set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1981         } else {
1982
1983                 /*  20100721:Interrupt scan operation here. */
1984                 /*  For SW antenna diversity before link, it needs to switch to another antenna and scan again. */
1985                 /*  It compares the scan result and select better one to do connection. */
1986                 if (rtw_hal_antdiv_before_linked(padapter)) {
1987                         pmlmeext->sitesurvey_res.bss_cnt = 0;
1988                         pmlmeext->sitesurvey_res.channel_idx = -1;
1989                         pmlmeext->chan_scan_time = SURVEY_TO / 2;
1990                         set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1991                         return;
1992                 }
1993
1994                 pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
1995
1996                 /* switch back to the original channel */
1997
1998                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
1999
2000                 /* flush 4-AC Queue after site_survey */
2001                 /* val8 = 0; */
2002                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
2003
2004                 /* config MSR */
2005                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2006
2007                 initialgain = 0xff; /* restore RX GAIN */
2008                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
2009                 /* turn on dynamic functions */
2010                 Restore_DM_Func_Flag(padapter);
2011                 /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
2012
2013                 if (is_client_associated_to_ap(padapter))
2014                         issue_nulldata(padapter, NULL, 0, 3, 500);
2015
2016                 val8 = 0; /* survey done */
2017                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
2018
2019                 report_surveydone_event(padapter);
2020
2021                 pmlmeext->chan_scan_time = SURVEY_TO;
2022                 pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
2023
2024                 issue_action_BSSCoexistPacket(padapter);
2025                 issue_action_BSSCoexistPacket(padapter);
2026                 issue_action_BSSCoexistPacket(padapter);
2027         }
2028 }
2029
2030 /* collect bss info from Beacon and Probe request/response frames. */
2031 static u8 collect_bss_info(struct adapter *padapter,
2032                            struct recv_frame *precv_frame,
2033                            struct wlan_bssid_ex *bssid)
2034 {
2035         int     i;
2036         u32     len;
2037         u8 *p;
2038         u16 val16, subtype;
2039         u8 *pframe = precv_frame->pkt->data;
2040         u32 packet_len = precv_frame->pkt->len;
2041         u8 ie_offset;
2042         struct registry_priv    *pregistrypriv = &padapter->registrypriv;
2043         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2044         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2045
2046         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
2047
2048         if (len > MAX_IE_SZ)
2049                 return _FAIL;
2050
2051         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
2052
2053         subtype = GetFrameSubType(pframe);
2054
2055         if (subtype == WIFI_BEACON) {
2056                 bssid->Reserved[0] = 1;
2057                 ie_offset = _BEACON_IE_OFFSET_;
2058         } else {
2059                 /*  FIXME : more type */
2060                 if (subtype == WIFI_PROBEREQ) {
2061                         ie_offset = _PROBEREQ_IE_OFFSET_;
2062                         bssid->Reserved[0] = 2;
2063                 } else if (subtype == WIFI_PROBERSP) {
2064                         ie_offset = _PROBERSP_IE_OFFSET_;
2065                         bssid->Reserved[0] = 3;
2066                 } else {
2067                         bssid->Reserved[0] = 0;
2068                         ie_offset = _FIXED_IE_LENGTH_;
2069                 }
2070         }
2071
2072         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
2073
2074         /* below is to copy the information element */
2075         bssid->IELength = len;
2076         memcpy(bssid->IEs, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->IELength);
2077
2078         /* get the signal strength in dBM.raw data */
2079         bssid->Rssi = precv_frame->attrib.phy_info.recvpower;
2080         bssid->PhyInfo.SignalQuality = precv_frame->attrib.phy_info.SignalQuality;/* in percentage */
2081         bssid->PhyInfo.SignalStrength = precv_frame->attrib.phy_info.SignalStrength;/* in percentage */
2082         rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
2083
2084         /*  checking SSID */
2085         p = rtw_get_ie(bssid->IEs + ie_offset, _SSID_IE_, &len, bssid->IELength - ie_offset);
2086         if (p == NULL) {
2087                 DBG_88E("marc: cannot find SSID for survey event\n");
2088                 return _FAIL;
2089         }
2090
2091         if (len) {
2092                 if (len > NDIS_802_11_LENGTH_SSID) {
2093                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2094                         return _FAIL;
2095                 }
2096                 memcpy(bssid->Ssid.Ssid, (p + 2), len);
2097                 bssid->Ssid.SsidLength = len;
2098         } else {
2099                 bssid->Ssid.SsidLength = 0;
2100         }
2101
2102         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
2103
2104         /* checking rate info... */
2105         i = 0;
2106         p = rtw_get_ie(bssid->IEs + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2107         if (p != NULL) {
2108                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
2109                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2110                         return _FAIL;
2111                 }
2112                 memcpy(bssid->SupportedRates, (p + 2), len);
2113                 i = len;
2114         }
2115
2116         p = rtw_get_ie(bssid->IEs + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2117         if (p != NULL) {
2118                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i)) {
2119                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2120                         return _FAIL;
2121                 }
2122                 memcpy(bssid->SupportedRates + i, (p + 2), len);
2123         }
2124
2125         /* todo: */
2126         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
2127
2128         if (bssid->IELength < 12)
2129                 return _FAIL;
2130
2131         /*  Checking for DSConfig */
2132         p = rtw_get_ie(bssid->IEs + ie_offset, _DSSET_IE_, &len, bssid->IELength - ie_offset);
2133
2134         bssid->Configuration.DSConfig = 0;
2135         bssid->Configuration.Length = 0;
2136
2137         if (p) {
2138                 bssid->Configuration.DSConfig = *(p + 2);
2139         } else {/*  In 5G, some ap do not have DSSET IE */
2140                 /*  checking HT info for channel */
2141                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->IELength - ie_offset);
2142                 if (p) {
2143                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
2144
2145                         bssid->Configuration.DSConfig = HT_info->primary_channel;
2146                 } else { /*  use current channel */
2147                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
2148                 }
2149         }
2150
2151         if (subtype == WIFI_PROBEREQ) {
2152                 /*  FIXME */
2153                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2154                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2155                 bssid->Privacy = 1;
2156                 return _SUCCESS;
2157         }
2158
2159         bssid->Configuration.BeaconPeriod =
2160                 get_unaligned_le16(rtw_get_beacon_interval_from_ie(bssid->IEs));
2161
2162         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
2163
2164         if (val16 & BIT(0)) {
2165                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2166                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2167         } else {
2168                 bssid->InfrastructureMode = Ndis802_11IBSS;
2169                 ether_addr_copy(bssid->MacAddress, GetAddr3Ptr(pframe));
2170         }
2171
2172         if (val16 & BIT(4))
2173                 bssid->Privacy = 1;
2174         else
2175                 bssid->Privacy = 0;
2176
2177         bssid->Configuration.ATIMWindow = 0;
2178
2179         /* 20/40 BSS Coexistence check */
2180         if ((pregistrypriv->wifi_spec == 1) && (!pmlmeinfo->bwmode_updated)) {
2181                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2182
2183                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->IELength - ie_offset);
2184                 if (p && len > 0) {
2185                         struct ieee80211_ht_cap *pHT_caps =
2186                                 (struct ieee80211_ht_cap *)(p + 2);
2187
2188                         if (le16_to_cpu(pHT_caps->cap_info) & BIT(14))
2189                                 pmlmepriv->num_FortyMHzIntolerant++;
2190                 } else {
2191                         pmlmepriv->num_sta_no_ht++;
2192                 }
2193         }
2194
2195         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
2196         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
2197                 bssid->PhyInfo.SignalQuality = 101;
2198         return _SUCCESS;
2199 }
2200
2201 static void start_create_ibss(struct adapter *padapter)
2202 {
2203         unsigned short  caps;
2204         u8 val8;
2205         u8 join_type;
2206         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2207         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2208         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2209
2210         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2211         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2212
2213         /* update wireless mode */
2214         update_wireless_mode(padapter);
2215
2216         /* update capability */
2217         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2218         update_capinfo(padapter, caps);
2219         if (caps&cap_IBSS) {/* adhoc master */
2220                 val8 = 0xcf;
2221                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2222
2223                 /* switch channel */
2224                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
2225                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2226
2227                 beacon_timing_control(padapter);
2228
2229                 /* set msr to WIFI_FW_ADHOC_STATE */
2230                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2231                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2232
2233                 /* issue beacon */
2234                 if (send_beacon(padapter) == _FAIL) {
2235                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
2236
2237                         report_join_res(padapter, -1);
2238                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2239                 } else {
2240                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
2241                         join_type = 0;
2242                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
2243
2244                         report_join_res(padapter, 1);
2245                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
2246                 }
2247         } else {
2248                 DBG_88E("start_create_ibss, invalid cap:%x\n", caps);
2249                 return;
2250         }
2251 }
2252
2253 static void start_clnt_join(struct adapter *padapter)
2254 {
2255         unsigned short  caps;
2256         u8 val8;
2257         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2258         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2259         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2260         int beacon_timeout;
2261
2262         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2263         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2264
2265         /* update wireless mode */
2266         update_wireless_mode(padapter);
2267
2268         /* update capability */
2269         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2270         update_capinfo(padapter, caps);
2271         if (caps&cap_ESS) {
2272                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
2273
2274                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
2275
2276                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2277
2278                 /* switch channel */
2279                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2280
2281                 /* here wait for receiving the beacon to start auth */
2282                 /* and enable a timer */
2283                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
2284                 set_link_timer(pmlmeext, beacon_timeout);
2285                 mod_timer(&padapter->mlmepriv.assoc_timer, jiffies +
2286                           msecs_to_jiffies((REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO * REASSOC_LIMIT) + beacon_timeout));
2287
2288                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
2289         } else if (caps&cap_IBSS) { /* adhoc client */
2290                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
2291
2292                 val8 = 0xcf;
2293                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2294
2295                 /* switch channel */
2296                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2297
2298                 beacon_timing_control(padapter);
2299
2300                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2301
2302                 report_join_res(padapter, 1);
2303         } else {
2304                 return;
2305         }
2306 }
2307
2308 static void start_clnt_auth(struct adapter *padapter)
2309 {
2310         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2311         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2312
2313         del_timer_sync(&pmlmeext->link_timer);
2314
2315         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
2316         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
2317
2318         pmlmeinfo->auth_seq = 1;
2319         pmlmeinfo->reauth_count = 0;
2320         pmlmeinfo->reassoc_count = 0;
2321         pmlmeinfo->link_count = 0;
2322         pmlmeext->retry = 0;
2323
2324
2325         /*  Because of AP's not receiving deauth before */
2326         /*  AP may: 1)not response auth or 2)deauth us after link is complete */
2327         /*  issue deauth before issuing auth to deal with the situation */
2328         /*      Commented by Albert 2012/07/21 */
2329         /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
2330         issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
2331
2332         DBG_88E_LEVEL(_drv_info_, "start auth\n");
2333         issue_auth(padapter, NULL, 0);
2334
2335         set_link_timer(pmlmeext, REAUTH_TO);
2336 }
2337
2338
2339 static void start_clnt_assoc(struct adapter *padapter)
2340 {
2341         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2342         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2343
2344         del_timer_sync(&pmlmeext->link_timer);
2345
2346         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
2347         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
2348
2349         issue_assocreq(padapter);
2350
2351         set_link_timer(pmlmeext, REASSOC_TO);
2352 }
2353
2354 static unsigned int receive_disconnect(struct adapter *padapter,
2355                                        unsigned char *MacAddr,
2356                                        unsigned short reason)
2357 {
2358         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2359         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2360         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
2361
2362         /* check A3 */
2363         if (memcmp(MacAddr, pnetwork->MacAddress, ETH_ALEN))
2364                 return _SUCCESS;
2365
2366         DBG_88E("%s\n", __func__);
2367
2368         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
2369                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
2370                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2371                         report_del_sta_event(padapter, MacAddr, reason);
2372                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
2373                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2374                         report_join_res(padapter, -2);
2375                 }
2376         }
2377         return _SUCCESS;
2378 }
2379
2380 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
2381 {
2382         struct registry_priv *pregistrypriv;
2383         struct mlme_ext_priv *pmlmeext;
2384         struct rt_channel_info *chplan_new;
2385         u8 channel;
2386         u8 i;
2387
2388         pregistrypriv = &padapter->registrypriv;
2389         pmlmeext = &padapter->mlmeextpriv;
2390
2391         /*  Adjust channel plan by AP Country IE */
2392         if (pregistrypriv->enable80211d &&
2393             (!pmlmeext->update_channel_plan_by_ap_done)) {
2394                 u8 *ie, *p;
2395                 u32 len;
2396                 struct rt_channel_plan chplan_ap;
2397                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
2398                 u8 country[4];
2399                 u8 fcn; /*  first channel number */
2400                 u8 noc; /*  number of channel */
2401                 u8 j, k;
2402
2403                 ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
2404                 if (!ie)
2405                         return;
2406                 if (len < 6)
2407                         return;
2408                 ie += 2;
2409                 p = ie;
2410                 ie += len;
2411
2412                 memset(country, 0, 4);
2413                 memcpy(country, p, 3);
2414                 p += 3;
2415                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2416                          ("%s: 802.11d country =%s\n", __func__, country));
2417
2418                 i = 0;
2419                 while ((ie - p) >= 3) {
2420                         fcn = *(p++);
2421                         noc = *(p++);
2422                         p++;
2423
2424                         for (j = 0; j < noc; j++) {
2425                                 if (fcn <= 14)
2426                                         channel = fcn + j; /*  2.4 GHz */
