drivers/staging/rtl8188eu/core/rtw_mlme_ext.c

   1 /******************************************************************************
   2  *
   3  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  ******************************************************************************/
  15 #define _RTW_MLME_EXT_C_
  16
  17 #include <linux/ieee80211.h>
  18 #include <asm/unaligned.h>
  19
  20 #include <osdep_service.h>
  21 #include <drv_types.h>
  22 #include <wifi.h>
  23 #include <rtw_mlme_ext.h>
  24 #include <wlan_bssdef.h>
  25 #include <mlme_osdep.h>
  26 #include <recv_osdep.h>
  27
  28 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  29
  30 /**************************************************
  31 OUI definitions for the vendor specific IE
  32 ***************************************************/
  33 unsigned char   RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  34 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  35 unsigned char   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  36 unsigned char   P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  37 unsigned char   WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  38
  39 unsigned char   WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  40 unsigned char   WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  41
  42 unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
  43 unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
  44
  45 extern unsigned char REALTEK_96B_IE[];
  46
  47 /********************************************************
  48 MCS rate definitions
  49 *********************************************************/
  50 unsigned char   MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  51 unsigned char   MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  52
  53 /********************************************************
  54 ChannelPlan definitions
  55 *********************************************************/
  56 static struct rt_channel_plan_2g RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  57         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  58         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  59         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  60         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  61         {{10, 11, 12, 13}, 4},                                  /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  62         {{}, 0},                                                                        /*  0x05, RT_CHANNEL_DOMAIN_2G_NULL */
  63 };
  64
  65 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  66         /*  0x00 ~ 0x1F , Old Define ===== */
  67         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  68         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  69         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  70         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  71         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  72         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  73         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  74         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  75         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  76         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  77         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  78         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  79         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  80         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  81         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  82         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  83         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
  84         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
  85         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  86         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
  87         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
  88         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
  89         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
  90         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  91         {0x05}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
  92         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
  93         {0x00}, /* 0x1A, */
  94         {0x00}, /* 0x1B, */
  95         {0x00}, /* 0x1C, */
  96         {0x00}, /* 0x1D, */
  97         {0x00}, /* 0x1E, */
  98         {0x05}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
  99         /*  0x20 ~ 0x7F , New Define ===== */
 100         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 101         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 102         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 103         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 104         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 105         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 106         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 107         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 108         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 109         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 110         {0x00}, /* 0x2A, */
 111         {0x00}, /* 0x2B, */
 112         {0x00}, /* 0x2C, */
 113         {0x00}, /* 0x2D, */
 114         {0x00}, /* 0x2E, */
 115         {0x00}, /* 0x2F, */
 116         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 117         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 118         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 119         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 120         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 121         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 122         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 123         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 124         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 125         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 126         {0x00}, /* 0x3A, */
 127         {0x00}, /* 0x3B, */
 128         {0x00}, /* 0x3C, */
 129         {0x00}, /* 0x3D, */
 130         {0x00}, /* 0x3E, */
 131         {0x00}, /* 0x3F, */
 132         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 133         {0x03}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G */
 134 };
 135
 136 static const struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {
 137         0x03
 138 }; /* use the combination for max channel numbers */
 139
 140 /*
 141  * Search the @param channel_num in given @param channel_set
 142  * @ch_set: the given channel set
 143  * @ch: the given channel number
 144  *
 145  * return the index of channel_num in channel_set, -1 if not found
 146  */
 147 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 148 {
 149         int i;
 150
 151         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 152                 if (ch == ch_set[i].ChannelNum)
 153                         break;
 154         }
 155
 156         if (i >= ch_set[i].ChannelNum)
 157                 return -1;
 158         return i;
 159 }
 160
 161 struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
 162 {
 163         struct xmit_frame                       *pmgntframe;
 164         struct xmit_buf                         *pxmitbuf;
 165
 166         pmgntframe = rtw_alloc_xmitframe(pxmitpriv);
 167         if (pmgntframe == NULL) {
 168                 DBG_88E("%s, alloc xmitframe fail\n", __func__);
 169                 return NULL;
 170         }
 171
 172         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
 173         if (pxmitbuf == NULL) {
 174                 DBG_88E("%s, alloc xmitbuf fail\n", __func__);
 175                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
 176                 return NULL;
 177         }
 178         pmgntframe->frame_tag = MGNT_FRAMETAG;
 179         pmgntframe->pxmitbuf = pxmitbuf;
 180         pmgntframe->buf_addr = pxmitbuf->pbuf;
 181         pxmitbuf->priv_data = pmgntframe;
 182         return pmgntframe;
 183 }
 184
 185 /****************************************************************************
 186
 187 Following are some TX functions for WiFi MLME
 188
 189 *****************************************************************************/
 190
 191 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
 192 {
 193         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 194
 195         pmlmeext->tx_rate = rate;
 196         DBG_88E("%s(): rate = %x\n", __func__, rate);
 197 }
 198
 199 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
 200 {
 201         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 202
 203         memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
 204
 205         pattrib->hdrlen = 24;
 206         pattrib->nr_frags = 1;
 207         pattrib->priority = 7;
 208         pattrib->mac_id = 0;
 209         pattrib->qsel = 0x12;
 210
 211         pattrib->pktlen = 0;
 212
 213         if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
 214                 pattrib->raid = 6;/* b mode */
 215         else
 216                 pattrib->raid = 5;/* a/g mode */
 217
 218         pattrib->encrypt = _NO_PRIVACY_;
 219         pattrib->bswenc = false;
 220
 221         pattrib->qos_en = false;
 222         pattrib->ht_en = false;
 223         pattrib->bwmode = HT_CHANNEL_WIDTH_20;
 224         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 225         pattrib->sgi = false;
 226
 227         pattrib->seqnum = pmlmeext->mgnt_seq;
 228
 229         pattrib->retry_ctrl = true;
 230 }
 231
 232 static void dump_mgntframe(struct adapter *padapter,
 233                            struct xmit_frame *pmgntframe)
 234 {
 235         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 236                 return;
 237
 238         rtw_hal_mgnt_xmit(padapter, pmgntframe);
 239 }
 240
 241 static s32 dump_mgntframe_and_wait(struct adapter *padapter,
 242                                    struct xmit_frame *pmgntframe,
 243                                    int timeout_ms)
 244 {
 245         s32 ret = _FAIL;
 246         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
 247         struct submit_ctx sctx;
 248
 249         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 250                 return ret;
 251
 252         rtw_sctx_init(&sctx, timeout_ms);
 253         pxmitbuf->sctx = &sctx;
 254
 255         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
 256
 257         if (ret == _SUCCESS)
 258                 ret = rtw_sctx_wait(&sctx);
 259
 260         return ret;
 261 }
 262
 263 static s32 dump_mgntframe_and_wait_ack(struct adapter *padapter,
 264                                        struct xmit_frame *pmgntframe)
 265 {
 266         s32 ret = _FAIL;
 267         u32 timeout_ms = 500;/*   500ms */
 268         struct xmit_priv        *pxmitpriv = &padapter->xmitpriv;
 269
 270         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 271                 return -1;
 272
 273         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex))
 274                 return _FAIL;
 275         pxmitpriv->ack_tx = true;
 276
 277         pmgntframe->ack_report = 1;
 278         if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS) {
 279                 ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
 280         }
 281
 282         pxmitpriv->ack_tx = false;
 283         mutex_unlock(&pxmitpriv->ack_tx_mutex);
 284
 285         return ret;
 286 }
 287
 288 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
 289 {
 290         u8 *ssid_ie;
 291         int ssid_len_ori;
 292         int len_diff = 0;
 293
 294         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
 295
 296         if (ssid_ie && ssid_len_ori > 0) {
 297                 switch (hidden_ssid_mode) {
 298                 case 1: {
 299                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
 300                         u32 remain_len = 0;
 301
 302                         remain_len = ies_len - (next_ie - ies);
 303
 304                         ssid_ie[1] = 0;
 305                         memcpy(ssid_ie+2, next_ie, remain_len);
 306                         len_diff -= ssid_len_ori;
 307
 308                         break;
 309                 }
 310                 case 2:
 311                         memset(&ssid_ie[2], 0, ssid_len_ori);
 312                         break;
 313                 default:
 314                         break;
 315                 }
 316         }
 317
 318         return len_diff;
 319 }
 320
 321 static void issue_beacon(struct adapter *padapter, int timeout_ms)
 322 {
 323         struct xmit_frame       *pmgntframe;
 324         struct pkt_attrib       *pattrib;
 325         unsigned char   *pframe;
 326         struct ieee80211_hdr *pwlanhdr;
 327         __le16 *fctrl;
 328         unsigned int    rate_len;
 329         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 330         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 331         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 332         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 333         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 334         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 335
 336         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 337         if (pmgntframe == NULL) {
 338                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 339                 return;
 340         }
 341 #if defined(CONFIG_88EU_AP_MODE)
 342         spin_lock_bh(&pmlmepriv->bcn_update_lock);
 343 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 344
 345         /* update attribute */
 346         pattrib = &pmgntframe->attrib;
 347         update_mgntframe_attrib(padapter, pattrib);
 348         pattrib->qsel = 0x10;
 349
 350         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 351
 352         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 353         pwlanhdr = (struct ieee80211_hdr *)pframe;
 354
 355
 356         fctrl = &pwlanhdr->frame_control;
 357         *(fctrl) = 0;
 358
 359         ether_addr_copy(pwlanhdr->addr1, bc_addr);
 360         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
 361         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
 362
 363         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
 364         /* pmlmeext->mgnt_seq++; */
 365         SetFrameSubType(pframe, WIFI_BEACON);
 366
 367         pframe += sizeof(struct ieee80211_hdr_3addr);
 368         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 369
 370         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 371                 int len_diff;
 372                 u8 *wps_ie;
 373                 uint wps_ielen;
 374                 u8 sr = 0;
 375
 376                 memcpy(pframe, cur_network->IEs, cur_network->IELength);
 377                 len_diff = update_hidden_ssid(
 378                         pframe+_BEACON_IE_OFFSET_
 379                         , cur_network->IELength-_BEACON_IE_OFFSET_
 380                         , pmlmeinfo->hidden_ssid_mode
 381                         );
 382                 pframe += (cur_network->IELength+len_diff);
 383                 pattrib->pktlen += (cur_network->IELength+len_diff);
 384                 wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
 385                         pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
 386                 if (wps_ie && wps_ielen > 0)
 387                         rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
 388                 if (sr != 0)
 389                         set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
 390                 else
 391                         _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
 392
 393                 goto _issue_bcn;
 394         }
 395
 396         /* below for ad-hoc mode */
 397
 398         /* timestamp will be inserted by hardware */
 399         pframe += 8;
 400         pattrib->pktlen += 8;
 401
 402         /*  beacon interval: 2 bytes */
 403
 404         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 405
 406         pframe += 2;
 407         pattrib->pktlen += 2;
 408
 409         /*  capability info: 2 bytes */
 410
 411         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 412
 413         pframe += 2;
 414         pattrib->pktlen += 2;
 415
 416         /*  SSID */
 417         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 418
 419         /*  supported rates... */
 420         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 421         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 422
 423         /*  DS parameter set */
 424         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 425
 426         {
 427                 u8 erpinfo = 0;
 428                 u32 ATIMWindow;
 429                 /*  IBSS Parameter Set... */
 430                 ATIMWindow = 0;
 431                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 432
 433                 /* ERP IE */
 434                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 435         }
 436
 437         /*  EXTERNDED SUPPORTED RATE */
 438         if (rate_len > 8)
 439                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 440         /* todo:HT for adhoc */
 441 _issue_bcn:
 442
 443 #if defined(CONFIG_88EU_AP_MODE)
 444         pmlmepriv->update_bcn = false;
 445
 446         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
 447 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 448
 449         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
 450                 DBG_88E("beacon frame too large\n");
 451                 return;
 452         }
 453
 454         pattrib->last_txcmdsz = pattrib->pktlen;
 455
 456         /* DBG_88E("issue bcn_sz=%d\n", pattrib->last_txcmdsz); */
 457         if (timeout_ms > 0)
 458                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
 459         else
 460                 dump_mgntframe(padapter, pmgntframe);
 461 }
 462
 463 static void issue_probersp(struct adapter *padapter, unsigned char *da)
 464 {
 465         struct xmit_frame                       *pmgntframe;
 466         struct pkt_attrib                       *pattrib;
 467         unsigned char                                   *pframe;
 468         struct ieee80211_hdr *pwlanhdr;
 469         __le16 *fctrl;
 470         unsigned char                                   *mac, *bssid;
 471         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 472 #if defined(CONFIG_88EU_AP_MODE)
 473         u8 *pwps_ie;
 474         uint wps_ielen;
 475         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 476 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 477         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 478         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 479         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 480         unsigned int    rate_len;
 481
 482         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 483         if (pmgntframe == NULL) {
 484                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 485                 return;
 486         }
 487
 488         /* update attribute */
 489         pattrib = &pmgntframe->attrib;
 490         update_mgntframe_attrib(padapter, pattrib);
 491
 492         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 493
 494         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 495         pwlanhdr = (struct ieee80211_hdr *)pframe;
 496
 497         mac = myid(&(padapter->eeprompriv));
 498         bssid = cur_network->MacAddress;
 499
 500         fctrl = &pwlanhdr->frame_control;
 501         *(fctrl) = 0;
 502         ether_addr_copy(pwlanhdr->addr1, da);
 503         ether_addr_copy(pwlanhdr->addr2, mac);
 504         ether_addr_copy(pwlanhdr->addr3, bssid);
 505
 506         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 507         pmlmeext->mgnt_seq++;
 508         SetFrameSubType(fctrl, WIFI_PROBERSP);
 509
 510         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 511         pattrib->pktlen = pattrib->hdrlen;
 512         pframe += pattrib->hdrlen;
 513
 514         if (cur_network->IELength > MAX_IE_SZ)
 515                 return;
 516
 517 #if defined(CONFIG_88EU_AP_MODE)
 518         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 519                 pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
 520
 521                 /* inerset & update wps_probe_resp_ie */
 522                 if ((pmlmepriv->wps_probe_resp_ie != NULL) && pwps_ie && (wps_ielen > 0)) {
 523                         uint wps_offset, remainder_ielen;
 524                         u8 *premainder_ie;
 525
 526                         wps_offset = (uint)(pwps_ie - cur_network->IEs);
 527
 528                         premainder_ie = pwps_ie + wps_ielen;
 529
 530                         remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
 531
 532                         memcpy(pframe, cur_network->IEs, wps_offset);
 533                         pframe += wps_offset;
 534                         pattrib->pktlen += wps_offset;
 535
 536                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
 537                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
 538                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
 539                                 pframe += wps_ielen+2;
 540                                 pattrib->pktlen += wps_ielen+2;
 541                         }
 542
 543                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
 544                                 memcpy(pframe, premainder_ie, remainder_ielen);
 545                                 pframe += remainder_ielen;
 546                                 pattrib->pktlen += remainder_ielen;
 547                         }
 548                 } else {
 549                         memcpy(pframe, cur_network->IEs, cur_network->IELength);
 550                         pframe += cur_network->IELength;
 551                         pattrib->pktlen += cur_network->IELength;
 552                 }
 553         } else
 554 #endif
 555         {
 556                 /* timestamp will be inserted by hardware */
 557                 pframe += 8;
 558                 pattrib->pktlen += 8;
 559
 560                 /*  beacon interval: 2 bytes */
 561
 562                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 563
 564                 pframe += 2;
 565                 pattrib->pktlen += 2;
 566
 567                 /*  capability info: 2 bytes */
 568
 569                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 570
 571                 pframe += 2;
 572                 pattrib->pktlen += 2;
 573
 574                 /* below for ad-hoc mode */
 575
 576                 /*  SSID */
 577                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 578
 579                 /*  supported rates... */
 580                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 581                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 582
 583                 /*  DS parameter set */
 584                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 585
 586                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 587                         u8 erpinfo = 0;
 588                         u32 ATIMWindow;
 589                         /*  IBSS Parameter Set... */
 590                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
 591                         ATIMWindow = 0;
 592                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 593
 594                         /* ERP IE */
 595                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 596                 }
 597
 598
 599                 /*  EXTERNDED SUPPORTED RATE */
 600                 if (rate_len > 8)
 601                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 602                 /* todo:HT for adhoc */
 603         }
 604
 605         pattrib->last_txcmdsz = pattrib->pktlen;
 606
 607         dump_mgntframe(padapter, pmgntframe);
 608 }
 609
 610 static int issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, bool wait_ack)
 611 {
 612         int ret = _FAIL;
 613         struct xmit_frame               *pmgntframe;
 614         struct pkt_attrib               *pattrib;
 615         unsigned char                   *pframe;
 616         struct ieee80211_hdr *pwlanhdr;
 617         __le16 *fctrl;
 618         unsigned char                   *mac;
 619         unsigned char                   bssrate[NumRates];
 620         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
 621         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 622         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 623         int     bssrate_len = 0;
 624         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 625
 626         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+issue_probereq\n"));
 627
 628         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 629         if (pmgntframe == NULL)
 630                 goto exit;
 631
 632         /* update attribute */
 633         pattrib = &pmgntframe->attrib;
 634         update_mgntframe_attrib(padapter, pattrib);
 635
 636
 637         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 638
 639         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 640         pwlanhdr = (struct ieee80211_hdr *)pframe;
 641
 642         mac = myid(&(padapter->eeprompriv));
 643
 644         fctrl = &pwlanhdr->frame_control;
 645         *(fctrl) = 0;
 646
 647         if (da) {
 648                 /*      unicast probe request frame */
 649                 ether_addr_copy(pwlanhdr->addr1, da);
 650                 ether_addr_copy(pwlanhdr->addr3, da);
 651         } else {
 652                 /*      broadcast probe request frame */
 653                 ether_addr_copy(pwlanhdr->addr1, bc_addr);
 654                 ether_addr_copy(pwlanhdr->addr3, bc_addr);
 655         }
 656
 657         ether_addr_copy(pwlanhdr->addr2, mac);
 658
 659         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 660         pmlmeext->mgnt_seq++;
 661         SetFrameSubType(pframe, WIFI_PROBEREQ);
 662
 663         pframe += sizeof(struct ieee80211_hdr_3addr);
 664         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 665
 666         if (pssid)
 667                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
 668         else
 669                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
 670
 671         get_rate_set(padapter, bssrate, &bssrate_len);
 672
 673         if (bssrate_len > 8) {
 674                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
 675                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
 676         } else {
 677                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
 678         }
 679
 680         /* add wps_ie for wps2.0 */
 681         if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
 682                 memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
 683                 pframe += pmlmepriv->wps_probe_req_ie_len;
 684                 pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
 685         }
 686
 687         pattrib->last_txcmdsz = pattrib->pktlen;
 688
 689         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
 690                  ("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
 691
 692         if (wait_ack) {
 693                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
 694         } else {
 695                 dump_mgntframe(padapter, pmgntframe);
 696                 ret = _SUCCESS;
 697         }
 698
 699 exit:
 700         return ret;
 701 }
 702
 703 static int issue_probereq_ex(struct adapter *padapter,
 704                              struct ndis_802_11_ssid *pssid, u8 *da,
 705                              int try_cnt, int wait_ms)
 706 {
 707         int ret;
 708         int i = 0;
 709         unsigned long start = jiffies;
 710
 711         do {
 712                 ret = issue_probereq(padapter, pssid, da, wait_ms > 0 ? true : false);
 713
 714                 i++;
 715
 716                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
 717                         break;
 718
 719                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
 720                         msleep(wait_ms);