2427                                 else
2428                                         channel = fcn + j*4; /*  5 GHz */
2429
2430                                 chplan_ap.Channel[i++] = channel;
2431                         }
2432                 }
2433                 chplan_ap.Len = i;
2434
2435                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
2436
2437                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
2438                 chplan_new = pmlmeext->channel_set;
2439
2440                 i = 0;
2441                 j = 0;
2442                 k = 0;
2443                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
2444                         do {
2445                                 if ((i == MAX_CHANNEL_NUM) ||
2446                                     (chplan_sta[i].ChannelNum == 0) ||
2447                                     (chplan_sta[i].ChannelNum > 14))
2448                                         break;
2449
2450                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
2451                                         break;
2452
2453                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
2454                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2455                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2456                                         i++;
2457                                         j++;
2458                                         k++;
2459                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
2460                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2461                                         chplan_new[k].ScanType = SCAN_PASSIVE;
2462                                         i++;
2463                                         k++;
2464                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
2465                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2466                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2467                                         j++;
2468                                         k++;
2469                                 }
2470                         } while (1);
2471
2472                         /*  change AP not support channel to Passive scan */
2473                         while ((i < MAX_CHANNEL_NUM) &&
2474                                (chplan_sta[i].ChannelNum != 0) &&
2475                                (chplan_sta[i].ChannelNum <= 14)) {
2476                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2477                                 chplan_new[k].ScanType = SCAN_PASSIVE;
2478                                 i++;
2479                                 k++;
2480                         }
2481
2482                         /*  add channel AP supported */
2483                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
2484                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2485                                 chplan_new[k].ScanType = SCAN_ACTIVE;
2486                                 j++;
2487                                 k++;
2488                         }
2489                 } else {
2490                         /*  keep original STA 2.4G channel plan */
2491                         while ((i < MAX_CHANNEL_NUM) &&
2492                                (chplan_sta[i].ChannelNum != 0) &&
2493                                (chplan_sta[i].ChannelNum <= 14)) {
2494                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2495                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
2496                                 i++;
2497                                 k++;
2498                         }
2499
2500                         /*  skip AP 2.4G channel plan */
2501                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
2502                                 j++;
2503                 }
2504
2505                 /*  keep original STA 5G channel plan */
2506                 while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
2507                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2508                         chplan_new[k].ScanType = chplan_sta[i].ScanType;
2509                         i++;
2510                         k++;
2511                 }
2512
2513                 pmlmeext->update_channel_plan_by_ap_done = 1;
2514         }
2515
2516         /*  If channel is used by AP, set channel scan type to active */
2517         channel = bssid->Configuration.DSConfig;
2518         chplan_new = pmlmeext->channel_set;
2519         i = 0;
2520         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
2521                 if (chplan_new[i].ChannelNum == channel) {
2522                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
2523                                 chplan_new[i].ScanType = SCAN_ACTIVE;
2524                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2525                                          ("%s: change channel %d scan type from passive to active\n",
2526                                          __func__, channel));
2527                         }
2528                         break;
2529                 }
2530                 i++;
2531         }
2532 }
2533
2534 /****************************************************************************
2535
2536 Following are the callback functions for each subtype of the management frames
2537
2538 *****************************************************************************/
2539
2540 static unsigned int OnProbeReq(struct adapter *padapter,
2541                                struct recv_frame *precv_frame)
2542 {
2543         unsigned int    ielen;
2544         unsigned char   *p;
2545         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2546         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2547         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2548         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2549         u8 *pframe = precv_frame->pkt->data;
2550         uint len = precv_frame->pkt->len;
2551
2552         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
2553                 return _SUCCESS;
2554
2555         if (!check_fwstate(pmlmepriv, _FW_LINKED) &&
2556             !check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
2557                 return _SUCCESS;
2558
2559         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, &ielen,
2560                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
2561
2562         /* check (wildcard) SSID */
2563         if (p != NULL) {
2564                 if ((ielen != 0 && memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength)) ||
2565                     (ielen == 0 && pmlmeinfo->hidden_ssid_mode))
2566                         return _SUCCESS;
2567
2568                 if (check_fwstate(pmlmepriv, _FW_LINKED) &&
2569                     pmlmepriv->cur_network.join_res)
2570                         issue_probersp(padapter, get_sa(pframe));
2571         }
2572         return _SUCCESS;
2573 }
2574
2575 static unsigned int OnProbeRsp(struct adapter *padapter,
2576                                struct recv_frame *precv_frame)
2577 {
2578         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2579
2580         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2581                 report_survey_event(padapter, precv_frame);
2582                 return _SUCCESS;
2583         }
2584
2585         return _SUCCESS;
2586 }
2587
2588 static unsigned int OnBeacon(struct adapter *padapter,
2589                              struct recv_frame *precv_frame)
2590 {
2591         int cam_idx;
2592         struct sta_info *psta;
2593         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2594         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2595         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2596         struct sta_priv *pstapriv = &padapter->stapriv;
2597         u8 *pframe = precv_frame->pkt->data;
2598         uint len = precv_frame->pkt->len;
2599         struct wlan_bssid_ex *pbss;
2600         int ret = _SUCCESS;
2601         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2602
2603         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2604                 report_survey_event(padapter, precv_frame);
2605                 return _SUCCESS;
2606         }
2607
2608         if (!memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN)) {
2609                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
2610                         /* we should update current network before auth, or some IE is wrong */
2611                         pbss = (struct wlan_bssid_ex *)rtw_malloc(sizeof(struct wlan_bssid_ex));
2612                         if (pbss) {
2613                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
2614                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
2615                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
2616                                 }
2617                                 kfree(pbss);
2618                         }
2619
2620                         /* check the vendor of the assoc AP */
2621                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
2622
2623                         /* update TSF Value */
2624                         update_TSF(pmlmeext, pframe, len);
2625
2626                         /* start auth */
2627                         start_clnt_auth(padapter);
2628
2629                         return _SUCCESS;
2630                 }
2631
2632                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
2633                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2634                         if (psta != NULL) {
2635                                 ret = rtw_check_bcn_info(padapter, pframe, len);
2636                                 if (!ret) {
2637                                                 DBG_88E_LEVEL(_drv_info_, "ap has changed, disconnect now\n ");
2638                                                 receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 65535);
2639                                                 return _SUCCESS;
2640                                 }
2641                                 /* update WMM, ERP in the beacon */
2642                                 /* todo: the timer is used instead of the number of the beacon received */
2643                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2644                                         update_beacon_info(padapter, pframe, len, psta);
2645                         }
2646                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2647                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2648                         if (psta != NULL) {
2649                                 /* update WMM, ERP in the beacon */
2650                                 /* todo: the timer is used instead of the number of the beacon received */
2651                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2652                                         update_beacon_info(padapter, pframe, len, psta);
2653                         } else {
2654                                 /* allocate a new CAM entry for IBSS station */
2655                                 cam_idx = allocate_fw_sta_entry(padapter);
2656                                 if (cam_idx == NUM_STA)
2657                                         goto _END_ONBEACON_;
2658
2659                                 /* get supported rate */
2660                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
2661                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
2662                                         goto _END_ONBEACON_;
2663                                 }
2664
2665                                 /* update TSF Value */
2666                                 update_TSF(pmlmeext, pframe, len);
2667
2668                                 /* report sta add event */
2669                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
2670                         }
2671                 }
2672         }
2673
2674 _END_ONBEACON_:
2675
2676         return _SUCCESS;
2677 }
2678
2679 #ifdef CONFIG_88EU_AP_MODE
2680 static unsigned int OnAuth(struct adapter *padapter,
2681                            struct recv_frame *precv_frame)
2682 {
2683         unsigned int    auth_mode, ie_len;
2684         u16 seq;
2685         unsigned char   *sa, *p;
2686         u16 algorithm;
2687         int     status;
2688         static struct sta_info stat;
2689         struct  sta_info        *pstat = NULL;
2690         struct  sta_priv *pstapriv = &padapter->stapriv;
2691         struct security_priv *psecuritypriv = &padapter->securitypriv;
2692         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2693         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2694         u8 *pframe = precv_frame->pkt->data;
2695         uint len = precv_frame->pkt->len;
2696
2697         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2698                 return _FAIL;
2699
2700         DBG_88E("+OnAuth\n");
2701
2702         sa = GetAddr2Ptr(pframe);
2703
2704         auth_mode = psecuritypriv->dot11AuthAlgrthm;
2705         seq = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + 2));
2706         algorithm = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN));
2707
2708         DBG_88E("auth alg=%x, seq=%X\n", algorithm, seq);
2709
2710         if (auth_mode == 2 && psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
2711             psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
2712                 auth_mode = 0;
2713
2714         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
2715             (algorithm == 0 && auth_mode == 1)) {       /*  rx a open-system auth but shared-key is enabled */
2716                 DBG_88E("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
2717                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
2718
2719                 status = _STATS_NO_SUPP_ALG_;
2720
2721                 goto auth_fail;
2722         }
2723
2724         if (!rtw_access_ctrl(padapter, sa)) {
2725                 status = _STATS_UNABLE_HANDLE_STA_;
2726                 goto auth_fail;
2727         }
2728
2729         pstat = rtw_get_stainfo(pstapriv, sa);
2730         if (pstat == NULL) {
2731                 /*  allocate a new one */
2732                 DBG_88E("going to alloc stainfo for sa=%pM\n", sa);
2733                 pstat = rtw_alloc_stainfo(pstapriv, sa);
2734                 if (pstat == NULL) {
2735                         DBG_88E(" Exceed the upper limit of supported clients...\n");
2736                         status = _STATS_UNABLE_HANDLE_STA_;
2737                         goto auth_fail;
2738                 }
2739
2740                 pstat->state = WIFI_FW_AUTH_NULL;
2741                 pstat->auth_seq = 0;
2742         } else {
2743                 spin_lock_bh(&pstapriv->asoc_list_lock);
2744                 if (!list_empty(&pstat->asoc_list)) {
2745                         list_del_init(&pstat->asoc_list);
2746                         pstapriv->asoc_list_cnt--;
2747                 }
2748                 spin_unlock_bh(&pstapriv->asoc_list_lock);
2749
2750                 if (seq == 1) {
2751                         /* TODO: STA re_auth and auth timeout */
2752                 }
2753         }
2754
2755         spin_lock_bh(&pstapriv->auth_list_lock);
2756         if (list_empty(&pstat->auth_list)) {
2757                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
2758                 pstapriv->auth_list_cnt++;
2759         }
2760         spin_unlock_bh(&pstapriv->auth_list_lock);
2761
2762         if (pstat->auth_seq == 0)
2763                 pstat->expire_to = pstapriv->auth_to;
2764
2765         if ((pstat->auth_seq + 1) != seq) {
2766                 DBG_88E("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2767                         seq, pstat->auth_seq+1);
2768                 status = _STATS_OUT_OF_AUTH_SEQ_;
2769                 goto auth_fail;
2770         }
2771
2772         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2)) {
2773                 if (seq == 1) {
2774                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2775                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
2776                         pstat->expire_to = pstapriv->assoc_to;
2777                         pstat->authalg = algorithm;
2778                 } else {
2779                         DBG_88E("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2780                                 seq, pstat->auth_seq+1);
2781                         status = _STATS_OUT_OF_AUTH_SEQ_;
2782                         goto auth_fail;
2783                 }
2784         } else { /*  shared system or auto authentication */
2785                 if (seq == 1) {
2786                         /* prepare for the challenging txt... */
2787
2788                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2789                         pstat->state |= WIFI_FW_AUTH_STATE;
2790                         pstat->authalg = algorithm;
2791                         pstat->auth_seq = 2;
2792                 } else if (seq == 3) {
2793                         /* checking for challenging txt... */
2794                         DBG_88E("checking for challenging txt...\n");
2795
2796                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, &ie_len,
2797                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
2798
2799                         if ((p == NULL) || (ie_len <= 0)) {
2800                                 DBG_88E("auth rejected because challenge failure!(1)\n");
2801                                 status = _STATS_CHALLENGE_FAIL_;
2802                                 goto auth_fail;
2803                         }
2804
2805                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
2806                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
2807                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
2808                                 /*  challenging txt is correct... */
2809                                 pstat->expire_to =  pstapriv->assoc_to;
2810                         } else {
2811                                 DBG_88E("auth rejected because challenge failure!\n");
2812                                 status = _STATS_CHALLENGE_FAIL_;
2813                                 goto auth_fail;
2814                         }
2815                 } else {
2816                         DBG_88E("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2817                                 seq, pstat->auth_seq+1);
2818                         status = _STATS_OUT_OF_AUTH_SEQ_;
2819                         goto auth_fail;
2820                 }
2821         }
2822
2823         /*  Now, we are going to issue_auth... */
2824         pstat->auth_seq = seq + 1;
2825
2826         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
2827
2828         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
2829                 pstat->auth_seq = 0;
2830
2831         return _SUCCESS;
2832
2833 auth_fail:
2834
2835         if (pstat)
2836                 rtw_free_stainfo(padapter, pstat);
2837
2838         pstat = &stat;
2839         memset((char *)pstat, '\0', sizeof(stat));
2840         pstat->auth_seq = 2;
2841         memcpy(pstat->hwaddr, sa, 6);
2842
2843         issue_auth(padapter, pstat, (unsigned short)status);
2844
2845         return _FAIL;
2846 }
2847 #endif /* CONFIG_88EU_AP_MODE */
2848
2849 static unsigned int OnAuthClient(struct adapter *padapter,
2850                                  struct recv_frame *precv_frame)
2851 {
2852         unsigned int    seq, len, status, offset;
2853         unsigned char   *p;
2854         unsigned int    go2asoc = 0;
2855         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2856         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2857         u8 *pframe = precv_frame->pkt->data;
2858         uint pkt_len = precv_frame->pkt->len;
2859
2860         DBG_88E("%s\n", __func__);
2861
2862         /* check A1 matches or not */
2863         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
2864                 return _SUCCESS;
2865
2866         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
2867                 return _SUCCESS;
2868
2869         offset = (GetPrivacy(pframe)) ? 4 : 0;
2870
2871         seq     = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 2));
2872         status  = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 4));
2873
2874         if (status != 0) {
2875                 DBG_88E("clnt auth fail, status: %d\n", status);
2876                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
2877                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2878                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
2879                         else
2880                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
2881                 }
2882
2883                 set_link_timer(pmlmeext, 1);
2884                 goto authclnt_fail;
2885         }
2886
2887         if (seq == 2) {
2888                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
2889                         /*  legendary shared system */
2890                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, &len,
2891                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
2892
2893                         if (p == NULL)
2894                                 goto authclnt_fail;
2895
2896                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
2897                         pmlmeinfo->auth_seq = 3;
2898                         issue_auth(padapter, NULL, 0);
2899                         set_link_timer(pmlmeext, REAUTH_TO);
2900
2901                         return _SUCCESS;
2902                 } else {
2903                         /*  open system */
2904                         go2asoc = 1;
2905                 }
2906         } else if (seq == 4) {
2907                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2908                         go2asoc = 1;
2909                 else
2910                         goto authclnt_fail;
2911         } else {
2912                 /*  this is also illegal */
2913                 goto authclnt_fail;
2914         }
2915
2916         if (go2asoc) {
2917                 DBG_88E_LEVEL(_drv_info_, "auth success, start assoc\n");
2918                 start_clnt_assoc(padapter);
2919                 return _SUCCESS;
2920         }
2921 authclnt_fail:
2922         return _FAIL;
2923 }
2924
2925 static unsigned int OnAssocReq(struct adapter *padapter,
2926                                struct recv_frame *precv_frame)
2927 {
2928 #ifdef CONFIG_88EU_AP_MODE
2929         u16 capab_info;
2930         struct rtw_ieee802_11_elems elems;
2931         struct sta_info *pstat;
2932         unsigned char           reassoc, *p, *pos, *wpa_ie;
2933         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
2934         int             i, wpa_ie_len, left;
2935         unsigned char           supportRate[16];
2936         int                                     supportRateNum;
2937         unsigned short          status = _STATS_SUCCESSFUL_;
2938         unsigned short          frame_type, ie_offset = 0;
2939         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2940         struct security_priv *psecuritypriv = &padapter->securitypriv;
2941         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2942         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2943         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2944         struct sta_priv *pstapriv = &padapter->stapriv;
2945         u8 *pframe = precv_frame->pkt->data;
2946         uint ie_len, pkt_len = precv_frame->pkt->len;
2947
2948         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2949                 return _FAIL;
2950
2951         frame_type = GetFrameSubType(pframe);
2952         if (frame_type == WIFI_ASSOCREQ) {
2953                 reassoc = 0;
2954                 ie_offset = _ASOCREQ_IE_OFFSET_;
2955         } else { /*  WIFI_REASSOCREQ */
2956                 reassoc = 1;
2957                 ie_offset = _REASOCREQ_IE_OFFSET_;
2958         }
2959
2960
2961         if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
2962                 DBG_88E("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
2963                        "\n", reassoc, (unsigned long)pkt_len);
2964                 return _FAIL;
2965         }
2966
2967         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2968         if (pstat == NULL) {
2969                 status = _RSON_CLS2_;
2970                 goto asoc_class2_error;
2971         }
2972
2973         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
2974
2975         left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
2976         pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
2977
2978
2979         DBG_88E("%s\n", __func__);
2980
2981         /*  check if this stat has been successfully authenticated/assocated */
2982         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
2983                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
2984                         status = _RSON_CLS2_;
2985                         goto asoc_class2_error;
2986                 } else {
2987                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
2988                         pstat->state |= WIFI_FW_ASSOC_STATE;
2989                 }
2990         } else {
2991                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
2992                 pstat->state |= WIFI_FW_ASSOC_STATE;
2993         }
2994         pstat->capability = capab_info;
2995         /* now parse all ieee802_11 ie to point to elems */
2996         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
2997             !elems.ssid) {
2998                 DBG_88E("STA %pM sent invalid association request\n",
2999                         pstat->hwaddr);
3000                 status = _STATS_FAILURE_;
3001                 goto OnAssocReqFail;
3002         }
3003
3004
3005         /*  now we should check all the fields... */
3006         /*  checking SSID */
3007         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
3008                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3009         if (p == NULL)
3010                 status = _STATS_FAILURE_;
3011
3012         if (ie_len == 0) { /*  broadcast ssid, however it is not allowed in assocreq */
3013                 status = _STATS_FAILURE_;
3014         } else {
3015                 /*  check if ssid match */
3016                 if (memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
3017                         status = _STATS_FAILURE_;
3018
3019                 if (ie_len != cur->Ssid.SsidLength)
3020                         status = _STATS_FAILURE_;
3021         }
3022
3023         if (_STATS_SUCCESSFUL_ != status)
3024                 goto OnAssocReqFail;
3025
3026         /*  check if the supported rate is ok */
3027         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3028         if (p == NULL) {
3029                 DBG_88E("Rx a sta assoc-req which supported rate is empty!\n");
3030                 /*  use our own rate set as statoin used */
3031                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
3032                 /* supportRateNum = AP_BSSRATE_LEN; */
3033
3034                 status = _STATS_FAILURE_;
3035                 goto OnAssocReqFail;
3036         } else {
3037                 memcpy(supportRate, p+2, ie_len);
3038                 supportRateNum = ie_len;
3039
3040                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_, &ie_len,
3041                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3042                 if (p !=  NULL) {
3043                         if (supportRateNum <= sizeof(supportRate)) {
3044                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
3045                                 supportRateNum += ie_len;
3046                         }
3047                 }
3048         }
3049
3050         /* todo: mask supportRate between AP & STA -> move to update raid */
3051         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
3052
3053         /* update station supportRate */
3054         pstat->bssratelen = supportRateNum;
3055         memcpy(pstat->bssrateset, supportRate, supportRateNum);
3056         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
3057
3058         /* check RSN/WPA/WPS */
3059         pstat->dot8021xalg = 0;
3060         pstat->wpa_psk = 0;
3061         pstat->wpa_group_cipher = 0;
3062         pstat->wpa2_group_cipher = 0;
3063         pstat->wpa_pairwise_cipher = 0;
3064         pstat->wpa2_pairwise_cipher = 0;
3065         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
3066         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
3067                 int group_cipher = 0, pairwise_cipher = 0;
3068
3069                 wpa_ie = elems.rsn_ie;
3070                 wpa_ie_len = elems.rsn_ie_len;
3071
3072                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3073                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3074                         pstat->wpa_psk |= BIT(1);
3075
3076                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
3077                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
3078
3079                         if (!pstat->wpa2_group_cipher)
3080                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3081
3082                         if (!pstat->wpa2_pairwise_cipher)
3083                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3084                 } else {
3085                         status = WLAN_STATUS_INVALID_IE;
3086                 }
3087         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
3088                 int group_cipher = 0, pairwise_cipher = 0;
3089
3090                 wpa_ie = elems.wpa_ie;
3091                 wpa_ie_len = elems.wpa_ie_len;
3092
3093                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3094                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3095                         pstat->wpa_psk |= BIT(0);
3096
3097                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
3098                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
3099
3100                         if (!pstat->wpa_group_cipher)
3101                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3102
3103                         if (!pstat->wpa_pairwise_cipher)
3104                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3105                 } else {
3106                         status = WLAN_STATUS_INVALID_IE;
3107                 }
3108         } else {
3109                 wpa_ie = NULL;
3110                 wpa_ie_len = 0;
3111         }
3112
3113         if (_STATS_SUCCESSFUL_ != status)
3114                 goto OnAssocReqFail;
3115
3116         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
3117         if (wpa_ie == NULL) {
3118                 if (elems.wps_ie) {
3119                         DBG_88E("STA included WPS IE in "
3120                                    "(Re)Association Request - assume WPS is "
3121                                    "used\n");
3122                         pstat->flags |= WLAN_STA_WPS;
3123                         /* wpabuf_free(sta->wps_ie); */
3124                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
3125                         /*                              elems.wps_ie_len - 4); */
3126                 } else {
3127                         DBG_88E("STA did not include WPA/RSN IE "
3128                                    "in (Re)Association Request - possible WPS "
3129                                    "use\n");
3130                         pstat->flags |= WLAN_STA_MAYBE_WPS;
3131                 }
3132
3133
3134                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
3135                 /*  that the selected registrar of AP is _FLASE */
3136                 if ((psecuritypriv->wpa_psk > 0) && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
3137                         if (pmlmepriv->wps_beacon_ie) {
3138                                 u8 selected_registrar = 0;
3139
3140                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
3141
3142                                 if (!selected_registrar) {
3143                                         DBG_88E("selected_registrar is false , or AP is not ready to do WPS\n");
3144
3145                                         status = _STATS_UNABLE_HANDLE_STA_;
3146
3147                                         goto OnAssocReqFail;
3148                                 }
3149                         }
3150                 }
3151         } else {
3152                 int copy_len;
3153
3154                 if (psecuritypriv->wpa_psk == 0) {
3155                         DBG_88E("STA %pM: WPA/RSN IE in association "
3156                         "request, but AP don't support WPA/RSN\n", pstat->hwaddr);
3157
3158                         status = WLAN_STATUS_INVALID_IE;
3159
3160                         goto OnAssocReqFail;
3161                 }
3162
3163                 if (elems.wps_ie) {
3164                         DBG_88E("STA included WPS IE in "
3165                                    "(Re)Association Request - WPS is "
3166                                    "used\n");
3167                         pstat->flags |= WLAN_STA_WPS;
3168                         copy_len = 0;
3169                 } else {
3170                         copy_len = min_t(int, wpa_ie_len + 2, sizeof(pstat->wpa_ie));
3171                 }
3172                 if (copy_len > 0)
3173                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
3174         }
3175         /*  check if there is WMM IE & support WWM-PS */
3176         pstat->flags &= ~WLAN_STA_WME;
3177         pstat->qos_option = 0;
3178         pstat->qos_info = 0;
3179         pstat->has_legacy_ac = true;
3180         pstat->uapsd_vo = 0;
3181         pstat->uapsd_vi = 0;
3182         pstat->uapsd_be = 0;
3183         pstat->uapsd_bk = 0;
3184         if (pmlmepriv->qospriv.qos_option) {
3185                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
3186                 for (;;) {
3187                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3188                         if (p != NULL) {
3189                                 if (!memcmp(p+2, WMM_IE, 6)) {
3190                                         pstat->flags |= WLAN_STA_WME;
3191
3192                                         pstat->qos_option = 1;
3193                                         pstat->qos_info = *(p+8);
3194
3195                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
3196
3197                                         if ((pstat->qos_info&0xf) != 0xf)
3198                                                 pstat->has_legacy_ac = true;
3199                                         else
3200                                                 pstat->has_legacy_ac = false;
3201
3202                                         if (pstat->qos_info&0xf) {
3203                                                 if (pstat->qos_info&BIT(0))
3204                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
3205                                                 else
3206                                                         pstat->uapsd_vo = 0;
3207
3208                                                 if (pstat->qos_info&BIT(1))
3209                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
3210                                                 else
3211                                                         pstat->uapsd_vi = 0;
3212
3213                                                 if (pstat->qos_info&BIT(2))
3214                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
3215                                                 else
3216                                                         pstat->uapsd_bk = 0;
3217
3218                                                 if (pstat->qos_info&BIT(3))
3219                                                         pstat->uapsd_be = BIT(0)|BIT(1);
3220                                                 else
3221                                                         pstat->uapsd_be = 0;
3222                                         }
3223                                         break;
3224                                 }
3225                         } else {
3226                                 break;
3227                         }
3228                         p = p + ie_len + 2;
3229                 }
3230         }
3231
3232         /* save HT capabilities in the sta object */
3233         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
3234         if (elems.ht_capabilities &&
3235             elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
3236                 pstat->flags |= WLAN_STA_HT;
3237
3238                 pstat->flags |= WLAN_STA_WME;
3239
3240                 memcpy(&pstat->htpriv.ht_cap,
3241                        elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
3242         } else {
3243                 pstat->flags &= ~WLAN_STA_HT;
3244         }