 721
 722         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
 723
 724         if (ret != _FAIL) {
 725                 ret = _SUCCESS;
 726                 goto exit;
 727         }
 728
 729         if (try_cnt && wait_ms) {
 730                 if (da)
 731                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
 732                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
 733                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 734                                 jiffies_to_msecs(jiffies - start));
 735                 else
 736                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
 737                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
 738                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 739                                 jiffies_to_msecs(jiffies - start));
 740         }
 741 exit:
 742         return ret;
 743 }
 744
 745 /*  if psta == NULL, indicate we are station(client) now... */
 746 static void issue_auth(struct adapter *padapter, struct sta_info *psta,
 747                        unsigned short status)
 748 {
 749         struct xmit_frame *pmgntframe;
 750         struct pkt_attrib *pattrib;
 751         unsigned char *pframe;
 752         struct ieee80211_hdr *pwlanhdr;
 753         __le16 *fctrl;
 754         unsigned int val32;
 755         u16 val16;
 756 #ifdef CONFIG_88EU_AP_MODE
 757         __le16 le_val16;
 758 #endif
 759         int use_shared_key = 0;
 760         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 761         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 762         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 763         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
 764
 765         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 766         if (pmgntframe == NULL)
 767                 return;
 768
 769         /* update attribute */
 770         pattrib = &pmgntframe->attrib;
 771         update_mgntframe_attrib(padapter, pattrib);
 772
 773         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 774
 775         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 776         pwlanhdr = (struct ieee80211_hdr *)pframe;
 777
 778         fctrl = &pwlanhdr->frame_control;
 779         *(fctrl) = 0;
 780
 781         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 782         pmlmeext->mgnt_seq++;
 783         SetFrameSubType(pframe, WIFI_AUTH);
 784
 785         pframe += sizeof(struct ieee80211_hdr_3addr);
 786         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 787
 788
 789         if (psta) {/*  for AP mode */
 790 #ifdef CONFIG_88EU_AP_MODE
 791
 792                 ether_addr_copy(pwlanhdr->addr1, psta->hwaddr);
 793                 ether_addr_copy(pwlanhdr->addr2,
 794                                 myid(&(padapter->eeprompriv)));
 795                 ether_addr_copy(pwlanhdr->addr3,
 796                                 myid(&(padapter->eeprompriv)));
 797
 798
 799                 /*  setting auth algo number */
 800                 val16 = (u16)psta->authalg;
 801
 802                 if (status != _STATS_SUCCESSFUL_)
 803                         val16 = 0;
 804
 805                 if (val16) {
 806                         le_val16 = cpu_to_le16(val16);
 807                         use_shared_key = 1;
 808                 } else {
 809                         le_val16 = 0;
 810                 }
 811
 812                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_val16,
 813                                           &pattrib->pktlen);
 814
 815                 /*  setting auth seq number */
 816                 val16 = (u16)psta->auth_seq;
 817                 le_val16 = cpu_to_le16(val16);
 818                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_val16,
 819                                           &pattrib->pktlen);
 820
 821                 /*  setting status code... */
 822                 val16 = status;
 823                 le_val16 = cpu_to_le16(val16);
 824                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_,
 825                                           &le_val16, &pattrib->pktlen);
 826
 827                 /*  added challenging text... */
 828                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
 829                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
 830 #endif
 831         } else {
 832                 __le32 le_tmp32;
 833                 __le16 le_tmp16;
 834
 835                 ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
 836                 ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
 837                 ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
 838
 839                 /*  setting auth algo number */
 840                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
 841                 if (val16)
 842                         use_shared_key = 1;
 843
 844                 /* setting IV for auth seq #3 */
 845                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 846                         val32 = (pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30);
 847                         le_tmp32 = cpu_to_le32(val32);
 848                         pframe = rtw_set_fixed_ie(pframe, 4, &le_tmp32,
 849                                                   &pattrib->pktlen);
 850
 851                         pattrib->iv_len = 4;
 852                 }
 853
 854                 le_tmp16 = cpu_to_le16(val16);
 855                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_tmp16,
 856                                           &pattrib->pktlen);
 857
 858                 /*  setting auth seq number */
 859                 val16 = pmlmeinfo->auth_seq;
 860                 le_tmp16 = cpu_to_le16(val16);
 861                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_tmp16,
 862                                           &pattrib->pktlen);
 863
 864
 865                 /*  setting status code... */
 866                 le_tmp16 = cpu_to_le16(status);
 867                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &le_tmp16,
 868                                           &pattrib->pktlen);
 869
 870                 /*  then checking to see if sending challenging text... */
 871                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 872                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
 873
 874                         SetPrivacy(fctrl);
 875
 876                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 877
 878                         pattrib->encrypt = _WEP40_;
 879
 880                         pattrib->icv_len = 4;
 881
 882                         pattrib->pktlen += pattrib->icv_len;
 883                 }
 884         }
 885
 886         pattrib->last_txcmdsz = pattrib->pktlen;
 887
 888         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
 889         DBG_88E("%s\n", __func__);
 890         dump_mgntframe(padapter, pmgntframe);
 891 }
 892
 893
 894 #ifdef CONFIG_88EU_AP_MODE
 895 static void issue_asocrsp(struct adapter *padapter, unsigned short status,
 896                           struct sta_info *pstat, int pkt_type)
 897 {
 898         struct xmit_frame       *pmgntframe;
 899         struct ieee80211_hdr *pwlanhdr;
 900         struct pkt_attrib *pattrib;
 901         unsigned char   *pbuf, *pframe;
 902         unsigned short val;
 903         __le16 *fctrl;
 904         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 905         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 906         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 907         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 908         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
 909         u8 *ie = pnetwork->IEs;
 910         __le16 lestatus, leval;
 911
 912         DBG_88E("%s\n", __func__);
 913
 914         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 915         if (pmgntframe == NULL)
 916                 return;
 917
 918         /* update attribute */
 919         pattrib = &pmgntframe->attrib;
 920         update_mgntframe_attrib(padapter, pattrib);
 921
 922
 923         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 924
 925         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 926         pwlanhdr = (struct ieee80211_hdr *)pframe;
 927
 928         fctrl = &pwlanhdr->frame_control;
 929         *(fctrl) = 0;
 930
 931         ether_addr_copy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr);
 932         ether_addr_copy((void *)GetAddr2Ptr(pwlanhdr),
 933                         myid(&(padapter->eeprompriv)));
 934         ether_addr_copy((void *)GetAddr3Ptr(pwlanhdr), pnetwork->MacAddress);
 935
 936
 937         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 938         pmlmeext->mgnt_seq++;
 939         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
 940                 SetFrameSubType(pwlanhdr, pkt_type);
 941         else
 942                 return;
 943
 944         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 945         pattrib->pktlen += pattrib->hdrlen;
 946         pframe += pattrib->hdrlen;
 947
 948         /* capability */
 949         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
 950
 951         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, &val, &pattrib->pktlen);
 952
 953         lestatus = cpu_to_le16(status);
 954         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &lestatus,
 955                                   &pattrib->pktlen);
 956
 957         leval = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
 958         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, &leval, &pattrib->pktlen);
 959
 960         if (pstat->bssratelen <= 8) {
 961                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
 962         } else {
 963                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
 964                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
 965         }
 966
 967         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
 968                 uint ie_len = 0;
 969
 970                 /* FILL HT CAP INFO IE */
 971                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 972                 if (pbuf && ie_len > 0) {
 973                         memcpy(pframe, pbuf, ie_len+2);
 974                         pframe += (ie_len+2);
 975                         pattrib->pktlen += (ie_len+2);
 976                 }
 977
 978                 /* FILL HT ADD INFO IE */
 979                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 980                 if (pbuf && ie_len > 0) {
 981                         memcpy(pframe, pbuf, ie_len+2);
 982                         pframe += (ie_len+2);
 983                         pattrib->pktlen += (ie_len+2);
 984                 }
 985         }
 986
 987         /* FILL WMM IE */
 988         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
 989                 uint ie_len = 0;
 990                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
 991
 992                 for (pbuf = ie + _BEACON_IE_OFFSET_;; pbuf += (ie_len + 2)) {
 993                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
 994                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
 995                                 memcpy(pframe, pbuf, ie_len+2);
 996                                 pframe += (ie_len+2);
 997                                 pattrib->pktlen += (ie_len+2);
 998                                 break;
 999                         }
1000
1001                         if ((pbuf == NULL) || (ie_len == 0))
1002                                 break;
1003                 }
1004         }
1005
1006         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1007                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
1008
1009         /* add WPS IE ie for wps 2.0 */
1010         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
1011                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
1012
1013                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
1014                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
1015         }
1016
1017         pattrib->last_txcmdsz = pattrib->pktlen;
1018         dump_mgntframe(padapter, pmgntframe);
1019 }
1020 #endif /* CONFIG_88EU_AP_MODE */
1021
1022 static void issue_assocreq(struct adapter *padapter)
1023 {
1024         int ret = _FAIL;
1025         struct xmit_frame       *pmgntframe;
1026         struct pkt_attrib       *pattrib;
1027         unsigned char           *pframe, *p;
1028         struct ieee80211_hdr *pwlanhdr;
1029         __le16 *fctrl;
1030         unsigned int    i, j, ie_len, index = 0;
1031         unsigned char   rf_type, bssrate[NumRates], sta_bssrate[NumRates];
1032         struct ndis_802_11_var_ie *pIE;
1033         struct registry_priv    *pregpriv = &padapter->registrypriv;
1034         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
1035         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1036         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1037         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1038         int     bssrate_len = 0, sta_bssrate_len = 0;
1039         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1040
1041         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1042         if (pmgntframe == NULL)
1043                 goto exit;
1044
1045         /* update attribute */
1046         pattrib = &pmgntframe->attrib;
1047         update_mgntframe_attrib(padapter, pattrib);
1048
1049         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1050         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1051         pwlanhdr = (struct ieee80211_hdr *)pframe;
1052
1053         fctrl = &pwlanhdr->frame_control;
1054         *(fctrl) = 0;
1055         ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
1056         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1057         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1058
1059         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1060         pmlmeext->mgnt_seq++;
1061         SetFrameSubType(pframe, WIFI_ASSOCREQ);
1062
1063         pframe += sizeof(struct ieee80211_hdr_3addr);
1064         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1065
1066         /* caps */
1067
1068         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
1069
1070         pframe += 2;
1071         pattrib->pktlen += 2;
1072
1073         /* listen interval */
1074         /* todo: listen interval for power saving */
1075         put_unaligned_le16(3, pframe);
1076         pframe += 2;
1077         pattrib->pktlen += 2;
1078
1079         /* SSID */
1080         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
1081
1082         /* supported rate & extended supported rate */
1083
1084         /*  Check if the AP's supported rates are also supported by STA. */
1085         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
1086
1087         if (pmlmeext->cur_channel == 14)/*  for JAPAN, channel 14 can only uses B Mode(CCK) */
1088                 sta_bssrate_len = 4;
1089
1090         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1091                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1092                         break;
1093                 DBG_88E("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
1094         }
1095
1096         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1097                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1098                         break;
1099
1100                 /*  Check if the AP's supported rates are also supported by STA. */
1101                 for (j = 0; j < sta_bssrate_len; j++) {
1102                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
1103                         if ((pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
1104                                         == (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK))
1105                                 break;
1106                 }
1107
1108                 if (j == sta_bssrate_len) {
1109                         /*  the rate is not supported by STA */
1110                         DBG_88E("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
1111                 } else {
1112                         /*  the rate is supported by STA */
1113                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
1114                 }
1115         }
1116
1117         bssrate_len = index;
1118         DBG_88E("bssrate_len=%d\n", bssrate_len);
1119
1120         if (bssrate_len == 0) {
1121                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
1122                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1123                 goto exit; /* don't connect to AP if no joint supported rate */
1124         }
1125
1126
1127         if (bssrate_len > 8) {
1128                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
1129                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
1130         } else {
1131                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
1132         }
1133
1134         /* RSN */
1135         p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1136         if (p != NULL)
1137                 pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
1138
1139         /* HT caps */
1140         if (padapter->mlmepriv.htpriv.ht_option) {
1141                 p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1142                 if ((p != NULL) && (!(is_ap_in_tkip(padapter)))) {
1143                         memcpy(&pmlmeinfo->HT_caps, p + 2, sizeof(struct ieee80211_ht_cap));
1144
1145                         /* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
1146                         if (pregpriv->cbw40_enable == 0)
1147                                 pmlmeinfo->HT_caps.cap_info &= cpu_to_le16(~(BIT(6) | BIT(1)));
1148                         else
1149                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(BIT(1));
1150
1151                         /* todo: disable SM power save mode */
1152                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x000c);
1153
1154                         rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
1155                         switch (rf_type) {
1156                         case RF_1T1R:
1157                                 if (pregpriv->rx_stbc)
1158                                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0100);/* RX STBC One spatial stream */
1159                                 memcpy((u8 *)&pmlmeinfo->HT_caps.mcs, MCS_rate_1R, 16);
1160                                 break;
1161                         case RF_2T2R:
1162                         case RF_1T2R:
1163                         default:
1164                                 if ((pregpriv->rx_stbc == 0x3) ||/* enable for 2.4/5 GHz */
1165                                     ((pmlmeext->cur_wireless_mode & WIRELESS_11_24N) && (pregpriv->rx_stbc == 0x1)) || /* enable for 2.4GHz */
1166                                     (pregpriv->wifi_spec == 1)) {
1167                                         DBG_88E("declare supporting RX STBC\n");
1168                                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0200);/* RX STBC two spatial stream */
1169                                 }
1170                                 memcpy(&pmlmeinfo->HT_caps.mcs, MCS_rate_2R, 16);
1171                                 break;
1172                         }
1173                         pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
1174                 }
1175         }
1176
1177         /* vendor specific IE, such as WPA, WMM, WPS */
1178         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pmlmeinfo->network.IELength; i += (pIE->Length + 2)) {
1179                 pIE = (struct ndis_802_11_var_ie *)(pmlmeinfo->network.IEs + i);
1180
1181                 switch (pIE->ElementID) {
1182                 case _VENDOR_SPECIFIC_IE_:
1183                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
1184                             (!memcmp(pIE->data, WMM_OUI, 4)) ||
1185                             (!memcmp(pIE->data, WPS_OUI, 4))) {
1186                                 if (!padapter->registrypriv.wifi_spec) {
1187                                         /* Commented by Kurt 20110629 */
1188                                         /* In some older APs, WPS handshake */
1189                                         /* would be fail if we append vender extensions informations to AP */
1190                                         if (!memcmp(pIE->data, WPS_OUI, 4))
1191                                                 pIE->Length = 14;
1192                                 }
1193                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
1194                         }
1195                         break;
1196                 default:
1197                         break;
1198                 }
1199         }
1200
1201         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1202                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
1203
1204         pattrib->last_txcmdsz = pattrib->pktlen;
1205         dump_mgntframe(padapter, pmgntframe);
1206
1207         ret = _SUCCESS;
1208
1209 exit:
1210         if (ret == _SUCCESS)
1211                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
1212         else
1213                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
1214 }
1215
1216 /* when wait_ack is true, this function should be called at process context */
1217 static int _issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int wait_ack)
1218 {
1219         int ret = _FAIL;
1220         struct xmit_frame                       *pmgntframe;
1221         struct pkt_attrib                       *pattrib;
1222         unsigned char                                   *pframe;
1223         struct ieee80211_hdr *pwlanhdr;
1224         __le16 *fctrl;
1225         struct xmit_priv        *pxmitpriv;
1226         struct mlme_ext_priv    *pmlmeext;
1227         struct mlme_ext_info    *pmlmeinfo;
1228         struct wlan_bssid_ex    *pnetwork;
1229
1230         if (!padapter)
1231                 goto exit;
1232
1233         pxmitpriv = &(padapter->xmitpriv);
1234         pmlmeext = &(padapter->mlmeextpriv);
1235         pmlmeinfo = &(pmlmeext->mlmext_info);
1236         pnetwork = &(pmlmeinfo->network);
1237
1238         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1239         if (pmgntframe == NULL)
1240                 goto exit;
1241
1242         /* update attribute */
1243         pattrib = &pmgntframe->attrib;
1244         update_mgntframe_attrib(padapter, pattrib);
1245         pattrib->retry_ctrl = false;
1246
1247         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1248
1249         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1250         pwlanhdr = (struct ieee80211_hdr *)pframe;
1251
1252         fctrl = &pwlanhdr->frame_control;
1253         *(fctrl) = 0;
1254
1255         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1256                 SetFrDs(fctrl);
1257         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1258                 SetToDs(fctrl);
1259
1260         if (power_mode)
1261                 SetPwrMgt(fctrl);
1262
1263         ether_addr_copy(pwlanhdr->addr1, da);
1264         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1265         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1266
1267         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1268         pmlmeext->mgnt_seq++;
1269         SetFrameSubType(pframe, WIFI_DATA_NULL);
1270
1271         pframe += sizeof(struct ieee80211_hdr_3addr);
1272         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1273
1274         pattrib->last_txcmdsz = pattrib->pktlen;
1275
1276         if (wait_ack) {
1277                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1278         } else {
1279                 dump_mgntframe(padapter, pmgntframe);
1280                 ret = _SUCCESS;
1281         }
1282
1283 exit:
1284         return ret;
1285 }
1286
1287
1288 /* when wait_ms > 0 , this function should be called at process context */
1289 /* da == NULL for station mode */
1290 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
1291 {
1292         int ret;
1293         int i = 0;
1294         unsigned long start = jiffies;
1295         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1296         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1297         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1298
1299         /* da == NULL, assume it's null data for sta to ap*/
1300         if (da == NULL)
1301                 da = pnetwork->MacAddress;
1302
1303         do {
1304                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0 ? true : false);
1305
1306                 i++;
1307
1308                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1309                         break;
1310
1311                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1312                         msleep(wait_ms);
1313         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1314
1315         if (ret != _FAIL) {
1316                 ret = _SUCCESS;
1317                 goto exit;
1318         }
1319
1320         if (try_cnt && wait_ms) {
1321                 if (da)
1322                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1323                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1324                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1325                                 jiffies_to_msecs(jiffies - start));
1326                 else
1327                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1328                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1329                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1330                                 jiffies_to_msecs(jiffies - start));
1331         }
1332 exit:
1333         return ret;
1334 }
1335
1336 /* when wait_ack is true, this function should be called at process context */
1337 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int wait_ack)
1338 {
1339         int ret = _FAIL;
1340         struct xmit_frame                       *pmgntframe;
1341         struct pkt_attrib                       *pattrib;
1342         unsigned char                                   *pframe;
1343         struct ieee80211_hdr *pwlanhdr;
1344         __le16 *fctrl;
1345         unsigned short *qc;
1346         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1347         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1348         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1349         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1350
1351         DBG_88E("%s\n", __func__);
1352
1353         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1354         if (pmgntframe == NULL)
1355                 goto exit;
1356
1357         /* update attribute */
1358         pattrib = &pmgntframe->attrib;
1359         update_mgntframe_attrib(padapter, pattrib);
1360
1361         pattrib->hdrlen += 2;
1362         pattrib->qos_en = true;
1363         pattrib->eosp = 1;
1364         pattrib->ack_policy = 0;
1365         pattrib->mdata = 0;
1366
1367         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1368
1369         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1370         pwlanhdr = (struct ieee80211_hdr *)pframe;
1371
1372         fctrl = &pwlanhdr->frame_control;
1373         *(fctrl) = 0;
1374
1375         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1376                 SetFrDs(fctrl);
1377         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1378                 SetToDs(fctrl);
1379
1380         if (pattrib->mdata)
1381                 SetMData(fctrl);
1382
1383         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
1384
1385         SetPriority(qc, tid);
1386
1387         SetEOSP(qc, pattrib->eosp);
1388
1389         SetAckpolicy(qc, pattrib->ack_policy);
1390
1391         ether_addr_copy(pwlanhdr->addr1, da);
1392         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1393         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1394
1395         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1396         pmlmeext->mgnt_seq++;
1397         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
1398
1399         pframe += sizeof(struct ieee80211_qos_hdr);