3245         if ((!pmlmepriv->htpriv.ht_option) && (pstat->flags&WLAN_STA_HT)) {
3246                 status = _STATS_FAILURE_;
3247                 goto OnAssocReqFail;
3248         }
3249
3250         if ((pstat->flags & WLAN_STA_HT) &&
3251             ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
3252             (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
3253                 DBG_88E("HT: %pM tried to "
3254                         "use TKIP with HT association\n", pstat->hwaddr);
3255
3256                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
3257                 /* goto OnAssocReqFail; */
3258         }
3259
3260         pstat->flags |= WLAN_STA_NONERP;
3261         for (i = 0; i < pstat->bssratelen; i++) {
3262                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
3263                         pstat->flags &= ~WLAN_STA_NONERP;
3264                         break;
3265                 }
3266         }
3267
3268         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3269                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
3270         else
3271                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3272
3273
3274
3275         if (status != _STATS_SUCCESSFUL_)
3276                 goto OnAssocReqFail;
3277
3278         /* TODO: identify_proprietary_vendor_ie(); */
3279         /*  Realtek proprietary IE */
3280         /*  identify if this is Broadcom sta */
3281         /*  identify if this is ralink sta */
3282         /*  Customer proprietary IE */
3283
3284         /* get a unique AID */
3285         if (pstat->aid > 0) {
3286                 DBG_88E("  old AID %d\n", pstat->aid);
3287         } else {
3288                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
3289                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
3290                                 break;
3291
3292                 /* if (pstat->aid > NUM_STA) { */
3293                 if (pstat->aid > pstapriv->max_num_sta) {
3294                         pstat->aid = 0;
3295
3296                         DBG_88E("  no room for more AIDs\n");
3297
3298                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3299
3300                         goto OnAssocReqFail;
3301                 } else {
3302                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
3303                         DBG_88E("allocate new AID=(%d)\n", pstat->aid);
3304                 }
3305         }
3306
3307         pstat->state &= (~WIFI_FW_ASSOC_STATE);
3308         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
3309
3310         spin_lock_bh(&pstapriv->auth_list_lock);
3311         if (!list_empty(&pstat->auth_list)) {
3312                 list_del_init(&pstat->auth_list);
3313                 pstapriv->auth_list_cnt--;
3314         }
3315         spin_unlock_bh(&pstapriv->auth_list_lock);
3316
3317         spin_lock_bh(&pstapriv->asoc_list_lock);
3318         if (list_empty(&pstat->asoc_list)) {
3319                 pstat->expire_to = pstapriv->expire_to;
3320                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
3321                 pstapriv->asoc_list_cnt++;
3322         }
3323         spin_unlock_bh(&pstapriv->asoc_list_lock);
3324
3325         /*  now the station is qualified to join our BSS... */
3326         if ((pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_ == status)) {
3327                 /* 1 bss_cap_update & sta_info_update */
3328                 bss_cap_update_on_sta_join(padapter, pstat);
3329                 sta_info_update(padapter, pstat);
3330
3331                 /* issue assoc rsp before notify station join event. */
3332                 if (frame_type == WIFI_ASSOCREQ)
3333                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3334                 else
3335                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3336
3337                 /* 2 - report to upper layer */
3338                 DBG_88E("indicate_sta_join_event to upper layer - hostapd\n");
3339                 rtw_indicate_sta_assoc_event(padapter, pstat);
3340
3341                 /* 3-(1) report sta add event */
3342                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
3343         }
3344
3345         return _SUCCESS;
3346
3347 asoc_class2_error:
3348
3349         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
3350
3351         return _FAIL;
3352
3353 OnAssocReqFail:
3354
3355         pstat->aid = 0;
3356         if (frame_type == WIFI_ASSOCREQ)
3357                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3358         else
3359                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3360
3361 #endif /* CONFIG_88EU_AP_MODE */
3362
3363         return _FAIL;
3364 }
3365
3366 static unsigned int OnAssocRsp(struct adapter *padapter,
3367                                struct recv_frame *precv_frame)
3368 {
3369         uint i;
3370         int res;
3371         unsigned short  status;
3372         struct ndis_802_11_var_ie *pIE;
3373         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3374         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3375         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3376         /* struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network); */
3377         u8 *pframe = precv_frame->pkt->data;
3378         uint pkt_len = precv_frame->pkt->len;
3379
3380         DBG_88E("%s\n", __func__);
3381
3382         /* check A1 matches or not */
3383         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
3384                 return _SUCCESS;
3385
3386         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
3387                 return _SUCCESS;
3388
3389         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
3390                 return _SUCCESS;
3391
3392         del_timer_sync(&pmlmeext->link_timer);
3393
3394         /* status */
3395         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
3396         if (status > 0) {
3397                 DBG_88E("assoc reject, status code: %d\n", status);
3398                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
3399                 res = -4;
3400                 goto report_assoc_result;
3401         }
3402
3403         /* get capabilities */
3404         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3405
3406         /* set slot time */
3407         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
3408
3409         /* AID */
3410         pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
3411         res = pmlmeinfo->aid;
3412
3413         /* following are moved to join event callback function */
3414         /* to handle HT, WMM, rate adaptive, update MAC reg */
3415         /* for not to handle the synchronous IO in the tasklet */
3416         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
3417                 pIE = (struct ndis_802_11_var_ie *)(pframe + i);
3418
3419                 switch (pIE->ElementID) {
3420                 case _VENDOR_SPECIFIC_IE_:
3421                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6)) /* WMM */
3422                                 WMM_param_handler(padapter, pIE);
3423                         break;
3424                 case _HT_CAPABILITY_IE_:        /* HT caps */
3425                         HT_caps_handler(padapter, pIE);
3426                         break;
3427                 case _HT_EXTRA_INFO_IE_:        /* HT info */
3428                         HT_info_handler(padapter, pIE);
3429                         break;
3430                 case _ERPINFO_IE_:
3431                         ERP_IE_handler(padapter, pIE);
3432                 default:
3433                         break;
3434                 }
3435
3436                 i += (pIE->Length + 2);
3437         }
3438
3439         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
3440         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
3441
3442         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
3443
3444 report_assoc_result:
3445         if (res > 0)
3446                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
3447         else
3448                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
3449
3450         report_join_res(padapter, res);
3451
3452         return _SUCCESS;
3453 }
3454
3455 static unsigned int OnDeAuth(struct adapter *padapter,
3456                              struct recv_frame *precv_frame)
3457 {
3458         unsigned short  reason;
3459         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3460         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3461         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3462         u8 *pframe = precv_frame->pkt->data;
3463         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3464
3465         /* check A3 */
3466         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3467                 return _SUCCESS;
3468
3469         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3470
3471         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3472
3473 #ifdef CONFIG_88EU_AP_MODE
3474         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3475                 struct sta_info *psta;
3476                 struct sta_priv *pstapriv = &padapter->stapriv;
3477
3478                 DBG_88E_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
3479                               reason, GetAddr2Ptr(pframe));
3480
3481                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3482                 if (psta) {
3483                         u8 updated = 0;
3484
3485                         spin_lock_bh(&pstapriv->asoc_list_lock);
3486                         if (!list_empty(&psta->asoc_list)) {
3487                                 list_del_init(&psta->asoc_list);
3488                                 pstapriv->asoc_list_cnt--;
3489                                 updated = ap_free_sta(padapter, psta, false, reason);
3490                         }
3491                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3492
3493                         associated_clients_update(padapter, updated);
3494                 }
3495
3496
3497                 return _SUCCESS;
3498         } else
3499 #endif
3500         {
3501                 DBG_88E_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM\n",
3502                               reason, GetAddr3Ptr(pframe));
3503
3504                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3505         }
3506         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3507         return _SUCCESS;
3508 }
3509
3510 static unsigned int OnDisassoc(struct adapter *padapter,
3511                                struct recv_frame *precv_frame)
3512 {
3513         u16 reason;
3514         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3515         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3516         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3517         u8 *pframe = precv_frame->pkt->data;
3518         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3519
3520         /* check A3 */
3521         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3522                 return _SUCCESS;
3523
3524         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3525
3526         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3527
3528 #ifdef CONFIG_88EU_AP_MODE
3529         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3530                 struct sta_info *psta;
3531                 struct sta_priv *pstapriv = &padapter->stapriv;
3532
3533                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3534                               reason, GetAddr2Ptr(pframe));
3535
3536                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3537                 if (psta) {
3538                         u8 updated = 0;
3539
3540                         spin_lock_bh(&pstapriv->asoc_list_lock);
3541                         if (!list_empty(&psta->asoc_list)) {
3542                                 list_del_init(&psta->asoc_list);
3543                                 pstapriv->asoc_list_cnt--;
3544                                 updated = ap_free_sta(padapter, psta, false, reason);
3545                         }
3546                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3547
3548                         associated_clients_update(padapter, updated);
3549                 }
3550
3551                 return _SUCCESS;
3552         } else
3553 #endif
3554         {
3555                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3556                               reason, GetAddr3Ptr(pframe));
3557
3558                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3559         }
3560         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3561         return _SUCCESS;
3562 }
3563
3564 static unsigned int OnAtim(struct adapter *padapter,
3565                            struct recv_frame *precv_frame)
3566 {
3567         DBG_88E("%s\n", __func__);
3568         return _SUCCESS;
3569 }
3570
3571 static unsigned int on_action_spct(struct adapter *padapter,
3572                                    struct recv_frame *precv_frame)
3573 {
3574         struct sta_info *psta = NULL;
3575         struct sta_priv *pstapriv = &padapter->stapriv;
3576         u8 *pframe = precv_frame->pkt->data;
3577         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3578         u8 category;
3579         u8 action;
3580
3581         DBG_88E(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
3582
3583         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3584
3585         if (!psta)
3586                 goto exit;
3587
3588         category = frame_body[0];
3589         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
3590                 goto exit;
3591
3592         action = frame_body[1];
3593         switch (action) {
3594         case RTW_WLAN_ACTION_SPCT_MSR_REQ:
3595         case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
3596         case RTW_WLAN_ACTION_SPCT_TPC_REQ:
3597         case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
3598                 break;
3599         case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
3600                 break;
3601         default:
3602                 break;
3603         }
3604
3605 exit:
3606         return _FAIL;
3607 }
3608
3609 static unsigned int OnAction_qos(struct adapter *padapter,
3610                                  struct recv_frame *precv_frame)
3611 {
3612         return _SUCCESS;
3613 }
3614
3615 static unsigned int OnAction_dls(struct adapter *padapter,
3616                                  struct recv_frame *precv_frame)
3617 {
3618         return _SUCCESS;
3619 }
3620
3621 static unsigned int OnAction_back(struct adapter *padapter,
3622                                   struct recv_frame *precv_frame)
3623 {
3624         u8 *addr;
3625         struct sta_info *psta = NULL;
3626         struct recv_reorder_ctrl *preorder_ctrl;
3627         unsigned char           *frame_body;
3628         unsigned char           category, action;
3629         unsigned short  tid, status, reason_code = 0;
3630         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3631         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3632         u8 *pframe = precv_frame->pkt->data;
3633         struct sta_priv *pstapriv = &padapter->stapriv;
3634         /* check RA matches or not */
3635         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe),
3636                    ETH_ALEN))/* for if1, sta/ap mode */
3637                 return _SUCCESS;
3638
3639         DBG_88E("%s\n", __func__);
3640
3641         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3642                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3643                         return _SUCCESS;
3644
3645         addr = GetAddr2Ptr(pframe);
3646         psta = rtw_get_stainfo(pstapriv, addr);
3647
3648         if (psta == NULL)
3649                 return _SUCCESS;
3650
3651         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3652
3653         category = frame_body[0];
3654         if (category == RTW_WLAN_CATEGORY_BACK) { /*  representing Block Ack */
3655                 if (!pmlmeinfo->HT_enable)
3656                         return _SUCCESS;
3657                 action = frame_body[1];
3658                 DBG_88E("%s, action=%d\n", __func__, action);
3659                 switch (action) {
3660                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
3661                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
3662                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
3663
3664                         /* 37 = reject ADDBA Req */
3665                         issue_action_BA(padapter, addr,
3666                                         RTW_WLAN_ACTION_ADDBA_RESP,
3667                                         pmlmeinfo->accept_addba_req ? 0 : 37);
3668                         break;
3669                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
3670                         status = get_unaligned_le16(&frame_body[3]);
3671                         tid = (frame_body[5] >> 2) & 0x7;
3672                         if (status == 0) {      /* successful */
3673                                 DBG_88E("agg_enable for TID=%d\n", tid);
3674                                 psta->htpriv.agg_enable_bitmap |= 1 << tid;
3675                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3676                         } else {
3677                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3678                         }
3679                         break;
3680                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
3681                         if ((frame_body[3] & BIT(3)) == 0) {
3682                                 psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3683                                 psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3684                                 reason_code = get_unaligned_le16(&frame_body[4]);
3685                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
3686                                 tid = (frame_body[3] >> 4) & 0x0F;
3687                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
3688                                 preorder_ctrl->enable = false;
3689                                 preorder_ctrl->indicate_seq = 0xffff;
3690                         }
3691                         DBG_88E("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
3692                         /* todo: how to notify the host while receiving DELETE BA */
3693                         break;
3694                 default:
3695                         break;
3696                 }
3697         }
3698         return _SUCCESS;
3699 }
3700
3701 static s32 rtw_action_public_decache(struct recv_frame *recv_frame, s32 token)
3702 {
3703         struct adapter *adapter = recv_frame->adapter;
3704         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
3705         u8 *frame = recv_frame->pkt->data;
3706         u16 seq_ctrl = ((recv_frame->attrib.seq_num&0xffff) << 4) |
3707                 (recv_frame->attrib.frag_num & 0xf);
3708
3709         if (GetRetry(frame)) {
3710                 if (token >= 0) {
3711                         if ((seq_ctrl == mlmeext->action_public_rxseq) && (token == mlmeext->action_public_dialog_token)) {
3712                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
3713                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
3714                                 return _FAIL;
3715                         }
3716                 } else {
3717                         if (seq_ctrl == mlmeext->action_public_rxseq) {
3718                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
3719                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
3720                                 return _FAIL;
3721                         }
3722                 }
3723         }
3724
3725         mlmeext->action_public_rxseq = seq_ctrl;
3726
3727         if (token >= 0)
3728                 mlmeext->action_public_dialog_token = token;
3729
3730         return _SUCCESS;
3731 }
3732
3733 static unsigned int on_action_public_p2p(struct recv_frame *precv_frame)
3734 {
3735         u8 *pframe = precv_frame->pkt->data;
3736         u8 *frame_body;
3737         u8 dialogToken = 0;
3738
3739         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3740         dialogToken = frame_body[7];
3741
3742         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
3743                 return _FAIL;
3744
3745         return _SUCCESS;
3746 }
3747
3748 static unsigned int on_action_public_vendor(struct recv_frame *precv_frame)
3749 {
3750         unsigned int ret = _FAIL;
3751         u8 *pframe = precv_frame->pkt->data;
3752         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3753
3754         if (!memcmp(frame_body + 2, P2P_OUI, 4))
3755                 ret = on_action_public_p2p(precv_frame);
3756
3757         return ret;
3758 }
3759
3760 static unsigned int on_action_public_default(struct recv_frame *precv_frame, u8 action)
3761 {
3762         unsigned int ret = _FAIL;
3763         u8 *pframe = precv_frame->pkt->data;
3764         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3765         u8 token;
3766
3767         token = frame_body[2];
3768
3769         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
3770                 goto exit;
3771
3772         ret = _SUCCESS;
3773
3774 exit:
3775         return ret;
3776 }
3777
3778 static unsigned int on_action_public(struct adapter *padapter,
3779                                      struct recv_frame *precv_frame)
3780 {
3781         unsigned int ret = _FAIL;
3782         u8 *pframe = precv_frame->pkt->data;
3783         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3784         u8 category, action;
3785
3786         /* check RA matches or not */
3787         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
3788                 goto exit;
3789
3790         category = frame_body[0];
3791         if (category != RTW_WLAN_CATEGORY_PUBLIC)
3792                 goto exit;
3793
3794         action = frame_body[1];
3795         switch (action) {
3796         case ACT_PUBLIC_VENDOR:
3797                 ret = on_action_public_vendor(precv_frame);
3798                 break;
3799         default:
3800                 ret = on_action_public_default(precv_frame, action);
3801                 break;
3802         }
3803
3804 exit:
3805         return ret;
3806 }
3807
3808 static unsigned int OnAction_ht(struct adapter *padapter,
3809                                 struct recv_frame *precv_frame)
3810 {
3811         return _SUCCESS;
3812 }
3813
3814 static unsigned int OnAction_wmm(struct adapter *padapter,
3815                                  struct recv_frame *precv_frame)
3816 {
3817         return _SUCCESS;
3818 }
3819
3820 static unsigned int OnAction_p2p(struct adapter *padapter,
3821                                  struct recv_frame *precv_frame)
3822 {
3823         return _SUCCESS;
3824 }
3825
3826 static unsigned int DoReserved(struct adapter *padapter,
3827                                struct recv_frame *precv_frame)
3828 {
3829         return _SUCCESS;
3830 }
3831
3832 static struct action_handler OnAction_tbl[] = {
3833         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
3834         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
3835         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
3836         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
3837         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
3838         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
3839         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
3840         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
3841         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
3842         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
3843         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
3844 };
3845
3846 static unsigned int OnAction(struct adapter *padapter,
3847                              struct recv_frame *precv_frame)
3848 {
3849         int i;
3850         unsigned char   category;
3851         struct action_handler *ptable;
3852         unsigned char   *frame_body;
3853         u8 *pframe = precv_frame->pkt->data;
3854
3855         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3856
3857         category = frame_body[0];
3858
3859         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
3860                 ptable = &OnAction_tbl[i];
3861                 if (category == ptable->num)
3862                         ptable->func(padapter, precv_frame);
3863         }
3864         return _SUCCESS;
3865 }
3866
3867 /****************************************************************************
3868
3869 Following are the initialization functions for WiFi MLME
3870
3871 *****************************************************************************/
3872
3873 static struct mlme_handler mlme_sta_tbl[] = {
3874         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
3875         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
3876         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
3877         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
3878         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
3879         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
3880
3881         /*----------------------------------------------------------
3882                                         below 2 are reserved
3883         -----------------------------------------------------------*/
3884         {0,                                     "DoReserved",           &DoReserved},
3885         {0,                                     "DoReserved",           &DoReserved},
3886         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
3887         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
3888         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
3889         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
3890         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
3891         {WIFI_ACTION,           "OnAction",             &OnAction},
3892 };
3893
3894 int init_hw_mlme_ext(struct adapter *padapter)
3895 {
3896         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3897
3898         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3899         return _SUCCESS;
3900 }
3901
3902 static void init_mlme_ext_priv_value(struct adapter *padapter)
3903 {
3904         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3905         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3906         unsigned char   mixed_datarate[NumRates] = {
3907                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3908                 _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_,
3909                  _48M_RATE_, _54M_RATE_, 0xff
3910         };
3911         unsigned char   mixed_basicrate[NumRates] = {
3912                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3913                 _12M_RATE_, _24M_RATE_, 0xff,
3914         };
3915
3916         atomic_set(&pmlmeext->event_seq, 0);
3917         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
3918
3919         pmlmeext->cur_channel = padapter->registrypriv.channel;
3920         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
3921         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
3922         pmlmeext->oper_channel = pmlmeext->cur_channel;
3923         pmlmeext->oper_bwmode = pmlmeext->cur_bwmode;
3924         pmlmeext->oper_ch_offset = pmlmeext->cur_ch_offset;
3925         pmlmeext->retry = 0;
3926
3927         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
3928
3929         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
3930         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
3931
3932         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
3933
3934         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3935         pmlmeext->sitesurvey_res.channel_idx = 0;
3936         pmlmeext->sitesurvey_res.bss_cnt = 0;
3937         pmlmeext->scan_abort = false;
3938
3939         pmlmeinfo->state = WIFI_FW_NULL_STATE;
3940         pmlmeinfo->reauth_count = 0;
3941         pmlmeinfo->reassoc_count = 0;
3942         pmlmeinfo->link_count = 0;
3943         pmlmeinfo->auth_seq = 0;
3944         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
3945         pmlmeinfo->key_index = 0;
3946         pmlmeinfo->iv = 0;
3947
3948         pmlmeinfo->enc_algo = _NO_PRIVACY_;
3949         pmlmeinfo->authModeToggle = 0;
3950
3951         memset(pmlmeinfo->chg_txt, 0, 128);
3952
3953         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
3954         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
3955
3956         pmlmeinfo->dialogToken = 0;
3957
3958         pmlmeext->action_public_rxseq = 0xffff;
3959         pmlmeext->action_public_dialog_token = 0xff;
3960 }
3961
3962 static int has_channel(struct rt_channel_info *channel_set,
3963                                            u8 chanset_size,
3964                                            u8 chan)
3965 {
3966         int i;
3967
3968         for (i = 0; i < chanset_size; i++) {
3969                 if (channel_set[i].ChannelNum == chan)
3970                         return 1;
3971         }
3972         return 0;
3973 }
3974
3975 static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
3976                                                           u8 chanset_size,
3977                                                         struct p2p_channels *channel_list)
3978 {
3979         struct p2p_oper_class_map op_class[] = {
3980                 { IEEE80211G,  81,   1,  13,  1, BW20 },
3981                 { IEEE80211G,  82,  14,  14,  1, BW20 },
3982                 { -1, 0, 0, 0, 0, BW20 }
3983         };
3984
3985         int cla, op;
3986
3987         cla = 0;
3988
3989         for (op = 0; op_class[op].op_class; op++) {
3990                 u8 ch;
3991                 struct p2p_oper_class_map *o = &op_class[op];
3992                 struct p2p_reg_class *reg = NULL;
3993
3994                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
3995                         if (!has_channel(channel_set, chanset_size, ch))
3996                                 continue;
3997
3998                         if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
3999                                 continue;
4000
4001                         if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
4002                             ((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
4003                                 continue;
4004
4005                         if (reg == NULL) {
4006                                 reg = &channel_list->reg_class[cla];
4007                                 cla++;
4008                                 reg->reg_class = o->op_class;
4009                                 reg->channels = 0;
4010                         }
4011                         reg->channel[reg->channels] = ch;
4012                         reg->channels++;
4013                 }
4014         }
4015         channel_list->reg_classes = cla;
4016 }
4017
4018 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
4019 {
4020         u8 index, chanset_size = 0;
4021         u8 b2_4GBand = false;
4022         u8 Index2G = 0;
4023
4024         memset(channel_set, 0, sizeof(struct rt_channel_info) * MAX_CHANNEL_NUM);
4025
4026         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
4027                 DBG_88E("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
4028                 return chanset_size;
4029         }
4030
4031         if (padapter->registrypriv.wireless_mode & WIRELESS_11G) {
4032                 b2_4GBand = true;
4033                 if (RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
4034                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
4035                 else
4036                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
4037         }
4038
4039         if (b2_4GBand) {
4040                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
4041                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
4042
4043                         if ((RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) ||/* Channel 1~11 is active, and 12~14 is passive */
4044                             (RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G == ChannelPlan)) {
4045                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
4046                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4047                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
4048                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
4049                         } else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
4050                                    RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) {/*  channel 12~13, passive scan */
4051                                 if (channel_set[chanset_size].ChannelNum <= 11)
4052                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4053                                 else
4054                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
4055                         } else {
4056                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4057                         }
4058
4059                         chanset_size++;
4060                 }
4061         }
4062         return chanset_size;
4063 }
4064
4065 int     init_mlme_ext_priv(struct adapter *padapter)
4066 {
4067         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4068         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4069         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4070         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4071
4072         pmlmeext->padapter = padapter;
4073
4074         init_mlme_ext_priv_value(padapter);
4075         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
4076
4077         init_mlme_ext_timer(padapter);
4078
4079 #ifdef CONFIG_88EU_AP_MODE
4080         init_mlme_ap_info(padapter);
4081 #endif
4082
4083         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
4084         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
4085
4086         pmlmeext->chan_scan_time = SURVEY_TO;
4087         pmlmeext->mlmeext_init = true;
4088
4089
4090         pmlmeext->active_keep_alive_check = true;
4091
4092         return _SUCCESS;
4093 }
4094
4095 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
4096 {
4097         struct adapter *padapter = pmlmeext->padapter;
4098
4099         if (!padapter)
4100                 return;
4101
4102         if (padapter->bDriverStopped) {
4103                 del_timer_sync(&pmlmeext->survey_timer);
4104                 del_timer_sync(&pmlmeext->link_timer);
4105         }
4106 }
4107
4108 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, struct recv_frame *precv_frame)
4109 {
4110         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4111         u8 *pframe = precv_frame->pkt->data;
4112
4113         if (ptable->func) {
4114                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4115                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4116                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4117                         return;
4118                 ptable->func(padapter, precv_frame);
4119         }
4120 }
4121
4122 void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame)
4123 {
4124         int index;
4125         struct mlme_handler *ptable;
4126 #ifdef CONFIG_88EU_AP_MODE
4127         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4128 #endif /* CONFIG_88EU_AP_MODE */
4129         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4130         u8 *pframe = precv_frame->pkt->data;
4131         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
4132
4133         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
4134                  ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
4135                   (unsigned int)GetFrameType(pframe),
4136                   (unsigned int)GetFrameSubType(pframe)));
4137
4138         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
4139                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
4140                          ("mgt_dispatcher: type(0x%x) error!\n",
4141                           (unsigned int)GetFrameType(pframe)));
4142                 return;
4143         }
4144
4145         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4146         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4147             memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4148                 return;
4149
4150         ptable = mlme_sta_tbl;
4151
4152         index = GetFrameSubType(pframe) >> 4;
4153
4154         if (index > 13) {
4155                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type=%d\n", index));
4156                 return;
4157         }
4158         ptable += index;
4159
4160         if (psta != NULL) {
4161                 if (GetRetry(pframe)) {
4162                         if (precv_frame->attrib.seq_num ==
4163                             psta->RxMgmtFrameSeqNum) {
4164                                 /* drop the duplicate management frame */