1400         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
1401
1402         pattrib->last_txcmdsz = pattrib->pktlen;
1403
1404         if (wait_ack) {
1405                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1406         } else {
1407                 dump_mgntframe(padapter, pmgntframe);
1408                 ret = _SUCCESS;
1409         }
1410
1411 exit:
1412         return ret;
1413 }
1414
1415 /* when wait_ms > 0 , this function should be called at process context */
1416 /* da == NULL for station mode */
1417 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
1418 {
1419         int ret;
1420         int i = 0;
1421         unsigned long start = jiffies;
1422         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1423         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1424         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1425
1426         /* da == NULL, assume it's null data for sta to ap*/
1427         if (da == NULL)
1428                 da = pnetwork->MacAddress;
1429
1430         do {
1431                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0 ? true : false);
1432
1433                 i++;
1434
1435                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1436                         break;
1437
1438                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1439                         msleep(wait_ms);
1440         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1441
1442         if (ret != _FAIL) {
1443                 ret = _SUCCESS;
1444                 goto exit;
1445         }
1446
1447         if (try_cnt && wait_ms) {
1448                 if (da)
1449                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1450                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1451                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1452                                 jiffies_to_msecs(jiffies - start));
1453                 else
1454                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1455                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1456                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1457                                 jiffies_to_msecs(jiffies - start));
1458         }
1459 exit:
1460         return ret;
1461 }
1462
1463 static int _issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason, u8 wait_ack)
1464 {
1465         struct xmit_frame                       *pmgntframe;
1466         struct pkt_attrib                       *pattrib;
1467         unsigned char                                   *pframe;
1468         struct ieee80211_hdr *pwlanhdr;
1469         __le16 *fctrl;
1470         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1471         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1472         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1473         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1474         int ret = _FAIL;
1475         __le16 le_tmp;
1476
1477         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1478         if (pmgntframe == NULL)
1479                 goto exit;
1480
1481         /* update attribute */
1482         pattrib = &pmgntframe->attrib;
1483         update_mgntframe_attrib(padapter, pattrib);
1484         pattrib->retry_ctrl = false;
1485
1486         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1487
1488         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1489         pwlanhdr = (struct ieee80211_hdr *)pframe;
1490
1491         fctrl = &pwlanhdr->frame_control;
1492         *(fctrl) = 0;
1493
1494         ether_addr_copy(pwlanhdr->addr1, da);
1495         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1496         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1497
1498         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1499         pmlmeext->mgnt_seq++;
1500         SetFrameSubType(pframe, WIFI_DEAUTH);
1501
1502         pframe += sizeof(struct ieee80211_hdr_3addr);
1503         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1504
1505         le_tmp = cpu_to_le16(reason);
1506         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, &le_tmp,
1507                                   &pattrib->pktlen);
1508
1509         pattrib->last_txcmdsz = pattrib->pktlen;
1510
1511
1512         if (wait_ack) {
1513                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1514         } else {
1515                 dump_mgntframe(padapter, pmgntframe);
1516                 ret = _SUCCESS;
1517         }
1518
1519 exit:
1520         return ret;
1521 }
1522
1523 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
1524 {
1525         DBG_88E("%s to %pM\n", __func__, da);
1526         return _issue_deauth(padapter, da, reason, false);
1527 }
1528
1529 static int issue_deauth_ex(struct adapter *padapter, u8 *da,
1530                            unsigned short reason, int try_cnt,
1531                            int wait_ms)
1532 {
1533         int ret;
1534         int i = 0;
1535         unsigned long start = jiffies;
1536
1537         do {
1538                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0 ? true : false);
1539
1540                 i++;
1541
1542                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1543                         break;
1544
1545                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1546                         msleep(wait_ms);
1547         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1548
1549         if (ret != _FAIL) {
1550                 ret = _SUCCESS;
1551                 goto exit;
1552         }
1553
1554         if (try_cnt && wait_ms) {
1555                 if (da)
1556                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1557                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1558                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1559                                 jiffies_to_msecs(jiffies - start));
1560                 else
1561                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1562                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1563                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1564                                 jiffies_to_msecs(jiffies - start));
1565         }
1566 exit:
1567         return ret;
1568 }
1569
1570 static void issue_action_BA(struct adapter *padapter, unsigned char *raddr,
1571                             unsigned char action, unsigned short status)
1572 {
1573         u8 category = RTW_WLAN_CATEGORY_BACK;
1574         u16 start_seq;
1575         u16 BA_para_set;
1576         u16 reason_code;
1577         u16 BA_timeout_value;
1578         __le16  le_tmp;
1579         u16 BA_starting_seqctrl = 0;
1580         enum ht_cap_ampdu_factor max_rx_ampdu_factor;
1581         struct xmit_frame *pmgntframe;
1582         struct pkt_attrib *pattrib;
1583         u8 *pframe;
1584         struct ieee80211_hdr *pwlanhdr;
1585         __le16 *fctrl;
1586         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
1587         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1588         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1589         struct sta_info *psta;
1590         struct sta_priv *pstapriv = &padapter->stapriv;
1591         struct registry_priv *pregpriv = &padapter->registrypriv;
1592         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1593
1594         DBG_88E("%s, category=%d, action=%d, status=%d\n", __func__, category, action, status);
1595
1596         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1597         if (pmgntframe == NULL)
1598                 return;
1599
1600         /* update attribute */
1601         pattrib = &pmgntframe->attrib;
1602         update_mgntframe_attrib(padapter, pattrib);
1603
1604         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1605
1606         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1607         pwlanhdr = (struct ieee80211_hdr *)pframe;
1608
1609         fctrl = &pwlanhdr->frame_control;
1610         *(fctrl) = 0;
1611
1612         ether_addr_copy(pwlanhdr->addr1, raddr);
1613         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1614         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1615
1616         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1617         pmlmeext->mgnt_seq++;
1618         SetFrameSubType(pframe, WIFI_ACTION);
1619
1620         pframe += sizeof(struct ieee80211_hdr_3addr);
1621         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1622
1623         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1624         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1625
1626         if (category == 3) {
1627                 switch (action) {
1628                 case 0: /* ADDBA req */
1629                         do {
1630                                 pmlmeinfo->dialogToken++;
1631                         } while (pmlmeinfo->dialogToken == 0);
1632                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
1633
1634                         BA_para_set = 0x1002 | ((status & 0xf) << 2); /* immediate ack & 64 buffer size */
1635                         le_tmp = cpu_to_le16(BA_para_set);
1636                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1637                                                   &pattrib->pktlen);
1638
1639                         BA_timeout_value = 5000;/*  5ms */
1640                         le_tmp = cpu_to_le16(BA_timeout_value);
1641                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1642                                                   &pattrib->pktlen);
1643
1644                         psta = rtw_get_stainfo(pstapriv, raddr);
1645                         if (psta != NULL) {
1646                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
1647
1648                                 DBG_88E("BA_starting_seqctrl=%d for TID=%d\n", start_seq, status & 0x07);
1649
1650                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
1651
1652                                 BA_starting_seqctrl = start_seq << 4;
1653                         }
1654                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
1655                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1656                                                   &pattrib->pktlen);
1657                         break;
1658                 case 1: /* ADDBA rsp */
1659                 {
1660                         struct ADDBA_request *ADDBA_req = &pmlmeinfo->ADDBA_req;
1661
1662                         pframe = rtw_set_fixed_ie(pframe, 1,
1663                                                   &ADDBA_req->dialog_token,
1664                                                   &pattrib->pktlen);
1665                         pframe = rtw_set_fixed_ie(pframe, 2, &status,
1666                                                   &pattrib->pktlen);
1667
1668                         BA_para_set = le16_to_cpu(ADDBA_req->BA_para_set) &
1669                                       0x3f;
1670                         rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
1671                         switch (max_rx_ampdu_factor) {
1672                         case MAX_AMPDU_FACTOR_64K:
1673                                 BA_para_set |= 0x1000; /* 64 buffer size */
1674                                 break;
1675                         case MAX_AMPDU_FACTOR_32K:
1676                                 BA_para_set |= 0x0800; /* 32 buffer size */
1677                                 break;
1678                         case MAX_AMPDU_FACTOR_16K:
1679                                 BA_para_set |= 0x0400; /* 16 buffer size */
1680                                 break;
1681                         case MAX_AMPDU_FACTOR_8K:
1682                                 BA_para_set |= 0x0200; /* 8 buffer size */
1683                                 break;
1684                         default:
1685                                 BA_para_set |= 0x1000; /* 64 buffer size */
1686                                 break;
1687                         }
1688
1689                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
1690                                 BA_para_set = BA_para_set & ~BIT(0);
1691                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
1692                                 BA_para_set = BA_para_set | BIT(0);
1693                         le_tmp = cpu_to_le16(BA_para_set);
1694
1695                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1696                                                   &pattrib->pktlen);
1697                         pframe = rtw_set_fixed_ie(pframe, 2,
1698                                                   &ADDBA_req->BA_timeout_value,
1699                                                   &pattrib->pktlen);
1700                         break;
1701                 }
1702                 case 2:/* DELBA */
1703                         BA_para_set = (status & 0x1F) << 3;
1704                         le_tmp = cpu_to_le16(BA_para_set);
1705                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1706                                                   &pattrib->pktlen);
1707
1708                         reason_code = 37;/* Requested from peer STA as it does not want to use the mechanism */
1709                         le_tmp = cpu_to_le16(reason_code);
1710                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1711                                                   &pattrib->pktlen);
1712                         break;
1713                 default:
1714                         break;
1715                 }
1716         }
1717
1718         pattrib->last_txcmdsz = pattrib->pktlen;
1719
1720         dump_mgntframe(padapter, pmgntframe);
1721 }
1722
1723 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
1724 {
1725         struct list_head *plist, *phead;
1726         unsigned char category, action;
1727         struct xmit_frame                       *pmgntframe;
1728         struct pkt_attrib                       *pattrib;
1729         unsigned char                           *pframe;
1730         struct ieee80211_hdr *pwlanhdr;
1731         __le16 *fctrl;
1732         struct  wlan_network    *pnetwork = NULL;
1733         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1734         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1735         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1736         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1737         struct __queue *queue   = &(pmlmepriv->scanned_queue);
1738         u8 InfoContent[16] = {0};
1739         u8 ICS[8][15];
1740         struct wlan_bssid_ex  *cur_network   = &(pmlmeinfo->network);
1741
1742         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
1743                 return;
1744
1745         if (pmlmeinfo->bwmode_updated)
1746                 return;
1747
1748
1749         DBG_88E("%s\n", __func__);
1750
1751
1752         category = RTW_WLAN_CATEGORY_PUBLIC;
1753         action = ACT_PUBLIC_BSSCOEXIST;
1754
1755         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1756         if (pmgntframe == NULL)
1757                 return;
1758
1759         /* update attribute */
1760         pattrib = &pmgntframe->attrib;
1761         update_mgntframe_attrib(padapter, pattrib);
1762
1763         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1764
1765         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1766         pwlanhdr = (struct ieee80211_hdr *)pframe;
1767
1768         fctrl = &pwlanhdr->frame_control;
1769         *(fctrl) = 0;
1770
1771         ether_addr_copy(pwlanhdr->addr1, cur_network->MacAddress);
1772         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1773         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
1774
1775         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1776         pmlmeext->mgnt_seq++;
1777         SetFrameSubType(pframe, WIFI_ACTION);
1778
1779         pframe += sizeof(struct ieee80211_hdr_3addr);
1780         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1781
1782         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1783         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1784
1785
1786         /*  */
1787         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
1788                 u8 iedata = 0;
1789
1790                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
1791
1792                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
1793         }
1794
1795
1796         /*  */
1797         memset(ICS, 0, sizeof(ICS));
1798         if (pmlmepriv->num_sta_no_ht > 0) {
1799                 int i;
1800
1801                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1802
1803                 phead = get_list_head(queue);
1804                 plist = phead->next;
1805
1806                 while (phead != plist) {
1807                         int len;
1808                         u8 *p;
1809                         struct wlan_bssid_ex *pbss_network;
1810
1811                         pnetwork = container_of(plist, struct wlan_network, list);
1812
1813                         plist = plist->next;
1814
1815                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
1816
1817                         p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
1818                         if ((p == NULL) || (len == 0)) { /* non-HT */
1819                                 if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
1820                                         continue;
1821
1822                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
1823
1824                                 if (ICS[0][0] == 0)
1825                                         ICS[0][0] = 1;
1826                         }
1827                 }
1828                 spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
1829
1830                 for (i = 0; i < 8; i++) {
1831                         if (ICS[i][0] == 1) {
1832                                 int j, k = 0;
1833
1834                                 InfoContent[k] = i;
1835                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
1836                                 k++;
1837
1838                                 for (j = 1; j <= 14; j++) {
1839                                         if (ICS[i][j] == 1) {
1840                                                 if (k < 16) {
1841                                                         InfoContent[k] = j; /* channel number */
1842                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
1843                                                         k++;
1844                                                 }
1845                                         }
1846                                 }
1847
1848                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
1849                         }
1850                 }
1851         }
1852
1853
1854         pattrib->last_txcmdsz = pattrib->pktlen;
1855
1856         dump_mgntframe(padapter, pmgntframe);
1857 }
1858
1859 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
1860 {
1861         struct sta_priv *pstapriv = &padapter->stapriv;
1862         struct sta_info *psta = NULL;
1863         /* struct recv_reorder_ctrl *preorder_ctrl; */
1864         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1865         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1866         u16 tid;
1867
1868         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1869                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1870                         return _SUCCESS;
1871
1872         psta = rtw_get_stainfo(pstapriv, addr);
1873         if (psta == NULL)
1874                 return _SUCCESS;
1875
1876         if (initiator == 0) { /*  recipient */
1877                 for (tid = 0; tid < MAXTID; tid++) {
1878                         if (psta->recvreorder_ctrl[tid].enable) {
1879                                 DBG_88E("rx agg disable tid(%d)\n", tid);
1880                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1881                                 psta->recvreorder_ctrl[tid].enable = false;
1882                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
1883                         }
1884                 }
1885         } else if (initiator == 1) { /*  originator */
1886                 for (tid = 0; tid < MAXTID; tid++) {
1887                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
1888                                 DBG_88E("tx agg disable tid(%d)\n", tid);
1889                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1890                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1891                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1892                         }
1893                 }
1894         }
1895
1896         return _SUCCESS;
1897 }
1898
1899 unsigned int send_beacon(struct adapter *padapter)
1900 {
1901         u8 bxmitok = false;
1902         int     issue = 0;
1903         int poll = 0;
1904
1905         unsigned long start = jiffies;
1906
1907         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
1908         do {
1909                 issue_beacon(padapter, 100);
1910                 issue++;
1911                 do {
1912                         yield();
1913                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
1914                         poll++;
1915                 } while ((poll%10) != 0 && !bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1916         } while (!bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1917
1918         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
1919                 return _FAIL;
1920         if (!bxmitok) {
1921                 DBG_88E("%s fail! %u ms\n", __func__,
1922                         jiffies_to_msecs(jiffies - start));
1923                 return _FAIL;
1924         } else {
1925                 u32 passing_time = jiffies_to_msecs(jiffies - start);
1926
1927                 if (passing_time > 100 || issue > 3)
1928                         DBG_88E("%s success, issue:%d, poll:%d, %u ms\n",
1929                                 __func__, issue, poll,
1930                                 jiffies_to_msecs(jiffies - start));
1931                 return _SUCCESS;
1932         }
1933 }
1934
1935 /****************************************************************************
1936
1937 Following are some utility functions for WiFi MLME
1938
1939 *****************************************************************************/
1940
1941 static void site_survey(struct adapter *padapter)
1942 {
1943         unsigned char           survey_channel = 0, val8;
1944         enum rt_scan_type ScanType = SCAN_PASSIVE;
1945         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1946         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1947         u32 initialgain = 0;
1948         struct rtw_ieee80211_channel *ch;
1949
1950         if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
1951                 ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
1952                 survey_channel = ch->hw_value;
1953                 ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
1954         }
1955
1956
1957         if (survey_channel != 0) {
1958                 /* PAUSE 4-AC Queue when site_survey */
1959                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1960                 /* val8 |= 0x0f; */
1961                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1962                 if (pmlmeext->sitesurvey_res.channel_idx == 0)
1963                         set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
1964                 else
1965                         SelectChannel(padapter, survey_channel);
1966
1967                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
1968                         int i;
1969
1970                         for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
1971                                 if (pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
1972                                         /* todo: to issue two probe req??? */
1973                                         issue_probereq(padapter,
1974                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1975                                                                 NULL, false);
1976                                         /* msleep(SURVEY_TO>>1); */
1977                                         issue_probereq(padapter,
1978                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1979                                                                 NULL, false);
1980                                 }
1981                         }
1982
1983                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1984                                 /* todo: to issue two probe req??? */
1985                                 issue_probereq(padapter, NULL, NULL, false);
1986                                 /* msleep(SURVEY_TO>>1); */
1987                                 issue_probereq(padapter, NULL, NULL, false);
1988                         }
1989
1990                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1991                                 /* todo: to issue two probe req??? */
1992                                 issue_probereq(padapter, NULL, NULL, false);
1993                                 /* msleep(SURVEY_TO>>1); */
1994                                 issue_probereq(padapter, NULL, NULL, false);
1995                         }
1996                 }
1997
1998                 set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1999         } else {
2000
2001                 /*  20100721:Interrupt scan operation here. */
2002                 /*  For SW antenna diversity before link, it needs to switch to another antenna and scan again. */
2003                 /*  It compares the scan result and select better one to do connection. */
2004                 if (rtw_hal_antdiv_before_linked(padapter)) {
2005                         pmlmeext->sitesurvey_res.bss_cnt = 0;
2006                         pmlmeext->sitesurvey_res.channel_idx = -1;
2007                         pmlmeext->chan_scan_time = SURVEY_TO / 2;
2008                         set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
2009                         return;
2010                 }
2011
2012                 pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
2013
2014                 /* switch back to the original channel */
2015
2016                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2017
2018                 /* flush 4-AC Queue after site_survey */
2019                 /* val8 = 0; */
2020                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
2021
2022                 /* config MSR */
2023                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2024
2025                 initialgain = 0xff; /* restore RX GAIN */
2026                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
2027                 /* turn on dynamic functions */
2028                 Restore_DM_Func_Flag(padapter);
2029                 /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
2030
2031                 if (is_client_associated_to_ap(padapter))
2032                         issue_nulldata(padapter, NULL, 0, 3, 500);
2033
2034                 val8 = 0; /* survey done */
2035                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
2036
2037                 report_surveydone_event(padapter);
2038
2039                 pmlmeext->chan_scan_time = SURVEY_TO;
2040                 pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
2041
2042                 issue_action_BSSCoexistPacket(padapter);
2043                 issue_action_BSSCoexistPacket(padapter);
2044                 issue_action_BSSCoexistPacket(padapter);
2045         }
2046 }
2047
2048 /* collect bss info from Beacon and Probe request/response frames. */
2049 static u8 collect_bss_info(struct adapter *padapter,
2050                            struct recv_frame *precv_frame,
2051                            struct wlan_bssid_ex *bssid)
2052 {
2053         int     i;
2054         u32     len;
2055         u8 *p;
2056         u16 val16, subtype;
2057         u8 *pframe = precv_frame->rx_data;
2058         u32     packet_len = precv_frame->len;
2059         u8 ie_offset;
2060         struct registry_priv    *pregistrypriv = &padapter->registrypriv;
2061         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2062         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2063