4165                                 DBG_88E("Drop duplicate management frame with seq_num=%d.\n",
4166                                         precv_frame->attrib.seq_num);
4167                                 return;
4168                         }
4169                 }
4170                 psta->RxMgmtFrameSeqNum = precv_frame->attrib.seq_num;
4171         }
4172
4173 #ifdef CONFIG_88EU_AP_MODE
4174         switch (GetFrameSubType(pframe)) {
4175         case WIFI_AUTH:
4176                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
4177                         ptable->func = &OnAuth;
4178                 else
4179                         ptable->func = &OnAuthClient;
4180                 /* fall through */
4181         case WIFI_ASSOCREQ:
4182         case WIFI_REASSOCREQ:
4183         case WIFI_PROBEREQ:
4184         case WIFI_BEACON:
4185         case WIFI_ACTION:
4186                 _mgt_dispatcher(padapter, ptable, precv_frame);
4187                 break;
4188         default:
4189                 _mgt_dispatcher(padapter, ptable, precv_frame);
4190                 break;
4191         }
4192 #else
4193         _mgt_dispatcher(padapter, ptable, precv_frame);
4194 #endif
4195 }
4196
4197 /****************************************************************************
4198
4199 Following are the functions to report events
4200
4201 *****************************************************************************/
4202
4203 void report_survey_event(struct adapter *padapter,
4204                          struct recv_frame *precv_frame)
4205 {
4206         struct cmd_obj *pcmd_obj;
4207         u8 *pevtcmd;
4208         u32 cmdsz;
4209         struct survey_event     *psurvey_evt;
4210         struct C2HEvent_Header *pc2h_evt_hdr;
4211         struct mlme_ext_priv *pmlmeext;
4212         struct cmd_priv *pcmdpriv;
4213
4214         if (!padapter)
4215                 return;
4216
4217         pmlmeext = &padapter->mlmeextpriv;
4218         pcmdpriv = &padapter->cmdpriv;
4219
4220
4221         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4222         if (!pcmd_obj)
4223                 return;
4224
4225         cmdsz = sizeof(struct survey_event) + sizeof(struct C2HEvent_Header);
4226         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4227         if (!pevtcmd) {
4228                 kfree(pcmd_obj);
4229                 return;
4230         }
4231
4232         INIT_LIST_HEAD(&pcmd_obj->list);
4233
4234         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4235         pcmd_obj->cmdsz = cmdsz;
4236         pcmd_obj->parmbuf = pevtcmd;
4237
4238         pcmd_obj->rsp = NULL;
4239         pcmd_obj->rspsz  = 0;
4240
4241         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4242         pc2h_evt_hdr->len = sizeof(struct survey_event);
4243         pc2h_evt_hdr->ID = _Survey_EVT_;
4244         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4245
4246         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4247
4248         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4249                 kfree(pcmd_obj);
4250                 kfree(pevtcmd);
4251                 return;
4252         }
4253
4254         process_80211d(padapter, &psurvey_evt->bss);
4255
4256         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4257
4258         pmlmeext->sitesurvey_res.bss_cnt++;
4259 }
4260
4261 void report_surveydone_event(struct adapter *padapter)
4262 {
4263         struct cmd_obj *pcmd_obj;
4264         u8 *pevtcmd;
4265         u32 cmdsz;
4266         struct surveydone_event *psurveydone_evt;
4267         struct C2HEvent_Header  *pc2h_evt_hdr;
4268         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4269         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4270
4271         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4272         if (!pcmd_obj)
4273                 return;
4274
4275         cmdsz = sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header);
4276         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4277         if (!pevtcmd) {
4278                 kfree(pcmd_obj);
4279                 return;
4280         }
4281
4282         INIT_LIST_HEAD(&pcmd_obj->list);
4283
4284         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4285         pcmd_obj->cmdsz = cmdsz;
4286         pcmd_obj->parmbuf = pevtcmd;
4287
4288         pcmd_obj->rsp = NULL;
4289         pcmd_obj->rspsz  = 0;
4290
4291         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4292         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4293         pc2h_evt_hdr->ID = _SurveyDone_EVT_;
4294         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4295
4296         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4297         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4298
4299         DBG_88E("survey done event(%x)\n", psurveydone_evt->bss_cnt);
4300
4301         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4302 }
4303
4304 void report_join_res(struct adapter *padapter, int res)
4305 {
4306         struct cmd_obj *pcmd_obj;
4307         u8 *pevtcmd;
4308         u32 cmdsz;
4309         struct joinbss_event            *pjoinbss_evt;
4310         struct C2HEvent_Header  *pc2h_evt_hdr;
4311         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4312         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4313         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4314
4315         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4316         if (!pcmd_obj)
4317                 return;
4318
4319         cmdsz = sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header);
4320         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4321         if (!pevtcmd) {
4322                 kfree(pcmd_obj);
4323                 return;
4324         }
4325
4326         INIT_LIST_HEAD(&pcmd_obj->list);
4327
4328         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4329         pcmd_obj->cmdsz = cmdsz;
4330         pcmd_obj->parmbuf = pevtcmd;
4331
4332         pcmd_obj->rsp = NULL;
4333         pcmd_obj->rspsz  = 0;
4334
4335         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4336         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4337         pc2h_evt_hdr->ID = _JoinBss_EVT_;
4338         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4339
4340         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4341         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4342         pjoinbss_evt->network.join_res  = res;
4343         pjoinbss_evt->network.aid = res;
4344
4345         DBG_88E("report_join_res(%d)\n", res);
4346
4347
4348         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4349
4350
4351         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4352 }
4353
4354 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4355 {
4356         struct cmd_obj *pcmd_obj;
4357         u8 *pevtcmd;
4358         u32 cmdsz;
4359         struct sta_info *psta;
4360         int     mac_id;
4361         struct stadel_event                     *pdel_sta_evt;
4362         struct C2HEvent_Header  *pc2h_evt_hdr;
4363         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4364         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4365
4366         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4367         if (!pcmd_obj)
4368                 return;
4369
4370         cmdsz = sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header);
4371         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4372         if (!pevtcmd) {
4373                 kfree(pcmd_obj);
4374                 return;
4375         }
4376
4377         INIT_LIST_HEAD(&pcmd_obj->list);
4378
4379         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4380         pcmd_obj->cmdsz = cmdsz;
4381         pcmd_obj->parmbuf = pevtcmd;
4382
4383         pcmd_obj->rsp = NULL;
4384         pcmd_obj->rspsz  = 0;
4385
4386         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4387         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4388         pc2h_evt_hdr->ID = _DelSTA_EVT_;
4389         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4390
4391         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4392         ether_addr_copy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr);
4393         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4394
4395
4396         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4397         if (psta)
4398                 mac_id = (int)psta->mac_id;
4399         else
4400                 mac_id = -1;
4401
4402         pdel_sta_evt->mac_id = mac_id;
4403
4404         DBG_88E("report_del_sta_event: delete STA, mac_id =%d\n", mac_id);
4405
4406         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4407 }
4408
4409 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
4410 {
4411         struct cmd_obj *pcmd_obj;
4412         u8 *pevtcmd;
4413         u32 cmdsz;
4414         struct stassoc_event            *padd_sta_evt;
4415         struct C2HEvent_Header  *pc2h_evt_hdr;
4416         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4417         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4418
4419         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4420         if (!pcmd_obj)
4421                 return;
4422
4423         cmdsz = sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header);
4424         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4425         if (!pevtcmd) {
4426                 kfree(pcmd_obj);
4427                 return;
4428         }
4429
4430         INIT_LIST_HEAD(&pcmd_obj->list);
4431
4432         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4433         pcmd_obj->cmdsz = cmdsz;
4434         pcmd_obj->parmbuf = pevtcmd;
4435
4436         pcmd_obj->rsp = NULL;
4437         pcmd_obj->rspsz  = 0;
4438
4439         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4440         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4441         pc2h_evt_hdr->ID = _AddSTA_EVT_;
4442         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4443
4444         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4445         ether_addr_copy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr);
4446         padd_sta_evt->cam_id = cam_idx;
4447
4448         DBG_88E("report_add_sta_event: add STA\n");
4449
4450         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4451 }
4452
4453
4454 /****************************************************************************
4455
4456 Following are the event callback functions
4457
4458 *****************************************************************************/
4459
4460 /* for sta/adhoc mode */
4461 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4462 {
4463         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4464         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4465         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4466
4467         /* ERP */
4468         VCS_update(padapter, psta);
4469
4470         /* HT */
4471         if (pmlmepriv->htpriv.ht_option) {
4472                 psta->htpriv.ht_option = true;
4473
4474                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4475
4476                 if (support_short_GI(padapter, &pmlmeinfo->HT_caps))
4477                         psta->htpriv.sgi = true;
4478
4479                 psta->qos_option = true;
4480         } else {
4481                 psta->htpriv.ht_option = false;
4482
4483                 psta->htpriv.ampdu_enable = false;
4484
4485                 psta->htpriv.sgi = false;
4486                 psta->qos_option = false;
4487         }
4488         psta->htpriv.bwmode = pmlmeext->cur_bwmode;
4489         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4490
4491         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4492         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4493
4494         /* QoS */
4495         if (pmlmepriv->qospriv.qos_option)
4496                 psta->qos_option = true;
4497
4498
4499         psta->state = _FW_LINKED;
4500 }
4501
4502 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4503 {
4504         struct sta_info         *psta, *psta_bmc;
4505         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4506         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4507         struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
4508         struct sta_priv         *pstapriv = &padapter->stapriv;
4509         u8 join_type;
4510         u16 media_status;
4511
4512         if (join_res < 0) {
4513                 join_type = 1;
4514                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4515                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4516
4517                 /* restore to initial setting. */
4518                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4519
4520                 goto exit_mlmeext_joinbss_event_callback;
4521         }
4522
4523         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4524                 /* for bc/mc */
4525                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
4526                 if (psta_bmc) {
4527                         pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
4528                         update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
4529                         Update_RA_Entry(padapter, psta_bmc->mac_id);
4530                 }
4531         }
4532
4533
4534         /* turn on dynamic functions */
4535         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4536
4537         /*  update IOT-related issue */
4538         update_IOT_info(padapter);
4539
4540         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
4541
4542         /* BCN interval */
4543         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4544
4545         /* update capability */
4546         update_capinfo(padapter, pmlmeinfo->capability);
4547
4548         /* WMM, Update EDCA param */
4549         WMMOnAssocRsp(padapter);
4550
4551         /* HT */
4552         HTOnAssocRsp(padapter);
4553
4554         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4555
4556         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
4557         if (psta) { /* only for infra. mode */
4558                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4559
4560                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4561
4562                 /* set per sta rate after updating HT cap. */
4563                 set_sta_rate(padapter, psta);
4564                 rtw_hal_set_hwreg(padapter, HW_VAR_TX_RPT_MAX_MACID, (u8 *)&psta->mac_id);
4565                 media_status = (psta->mac_id<<8)|1; /*   MACID|OPMODE: 1 means connect */
4566                 rtw_hal_set_hwreg(padapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
4567         }
4568
4569         join_type = 2;
4570         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4571
4572         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4573                 /*  correcting TSF */
4574                 correct_TSF(padapter, pmlmeext);
4575         }
4576         rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4577
4578 exit_mlmeext_joinbss_event_callback:
4579
4580         DBG_88E("=>%s\n", __func__);
4581 }
4582
4583 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4584 {
4585         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
4586         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4587         u8 join_type;
4588
4589         DBG_88E("%s\n", __func__);
4590
4591         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4592                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {/* adhoc master or sta_count>1 */
4593                         /* nothing to do */
4594                 } else { /* adhoc client */
4595                         /*  correcting TSF */
4596                         correct_TSF(padapter, pmlmeext);
4597
4598                         /* start beacon */
4599                         if (send_beacon(padapter) == _FAIL) {
4600                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4601                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4602                                 return;
4603                         }
4604                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4605                 }
4606
4607                 join_type = 2;
4608                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4609         }
4610
4611         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4612
4613         /* rate radaptive */
4614         Update_RA_Entry(padapter, psta->mac_id);
4615
4616         /* update adhoc sta_info */
4617         update_sta_info(padapter, psta);
4618 }
4619
4620 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4621 {
4622         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4623         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4624
4625         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter)) {
4626                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4627                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4628
4629                 /* restore to initial setting. */
4630                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4631
4632                 /* switch to the 20M Hz mode after disconnect */
4633                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4634                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4635
4636                 /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4637                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4638
4639
4640                 flush_all_cam_entry(padapter);
4641
4642                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4643
4644                 /* set MSR to no link state -> infra. mode */
4645                 Set_MSR(padapter, _HW_STATE_STATION_);
4646
4647                 del_timer_sync(&pmlmeext->link_timer);
4648         }
4649 }
4650
4651 /****************************************************************************
4652
4653 Following are the functions for the timer handlers
4654
4655 *****************************************************************************/
4656
4657 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4658 {
4659         u8 ret = false;
4660
4661         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta)) &&
4662             sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta) &&
4663             sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta))
4664                 ret = false;
4665         else