2064         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
2065
2066         if (len > MAX_IE_SZ)
2067                 return _FAIL;
2068
2069         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
2070
2071         subtype = GetFrameSubType(pframe);
2072
2073         if (subtype == WIFI_BEACON) {
2074                 bssid->Reserved[0] = 1;
2075                 ie_offset = _BEACON_IE_OFFSET_;
2076         } else {
2077                 /*  FIXME : more type */
2078                 if (subtype == WIFI_PROBEREQ) {
2079                         ie_offset = _PROBEREQ_IE_OFFSET_;
2080                         bssid->Reserved[0] = 2;
2081                 } else if (subtype == WIFI_PROBERSP) {
2082                         ie_offset = _PROBERSP_IE_OFFSET_;
2083                         bssid->Reserved[0] = 3;
2084                 } else {
2085                         bssid->Reserved[0] = 0;
2086                         ie_offset = _FIXED_IE_LENGTH_;
2087                 }
2088         }
2089
2090         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
2091
2092         /* below is to copy the information element */
2093         bssid->IELength = len;
2094         memcpy(bssid->IEs, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->IELength);
2095
2096         /* get the signal strength in dBM.raw data */
2097         bssid->Rssi = precv_frame->attrib.phy_info.recvpower;
2098         bssid->PhyInfo.SignalQuality = precv_frame->attrib.phy_info.SignalQuality;/* in percentage */
2099         bssid->PhyInfo.SignalStrength = precv_frame->attrib.phy_info.SignalStrength;/* in percentage */
2100         rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
2101
2102         /*  checking SSID */
2103         p = rtw_get_ie(bssid->IEs + ie_offset, _SSID_IE_, &len, bssid->IELength - ie_offset);
2104         if (p == NULL) {
2105                 DBG_88E("marc: cannot find SSID for survey event\n");
2106                 return _FAIL;
2107         }
2108
2109         if (len) {
2110                 if (len > NDIS_802_11_LENGTH_SSID) {
2111                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2112                         return _FAIL;
2113                 }
2114                 memcpy(bssid->Ssid.Ssid, (p + 2), len);
2115                 bssid->Ssid.SsidLength = len;
2116         } else {
2117                 bssid->Ssid.SsidLength = 0;
2118         }
2119
2120         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
2121
2122         /* checking rate info... */
2123         i = 0;
2124         p = rtw_get_ie(bssid->IEs + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2125         if (p != NULL) {
2126                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
2127                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2128                         return _FAIL;
2129                 }
2130                 memcpy(bssid->SupportedRates, (p + 2), len);
2131                 i = len;
2132         }
2133
2134         p = rtw_get_ie(bssid->IEs + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2135         if (p != NULL) {
2136                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i)) {
2137                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2138                         return _FAIL;
2139                 }
2140                 memcpy(bssid->SupportedRates + i, (p + 2), len);
2141         }
2142
2143         /* todo: */
2144         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
2145
2146         if (bssid->IELength < 12)
2147                 return _FAIL;
2148
2149         /*  Checking for DSConfig */
2150         p = rtw_get_ie(bssid->IEs + ie_offset, _DSSET_IE_, &len, bssid->IELength - ie_offset);
2151
2152         bssid->Configuration.DSConfig = 0;
2153         bssid->Configuration.Length = 0;
2154
2155         if (p) {
2156                 bssid->Configuration.DSConfig = *(p + 2);
2157         } else {/*  In 5G, some ap do not have DSSET IE */
2158                 /*  checking HT info for channel */
2159                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->IELength - ie_offset);
2160                 if (p) {
2161                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
2162
2163                         bssid->Configuration.DSConfig = HT_info->primary_channel;
2164                 } else { /*  use current channel */
2165                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
2166                 }
2167         }
2168
2169         if (subtype == WIFI_PROBEREQ) {
2170                 /*  FIXME */
2171                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2172                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2173                 bssid->Privacy = 1;
2174                 return _SUCCESS;
2175         }
2176
2177         bssid->Configuration.BeaconPeriod =
2178                 get_unaligned_le16(rtw_get_beacon_interval_from_ie(bssid->IEs));
2179
2180         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
2181
2182         if (val16 & BIT(0)) {
2183                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2184                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2185         } else {
2186                 bssid->InfrastructureMode = Ndis802_11IBSS;
2187                 ether_addr_copy(bssid->MacAddress, GetAddr3Ptr(pframe));
2188         }
2189
2190         if (val16 & BIT(4))
2191                 bssid->Privacy = 1;
2192         else
2193                 bssid->Privacy = 0;
2194
2195         bssid->Configuration.ATIMWindow = 0;
2196
2197         /* 20/40 BSS Coexistence check */
2198         if ((pregistrypriv->wifi_spec == 1) && (!pmlmeinfo->bwmode_updated)) {
2199                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2200
2201                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->IELength - ie_offset);
2202                 if (p && len > 0) {
2203                         struct ieee80211_ht_cap *pHT_caps =
2204                                 (struct ieee80211_ht_cap *)(p + 2);
2205
2206                         if (le16_to_cpu(pHT_caps->cap_info) & BIT(14))
2207                                 pmlmepriv->num_FortyMHzIntolerant++;
2208                 } else {
2209                         pmlmepriv->num_sta_no_ht++;
2210                 }
2211         }
2212
2213         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
2214         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
2215                 bssid->PhyInfo.SignalQuality = 101;
2216         return _SUCCESS;
2217 }
2218
2219 static void start_create_ibss(struct adapter *padapter)
2220 {
2221         unsigned short  caps;
2222         u8 val8;
2223         u8 join_type;
2224         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2225         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2226         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2227
2228         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2229         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2230
2231         /* update wireless mode */
2232         update_wireless_mode(padapter);
2233
2234         /* update capability */
2235         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2236         update_capinfo(padapter, caps);
2237         if (caps&cap_IBSS) {/* adhoc master */
2238                 val8 = 0xcf;
2239                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2240
2241                 /* switch channel */
2242                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
2243                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2244
2245                 beacon_timing_control(padapter);
2246
2247                 /* set msr to WIFI_FW_ADHOC_STATE */
2248                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2249                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2250
2251                 /* issue beacon */
2252                 if (send_beacon(padapter) == _FAIL) {
2253                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
2254
2255                         report_join_res(padapter, -1);
2256                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2257                 } else {
2258                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
2259                         join_type = 0;
2260                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
2261
2262                         report_join_res(padapter, 1);
2263                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
2264                 }
2265         } else {
2266                 DBG_88E("start_create_ibss, invalid cap:%x\n", caps);
2267                 return;
2268         }
2269 }
2270
2271 static void start_clnt_join(struct adapter *padapter)
2272 {
2273         unsigned short  caps;
2274         u8 val8;
2275         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2276         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2277         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2278         int beacon_timeout;
2279
2280         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2281         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2282
2283         /* update wireless mode */
2284         update_wireless_mode(padapter);
2285
2286         /* update capability */
2287         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2288         update_capinfo(padapter, caps);
2289         if (caps&cap_ESS) {
2290                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
2291
2292                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
2293
2294                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2295
2296                 /* switch channel */
2297                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2298
2299                 /* here wait for receiving the beacon to start auth */
2300                 /* and enable a timer */
2301                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
2302                 set_link_timer(pmlmeext, beacon_timeout);
2303                 mod_timer(&padapter->mlmepriv.assoc_timer, jiffies +
2304                           msecs_to_jiffies((REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO * REASSOC_LIMIT) + beacon_timeout));
2305
2306                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
2307         } else if (caps&cap_IBSS) { /* adhoc client */
2308                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
2309
2310                 val8 = 0xcf;
2311                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2312
2313                 /* switch channel */
2314                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2315
2316                 beacon_timing_control(padapter);
2317
2318                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2319
2320                 report_join_res(padapter, 1);
2321         } else {
2322                 return;
2323         }
2324 }
2325
2326 static void start_clnt_auth(struct adapter *padapter)
2327 {
2328         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2329         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2330
2331         del_timer_sync(&pmlmeext->link_timer);
2332
2333         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
2334         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
2335
2336         pmlmeinfo->auth_seq = 1;
2337         pmlmeinfo->reauth_count = 0;
2338         pmlmeinfo->reassoc_count = 0;
2339         pmlmeinfo->link_count = 0;
2340         pmlmeext->retry = 0;
2341
2342
2343         /*  Because of AP's not receiving deauth before */
2344         /*  AP may: 1)not response auth or 2)deauth us after link is complete */
2345         /*  issue deauth before issuing auth to deal with the situation */
2346         /*      Commented by Albert 2012/07/21 */
2347         /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
2348         issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
2349
2350         DBG_88E_LEVEL(_drv_info_, "start auth\n");
2351         issue_auth(padapter, NULL, 0);
2352
2353         set_link_timer(pmlmeext, REAUTH_TO);
2354 }
2355
2356
2357 static void start_clnt_assoc(struct adapter *padapter)
2358 {
2359         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2360         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2361
2362         del_timer_sync(&pmlmeext->link_timer);
2363
2364         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
2365         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
2366
2367         issue_assocreq(padapter);
2368
2369         set_link_timer(pmlmeext, REASSOC_TO);
2370 }
2371
2372 static unsigned int receive_disconnect(struct adapter *padapter,
2373                                        unsigned char *MacAddr,
2374                                        unsigned short reason)
2375 {
2376         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2377         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2378         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
2379
2380         /* check A3 */
2381         if (memcmp(MacAddr, pnetwork->MacAddress, ETH_ALEN))
2382                 return _SUCCESS;
2383
2384         DBG_88E("%s\n", __func__);
2385
2386         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
2387                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
2388                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2389                         report_del_sta_event(padapter, MacAddr, reason);
2390                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
2391                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2392                         report_join_res(padapter, -2);
2393                 }
2394         }
2395         return _SUCCESS;
2396 }
2397
2398 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
2399 {
2400         struct registry_priv *pregistrypriv;
2401         struct mlme_ext_priv *pmlmeext;
2402         struct rt_channel_info *chplan_new;
2403         u8 channel;
2404         u8 i;
2405
2406         pregistrypriv = &padapter->registrypriv;
2407         pmlmeext = &padapter->mlmeextpriv;
2408
2409         /*  Adjust channel plan by AP Country IE */
2410         if (pregistrypriv->enable80211d &&
2411             (!pmlmeext->update_channel_plan_by_ap_done)) {
2412                 u8 *ie, *p;
2413                 u32 len;
2414                 struct rt_channel_plan chplan_ap;
2415                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
2416                 u8 country[4];
2417                 u8 fcn; /*  first channel number */
2418                 u8 noc; /*  number of channel */
2419                 u8 j, k;
2420
2421                 ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
2422                 if (!ie)
2423                         return;
2424                 if (len < 6)
2425                         return;
2426                 ie += 2;
2427                 p = ie;
2428                 ie += len;
2429
2430                 memset(country, 0, 4);
2431                 memcpy(country, p, 3);
2432                 p += 3;
2433                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2434                          ("%s: 802.11d country =%s\n", __func__, country));
2435
2436                 i = 0;
2437                 while ((ie - p) >= 3) {
2438                         fcn = *(p++);
2439                         noc = *(p++);
2440                         p++;
2441
2442                         for (j = 0; j < noc; j++) {
2443                                 if (fcn <= 14)
2444                                         channel = fcn + j; /*  2.4 GHz */
2445                                 else
2446                                         channel = fcn + j*4; /*  5 GHz */
2447
2448                                 chplan_ap.Channel[i++] = channel;
2449                         }
2450                 }
2451                 chplan_ap.Len = i;
2452
2453                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
2454
2455                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
2456                 chplan_new = pmlmeext->channel_set;
2457
2458                 i = 0;
2459                 j = 0;
2460                 k = 0;
2461                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
2462                         do {
2463                                 if ((i == MAX_CHANNEL_NUM) ||
2464                                     (chplan_sta[i].ChannelNum == 0) ||
2465                                     (chplan_sta[i].ChannelNum > 14))
2466                                         break;
2467
2468                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
2469                                         break;
2470
2471                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
2472                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2473                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2474                                         i++;
2475                                         j++;
2476                                         k++;
2477                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
2478                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2479                                         chplan_new[k].ScanType = SCAN_PASSIVE;
2480                                         i++;
2481                                         k++;
2482                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
2483                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2484                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2485                                         j++;
2486                                         k++;
2487                                 }
2488                         } while (1);
2489
2490                         /*  change AP not support channel to Passive scan */
2491                         while ((i < MAX_CHANNEL_NUM) &&
2492                                (chplan_sta[i].ChannelNum != 0) &&
2493                                (chplan_sta[i].ChannelNum <= 14)) {
2494                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2495                                 chplan_new[k].ScanType = SCAN_PASSIVE;
2496                                 i++;
2497                                 k++;
2498                         }
2499
2500                         /*  add channel AP supported */
2501                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
2502                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2503                                 chplan_new[k].ScanType = SCAN_ACTIVE;
2504                                 j++;
2505                                 k++;
2506                         }
2507                 } else {
2508                         /*  keep original STA 2.4G channel plan */
2509                         while ((i < MAX_CHANNEL_NUM) &&
2510                                (chplan_sta[i].ChannelNum != 0) &&
2511                                (chplan_sta[i].ChannelNum <= 14)) {
2512                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2513                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
2514                                 i++;
2515                                 k++;
2516                         }
2517
2518                         /*  skip AP 2.4G channel plan */
2519                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
2520                                 j++;
2521                 }
2522
2523                 /*  keep original STA 5G channel plan */
2524                 while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
2525                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2526                         chplan_new[k].ScanType = chplan_sta[i].ScanType;
2527                         i++;
2528                         k++;
2529                 }
2530
2531                 pmlmeext->update_channel_plan_by_ap_done = 1;
2532         }
2533
2534         /*  If channel is used by AP, set channel scan type to active */
2535         channel = bssid->Configuration.DSConfig;
2536         chplan_new = pmlmeext->channel_set;
2537         i = 0;
2538         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
2539                 if (chplan_new[i].ChannelNum == channel) {
2540                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
2541                                 chplan_new[i].ScanType = SCAN_ACTIVE;
2542                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2543                                          ("%s: change channel %d scan type from passive to active\n",
2544                                          __func__, channel));
2545                         }
2546                         break;
2547                 }
2548                 i++;
2549         }
2550 }
2551
2552 /****************************************************************************
2553
2554 Following are the callback functions for each subtype of the management frames
2555
2556 *****************************************************************************/
2557
2558 static unsigned int OnProbeReq(struct adapter *padapter,
2559                                struct recv_frame *precv_frame)
2560 {
2561         unsigned int    ielen;
2562         unsigned char   *p;
2563         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2564         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2565         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2566         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2567         u8 *pframe = precv_frame->rx_data;
2568         uint len = precv_frame->len;
2569
2570         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
2571                 return _SUCCESS;
2572
2573         if (!check_fwstate(pmlmepriv, _FW_LINKED) &&
2574             !check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
2575                 return _SUCCESS;
2576
2577         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ielen,
2578                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
2579
2580         /* check (wildcard) SSID */
2581         if (p != NULL) {
2582                 if ((ielen != 0 && memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength)) ||
2583                     (ielen == 0 && pmlmeinfo->hidden_ssid_mode))
2584                         return _SUCCESS;
2585
2586                 if (check_fwstate(pmlmepriv, _FW_LINKED) &&
2587                     pmlmepriv->cur_network.join_res)
2588                         issue_probersp(padapter, get_sa(pframe));
2589         }
2590         return _SUCCESS;
2591 }
2592
2593 static unsigned int OnProbeRsp(struct adapter *padapter,
2594                                struct recv_frame *precv_frame)
2595 {
2596         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2597
2598         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2599                 report_survey_event(padapter, precv_frame);
2600                 return _SUCCESS;
2601         }
2602
2603         return _SUCCESS;
2604 }
2605
2606 static unsigned int OnBeacon(struct adapter *padapter,
2607                              struct recv_frame *precv_frame)
2608 {
2609         int cam_idx;
2610         struct sta_info *psta;
2611         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2612         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2613         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2614         struct sta_priv *pstapriv = &padapter->stapriv;
2615         u8 *pframe = precv_frame->rx_data;
2616         uint len = precv_frame->len;
2617         struct wlan_bssid_ex *pbss;
2618         int ret = _SUCCESS;
2619         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2620
2621         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2622                 report_survey_event(padapter, precv_frame);
2623                 return _SUCCESS;
2624         }
2625
2626         if (!memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN)) {
2627                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
2628                         /* we should update current network before auth, or some IE is wrong */
2629                         pbss = (struct wlan_bssid_ex *)rtw_malloc(sizeof(struct wlan_bssid_ex));
2630                         if (pbss) {
2631                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
2632                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
2633                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
2634                                 }
2635                                 kfree(pbss);
2636                         }
2637
2638                         /* check the vendor of the assoc AP */
2639                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
2640
2641                         /* update TSF Value */
2642                         update_TSF(pmlmeext, pframe, len);
2643
2644                         /* start auth */
2645                         start_clnt_auth(padapter);
2646
2647                         return _SUCCESS;
2648                 }
2649
2650                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
2651                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2652                         if (psta != NULL) {
2653                                 ret = rtw_check_bcn_info(padapter, pframe, len);
2654                                 if (!ret) {
2655                                                 DBG_88E_LEVEL(_drv_info_, "ap has changed, disconnect now\n ");
2656                                                 receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 65535);
2657                                                 return _SUCCESS;
2658                                 }
2659                                 /* update WMM, ERP in the beacon */
2660                                 /* todo: the timer is used instead of the number of the beacon received */
2661                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2662                                         update_beacon_info(padapter, pframe, len, psta);
2663                         }
2664                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2665                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2666                         if (psta != NULL) {
2667                                 /* update WMM, ERP in the beacon */
2668                                 /* todo: the timer is used instead of the number of the beacon received */
2669                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2670                                         update_beacon_info(padapter, pframe, len, psta);
2671                         } else {
2672                                 /* allocate a new CAM entry for IBSS station */
2673                                 cam_idx = allocate_fw_sta_entry(padapter);
2674                                 if (cam_idx == NUM_STA)
2675                                         goto _END_ONBEACON_;
2676
2677                                 /* get supported rate */
2678                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
2679                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
2680                                         goto _END_ONBEACON_;
2681                                 }
2682
2683                                 /* update TSF Value */
2684                                 update_TSF(pmlmeext, pframe, len);
2685
2686                                 /* report sta add event */
2687                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
2688                         }
2689                 }
2690         }
2691
2692 _END_ONBEACON_:
2693
2694         return _SUCCESS;
2695 }
2696
2697 #ifdef CONFIG_88EU_AP_MODE
2698 static unsigned int OnAuth(struct adapter *padapter,
2699                            struct recv_frame *precv_frame)
2700 {
2701         unsigned int    auth_mode, ie_len;
2702         u16 seq;
2703         unsigned char   *sa, *p;
2704         u16 algorithm;
2705         int     status;
2706         static struct sta_info stat;
2707         struct  sta_info        *pstat = NULL;
2708         struct  sta_priv *pstapriv = &padapter->stapriv;
2709         struct security_priv *psecuritypriv = &padapter->securitypriv;
2710         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2711         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2712         u8 *pframe = precv_frame->rx_data;
2713         uint len = precv_frame->len;
2714
2715         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2716                 return _FAIL;
2717
2718         DBG_88E("+OnAuth\n");
2719
2720         sa = GetAddr2Ptr(pframe);
2721
2722         auth_mode = psecuritypriv->dot11AuthAlgrthm;
2723         seq = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + 2));
2724         algorithm = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN));
2725
2726         DBG_88E("auth alg=%x, seq=%X\n", algorithm, seq);
2727
2728         if (auth_mode == 2 && psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
2729             psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
2730                 auth_mode = 0;
2731
2732         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
2733             (algorithm == 0 && auth_mode == 1)) {       /*  rx a open-system auth but shared-key is enabled */
2734                 DBG_88E("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
2735                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
2736
2737                 status = _STATS_NO_SUPP_ALG_;
2738
2739                 goto auth_fail;
2740         }
2741
2742         if (!rtw_access_ctrl(padapter, sa)) {
2743                 status = _STATS_UNABLE_HANDLE_STA_;
2744                 goto auth_fail;
2745         }
2746
2747         pstat = rtw_get_stainfo(pstapriv, sa);
2748         if (pstat == NULL) {
2749                 /*  allocate a new one */
2750                 DBG_88E("going to alloc stainfo for sa=%pM\n", sa);
2751                 pstat = rtw_alloc_stainfo(pstapriv, sa);
2752                 if (pstat == NULL) {
2753                         DBG_88E(" Exceed the upper limit of supported clients...\n");
2754                         status = _STATS_UNABLE_HANDLE_STA_;
2755                         goto auth_fail;
2756                 }
2757
2758                 pstat->state = WIFI_FW_AUTH_NULL;
2759                 pstat->auth_seq = 0;
2760         } else {
2761                 spin_lock_bh(&pstapriv->asoc_list_lock);
2762                 if (!list_empty(&pstat->asoc_list)) {
2763                         list_del_init(&pstat->asoc_list);
2764                         pstapriv->asoc_list_cnt--;
2765                 }
2766                 spin_unlock_bh(&pstapriv->asoc_list_lock);
2767
2768                 if (seq == 1) {
2769                         /* TODO: STA re_auth and auth timeout */
2770                 }
2771         }
2772
2773         spin_lock_bh(&pstapriv->auth_list_lock);
2774         if (list_empty(&pstat->auth_list)) {
2775                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
2776                 pstapriv->auth_list_cnt++;
2777         }
2778         spin_unlock_bh(&pstapriv->auth_list_lock);
2779
2780         if (pstat->auth_seq == 0)
2781                 pstat->expire_to = pstapriv->auth_to;
2782
2783         if ((pstat->auth_seq + 1) != seq) {
2784                 DBG_88E("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2785                         seq, pstat->auth_seq+1);
2786                 status = _STATS_OUT_OF_AUTH_SEQ_;
2787                 goto auth_fail;
2788         }
2789
2790         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2)) {
2791                 if (seq == 1) {
2792                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2793                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
2794                         pstat->expire_to = pstapriv->assoc_to;
2795                         pstat->authalg = algorithm;
2796                 } else {
2797                         DBG_88E("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2798                                 seq, pstat->auth_seq+1);
2799                         status = _STATS_OUT_OF_AUTH_SEQ_;
2800                         goto auth_fail;
2801                 }
2802         } else { /*  shared system or auto authentication */
2803                 if (seq == 1) {
2804                         /* prepare for the challenging txt... */
2805
2806                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2807                         pstat->state |= WIFI_FW_AUTH_STATE;
2808                         pstat->authalg = algorithm;
2809                         pstat->auth_seq = 2;
2810                 } else if (seq == 3) {
2811                         /* checking for challenging txt... */
2812                         DBG_88E("checking for challenging txt...\n");
2813
2814                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&ie_len,
2815                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
2816
2817                         if ((p == NULL) || (ie_len <= 0)) {
2818                                 DBG_88E("auth rejected because challenge failure!(1)\n");
2819                                 status = _STATS_CHALLENGE_FAIL_;
2820                                 goto auth_fail;
2821                         }
2822
2823                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
2824                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
2825                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
2826                                 /*  challenging txt is correct... */
2827                                 pstat->expire_to =  pstapriv->assoc_to;
2828                         } else {
2829                                 DBG_88E("auth rejected because challenge failure!\n");
2830                                 status = _STATS_CHALLENGE_FAIL_;
2831                                 goto auth_fail;
2832                         }
2833                 } else {
2834                         DBG_88E("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2835                                 seq, pstat->auth_seq+1);
2836                         status = _STATS_OUT_OF_AUTH_SEQ_;
2837                         goto auth_fail;
2838                 }
2839         }
2840
2841         /*  Now, we are going to issue_auth... */
2842         pstat->auth_seq = seq + 1;
2843
2844         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
2845
2846         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
2847                 pstat->auth_seq = 0;
2848
2849         return _SUCCESS;
2850
2851 auth_fail:
2852
2853         if (pstat)
2854                 rtw_free_stainfo(padapter, pstat);
2855
2856         pstat = &stat;
2857         memset((char *)pstat, '\0', sizeof(stat));
2858         pstat->auth_seq = 2;
2859         memcpy(pstat->hwaddr, sa, 6);
2860
2861         issue_auth(padapter, pstat, (unsigned short)status);
2862
2863         return _FAIL;
2864 }
2865 #endif /* CONFIG_88EU_AP_MODE */
2866
2867 static unsigned int OnAuthClient(struct adapter *padapter,
2868                                  struct recv_frame *precv_frame)
2869 {
2870         unsigned int    seq, len, status, offset;
2871         unsigned char   *p;
2872         unsigned int    go2asoc = 0;
2873         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2874         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2875         u8 *pframe = precv_frame->rx_data;
2876         uint pkt_len = precv_frame->len;
2877
2878         DBG_88E("%s\n", __func__);
2879
2880         /* check A1 matches or not */
2881         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
2882                 return _SUCCESS;
2883
2884         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
2885                 return _SUCCESS;
2886
2887         offset = (GetPrivacy(pframe)) ? 4 : 0;
2888
2889         seq     = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 2));
2890         status  = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 4));
2891
2892         if (status != 0) {
2893                 DBG_88E("clnt auth fail, status: %d\n", status);
2894                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
2895                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2896                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
2897                         else
2898                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
2899                 }
2900
2901                 set_link_timer(pmlmeext, 1);
2902                 goto authclnt_fail;
2903         }
2904
2905         if (seq == 2) {
2906                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
2907                         /*  legendary shared system */
2908                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&len,
2909                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
2910
2911                         if (p == NULL)
2912                                 goto authclnt_fail;
2913
2914                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
2915                         pmlmeinfo->auth_seq = 3;
2916                         issue_auth(padapter, NULL, 0);
2917                         set_link_timer(pmlmeext, REAUTH_TO);
2918
2919                         return _SUCCESS;
2920                 } else {
2921                         /*  open system */
2922                         go2asoc = 1;
2923                 }
2924         } else if (seq == 4) {
2925                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2926                         go2asoc = 1;
2927                 else
2928                         goto authclnt_fail;
2929         } else {
2930                 /*  this is also illegal */
2931                 goto authclnt_fail;
2932         }
2933
2934         if (go2asoc) {
2935                 DBG_88E_LEVEL(_drv_info_, "auth success, start assoc\n");
2936                 start_clnt_assoc(padapter);
2937                 return _SUCCESS;
2938         }
2939 authclnt_fail:
2940         return _FAIL;
2941 }
2942
2943 static unsigned int OnAssocReq(struct adapter *padapter,
2944                                struct recv_frame *precv_frame)
2945 {
2946 #ifdef CONFIG_88EU_AP_MODE
2947         u16 capab_info;
2948         struct rtw_ieee802_11_elems elems;
2949         struct sta_info *pstat;
2950         unsigned char           reassoc, *p, *pos, *wpa_ie;
2951         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
2952         int             i, ie_len, wpa_ie_len, left;
2953         unsigned char           supportRate[16];
2954         int                                     supportRateNum;
2955         unsigned short          status = _STATS_SUCCESSFUL_;
2956         unsigned short          frame_type, ie_offset = 0;
2957         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2958         struct security_priv *psecuritypriv = &padapter->securitypriv;
2959         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2960         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2961         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2962         struct sta_priv *pstapriv = &padapter->stapriv;
2963         u8 *pframe = precv_frame->rx_data;
2964         uint pkt_len = precv_frame->len;
2965
2966         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2967                 return _FAIL;
2968
2969         frame_type = GetFrameSubType(pframe);
2970         if (frame_type == WIFI_ASSOCREQ) {
2971                 reassoc = 0;
2972                 ie_offset = _ASOCREQ_IE_OFFSET_;
2973         } else { /*  WIFI_REASSOCREQ */
2974                 reassoc = 1;
2975                 ie_offset = _REASOCREQ_IE_OFFSET_;
2976         }
2977
2978
2979         if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
2980                 DBG_88E("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
2981                        "\n", reassoc, (unsigned long)pkt_len);
2982                 return _FAIL;
2983         }
2984
2985         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2986         if (pstat == NULL) {
2987                 status = _RSON_CLS2_;
2988                 goto asoc_class2_error;
2989         }
2990
2991         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
2992
2993         left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
2994         pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
2995
2996
2997         DBG_88E("%s\n", __func__);
2998
2999         /*  check if this stat has been successfully authenticated/assocated */
3000         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
3001                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
3002                         status = _RSON_CLS2_;
3003                         goto asoc_class2_error;
3004                 } else {
3005                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
3006                         pstat->state |= WIFI_FW_ASSOC_STATE;
3007                 }
3008         } else {
3009                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
3010                 pstat->state |= WIFI_FW_ASSOC_STATE;
3011         }
3012         pstat->capability = capab_info;
3013         /* now parse all ieee802_11 ie to point to elems */
3014         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
3015             !elems.ssid) {
3016                 DBG_88E("STA %pM sent invalid association request\n",
3017                         pstat->hwaddr);
3018                 status = _STATS_FAILURE_;
3019                 goto OnAssocReqFail;
3020         }
3021
3022
3023         /*  now we should check all the fields... */
3024         /*  checking SSID */
3025         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
3026                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3027         if (p == NULL)
3028                 status = _STATS_FAILURE_;
3029
3030         if (ie_len == 0) { /*  broadcast ssid, however it is not allowed in assocreq */
3031                 status = _STATS_FAILURE_;
3032         } else {
3033                 /*  check if ssid match */
3034                 if (memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
3035                         status = _STATS_FAILURE_;
3036
3037                 if (ie_len != cur->Ssid.SsidLength)
3038                         status = _STATS_FAILURE_;
3039         }
3040
3041         if (_STATS_SUCCESSFUL_ != status)
3042                 goto OnAssocReqFail;
3043
3044         /*  check if the supported rate is ok */
3045         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3046         if (p == NULL) {
3047                 DBG_88E("Rx a sta assoc-req which supported rate is empty!\n");
3048                 /*  use our own rate set as statoin used */
3049                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
3050                 /* supportRateNum = AP_BSSRATE_LEN; */
3051
3052                 status = _STATS_FAILURE_;
3053                 goto OnAssocReqFail;
3054         } else {
3055                 memcpy(supportRate, p+2, ie_len);
3056                 supportRateNum = ie_len;
3057
3058                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_, &ie_len,
3059                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3060                 if (p !=  NULL) {
3061                         if (supportRateNum <= sizeof(supportRate)) {
3062                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
3063                                 supportRateNum += ie_len;
3064                         }
3065                 }
3066         }
3067
3068         /* todo: mask supportRate between AP & STA -> move to update raid */
3069         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
3070
3071         /* update station supportRate */
3072         pstat->bssratelen = supportRateNum;
3073         memcpy(pstat->bssrateset, supportRate, supportRateNum);
3074         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
3075
3076         /* check RSN/WPA/WPS */
3077         pstat->dot8021xalg = 0;
3078         pstat->wpa_psk = 0;
3079         pstat->wpa_group_cipher = 0;
3080         pstat->wpa2_group_cipher = 0;
3081         pstat->wpa_pairwise_cipher = 0;
3082         pstat->wpa2_pairwise_cipher = 0;
3083         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
3084         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
3085                 int group_cipher = 0, pairwise_cipher = 0;
3086
3087                 wpa_ie = elems.rsn_ie;
3088                 wpa_ie_len = elems.rsn_ie_len;
3089
3090                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3091                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3092                         pstat->wpa_psk |= BIT(1);
3093
3094                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
3095                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
3096
3097                         if (!pstat->wpa2_group_cipher)
3098                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3099
3100                         if (!pstat->wpa2_pairwise_cipher)
3101                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3102                 } else {
3103                         status = WLAN_STATUS_INVALID_IE;
3104                 }
3105         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
3106                 int group_cipher = 0, pairwise_cipher = 0;
3107
3108                 wpa_ie = elems.wpa_ie;
3109                 wpa_ie_len = elems.wpa_ie_len;
3110
3111                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3112                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3113                         pstat->wpa_psk |= BIT(0);
3114
3115                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
3116                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
3117
3118                         if (!pstat->wpa_group_cipher)
3119                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3120
3121                         if (!pstat->wpa_pairwise_cipher)
3122                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3123                 } else {
3124                         status = WLAN_STATUS_INVALID_IE;
3125                 }
3126         } else {
3127                 wpa_ie = NULL;
3128                 wpa_ie_len = 0;
3129         }
3130
3131         if (_STATS_SUCCESSFUL_ != status)
3132                 goto OnAssocReqFail;
3133
3134         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
3135         if (wpa_ie == NULL) {
3136                 if (elems.wps_ie) {
3137                         DBG_88E("STA included WPS IE in "
3138                                    "(Re)Association Request - assume WPS is "
3139                                    "used\n");
3140                         pstat->flags |= WLAN_STA_WPS;
3141                         /* wpabuf_free(sta->wps_ie); */
3142                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
3143                         /*                              elems.wps_ie_len - 4); */
3144                 } else {
3145                         DBG_88E("STA did not include WPA/RSN IE "
3146                                    "in (Re)Association Request - possible WPS "
3147                                    "use\n");
3148                         pstat->flags |= WLAN_STA_MAYBE_WPS;
3149                 }
3150
3151
3152                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
3153                 /*  that the selected registrar of AP is _FLASE */
3154                 if ((psecuritypriv->wpa_psk > 0) && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
3155                         if (pmlmepriv->wps_beacon_ie) {
3156                                 u8 selected_registrar = 0;
3157
3158                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
3159
3160                                 if (!selected_registrar) {
3161                                         DBG_88E("selected_registrar is false , or AP is not ready to do WPS\n");
3162
3163                                         status = _STATS_UNABLE_HANDLE_STA_;
3164
3165                                         goto OnAssocReqFail;
3166                                 }
3167                         }
3168                 }
3169         } else {
3170                 int copy_len;
3171
3172                 if (psecuritypriv->wpa_psk == 0) {
3173                         DBG_88E("STA %pM: WPA/RSN IE in association "
3174                         "request, but AP don't support WPA/RSN\n", pstat->hwaddr);
3175
3176                         status = WLAN_STATUS_INVALID_IE;
3177
3178                         goto OnAssocReqFail;
3179                 }
3180
3181                 if (elems.wps_ie) {
3182                         DBG_88E("STA included WPS IE in "
3183                                    "(Re)Association Request - WPS is "
3184                                    "used\n");
3185                         pstat->flags |= WLAN_STA_WPS;
3186                         copy_len = 0;
3187                 } else {
3188                         copy_len = min_t(int, wpa_ie_len + 2, sizeof(pstat->wpa_ie));
3189                 }
3190                 if (copy_len > 0)
3191                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
3192         }
3193         /*  check if there is WMM IE & support WWM-PS */
3194         pstat->flags &= ~WLAN_STA_WME;
3195         pstat->qos_option = 0;
3196         pstat->qos_info = 0;
3197         pstat->has_legacy_ac = true;
3198         pstat->uapsd_vo = 0;
3199         pstat->uapsd_vi = 0;
3200         pstat->uapsd_be = 0;
3201         pstat->uapsd_bk = 0;
3202         if (pmlmepriv->qospriv.qos_option) {
3203                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
3204                 for (;;) {
3205                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3206                         if (p != NULL) {
3207                                 if (!memcmp(p+2, WMM_IE, 6)) {
3208                                         pstat->flags |= WLAN_STA_WME;
3209
3210                                         pstat->qos_option = 1;
3211                                         pstat->qos_info = *(p+8);
3212
3213                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
3214
3215                                         if ((pstat->qos_info&0xf) != 0xf)
3216                                                 pstat->has_legacy_ac = true;
3217                                         else
3218                                                 pstat->has_legacy_ac = false;
3219
3220                                         if (pstat->qos_info&0xf) {
3221                                                 if (pstat->qos_info&BIT(0))
3222                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
3223                                                 else
3224                                                         pstat->uapsd_vo = 0;
3225
3226                                                 if (pstat->qos_info&BIT(1))
3227                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
3228                                                 else
3229                                                         pstat->uapsd_vi = 0;
3230
3231                                                 if (pstat->qos_info&BIT(2))
3232                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
3233                                                 else
3234                                                         pstat->uapsd_bk = 0;
3235
3236                                                 if (pstat->qos_info&BIT(3))
3237                                                         pstat->uapsd_be = BIT(0)|BIT(1);
3238                                                 else
3239                                                         pstat->uapsd_be = 0;
3240                                         }
3241                                         break;
3242                                 }
3243                         } else {
3244                                 break;
3245                         }
3246                         p = p + ie_len + 2;
3247                 }
3248         }
3249
3250         /* save HT capabilities in the sta object */
3251         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
3252         if (elems.ht_capabilities &&
3253             elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
3254                 pstat->flags |= WLAN_STA_HT;
3255
3256                 pstat->flags |= WLAN_STA_WME;
3257
3258                 memcpy(&pstat->htpriv.ht_cap,
3259                        elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
3260         } else {
3261                 pstat->flags &= ~WLAN_STA_HT;
3262         }
3263         if ((!pmlmepriv->htpriv.ht_option) && (pstat->flags&WLAN_STA_HT)) {
3264                 status = _STATS_FAILURE_;
3265                 goto OnAssocReqFail;
3266         }
3267
3268         if ((pstat->flags & WLAN_STA_HT) &&
3269             ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
3270             (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
3271                 DBG_88E("HT: %pM tried to "
3272                         "use TKIP with HT association\n", pstat->hwaddr);
3273
3274                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
3275                 /* goto OnAssocReqFail; */
3276         }
3277
3278         pstat->flags |= WLAN_STA_NONERP;
3279         for (i = 0; i < pstat->bssratelen; i++) {
3280                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
3281                         pstat->flags &= ~WLAN_STA_NONERP;
3282                         break;
3283                 }
3284         }
3285
3286         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3287                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
3288         else
3289                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3290
3291
3292
3293         if (status != _STATS_SUCCESSFUL_)
3294                 goto OnAssocReqFail;
3295
3296         /* TODO: identify_proprietary_vendor_ie(); */
3297         /*  Realtek proprietary IE */
3298         /*  identify if this is Broadcom sta */
3299         /*  identify if this is ralink sta */
3300         /*  Customer proprietary IE */
3301
3302         /* get a unique AID */
3303         if (pstat->aid > 0) {
3304                 DBG_88E("  old AID %d\n", pstat->aid);
3305         } else {
3306                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
3307                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
3308                                 break;
3309
3310                 /* if (pstat->aid > NUM_STA) { */
3311                 if (pstat->aid > pstapriv->max_num_sta) {
3312                         pstat->aid = 0;
3313
3314                         DBG_88E("  no room for more AIDs\n");
3315
3316                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3317
3318                         goto OnAssocReqFail;
3319                 } else {
3320                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
3321                         DBG_88E("allocate new AID=(%d)\n", pstat->aid);
3322                 }
3323         }
3324
3325         pstat->state &= (~WIFI_FW_ASSOC_STATE);
3326         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
3327
3328         spin_lock_bh(&pstapriv->auth_list_lock);
3329         if (!list_empty(&pstat->auth_list)) {
3330                 list_del_init(&pstat->auth_list);
3331                 pstapriv->auth_list_cnt--;
3332         }
3333         spin_unlock_bh(&pstapriv->auth_list_lock);
3334
3335         spin_lock_bh(&pstapriv->asoc_list_lock);
3336         if (list_empty(&pstat->asoc_list)) {
3337                 pstat->expire_to = pstapriv->expire_to;
3338                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
3339                 pstapriv->asoc_list_cnt++;
3340         }
3341         spin_unlock_bh(&pstapriv->asoc_list_lock);
3342
3343         /*  now the station is qualified to join our BSS... */
3344         if ((pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_ == status)) {
3345                 /* 1 bss_cap_update & sta_info_update */
3346                 bss_cap_update_on_sta_join(padapter, pstat);
3347                 sta_info_update(padapter, pstat);
3348
3349                 /* issue assoc rsp before notify station join event. */
3350                 if (frame_type == WIFI_ASSOCREQ)
3351                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3352                 else
3353                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3354
3355                 /* 2 - report to upper layer */
3356                 DBG_88E("indicate_sta_join_event to upper layer - hostapd\n");
3357                 rtw_indicate_sta_assoc_event(padapter, pstat);
3358
3359                 /* 3-(1) report sta add event */