4666                 ret = true;
4667
4668         sta_update_last_rx_pkts(psta);
4669
4670         return ret;
4671 }
4672
4673 void linked_status_chk(struct adapter *padapter)
4674 {
4675         u32     i;
4676         struct sta_info         *psta;
4677         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
4678         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4679         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4680         struct sta_priv         *pstapriv = &padapter->stapriv;
4681
4682         if (is_client_associated_to_ap(padapter)) {
4683                 /* linked infrastructure client mode */
4684
4685                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
4686                 int rx_chk_limit;
4687
4688                 rx_chk_limit = 4;
4689                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
4690                 if (psta != NULL) {
4691                         bool is_p2p_enable = false;
4692
4693                         if (!chk_ap_is_alive(padapter, psta))
4694                                 rx_chk = _FAIL;
4695
4696                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
4697                                 tx_chk = _FAIL;
4698
4699                         if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
4700                                 u8 backup_oper_channel = 0;
4701
4702                                 /* switch to correct channel of current network  before issue keep-alive frames */
4703                                 if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
4704                                         backup_oper_channel = rtw_get_oper_ch(padapter);
4705                                         SelectChannel(padapter, pmlmeext->cur_channel);
4706                                 }
4707
4708                                 if (rx_chk != _SUCCESS)
4709                                         issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
4710
4711                                 if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
4712                                         tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
4713                                         /* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
4714                                         if (tx_chk == _SUCCESS && !is_p2p_enable)
4715                                                 rx_chk = _SUCCESS;
4716                                 }
4717
4718                                 /* back to the original operation channel */
4719                                 if (backup_oper_channel > 0)
4720                                         SelectChannel(padapter, backup_oper_channel);
4721                         } else {
4722                                 if (rx_chk != _SUCCESS) {
4723                                         if (pmlmeext->retry == 0) {
4724                                                 issue_probereq(padapter,
4725                                                 &pmlmeinfo->network.Ssid,
4726                                                 pmlmeinfo->network.MacAddress,
4727                                                                         false);
4728                                                 issue_probereq(padapter,
4729                                                 &pmlmeinfo->network.Ssid,
4730                                                 pmlmeinfo->network.MacAddress,
4731                                                                         false);
4732                                                 issue_probereq(padapter,
4733                                                 &pmlmeinfo->network.Ssid,
4734                                                 pmlmeinfo->network.MacAddress,
4735                                                                         false);
4736                                         }
4737                                 }
4738
4739                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf)
4740                                         tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
4741                         }
4742
4743                         if (rx_chk == _FAIL) {
4744                                 pmlmeext->retry++;
4745                                 if (pmlmeext->retry > rx_chk_limit) {
4746                                         DBG_88E_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
4747                                                       FUNC_ADPT_ARG(padapter));
4748                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress,
4749                                                            WLAN_REASON_EXPIRATION_CHK);
4750                                         return;
4751                                 }
4752                         } else {
4753                                 pmlmeext->retry = 0;
4754                         }
4755
4756                         if (tx_chk == _FAIL) {
4757                                 pmlmeinfo->link_count &= 0xf;
4758                         } else {
4759                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
4760                                 pmlmeinfo->link_count = 0;
4761                         }
4762                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
4763         } else if (is_client_associated_to_ibss(padapter)) {
4764                 /* linked IBSS mode */
4765                 /* for each assoc list entry to check the rx pkt counter */
4766                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
4767                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
4768                                 psta = pmlmeinfo->FW_sta_info[i].psta;
4769
4770                                 if (NULL == psta)
4771                                         continue;
4772                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
4773                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
4774                                                 pmlmeinfo->FW_sta_info[i].retry++;
4775                                         } else {
4776                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
4777                                                 pmlmeinfo->FW_sta_info[i].status = 0;
4778                                                 report_del_sta_event(padapter, psta->hwaddr
4779                                                         , 65535/*  indicate disconnect caused by no rx */
4780                                         );
4781                                         }
4782                                 } else {
4783                                         pmlmeinfo->FW_sta_info[i].retry = 0;
4784                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
4785                                 }
4786                         }
4787                 }
4788         }
4789 }
4790
4791 void survey_timer_hdl(unsigned long data)
4792 {
4793         struct adapter *padapter = (struct adapter *)data;
4794         struct cmd_obj  *ph2c;
4795         struct sitesurvey_parm  *psurveyPara;
4796         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
4797         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4798
4799         /* issue rtw_sitesurvey_cmd */
4800         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
4801                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
4802                         pmlmeext->sitesurvey_res.channel_idx++;
4803
4804                 if (pmlmeext->scan_abort) {
4805                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
4806                         DBG_88E("%s idx:%d\n", __func__
4807                                 , pmlmeext->sitesurvey_res.channel_idx);
4808
4809                         pmlmeext->scan_abort = false;/* reset */
4810                 }
4811
4812                 ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4813                 if (!ph2c)
4814                         goto exit_survey_timer_hdl;
4815
4816                 psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
4817                 if (!psurveyPara) {
4818                         kfree(ph2c);
4819                         goto exit_survey_timer_hdl;
4820                 }
4821
4822                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, _SiteSurvey_CMD_);
4823                 rtw_enqueue_cmd(pcmdpriv, ph2c);
4824         }
4825
4826
4827 exit_survey_timer_hdl:
4828         return;
4829 }
4830
4831 void link_timer_hdl(unsigned long data)
4832 {
4833         struct adapter *padapter = (struct adapter *)data;
4834         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4835         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4836
4837         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
4838                 DBG_88E("link_timer_hdl:no beacon while connecting\n");
4839                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4840                 report_join_res(padapter, -3);
4841         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
4842                 /* re-auth timer */
4843                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
4844                         pmlmeinfo->state = 0;
4845                         report_join_res(padapter, -1);
4846                         return;
4847                 }
4848
4849                 DBG_88E("link_timer_hdl: auth timeout and try again\n");
4850                 pmlmeinfo->auth_seq = 1;
4851                 issue_auth(padapter, NULL, 0);
4852                 set_link_timer(pmlmeext, REAUTH_TO);
4853         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
4854                 /* re-assoc timer */
4855                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
4856                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4857                         report_join_res(padapter, -2);
4858                         return;
4859                 }
4860
4861                 DBG_88E("link_timer_hdl: assoc timeout and try again\n");
4862                 issue_assocreq(padapter);
4863                 set_link_timer(pmlmeext, REASSOC_TO);
4864         }
4865 }
4866
4867 void addba_timer_hdl(unsigned long data)
4868 {
4869         struct sta_info *psta = (struct sta_info *)data;
4870         struct ht_priv  *phtpriv;
4871
4872         if (!psta)
4873                 return;
4874
4875         phtpriv = &psta->htpriv;
4876
4877         if ((phtpriv->ht_option) && (phtpriv->ampdu_enable)) {
4878                 if (phtpriv->candidate_tid_bitmap)
4879                         phtpriv->candidate_tid_bitmap = 0x0;
4880         }
4881 }
4882
4883 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
4884 {
4885         u8 type;
4886         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4887         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4888         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
4889
4890         if (psetop->mode == Ndis802_11APMode) {
4891                 pmlmeinfo->state = WIFI_FW_AP_STATE;
4892                 type = _HW_STATE_AP_;
4893         } else if (psetop->mode == Ndis802_11Infrastructure) {
4894                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
4895                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
4896                 type = _HW_STATE_STATION_;
4897         } else if (psetop->mode == Ndis802_11IBSS) {
4898                 type = _HW_STATE_ADHOC_;
4899         } else {
4900                 type = _HW_STATE_NOLINK_;
4901         }
4902
4903         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
4904         /* Set_NETYPE0_MSR(padapter, type); */
4905
4906         return H2C_SUCCESS;
4907 }
4908
4909 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
4910 {
4911         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4912         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4913         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4914         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4915         /* u32  initialgain; */
4916
4917
4918         if (pparm->InfrastructureMode == Ndis802_11APMode) {
4919 #ifdef CONFIG_88EU_AP_MODE
4920
4921                 if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
4922                         /* todo: */
4923                         return H2C_SUCCESS;
4924                 }
4925 #endif
4926         }
4927
4928         /* below is for ad-hoc master */
4929         if (pparm->InfrastructureMode == Ndis802_11IBSS) {
4930                 rtw_joinbss_reset(padapter);
4931
4932                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4933                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4934                 pmlmeinfo->ERP_enable = 0;
4935                 pmlmeinfo->WMM_enable = 0;
4936                 pmlmeinfo->HT_enable = 0;
4937                 pmlmeinfo->HT_caps_enable = 0;
4938                 pmlmeinfo->HT_info_enable = 0;
4939                 pmlmeinfo->agg_enable_bitmap = 0;
4940                 pmlmeinfo->candidate_tid_bitmap = 0;
4941
4942                 /* disable dynamic functions, such as high power, DIG */
4943                 Save_DM_Func_Flag(padapter);
4944                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
4945
4946                 /* config the initial gain under linking, need to write the BB registers */
4947                 /* initialgain = 0x1E; */
4948                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
4949
4950                 /* cancel link timer */
4951                 del_timer_sync(&pmlmeext->link_timer);
4952
4953                 /* clear CAM */
4954                 flush_all_cam_entry(padapter);
4955
4956                 memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, IELength));
4957                 pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
4958
4959                 if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
4960                         return H2C_PARAMETERS_ERROR;
4961
4962                 memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
4963
4964                 start_create_ibss(padapter);
4965         }
4966
4967         return H2C_SUCCESS;
4968 }
4969
4970 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
4971 {
4972         u8 join_type;
4973         struct ndis_802_11_var_ie *pIE;
4974         struct registry_priv    *pregpriv = &padapter->registrypriv;
4975         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4976         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4977         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4978         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4979         u32 i;
4980
4981         /* check already connecting to AP or not */
4982         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
4983                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
4984                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
4985
4986                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4987
4988                 /* clear CAM */
4989                 flush_all_cam_entry(padapter);
4990
4991                 del_timer_sync(&pmlmeext->link_timer);
4992
4993                 /* set MSR to nolink -> infra. mode */
4994                 Set_MSR(padapter, _HW_STATE_STATION_);
4995
4996
4997                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4998         }
4999
5000         rtw_antenna_select_cmd(padapter, pparm->PhyInfo.Optimum_antenna, false);
5001
5002         rtw_joinbss_reset(padapter);
5003
5004         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5005         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5006         pmlmeinfo->ERP_enable = 0;
5007         pmlmeinfo->WMM_enable = 0;
5008         pmlmeinfo->HT_enable = 0;
5009         pmlmeinfo->HT_caps_enable = 0;
5010         pmlmeinfo->HT_info_enable = 0;
5011         pmlmeinfo->agg_enable_bitmap = 0;
5012         pmlmeinfo->candidate_tid_bitmap = 0;
5013         pmlmeinfo->bwmode_updated = false;
5014
5015         memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, IELength));
5016         pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
5017
5018         if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
5019                 return H2C_PARAMETERS_ERROR;
5020
5021         memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
5022
5023         /* Check AP vendor to move rtw_joinbss_cmd() */
5024
5025         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pnetwork->IELength;) {
5026                 pIE = (struct ndis_802_11_var_ie *)(pnetwork->IEs + i);
5027
5028                 switch (pIE->ElementID) {
5029                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
5030                         if (!memcmp(pIE->data, WMM_OUI, 4))
5031                                 pmlmeinfo->WMM_enable = 1;
5032                         break;
5033                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
5034                         pmlmeinfo->HT_caps_enable = 1;
5035                         break;
5036                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
5037                         pmlmeinfo->HT_info_enable = 1;
5038
5039                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5040                         {
5041                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5042
5043                                 if ((pregpriv->cbw40_enable) &&  (pht_info->infos[0] & BIT(2))) {
5044                                         /* switch to the 40M Hz mode according to the AP */
5045                                         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
5046                                         switch (pht_info->infos[0] & 0x3) {
5047                                         case 1:
5048                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5049                                                 break;
5050                                         case 3:
5051                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5052                                                 break;
5053                                         default:
5054                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5055                                                 break;
5056                                 }
5057
5058                                         DBG_88E("set ch/bw before connected\n");
5059                                 }
5060                         }
5061                         break;
5062                 default:
5063                         break;
5064                 }
5065
5066                 i += (pIE->Length + 2);
5067         }