3360                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
3361         }
3362
3363         return _SUCCESS;
3364
3365 asoc_class2_error:
3366
3367         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
3368
3369         return _FAIL;
3370
3371 OnAssocReqFail:
3372
3373         pstat->aid = 0;
3374         if (frame_type == WIFI_ASSOCREQ)
3375                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3376         else
3377                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3378
3379 #endif /* CONFIG_88EU_AP_MODE */
3380
3381         return _FAIL;
3382 }
3383
3384 static unsigned int OnAssocRsp(struct adapter *padapter,
3385                                struct recv_frame *precv_frame)
3386 {
3387         uint i;
3388         int res;
3389         unsigned short  status;
3390         struct ndis_802_11_var_ie *pIE;
3391         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3392         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3393         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3394         /* struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network); */
3395         u8 *pframe = precv_frame->rx_data;
3396         uint pkt_len = precv_frame->len;
3397
3398         DBG_88E("%s\n", __func__);
3399
3400         /* check A1 matches or not */
3401         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
3402                 return _SUCCESS;
3403
3404         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
3405                 return _SUCCESS;
3406
3407         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
3408                 return _SUCCESS;
3409
3410         del_timer_sync(&pmlmeext->link_timer);
3411
3412         /* status */
3413         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
3414         if (status > 0) {
3415                 DBG_88E("assoc reject, status code: %d\n", status);
3416                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
3417                 res = -4;
3418                 goto report_assoc_result;
3419         }
3420
3421         /* get capabilities */
3422         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3423
3424         /* set slot time */
3425         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
3426
3427         /* AID */
3428         pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
3429         res = pmlmeinfo->aid;
3430
3431         /* following are moved to join event callback function */
3432         /* to handle HT, WMM, rate adaptive, update MAC reg */
3433         /* for not to handle the synchronous IO in the tasklet */
3434         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
3435                 pIE = (struct ndis_802_11_var_ie *)(pframe + i);
3436
3437                 switch (pIE->ElementID) {
3438                 case _VENDOR_SPECIFIC_IE_:
3439                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6)) /* WMM */
3440                                 WMM_param_handler(padapter, pIE);
3441                         break;
3442                 case _HT_CAPABILITY_IE_:        /* HT caps */
3443                         HT_caps_handler(padapter, pIE);
3444                         break;
3445                 case _HT_EXTRA_INFO_IE_:        /* HT info */
3446                         HT_info_handler(padapter, pIE);
3447                         break;
3448                 case _ERPINFO_IE_:
3449                         ERP_IE_handler(padapter, pIE);
3450                 default:
3451                         break;
3452                 }
3453
3454                 i += (pIE->Length + 2);
3455         }
3456
3457         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
3458         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
3459
3460         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
3461
3462 report_assoc_result:
3463         if (res > 0) {
3464                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
3465         } else {
3466                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
3467         }
3468
3469         report_join_res(padapter, res);
3470
3471         return _SUCCESS;
3472 }
3473
3474 static unsigned int OnDeAuth(struct adapter *padapter,
3475                              struct recv_frame *precv_frame)
3476 {
3477         unsigned short  reason;
3478         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3479         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3480         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3481         u8 *pframe = precv_frame->rx_data;
3482         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3483
3484         /* check A3 */
3485         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3486                 return _SUCCESS;
3487
3488         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3489
3490         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3491
3492 #ifdef CONFIG_88EU_AP_MODE
3493         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3494                 struct sta_info *psta;
3495                 struct sta_priv *pstapriv = &padapter->stapriv;
3496
3497                 DBG_88E_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
3498                               reason, GetAddr2Ptr(pframe));
3499
3500                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3501                 if (psta) {
3502                         u8 updated = 0;
3503
3504                         spin_lock_bh(&pstapriv->asoc_list_lock);
3505                         if (!list_empty(&psta->asoc_list)) {
3506                                 list_del_init(&psta->asoc_list);
3507                                 pstapriv->asoc_list_cnt--;
3508                                 updated = ap_free_sta(padapter, psta, false, reason);
3509                         }
3510                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3511
3512                         associated_clients_update(padapter, updated);
3513                 }
3514
3515
3516                 return _SUCCESS;
3517         } else
3518 #endif
3519         {
3520                 DBG_88E_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM\n",
3521                               reason, GetAddr3Ptr(pframe));
3522
3523                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3524         }
3525         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3526         return _SUCCESS;
3527 }
3528
3529 static unsigned int OnDisassoc(struct adapter *padapter,
3530                                struct recv_frame *precv_frame)
3531 {
3532         u16 reason;
3533         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3534         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3535         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3536         u8 *pframe = precv_frame->rx_data;
3537         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3538
3539         /* check A3 */
3540         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3541                 return _SUCCESS;
3542
3543         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3544
3545         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3546
3547 #ifdef CONFIG_88EU_AP_MODE
3548         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3549                 struct sta_info *psta;
3550                 struct sta_priv *pstapriv = &padapter->stapriv;
3551
3552                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3553                               reason, GetAddr2Ptr(pframe));
3554
3555                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3556                 if (psta) {
3557                         u8 updated = 0;
3558
3559                         spin_lock_bh(&pstapriv->asoc_list_lock);
3560                         if (!list_empty(&psta->asoc_list)) {
3561                                 list_del_init(&psta->asoc_list);
3562                                 pstapriv->asoc_list_cnt--;
3563                                 updated = ap_free_sta(padapter, psta, false, reason);
3564                         }
3565                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3566
3567                         associated_clients_update(padapter, updated);
3568                 }
3569
3570                 return _SUCCESS;
3571         } else
3572 #endif
3573         {
3574                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3575                               reason, GetAddr3Ptr(pframe));
3576
3577                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3578         }
3579         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3580         return _SUCCESS;
3581 }
3582
3583 static unsigned int OnAtim(struct adapter *padapter,
3584                            struct recv_frame *precv_frame)
3585 {
3586         DBG_88E("%s\n", __func__);
3587         return _SUCCESS;
3588 }
3589
3590 static unsigned int on_action_spct(struct adapter *padapter,
3591                                    struct recv_frame *precv_frame)
3592 {
3593         struct sta_info *psta = NULL;
3594         struct sta_priv *pstapriv = &padapter->stapriv;
3595         u8 *pframe = precv_frame->rx_data;
3596         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3597         u8 category;
3598         u8 action;
3599
3600         DBG_88E(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
3601
3602         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3603
3604         if (!psta)
3605                 goto exit;
3606
3607         category = frame_body[0];
3608         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
3609                 goto exit;
3610
3611         action = frame_body[1];
3612         switch (action) {
3613         case RTW_WLAN_ACTION_SPCT_MSR_REQ:
3614         case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
3615         case RTW_WLAN_ACTION_SPCT_TPC_REQ:
3616         case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
3617                 break;
3618         case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
3619                 break;
3620         default:
3621                 break;
3622         }
3623
3624 exit:
3625         return _FAIL;
3626 }
3627
3628 static unsigned int OnAction_qos(struct adapter *padapter,
3629                                  struct recv_frame *precv_frame)
3630 {
3631         return _SUCCESS;
3632 }
3633
3634 static unsigned int OnAction_dls(struct adapter *padapter,
3635                                  struct recv_frame *precv_frame)
3636 {
3637         return _SUCCESS;
3638 }
3639
3640 static unsigned int OnAction_back(struct adapter *padapter,
3641                                   struct recv_frame *precv_frame)
3642 {
3643         u8 *addr;
3644         struct sta_info *psta = NULL;
3645         struct recv_reorder_ctrl *preorder_ctrl;
3646         unsigned char           *frame_body;
3647         unsigned char           category, action;
3648         unsigned short  tid, status, reason_code = 0;
3649         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3650         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3651         u8 *pframe = precv_frame->rx_data;
3652         struct sta_priv *pstapriv = &padapter->stapriv;
3653         /* check RA matches or not */
3654         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe),
3655                    ETH_ALEN))/* for if1, sta/ap mode */
3656                 return _SUCCESS;
3657
3658         DBG_88E("%s\n", __func__);
3659
3660         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3661                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3662                         return _SUCCESS;
3663
3664         addr = GetAddr2Ptr(pframe);
3665         psta = rtw_get_stainfo(pstapriv, addr);
3666
3667         if (psta == NULL)
3668                 return _SUCCESS;
3669
3670         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3671
3672         category = frame_body[0];
3673         if (category == RTW_WLAN_CATEGORY_BACK) { /*  representing Block Ack */
3674                 if (!pmlmeinfo->HT_enable)
3675                         return _SUCCESS;
3676                 action = frame_body[1];
3677                 DBG_88E("%s, action=%d\n", __func__, action);
3678                 switch (action) {
3679                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
3680                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
3681                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
3682
3683                         /* 37 = reject ADDBA Req */
3684                         issue_action_BA(padapter, addr,
3685                                         RTW_WLAN_ACTION_ADDBA_RESP,
3686                                         pmlmeinfo->accept_addba_req ? 0 : 37);
3687                         break;
3688                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
3689                         status = get_unaligned_le16(&frame_body[3]);
3690                         tid = (frame_body[5] >> 2) & 0x7;
3691                         if (status == 0) {      /* successful */
3692                                 DBG_88E("agg_enable for TID=%d\n", tid);
3693                                 psta->htpriv.agg_enable_bitmap |= 1 << tid;
3694                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3695                         } else {
3696                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3697                         }
3698                         break;
3699                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
3700                         if ((frame_body[3] & BIT(3)) == 0) {
3701                                 psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3702                                 psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3703                                 reason_code = get_unaligned_le16(&frame_body[4]);
3704                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
3705                                 tid = (frame_body[3] >> 4) & 0x0F;
3706                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
3707                                 preorder_ctrl->enable = false;
3708                                 preorder_ctrl->indicate_seq = 0xffff;
3709                         }
3710                         DBG_88E("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
3711                         /* todo: how to notify the host while receiving DELETE BA */
3712                         break;
3713                 default:
3714                         break;
3715                 }
3716         }
3717         return _SUCCESS;
3718 }
3719
3720 static s32 rtw_action_public_decache(struct recv_frame *recv_frame, s32 token)
3721 {
3722         struct adapter *adapter = recv_frame->adapter;
3723         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
3724         u8 *frame = recv_frame->rx_data;
3725         u16 seq_ctrl = ((recv_frame->attrib.seq_num&0xffff) << 4) |
3726                 (recv_frame->attrib.frag_num & 0xf);
3727
3728         if (GetRetry(frame)) {
3729                 if (token >= 0) {
3730                         if ((seq_ctrl == mlmeext->action_public_rxseq) && (token == mlmeext->action_public_dialog_token)) {
3731                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
3732                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
3733                                 return _FAIL;
3734                         }
3735                 } else {
3736                         if (seq_ctrl == mlmeext->action_public_rxseq) {
3737                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
3738                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
3739                                 return _FAIL;
3740                         }
3741                 }
3742         }
3743
3744         mlmeext->action_public_rxseq = seq_ctrl;
3745
3746         if (token >= 0)
3747                 mlmeext->action_public_dialog_token = token;
3748
3749         return _SUCCESS;
3750 }
3751
3752 static unsigned int on_action_public_p2p(struct recv_frame *precv_frame)
3753 {
3754         u8 *pframe = precv_frame->rx_data;
3755         u8 *frame_body;
3756         u8 dialogToken = 0;
3757
3758         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3759         dialogToken = frame_body[7];
3760
3761         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
3762                 return _FAIL;
3763
3764         return _SUCCESS;
3765 }
3766
3767 static unsigned int on_action_public_vendor(struct recv_frame *precv_frame)
3768 {
3769         unsigned int ret = _FAIL;
3770         u8 *pframe = precv_frame->rx_data;
3771         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3772
3773         if (!memcmp(frame_body + 2, P2P_OUI, 4))
3774                 ret = on_action_public_p2p(precv_frame);
3775
3776         return ret;
3777 }
3778
3779 static unsigned int on_action_public_default(struct recv_frame *precv_frame, u8 action)
3780 {
3781         unsigned int ret = _FAIL;
3782         u8 *pframe = precv_frame->rx_data;
3783         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3784         u8 token;
3785
3786         token = frame_body[2];
3787
3788         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
3789                 goto exit;
3790
3791         ret = _SUCCESS;
3792
3793 exit:
3794         return ret;
3795 }
3796
3797 static unsigned int on_action_public(struct adapter *padapter,
3798                                      struct recv_frame *precv_frame)
3799 {
3800         unsigned int ret = _FAIL;
3801         u8 *pframe = precv_frame->rx_data;
3802         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3803         u8 category, action;
3804
3805         /* check RA matches or not */
3806         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
3807                 goto exit;
3808
3809         category = frame_body[0];
3810         if (category != RTW_WLAN_CATEGORY_PUBLIC)
3811                 goto exit;
3812
3813         action = frame_body[1];
3814         switch (action) {
3815         case ACT_PUBLIC_VENDOR:
3816                 ret = on_action_public_vendor(precv_frame);
3817                 break;
3818         default:
3819                 ret = on_action_public_default(precv_frame, action);
3820                 break;
3821         }
3822
3823 exit:
3824         return ret;
3825 }
3826
3827 static unsigned int OnAction_ht(struct adapter *padapter,
3828                                 struct recv_frame *precv_frame)
3829 {
3830         return _SUCCESS;
3831 }
3832
3833 static unsigned int OnAction_wmm(struct adapter *padapter,
3834                                  struct recv_frame *precv_frame)
3835 {
3836         return _SUCCESS;
3837 }
3838
3839 static unsigned int OnAction_p2p(struct adapter *padapter,
3840                                  struct recv_frame *precv_frame)
3841 {
3842         return _SUCCESS;
3843 }
3844
3845 static unsigned int DoReserved(struct adapter *padapter,
3846                                struct recv_frame *precv_frame)
3847 {
3848         return _SUCCESS;
3849 }
3850
3851 static struct action_handler OnAction_tbl[] = {
3852         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
3853         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
3854         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
3855         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
3856         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
3857         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
3858         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
3859         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
3860         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
3861         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
3862         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
3863 };
3864
3865 static unsigned int OnAction(struct adapter *padapter,
3866                              struct recv_frame *precv_frame)
3867 {
3868         int i;
3869         unsigned char   category;
3870         struct action_handler *ptable;
3871         unsigned char   *frame_body;
3872         u8 *pframe = precv_frame->rx_data;
3873
3874         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3875
3876         category = frame_body[0];
3877
3878         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
3879                 ptable = &OnAction_tbl[i];
3880                 if (category == ptable->num)
3881                         ptable->func(padapter, precv_frame);
3882         }
3883         return _SUCCESS;
3884 }
3885
3886 /****************************************************************************
3887
3888 Following are the initialization functions for WiFi MLME
3889
3890 *****************************************************************************/
3891
3892 static struct mlme_handler mlme_sta_tbl[] = {
3893         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
3894         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
3895         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
3896         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
3897         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
3898         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
3899
3900         /*----------------------------------------------------------
3901                                         below 2 are reserved
3902         -----------------------------------------------------------*/
3903         {0,                                     "DoReserved",           &DoReserved},
3904         {0,                                     "DoReserved",           &DoReserved},
3905         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
3906         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
3907         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
3908         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
3909         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
3910         {WIFI_ACTION,           "OnAction",             &OnAction},
3911 };
3912
3913 int init_hw_mlme_ext(struct adapter *padapter)
3914 {
3915         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3916
3917         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3918         return _SUCCESS;
3919 }
3920
3921 static void init_mlme_ext_priv_value(struct adapter *padapter)
3922 {
3923         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3924         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3925         unsigned char   mixed_datarate[NumRates] = {
3926                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3927                 _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_,
3928                  _48M_RATE_, _54M_RATE_, 0xff
3929         };
3930         unsigned char   mixed_basicrate[NumRates] = {
3931                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3932                 _12M_RATE_, _24M_RATE_, 0xff,
3933         };
3934
3935         atomic_set(&pmlmeext->event_seq, 0);
3936         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
3937
3938         pmlmeext->cur_channel = padapter->registrypriv.channel;
3939         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
3940         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
3941         pmlmeext->oper_channel = pmlmeext->cur_channel;
3942         pmlmeext->oper_bwmode = pmlmeext->cur_bwmode;
3943         pmlmeext->oper_ch_offset = pmlmeext->cur_ch_offset;
3944         pmlmeext->retry = 0;
3945
3946         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
3947
3948         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
3949         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
3950
3951         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
3952
3953         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3954         pmlmeext->sitesurvey_res.channel_idx = 0;
3955         pmlmeext->sitesurvey_res.bss_cnt = 0;
3956         pmlmeext->scan_abort = false;
3957
3958         pmlmeinfo->state = WIFI_FW_NULL_STATE;
3959         pmlmeinfo->reauth_count = 0;
3960         pmlmeinfo->reassoc_count = 0;
3961         pmlmeinfo->link_count = 0;
3962         pmlmeinfo->auth_seq = 0;
3963         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
3964         pmlmeinfo->key_index = 0;
3965         pmlmeinfo->iv = 0;
3966
3967         pmlmeinfo->enc_algo = _NO_PRIVACY_;
3968         pmlmeinfo->authModeToggle = 0;
3969
3970         memset(pmlmeinfo->chg_txt, 0, 128);
3971
3972         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
3973         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
3974
3975         pmlmeinfo->dialogToken = 0;
3976
3977         pmlmeext->action_public_rxseq = 0xffff;
3978         pmlmeext->action_public_dialog_token = 0xff;
3979 }
3980
3981 static int has_channel(struct rt_channel_info *channel_set,
3982                                            u8 chanset_size,
3983                                            u8 chan) {
3984         int i;
3985
3986         for (i = 0; i < chanset_size; i++) {
3987                 if (channel_set[i].ChannelNum == chan)
3988                         return 1;
3989         }
3990         return 0;
3991 }
3992
3993 static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
3994                                                           u8 chanset_size,
3995                                                           struct p2p_channels *channel_list) {
3996         struct p2p_oper_class_map op_class[] = {
3997                 { IEEE80211G,  81,   1,  13,  1, BW20 },
3998                 { IEEE80211G,  82,  14,  14,  1, BW20 },
3999                 { -1, 0, 0, 0, 0, BW20 }
4000         };
4001
4002         int cla, op;
4003
4004         cla = 0;
4005
4006         for (op = 0; op_class[op].op_class; op++) {
4007                 u8 ch;
4008                 struct p2p_oper_class_map *o = &op_class[op];
4009                 struct p2p_reg_class *reg = NULL;
4010
4011                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
4012                         if (!has_channel(channel_set, chanset_size, ch)) {
4013                                 continue;
4014                         }
4015
4016                         if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
4017                                 continue;
4018
4019                         if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
4020                             ((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
4021                                 continue;
4022
4023                         if (reg == NULL) {
4024                                 reg = &channel_list->reg_class[cla];
4025                                 cla++;
4026                                 reg->reg_class = o->op_class;
4027                                 reg->channels = 0;
4028                         }
4029                         reg->channel[reg->channels] = ch;
4030                         reg->channels++;
4031                 }
4032         }
4033         channel_list->reg_classes = cla;
4034 }
4035
4036 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
4037 {
4038         u8 index, chanset_size = 0;
4039         u8 b2_4GBand = false;
4040         u8 Index2G = 0;
4041
4042         memset(channel_set, 0, sizeof(struct rt_channel_info) * MAX_CHANNEL_NUM);
4043
4044         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
4045                 DBG_88E("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
4046                 return chanset_size;
4047         }
4048
4049         if (padapter->registrypriv.wireless_mode & WIRELESS_11G) {
4050                 b2_4GBand = true;
4051                 if (RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
4052                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
4053                 else
4054                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
4055         }
4056
4057         if (b2_4GBand) {
4058                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
4059                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
4060
4061                         if ((RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) ||/* Channel 1~11 is active, and 12~14 is passive */
4062                             (RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G == ChannelPlan)) {
4063                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
4064                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4065                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