5068         /* disable dynamic functions, such as high power, DIG */
5069
5070         /* config the initial gain under linking, need to write the BB registers */
5071
5072         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
5073         join_type = 0;
5074         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5075
5076         /* cancel link timer */
5077         del_timer_sync(&pmlmeext->link_timer);
5078
5079         start_clnt_join(padapter);
5080
5081         return H2C_SUCCESS;
5082 }
5083
5084 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5085 {
5086         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5087         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5088         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5089         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5090         u8 val8;
5091
5092         if (is_client_associated_to_ap(padapter))
5093                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5094
5095         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5096         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5097
5098         /* restore to initial setting. */
5099         update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
5100
5101         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5102                 /* Stop BCN */
5103                 val8 = 0;
5104                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5105         }
5106
5107
5108         /* set MSR to no link state -> infra. mode */
5109         Set_MSR(padapter, _HW_STATE_STATION_);
5110
5111         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5112
5113         /* switch to the 20M Hz mode after disconnect */
5114         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5115         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5116
5117         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5118
5119         flush_all_cam_entry(padapter);
5120
5121         del_timer_sync(&pmlmeext->link_timer);
5122
5123         rtw_free_uc_swdec_pending_queue(padapter);
5124
5125         return  H2C_SUCCESS;
5126 }
5127
5128 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
5129         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
5130 {
5131         int i, j;
5132         int set_idx;
5133         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5134
5135         /* clear out first */
5136         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5137
5138         /* acquire channels from in */
5139         j = 0;
5140         for (i = 0; i < in_num; i++) {
5141                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5142                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED) &&
5143                     set_idx >= 0) {
5144                         out[j] = in[i];
5145
5146                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5147                                 out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5148
5149                         j++;
5150                 }
5151                 if (j >= out_num)
5152                         break;
5153         }
5154
5155         /* if out is empty, use channel_set as default */
5156         if (j == 0) {
5157                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5158                         out[i].hw_value = pmlmeext->channel_set[i].ChannelNum;
5159
5160                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5161                                 out[i].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5162
5163                         j++;
5164                 }
5165         }
5166
5167         return j;
5168 }
5169
5170 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5171 {
5172         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5173         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5174         u8 bdelayscan = false;
5175         u8 val8;
5176         u32     initialgain;
5177         u32     i;
5178
5179         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5180                 /* for first time sitesurvey_cmd */
5181                 rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, NULL);
5182
5183                 pmlmeext->sitesurvey_res.state = SCAN_START;
5184                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5185                 pmlmeext->sitesurvey_res.channel_idx = 0;
5186
5187                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5188                         if (pparm->ssid[i].SsidLength) {
5189                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
5190                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = pparm->ssid[i].SsidLength;
5191                         } else {
5192                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = 0;
5193                         }
5194                 }
5195
5196                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5197                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5198                         , pparm->ch, pparm->ch_num
5199         );
5200
5201                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5202
5203                 /* issue null data if associating to the AP */
5204                 if (is_client_associated_to_ap(padapter)) {
5205                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5206
5207                         issue_nulldata(padapter, NULL, 1, 3, 500);
5208
5209                         bdelayscan = true;
5210                 }
5211                 if (bdelayscan) {
5212                         /* delay 50ms to protect nulldata(1). */
5213                         set_survey_timer(pmlmeext, 50);
5214                         return H2C_SUCCESS;
5215                 }
5216         }
5217
5218         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5219                 /* disable dynamic functions, such as high power, DIG */
5220                 Save_DM_Func_Flag(padapter);
5221                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5222
5223                 /* config the initial gain under scanning, need to write the BB registers */
5224                 initialgain = 0x1E;
5225
5226                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5227
5228                 /* set MSR to no link state */
5229                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5230
5231                 val8 = 1; /* under site survey */
5232                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5233
5234                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5235         }
5236
5237         site_survey(padapter);
5238
5239         return H2C_SUCCESS;
5240 }
5241
5242 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5243 {
5244         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5245         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5246         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5247
5248         if (pparm->mode < 4)
5249                 pmlmeinfo->auth_algo = pparm->mode;
5250         return  H2C_SUCCESS;
5251 }
5252
5253 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5254 {
5255         unsigned short                          ctrl;
5256         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5257         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5258         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5259         unsigned char                                   null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5260
5261         /* main tx key for wep. */
5262         if (pparm->set_tx)
5263                 pmlmeinfo->key_index = pparm->keyid;
5264
5265         /* write cam */
5266         ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5267
5268         DBG_88E_LEVEL(_drv_info_, "set group key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) "
5269                         "keyid:%d\n", pparm->algorithm, pparm->keyid);
5270         write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
5271
5272         return H2C_SUCCESS;
5273 }
5274
5275 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5276 {
5277         u16 ctrl = 0;
5278         u8 cam_id;/* cam_entry */
5279         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5280         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5281         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5282
5283         /* cam_entry: */
5284         /* 0~3 for default key */
5285
5286         /* for concurrent mode (ap+sta): */
5287         /* default key is disable, using sw encrypt/decrypt */
5288         /* cam_entry = 4 for sta mode (macid = 0) */
5289         /* cam_entry(macid+3) = 5 ~ N for ap mode (aid = 1~N, macid = 2 ~N) */
5290
5291         /* for concurrent mode (sta+sta): */
5292         /* default key is disable, using sw encrypt/decrypt */
5293         /* cam_entry = 4 mapping to macid = 0 */
5294         /* cam_entry = 5 mapping to macid = 2 */
5295
5296         cam_id = 4;
5297
5298         DBG_88E_LEVEL(_drv_info_, "set pairwise key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) camid:%d\n",
5299                       pparm->algorithm, cam_id);
5300         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
5301                 struct sta_info *psta;
5302                 struct sta_priv *pstapriv = &padapter->stapriv;
5303
5304                 if (pparm->algorithm == _NO_PRIVACY_)   /*  clear cam entry */ {
5305                         clear_cam_entry(padapter, pparm->id);
5306                         return H2C_SUCCESS_RSP;
5307                 }
5308
5309                 psta = rtw_get_stainfo(pstapriv, pparm->addr);
5310                 if (psta) {
5311                         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5312
5313                         DBG_88E("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
5314
5315                         if ((psta->mac_id < 1) || (psta->mac_id > (NUM_STA-4))) {
5316                                 DBG_88E("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
5317                                 return H2C_REJECTED;
5318                         }
5319
5320                         cam_id = psta->mac_id + 3;/* 0~3 for default key, cmd_id = macid + 3, macid = aid+1; */
5321
5322                         DBG_88E("Write CAM, mac_addr =%pM, cam_entry=%d\n",
5323                                 pparm->addr, cam_id);
5324
5325                         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5326
5327                         return H2C_SUCCESS_RSP;
5328                 } else {
5329                         DBG_88E("r871x_set_stakey_hdl(): sta has been free\n");
5330                         return H2C_REJECTED;
5331                 }
5332         }
5333
5334         /* below for sta mode */
5335
5336         if (pparm->algorithm == _NO_PRIVACY_) { /*  clear cam entry */
5337                 clear_cam_entry(padapter, pparm->id);
5338                 return H2C_SUCCESS;
5339         }
5340         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5341         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5342         pmlmeinfo->enc_algo = pparm->algorithm;
5343         return H2C_SUCCESS;
5344 }
5345
5346 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5347 {
5348         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5349         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5350         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5351
5352         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5353
5354         if (!psta)
5355                 return  H2C_SUCCESS;
5356
5357         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5358             ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5359                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5360                 mod_timer(&psta->addba_retry_timer,
5361                           jiffies + msecs_to_jiffies(ADDBA_TO));
5362         } else {
5363                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5364         }
5365         return  H2C_SUCCESS;
5366 }
5367
5368 u8 set_tx_beacon_cmd(struct adapter *padapter)
5369 {
5370         struct cmd_obj  *ph2c;
5371         struct wlan_bssid_ex    *ptxBeacon_parm;
5372         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5373         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5374         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5375         u8 res = _SUCCESS;
5376         int len_diff = 0;
5377
5378
5379         ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
5380         if (!ph2c) {
5381                 res = _FAIL;
5382                 goto exit;
5383         }
5384
5385         ptxBeacon_parm = kmemdup(&(pmlmeinfo->network),
5386                                 sizeof(struct wlan_bssid_ex), GFP_KERNEL);
5387         if (ptxBeacon_parm == NULL) {
5388                 kfree(ph2c);
5389                 res = _FAIL;
5390                 goto exit;
5391         }
5392
5393         len_diff = update_hidden_ssid(ptxBeacon_parm->IEs+_BEACON_IE_OFFSET_,
5394                                       ptxBeacon_parm->IELength-_BEACON_IE_OFFSET_,
5395                                       pmlmeinfo->hidden_ssid_mode);
5396         ptxBeacon_parm->IELength += len_diff;
5397
5398         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, _TX_Beacon_CMD_);
5399
5400         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5401
5402
5403 exit:
5404
5405
5406         return res;
5407 }
5408
5409 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5410 {
5411         u8 evt_code;
5412         u16 evt_sz;
5413         uint    *peventbuf;
5414         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5415
5416         peventbuf = (uint *)pbuf;
5417         evt_sz = (u16)(*peventbuf&0xffff);
5418         evt_code = (u8)((*peventbuf>>16)&0xff);
5419
5420         /*  checking if event code is valid */
5421         if (evt_code >= MAX_C2HEVT) {
5422                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
5423                 goto _abort_event_;
5424         }
5425
5426         /*  checking if event size match the event parm size */
5427         if ((wlanevents[evt_code].parmsize != 0) &&
5428             (wlanevents[evt_code].parmsize != evt_sz)) {
5429                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_,
5430                          ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
5431                          evt_code, wlanevents[evt_code].parmsize, evt_sz));
5432                 goto _abort_event_;
5433         }
5434
5435         peventbuf += 2;
5436
5437         if (peventbuf) {
5438                 event_callback = wlanevents[evt_code].event_callback;
5439                 event_callback(padapter, (u8 *)peventbuf);
5440
5441         }
5442
5443 _abort_event_:
5444         return H2C_SUCCESS;
5445 }
5446
5447 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5448 {
5449         if (send_beacon(padapter) == _FAIL) {
5450                 DBG_88E("issue_beacon, fail!\n");
5451                 return H2C_PARAMETERS_ERROR;
5452         }
5453 #ifdef CONFIG_88EU_AP_MODE
5454         else { /* tx bc/mc frames after update TIM */
5455                 struct sta_info *psta_bmc;
5456                 struct list_head *xmitframe_plist, *xmitframe_phead;
5457                 struct xmit_frame *pxmitframe = NULL;
5458                 struct sta_priv  *pstapriv = &padapter->stapriv;
5459
5460                 /* for BC/MC Frames */
5461                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
5462                 if (!psta_bmc)
5463                         return H2C_SUCCESS;
5464
5465                 if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5466                         msleep(10);/*  10ms, ATIM(HIQ) Windows */
5467                         spin_lock_bh(&psta_bmc->sleep_q.lock);
5468
5469                         xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5470                         xmitframe_plist = xmitframe_phead->next;
5471
5472                         while (xmitframe_phead != xmitframe_plist) {
5473                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
5474
5475                                 xmitframe_plist = xmitframe_plist->next;
5476
5477                                 list_del_init(&pxmitframe->list);
5478
5479                                 psta_bmc->sleepq_len--;
5480                                 if (psta_bmc->sleepq_len > 0)
5481                                         pxmitframe->attrib.mdata = 1;
5482                                 else
5483                                         pxmitframe->attrib.mdata = 0;
5484
5485                                 pxmitframe->attrib.triggered = 1;
5486
5487                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5488
5489                                 spin_unlock_bh(&psta_bmc->sleep_q.lock);
5490                                 if (rtw_hal_xmit(padapter, pxmitframe))
5491                                         rtw_os_xmit_complete(padapter, pxmitframe);
5492                                 spin_lock_bh(&psta_bmc->sleep_q.lock);
5493                         }
5494                         spin_unlock_bh(&psta_bmc->sleep_q.lock);
5495                 }
5496         }
5497 #endif
5498         return H2C_SUCCESS;
5499 }
5500
5501 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5502 {
5503         struct set_ch_parm *set_ch_parm;
5504         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5505
5506         if (!pbuf)
5507                 return H2C_PARAMETERS_ERROR;
5508
5509         set_ch_parm = (struct set_ch_parm *)pbuf;
5510
5511         DBG_88E(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
5512                 FUNC_NDEV_ARG(padapter->pnetdev),
5513                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
5514
5515         pmlmeext->cur_channel = set_ch_parm->ch;
5516         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5517         pmlmeext->cur_bwmode = set_ch_parm->bw;
5518
5519         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5520
5521         return  H2C_SUCCESS;
5522 }
5523
5524 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5525 {
5526         struct SetChannelPlan_param *setChannelPlan_param;
5527         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5528
5529         if (!pbuf)
5530                 return H2C_PARAMETERS_ERROR;
5531
5532         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5533
5534         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5535         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5536
5537         return  H2C_SUCCESS;
5538 }