4066                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
4067                         } else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
4068                                    RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) {/*  channel 12~13, passive scan */
4069                                 if (channel_set[chanset_size].ChannelNum <= 11)
4070                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4071                                 else
4072                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
4073                         } else {
4074                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4075                         }
4076
4077                         chanset_size++;
4078                 }
4079         }
4080         return chanset_size;
4081 }
4082
4083 int     init_mlme_ext_priv(struct adapter *padapter)
4084 {
4085         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4086         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4087         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4088         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4089
4090         pmlmeext->padapter = padapter;
4091
4092         init_mlme_ext_priv_value(padapter);
4093         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
4094
4095         init_mlme_ext_timer(padapter);
4096
4097 #ifdef CONFIG_88EU_AP_MODE
4098         init_mlme_ap_info(padapter);
4099 #endif
4100
4101         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
4102         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
4103
4104         pmlmeext->chan_scan_time = SURVEY_TO;
4105         pmlmeext->mlmeext_init = true;
4106
4107
4108         pmlmeext->active_keep_alive_check = true;
4109
4110         return _SUCCESS;
4111 }
4112
4113 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
4114 {
4115         struct adapter *padapter = pmlmeext->padapter;
4116
4117         if (!padapter)
4118                 return;
4119
4120         if (padapter->bDriverStopped) {
4121                 del_timer_sync(&pmlmeext->survey_timer);
4122                 del_timer_sync(&pmlmeext->link_timer);
4123         }
4124 }
4125
4126 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, struct recv_frame *precv_frame)
4127 {
4128         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4129         u8 *pframe = precv_frame->rx_data;
4130
4131         if (ptable->func) {
4132                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4133                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4134                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4135                         return;
4136                 ptable->func(padapter, precv_frame);
4137         }
4138 }
4139
4140 void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame)
4141 {
4142         int index;
4143         struct mlme_handler *ptable;
4144 #ifdef CONFIG_88EU_AP_MODE
4145         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4146 #endif /* CONFIG_88EU_AP_MODE */
4147         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4148         u8 *pframe = precv_frame->rx_data;
4149         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
4150
4151         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
4152                  ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
4153                   (unsigned int)GetFrameType(pframe),
4154                   (unsigned int)GetFrameSubType(pframe)));
4155
4156         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
4157                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
4158                          ("mgt_dispatcher: type(0x%x) error!\n",
4159                           (unsigned int)GetFrameType(pframe)));
4160                 return;
4161         }
4162
4163         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4164         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4165             memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4166                 return;
4167
4168         ptable = mlme_sta_tbl;
4169
4170         index = GetFrameSubType(pframe) >> 4;
4171
4172         if (index > 13) {
4173                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type=%d\n", index));
4174                 return;
4175         }
4176         ptable += index;
4177
4178         if (psta != NULL) {
4179                 if (GetRetry(pframe)) {
4180                         if (precv_frame->attrib.seq_num ==
4181                             psta->RxMgmtFrameSeqNum) {
4182                                 /* drop the duplicate management frame */
4183                                 DBG_88E("Drop duplicate management frame with seq_num=%d.\n",
4184                                         precv_frame->attrib.seq_num);
4185                                 return;
4186                         }
4187                 }
4188                 psta->RxMgmtFrameSeqNum = precv_frame->attrib.seq_num;
4189         }
4190
4191 #ifdef CONFIG_88EU_AP_MODE
4192         switch (GetFrameSubType(pframe)) {
4193         case WIFI_AUTH:
4194                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
4195                         ptable->func = &OnAuth;
4196                 else
4197                         ptable->func = &OnAuthClient;
4198                 /* fall through */
4199         case WIFI_ASSOCREQ:
4200         case WIFI_REASSOCREQ:
4201         case WIFI_PROBEREQ:
4202         case WIFI_BEACON:
4203         case WIFI_ACTION:
4204                 _mgt_dispatcher(padapter, ptable, precv_frame);
4205                 break;
4206         default:
4207                 _mgt_dispatcher(padapter, ptable, precv_frame);
4208                 break;
4209         }
4210 #else
4211         _mgt_dispatcher(padapter, ptable, precv_frame);
4212 #endif
4213 }
4214
4215 /****************************************************************************
4216
4217 Following are the functions to report events
4218
4219 *****************************************************************************/
4220
4221 void report_survey_event(struct adapter *padapter,
4222                          struct recv_frame *precv_frame)
4223 {
4224         struct cmd_obj *pcmd_obj;
4225         u8 *pevtcmd;
4226         u32 cmdsz;
4227         struct survey_event     *psurvey_evt;
4228         struct C2HEvent_Header *pc2h_evt_hdr;
4229         struct mlme_ext_priv *pmlmeext;
4230         struct cmd_priv *pcmdpriv;
4231
4232         if (!padapter)
4233                 return;
4234
4235         pmlmeext = &padapter->mlmeextpriv;
4236         pcmdpriv = &padapter->cmdpriv;
4237
4238
4239         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4240         if (!pcmd_obj)
4241                 return;
4242
4243         cmdsz = sizeof(struct survey_event) + sizeof(struct C2HEvent_Header);
4244         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4245         if (!pevtcmd) {
4246                 kfree(pcmd_obj);
4247                 return;
4248         }
4249
4250         INIT_LIST_HEAD(&pcmd_obj->list);
4251
4252         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4253         pcmd_obj->cmdsz = cmdsz;
4254         pcmd_obj->parmbuf = pevtcmd;
4255
4256         pcmd_obj->rsp = NULL;
4257         pcmd_obj->rspsz  = 0;
4258
4259         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4260         pc2h_evt_hdr->len = sizeof(struct survey_event);
4261         pc2h_evt_hdr->ID = _Survey_EVT_;
4262         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4263
4264         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4265
4266         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4267                 kfree(pcmd_obj);
4268                 kfree(pevtcmd);
4269                 return;
4270         }
4271
4272         process_80211d(padapter, &psurvey_evt->bss);
4273
4274         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4275
4276         pmlmeext->sitesurvey_res.bss_cnt++;
4277 }
4278
4279 void report_surveydone_event(struct adapter *padapter)
4280 {
4281         struct cmd_obj *pcmd_obj;
4282         u8 *pevtcmd;
4283         u32 cmdsz;
4284         struct surveydone_event *psurveydone_evt;
4285         struct C2HEvent_Header  *pc2h_evt_hdr;
4286         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4287         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4288
4289         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4290         if (!pcmd_obj)
4291                 return;
4292
4293         cmdsz = sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header);
4294         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4295         if (!pevtcmd) {
4296                 kfree(pcmd_obj);
4297                 return;
4298         }
4299
4300         INIT_LIST_HEAD(&pcmd_obj->list);
4301
4302         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4303         pcmd_obj->cmdsz = cmdsz;
4304         pcmd_obj->parmbuf = pevtcmd;
4305
4306         pcmd_obj->rsp = NULL;
4307         pcmd_obj->rspsz  = 0;
4308
4309         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4310         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4311         pc2h_evt_hdr->ID = _SurveyDone_EVT_;
4312         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4313
4314         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4315         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4316
4317         DBG_88E("survey done event(%x)\n", psurveydone_evt->bss_cnt);
4318
4319         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4320 }
4321
4322 void report_join_res(struct adapter *padapter, int res)
4323 {
4324         struct cmd_obj *pcmd_obj;
4325         u8 *pevtcmd;
4326         u32 cmdsz;
4327         struct joinbss_event            *pjoinbss_evt;
4328         struct C2HEvent_Header  *pc2h_evt_hdr;
4329         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4330         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4331         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4332
4333         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4334         if (!pcmd_obj)
4335                 return;
4336
4337         cmdsz = sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header);
4338         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4339         if (!pevtcmd) {
4340                 kfree(pcmd_obj);
4341                 return;
4342         }
4343
4344         INIT_LIST_HEAD(&pcmd_obj->list);
4345
4346         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4347         pcmd_obj->cmdsz = cmdsz;
4348         pcmd_obj->parmbuf = pevtcmd;
4349
4350         pcmd_obj->rsp = NULL;
4351         pcmd_obj->rspsz  = 0;
4352
4353         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4354         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4355         pc2h_evt_hdr->ID = _JoinBss_EVT_;
4356         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4357
4358         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4359         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4360         pjoinbss_evt->network.join_res  = res;
4361         pjoinbss_evt->network.aid = res;
4362
4363         DBG_88E("report_join_res(%d)\n", res);
4364
4365
4366         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4367
4368
4369         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4370 }
4371
4372 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4373 {
4374         struct cmd_obj *pcmd_obj;
4375         u8 *pevtcmd;
4376         u32 cmdsz;
4377         struct sta_info *psta;
4378         int     mac_id;
4379         struct stadel_event                     *pdel_sta_evt;
4380         struct C2HEvent_Header  *pc2h_evt_hdr;
4381         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4382         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4383
4384         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4385         if (!pcmd_obj)
4386                 return;
4387
4388         cmdsz = sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header);
4389         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4390         if (!pevtcmd) {
4391                 kfree(pcmd_obj);
4392                 return;
4393         }
4394
4395         INIT_LIST_HEAD(&pcmd_obj->list);
4396
4397         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4398         pcmd_obj->cmdsz = cmdsz;
4399         pcmd_obj->parmbuf = pevtcmd;
4400
4401         pcmd_obj->rsp = NULL;
4402         pcmd_obj->rspsz  = 0;
4403
4404         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4405         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4406         pc2h_evt_hdr->ID = _DelSTA_EVT_;
4407         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4408
4409         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4410         ether_addr_copy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr);
4411         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4412
4413
4414         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4415         if (psta)
4416                 mac_id = (int)psta->mac_id;
4417         else
4418                 mac_id = -1;
4419
4420         pdel_sta_evt->mac_id = mac_id;
4421
4422         DBG_88E("report_del_sta_event: delete STA, mac_id =%d\n", mac_id);
4423
4424         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4425 }
4426
4427 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
4428 {
4429         struct cmd_obj *pcmd_obj;
4430         u8 *pevtcmd;
4431         u32 cmdsz;
4432         struct stassoc_event            *padd_sta_evt;
4433         struct C2HEvent_Header  *pc2h_evt_hdr;
4434         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4435         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4436
4437         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4438         if (!pcmd_obj)
4439                 return;
4440
4441         cmdsz = sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header);
4442         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4443         if (!pevtcmd) {
4444                 kfree(pcmd_obj);
4445                 return;
4446         }
4447
4448         INIT_LIST_HEAD(&pcmd_obj->list);
4449
4450         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4451         pcmd_obj->cmdsz = cmdsz;
4452         pcmd_obj->parmbuf = pevtcmd;
4453
4454         pcmd_obj->rsp = NULL;
4455         pcmd_obj->rspsz  = 0;
4456
4457         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4458         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4459         pc2h_evt_hdr->ID = _AddSTA_EVT_;
4460         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4461
4462         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4463         ether_addr_copy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr);
4464         padd_sta_evt->cam_id = cam_idx;
4465
4466         DBG_88E("report_add_sta_event: add STA\n");
4467
4468         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4469 }
4470
4471
4472 /****************************************************************************
4473
4474 Following are the event callback functions
4475
4476 *****************************************************************************/
4477
4478 /* for sta/adhoc mode */
4479 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4480 {
4481         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4482         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4483         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4484
4485         /* ERP */
4486         VCS_update(padapter, psta);
4487
4488         /* HT */
4489         if (pmlmepriv->htpriv.ht_option) {
4490                 psta->htpriv.ht_option = true;
4491
4492                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4493
4494                 if (support_short_GI(padapter, &pmlmeinfo->HT_caps))
4495                         psta->htpriv.sgi = true;
4496
4497                 psta->qos_option = true;
4498         } else {
4499                 psta->htpriv.ht_option = false;
4500
4501                 psta->htpriv.ampdu_enable = false;
4502
4503                 psta->htpriv.sgi = false;
4504                 psta->qos_option = false;
4505         }
4506         psta->htpriv.bwmode = pmlmeext->cur_bwmode;
4507         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4508
4509         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4510         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4511
4512         /* QoS */
4513         if (pmlmepriv->qospriv.qos_option)
4514                 psta->qos_option = true;
4515
4516
4517         psta->state = _FW_LINKED;
4518 }
4519
4520 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4521 {
4522         struct sta_info         *psta, *psta_bmc;
4523         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4524         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4525         struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
4526         struct sta_priv         *pstapriv = &padapter->stapriv;
4527         u8 join_type;
4528         u16 media_status;
4529
4530         if (join_res < 0) {
4531                 join_type = 1;
4532                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4533                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4534
4535                 /* restore to initial setting. */
4536                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4537
4538                 goto exit_mlmeext_joinbss_event_callback;
4539         }
4540
4541         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4542                 /* for bc/mc */
4543                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
4544                 if (psta_bmc) {
4545                         pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
4546                         update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
4547                         Update_RA_Entry(padapter, psta_bmc->mac_id);
4548                 }
4549         }
4550
4551
4552         /* turn on dynamic functions */
4553         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4554
4555         /*  update IOT-related issue */
4556         update_IOT_info(padapter);
4557
4558         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
4559
4560         /* BCN interval */
4561         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4562
4563         /* update capability */
4564         update_capinfo(padapter, pmlmeinfo->capability);
4565
4566         /* WMM, Update EDCA param */
4567         WMMOnAssocRsp(padapter);
4568
4569         /* HT */
4570         HTOnAssocRsp(padapter);
4571
4572         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4573
4574         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
4575         if (psta) { /* only for infra. mode */
4576                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4577
4578                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4579
4580                 /* set per sta rate after updating HT cap. */
4581                 set_sta_rate(padapter, psta);
4582                 rtw_hal_set_hwreg(padapter, HW_VAR_TX_RPT_MAX_MACID, (u8 *)&psta->mac_id);
4583                 media_status = (psta->mac_id<<8)|1; /*   MACID|OPMODE: 1 means connect */
4584                 rtw_hal_set_hwreg(padapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
4585         }
4586
4587         join_type = 2;
4588         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4589
4590         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4591                 /*  correcting TSF */
4592                 correct_TSF(padapter, pmlmeext);
4593         }
4594         rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4595
4596 exit_mlmeext_joinbss_event_callback:
4597
4598         DBG_88E("=>%s\n", __func__);
4599 }
4600
4601 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4602 {
4603         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
4604         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4605         u8 join_type;
4606
4607         DBG_88E("%s\n", __func__);
4608
4609         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4610                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {/* adhoc master or sta_count>1 */
4611                         /* nothing to do */
4612                 } else { /* adhoc client */
4613                         /*  correcting TSF */
4614                         correct_TSF(padapter, pmlmeext);
4615
4616                         /* start beacon */
4617                         if (send_beacon(padapter) == _FAIL) {
4618                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4619                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4620                                 return;
4621                         }
4622                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4623                 }
4624
4625                 join_type = 2;
4626                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4627         }
4628
4629         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4630
4631         /* rate radaptive */
4632         Update_RA_Entry(padapter, psta->mac_id);
4633
4634         /* update adhoc sta_info */
4635         update_sta_info(padapter, psta);
4636 }
4637
4638 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4639 {
4640         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4641         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4642
4643         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter)) {
4644                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4645                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4646
4647                 /* restore to initial setting. */
4648                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4649
4650                 /* switch to the 20M Hz mode after disconnect */
4651                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4652                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4653
4654                 /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4655                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4656
4657
4658                 flush_all_cam_entry(padapter);
4659
4660                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4661
4662                 /* set MSR to no link state -> infra. mode */
4663                 Set_MSR(padapter, _HW_STATE_STATION_);
4664
4665                 del_timer_sync(&pmlmeext->link_timer);
4666         }
4667 }
4668
4669 /****************************************************************************
4670
4671 Following are the functions for the timer handlers
4672
4673 *****************************************************************************/
4674 void _linked_rx_signal_strehgth_display(struct adapter *padapter);
4675 void _linked_rx_signal_strehgth_display(struct adapter *padapter)
4676 {
4677         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4678       struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4679         u8 mac_id;
4680         int UndecoratedSmoothedPWDB;
4681
4682         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
4683                 mac_id = 0;
4684         else if ((pmlmeinfo->state&0x03) == _HW_STATE_AP_)
4685                 mac_id = 2;
4686
4687         rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &mac_id);
4688
4689         rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
4690         DBG_88E("UndecoratedSmoothedPWDB:%d\n", UndecoratedSmoothedPWDB);
4691 }
4692
4693 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4694 {
4695         u8 ret = false;
4696
4697         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta)) &&
4698             sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta) &&
4699             sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta))
4700                 ret = false;
4701         else
4702                 ret = true;
4703
4704         sta_update_last_rx_pkts(psta);
4705
4706         return ret;
4707 }
4708
4709 void linked_status_chk(struct adapter *padapter)
4710 {
4711         u32     i;
4712         struct sta_info         *psta;
4713         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
4714         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4715         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4716         struct sta_priv         *pstapriv = &padapter->stapriv;
4717
4718         if (padapter->bRxRSSIDisplay)
4719                 _linked_rx_signal_strehgth_display(padapter);
4720
4721         if (is_client_associated_to_ap(padapter)) {
4722                 /* linked infrastructure client mode */
4723
4724                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
4725                 int rx_chk_limit;
4726
4727                 rx_chk_limit = 4;
4728                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
4729                 if (psta != NULL) {
4730                         bool is_p2p_enable = false;
4731
4732                         if (!chk_ap_is_alive(padapter, psta))
4733                                 rx_chk = _FAIL;
4734
4735                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
4736                                 tx_chk = _FAIL;
4737
4738                         if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
4739                                 u8 backup_oper_channel = 0;
4740
4741                                 /* switch to correct channel of current network  before issue keep-alive frames */
4742                                 if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
4743                                         backup_oper_channel = rtw_get_oper_ch(padapter);
4744                                         SelectChannel(padapter, pmlmeext->cur_channel);
4745                                 }
4746
4747                                 if (rx_chk != _SUCCESS)
4748                                         issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
4749
4750                                 if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
4751                                         tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
4752                                         /* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
4753                                         if (tx_chk == _SUCCESS && !is_p2p_enable)
4754                                                 rx_chk = _SUCCESS;
4755                                 }
4756
4757                                 /* back to the original operation channel */
4758                                 if (backup_oper_channel > 0)
4759                                         SelectChannel(padapter, backup_oper_channel);
4760                         } else {
4761                                 if (rx_chk != _SUCCESS) {
4762                                         if (pmlmeext->retry == 0) {
4763                                                 issue_probereq(padapter,
4764                                                 &pmlmeinfo->network.Ssid,
4765                                                 pmlmeinfo->network.MacAddress,
4766                                                                         false);
4767                                                 issue_probereq(padapter,
4768                                                 &pmlmeinfo->network.Ssid,
4769                                                 pmlmeinfo->network.MacAddress,
4770                                                                         false);
4771                                                 issue_probereq(padapter,
4772                                                 &pmlmeinfo->network.Ssid,
4773                                                 pmlmeinfo->network.MacAddress,
4774                                                                         false);
4775                                         }
4776                                 }
4777
4778                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) {
4779                                         tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
4780                                 }
4781                         }
4782
4783                         if (rx_chk == _FAIL) {
4784                                 pmlmeext->retry++;
4785                                 if (pmlmeext->retry > rx_chk_limit) {
4786                                         DBG_88E_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
4787                                                       FUNC_ADPT_ARG(padapter));
4788                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress,
4789                                                            WLAN_REASON_EXPIRATION_CHK);
4790                                         return;
4791                                 }
4792                         } else {
4793                                 pmlmeext->retry = 0;
4794                         }
4795
4796                         if (tx_chk == _FAIL) {
4797                                 pmlmeinfo->link_count &= 0xf;
4798                         } else {
4799                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
4800                                 pmlmeinfo->link_count = 0;
4801                         }
4802                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
4803         } else if (is_client_associated_to_ibss(padapter)) {
4804                 /* linked IBSS mode */
4805                 /* for each assoc list entry to check the rx pkt counter */
4806                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
4807                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
4808                                 psta = pmlmeinfo->FW_sta_info[i].psta;
4809
4810                                 if (NULL == psta)
4811                                         continue;
4812                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
4813                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
4814                                                 pmlmeinfo->FW_sta_info[i].retry++;
4815                                         } else {
4816                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
4817                                                 pmlmeinfo->FW_sta_info[i].status = 0;
4818                                                 report_del_sta_event(padapter, psta->hwaddr
4819                                                         , 65535/*  indicate disconnect caused by no rx */
4820                                         );
4821                                         }
4822                                 } else {
4823                                         pmlmeinfo->FW_sta_info[i].retry = 0;
4824                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
4825                                 }
4826                         }
4827                 }
4828         }
4829 }
4830
4831 void survey_timer_hdl(unsigned long data)
4832 {
4833         struct adapter *padapter = (struct adapter *)data;
4834         struct cmd_obj  *ph2c;
4835         struct sitesurvey_parm  *psurveyPara;
4836         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
4837         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4838
4839         /* issue rtw_sitesurvey_cmd */
4840         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
4841                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
4842                         pmlmeext->sitesurvey_res.channel_idx++;
4843
4844                 if (pmlmeext->scan_abort) {
4845                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
4846                         DBG_88E("%s idx:%d\n", __func__
4847                                 , pmlmeext->sitesurvey_res.channel_idx);
4848
4849                         pmlmeext->scan_abort = false;/* reset */
4850                 }
4851
4852                 ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4853                 if (!ph2c)
4854                         goto exit_survey_timer_hdl;
4855
4856                 psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
4857                 if (!psurveyPara) {
4858                         kfree(ph2c);
4859                         goto exit_survey_timer_hdl;
4860                 }
4861
4862                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, _SiteSurvey_CMD_);
4863                 rtw_enqueue_cmd(pcmdpriv, ph2c);
4864         }
4865
4866
4867 exit_survey_timer_hdl:
4868         return;
4869 }
4870
4871 void link_timer_hdl(unsigned long data)
4872 {
4873         struct adapter *padapter = (struct adapter *)data;
4874         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4875         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4876
4877         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
4878                 DBG_88E("link_timer_hdl:no beacon while connecting\n");
4879                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4880                 report_join_res(padapter, -3);
4881         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
4882                 /* re-auth timer */
4883                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
4884                         pmlmeinfo->state = 0;
4885                         report_join_res(padapter, -1);
4886                         return;
4887                 }
4888
4889                 DBG_88E("link_timer_hdl: auth timeout and try again\n");
4890                 pmlmeinfo->auth_seq = 1;
4891                 issue_auth(padapter, NULL, 0);
4892                 set_link_timer(pmlmeext, REAUTH_TO);
4893         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
4894                 /* re-assoc timer */
4895                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
4896                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4897                         report_join_res(padapter, -2);
4898                         return;
4899                 }
4900
4901                 DBG_88E("link_timer_hdl: assoc timeout and try again\n");
4902                 issue_assocreq(padapter);
4903                 set_link_timer(pmlmeext, REASSOC_TO);
4904         }
4905 }
4906
4907 void addba_timer_hdl(unsigned long data)
4908 {
4909         struct sta_info *psta = (struct sta_info *)data;
4910         struct ht_priv  *phtpriv;
4911
4912         if (!psta)
4913                 return;
4914
4915         phtpriv = &psta->htpriv;
4916
4917         if ((phtpriv->ht_option) && (phtpriv->ampdu_enable)) {
4918                 if (phtpriv->candidate_tid_bitmap)
4919                         phtpriv->candidate_tid_bitmap = 0x0;
4920         }
4921 }
4922
4923 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
4924 {
4925         u8 type;
4926         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4927         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4928         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
4929
4930         if (psetop->mode == Ndis802_11APMode) {
4931                 pmlmeinfo->state = WIFI_FW_AP_STATE;
4932                 type = _HW_STATE_AP_;
4933         } else if (psetop->mode == Ndis802_11Infrastructure) {
4934                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
4935                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
4936                 type = _HW_STATE_STATION_;
4937         } else if (psetop->mode == Ndis802_11IBSS) {
4938                 type = _HW_STATE_ADHOC_;
4939         } else {
4940                 type = _HW_STATE_NOLINK_;
4941         }
4942
4943         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
4944         /* Set_NETYPE0_MSR(padapter, type); */
4945
4946         return H2C_SUCCESS;
4947 }
4948
4949 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
4950 {
4951         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4952         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4953         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4954         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4955         /* u32  initialgain; */
4956
4957
4958         if (pparm->InfrastructureMode == Ndis802_11APMode) {
4959 #ifdef CONFIG_88EU_AP_MODE
4960
4961                 if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
4962                         /* todo: */
4963                         return H2C_SUCCESS;
4964                 }
4965 #endif
4966         }
4967
4968         /* below is for ad-hoc master */
4969         if (pparm->InfrastructureMode == Ndis802_11IBSS) {
4970                 rtw_joinbss_reset(padapter);
4971
4972                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4973                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4974                 pmlmeinfo->ERP_enable = 0;
4975                 pmlmeinfo->WMM_enable = 0;
4976                 pmlmeinfo->HT_enable = 0;
4977                 pmlmeinfo->HT_caps_enable = 0;
4978                 pmlmeinfo->HT_info_enable = 0;
4979                 pmlmeinfo->agg_enable_bitmap = 0;
4980                 pmlmeinfo->candidate_tid_bitmap = 0;
4981
4982                 /* disable dynamic functions, such as high power, DIG */
4983                 Save_DM_Func_Flag(padapter);
4984                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
4985
4986                 /* config the initial gain under linking, need to write the BB registers */
4987                 /* initialgain = 0x1E; */
4988                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
4989
4990                 /* cancel link timer */
4991                 del_timer_sync(&pmlmeext->link_timer);
4992
4993                 /* clear CAM */
4994                 flush_all_cam_entry(padapter);
4995
4996                 memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, IELength));
4997                 pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
4998
4999                 if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
5000                         return H2C_PARAMETERS_ERROR;
5001
5002                 memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
5003
5004                 start_create_ibss(padapter);
5005         }
5006
5007         return H2C_SUCCESS;
5008 }
5009
5010 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5011 {
5012         u8 join_type;
5013         struct ndis_802_11_var_ie *pIE;
5014         struct registry_priv    *pregpriv = &padapter->registrypriv;
5015         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5016         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5017         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5018         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
5019         u32 i;
5020
5021         /* check already connecting to AP or not */
5022         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
5023                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
5024                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
5025
5026                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5027
5028                 /* clear CAM */
5029                 flush_all_cam_entry(padapter);
5030
5031                 del_timer_sync(&pmlmeext->link_timer);
5032
5033                 /* set MSR to nolink -> infra. mode */
5034                 Set_MSR(padapter, _HW_STATE_STATION_);
5035
5036
5037                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5038         }
5039
5040         rtw_antenna_select_cmd(padapter, pparm->PhyInfo.Optimum_antenna, false);
5041
5042         rtw_joinbss_reset(padapter);
5043
5044         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5045         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5046         pmlmeinfo->ERP_enable = 0;
5047         pmlmeinfo->WMM_enable = 0;
5048         pmlmeinfo->HT_enable = 0;
5049         pmlmeinfo->HT_caps_enable = 0;
5050         pmlmeinfo->HT_info_enable = 0;
5051         pmlmeinfo->agg_enable_bitmap = 0;
5052         pmlmeinfo->candidate_tid_bitmap = 0;
5053         pmlmeinfo->bwmode_updated = false;
5054
5055         memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, IELength));
5056         pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
5057
5058         if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
5059                 return H2C_PARAMETERS_ERROR;
5060
5061         memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
5062
5063         /* Check AP vendor to move rtw_joinbss_cmd() */
5064
5065         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pnetwork->IELength;) {
5066                 pIE = (struct ndis_802_11_var_ie *)(pnetwork->IEs + i);
5067
5068                 switch (pIE->ElementID) {
5069                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
5070                         if (!memcmp(pIE->data, WMM_OUI, 4))
5071                                 pmlmeinfo->WMM_enable = 1;
5072                         break;
5073                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
5074                         pmlmeinfo->HT_caps_enable = 1;
5075                         break;
5076                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
5077                         pmlmeinfo->HT_info_enable = 1;
5078
5079                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5080                         {
5081                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5082
5083                                 if ((pregpriv->cbw40_enable) &&  (pht_info->infos[0] & BIT(2))) {
5084                                         /* switch to the 40M Hz mode according to the AP */
5085                                         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
5086                                         switch (pht_info->infos[0] & 0x3) {
5087                                         case 1:
5088                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5089                                                 break;
5090                                         case 3:
5091                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5092                                                 break;
5093                                         default:
5094                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5095                                                 break;
5096                                 }
5097
5098                                         DBG_88E("set ch/bw before connected\n");
5099                                 }
5100                         }
5101                         break;
5102                 default:
5103                         break;
5104                 }
5105
5106                 i += (pIE->Length + 2);
5107         }
5108         /* disable dynamic functions, such as high power, DIG */
5109
5110         /* config the initial gain under linking, need to write the BB registers */
5111
5112         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
5113         join_type = 0;
5114         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5115
5116         /* cancel link timer */
5117         del_timer_sync(&pmlmeext->link_timer);
5118
5119         start_clnt_join(padapter);
5120
5121         return H2C_SUCCESS;
5122 }
5123
5124 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5125 {
5126         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5127         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5128         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5129         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5130         u8 val8;
5131
5132         if (is_client_associated_to_ap(padapter))
5133                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5134
5135         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5136         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5137
5138         /* restore to initial setting. */
5139         update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
5140
5141         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5142                 /* Stop BCN */
5143                 val8 = 0;
5144                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5145         }
5146
5147
5148         /* set MSR to no link state -> infra. mode */
5149         Set_MSR(padapter, _HW_STATE_STATION_);
5150
5151         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5152
5153         /* switch to the 20M Hz mode after disconnect */
5154         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5155         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5156
5157         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5158
5159         flush_all_cam_entry(padapter);
5160
5161         del_timer_sync(&pmlmeext->link_timer);
5162
5163         rtw_free_uc_swdec_pending_queue(padapter);
5164
5165         return  H2C_SUCCESS;
5166 }
5167
5168 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
5169         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
5170 {
5171         int i, j;
5172         int set_idx;
5173         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5174
5175         /* clear out first */
5176         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5177
5178         /* acquire channels from in */
5179         j = 0;
5180         for (i = 0; i < in_num; i++) {
5181                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5182                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED) &&
5183                     set_idx >= 0) {
5184                         out[j] = in[i];
5185
5186                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5187                                 out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5188
5189                         j++;
5190                 }
5191                 if (j >= out_num)
5192                         break;
5193         }
5194
5195         /* if out is empty, use channel_set as default */
5196         if (j == 0) {
5197                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5198                         out[i].hw_value = pmlmeext->channel_set[i].ChannelNum;
5199
5200                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5201                                 out[i].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5202
5203                         j++;
5204                 }
5205         }
5206
5207         return j;
5208 }
5209
5210 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5211 {
5212         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5213         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5214         u8 bdelayscan = false;
5215         u8 val8;
5216         u32     initialgain;
5217         u32     i;
5218
5219         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5220                 /* for first time sitesurvey_cmd */
5221                 rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, NULL);
5222
5223                 pmlmeext->sitesurvey_res.state = SCAN_START;
5224                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5225                 pmlmeext->sitesurvey_res.channel_idx = 0;
5226
5227                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5228                         if (pparm->ssid[i].SsidLength) {
5229                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
5230                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = pparm->ssid[i].SsidLength;
5231                         } else {
5232                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = 0;
5233                         }
5234                 }
5235
5236                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5237                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5238                         , pparm->ch, pparm->ch_num
5239         );
5240
5241                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5242
5243                 /* issue null data if associating to the AP */
5244                 if (is_client_associated_to_ap(padapter)) {
5245                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5246
5247                         issue_nulldata(padapter, NULL, 1, 3, 500);
5248
5249                         bdelayscan = true;
5250                 }
5251                 if (bdelayscan) {
5252                         /* delay 50ms to protect nulldata(1). */
5253                         set_survey_timer(pmlmeext, 50);
5254                         return H2C_SUCCESS;
5255                 }
5256         }
5257
5258         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5259                 /* disable dynamic functions, such as high power, DIG */
5260                 Save_DM_Func_Flag(padapter);
5261                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5262
5263                 /* config the initial gain under scanning, need to write the BB registers */
5264                 initialgain = 0x1E;
5265
5266                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5267
5268                 /* set MSR to no link state */
5269                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5270
5271                 val8 = 1; /* under site survey */
5272                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5273
5274                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5275         }
5276
5277         site_survey(padapter);
5278
5279         return H2C_SUCCESS;
5280 }
5281
5282 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5283 {
5284         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5285         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5286         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5287
5288         if (pparm->mode < 4)
5289                 pmlmeinfo->auth_algo = pparm->mode;
5290         return  H2C_SUCCESS;
5291 }
5292
5293 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5294 {
5295         unsigned short                          ctrl;
5296         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5297         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5298         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5299         unsigned char                                   null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5300
5301         /* main tx key for wep. */
5302         if (pparm->set_tx)
5303                 pmlmeinfo->key_index = pparm->keyid;
5304
5305         /* write cam */
5306         ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5307
5308         DBG_88E_LEVEL(_drv_info_, "set group key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) "
5309                         "keyid:%d\n", pparm->algorithm, pparm->keyid);
5310         write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
5311
5312         return H2C_SUCCESS;
5313 }
5314
5315 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5316 {
5317         u16 ctrl = 0;
5318         u8 cam_id;/* cam_entry */
5319         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5320         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5321         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5322
5323         /* cam_entry: */
5324         /* 0~3 for default key */
5325
5326         /* for concurrent mode (ap+sta): */
5327         /* default key is disable, using sw encrypt/decrypt */
5328         /* cam_entry = 4 for sta mode (macid = 0) */
5329         /* cam_entry(macid+3) = 5 ~ N for ap mode (aid = 1~N, macid = 2 ~N) */
5330
5331         /* for concurrent mode (sta+sta): */
5332         /* default key is disable, using sw encrypt/decrypt */
5333         /* cam_entry = 4 mapping to macid = 0 */
5334         /* cam_entry = 5 mapping to macid = 2 */
5335
5336         cam_id = 4;
5337
5338         DBG_88E_LEVEL(_drv_info_, "set pairwise key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) camid:%d\n",
5339                       pparm->algorithm, cam_id);
5340         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
5341                 struct sta_info *psta;
5342                 struct sta_priv *pstapriv = &padapter->stapriv;
5343
5344                 if (pparm->algorithm == _NO_PRIVACY_)   /*  clear cam entry */ {
5345                         clear_cam_entry(padapter, pparm->id);
5346                         return H2C_SUCCESS_RSP;
5347                 }
5348
5349                 psta = rtw_get_stainfo(pstapriv, pparm->addr);
5350                 if (psta) {
5351                         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5352
5353                         DBG_88E("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
5354
5355                         if ((psta->mac_id < 1) || (psta->mac_id > (NUM_STA-4))) {
5356                                 DBG_88E("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
5357                                 return H2C_REJECTED;
5358                         }
5359
5360                         cam_id = psta->mac_id + 3;/* 0~3 for default key, cmd_id = macid + 3, macid = aid+1; */
5361
5362                         DBG_88E("Write CAM, mac_addr =%pM, cam_entry=%d\n",
5363                                 pparm->addr, cam_id);
5364
5365                         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5366
5367                         return H2C_SUCCESS_RSP;
5368                 } else {
5369                         DBG_88E("r871x_set_stakey_hdl(): sta has been free\n");
5370                         return H2C_REJECTED;
5371                 }
5372         }
5373
5374         /* below for sta mode */
5375
5376         if (pparm->algorithm == _NO_PRIVACY_) { /*  clear cam entry */
5377                 clear_cam_entry(padapter, pparm->id);
5378                 return H2C_SUCCESS;
5379         }
5380         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5381         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5382         pmlmeinfo->enc_algo = pparm->algorithm;
5383         return H2C_SUCCESS;
5384 }
5385
5386 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5387 {
5388         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5389         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5390         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5391
5392         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5393
5394         if (!psta)
5395                 return  H2C_SUCCESS;
5396
5397         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5398             ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5399                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5400                 mod_timer(&psta->addba_retry_timer,
5401                           jiffies + msecs_to_jiffies(ADDBA_TO));
5402         } else {
5403                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5404         }
5405         return  H2C_SUCCESS;
5406 }
5407
5408 u8 set_tx_beacon_cmd(struct adapter *padapter)
5409 {
5410         struct cmd_obj  *ph2c;
5411         struct wlan_bssid_ex    *ptxBeacon_parm;
5412         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5413         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5414         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5415         u8 res = _SUCCESS;
5416         int len_diff = 0;
5417
5418
5419         ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
5420         if (!ph2c) {
5421                 res = _FAIL;
5422                 goto exit;
5423         }
5424
5425         ptxBeacon_parm = kmemdup(&(pmlmeinfo->network),
5426                                 sizeof(struct wlan_bssid_ex), GFP_KERNEL);
5427         if (ptxBeacon_parm == NULL) {
5428                 kfree(ph2c);
5429                 res = _FAIL;
5430                 goto exit;
5431         }
5432
5433         len_diff = update_hidden_ssid(ptxBeacon_parm->IEs+_BEACON_IE_OFFSET_,
5434                                       ptxBeacon_parm->IELength-_BEACON_IE_OFFSET_,
5435                                       pmlmeinfo->hidden_ssid_mode);
5436         ptxBeacon_parm->IELength += len_diff;
5437
5438         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, _TX_Beacon_CMD_);
5439
5440         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5441
5442
5443 exit:
5444
5445
5446         return res;
5447 }
5448
5449 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5450 {
5451         u8 evt_code;
5452         u16 evt_sz;
5453         uint    *peventbuf;
5454         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5455
5456         peventbuf = (uint *)pbuf;
5457         evt_sz = (u16)(*peventbuf&0xffff);
5458         evt_code = (u8)((*peventbuf>>16)&0xff);
5459
5460         /*  checking if event code is valid */
5461         if (evt_code >= MAX_C2HEVT) {
5462                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
5463                 goto _abort_event_;
5464         }
5465
5466         /*  checking if event size match the event parm size */
5467         if ((wlanevents[evt_code].parmsize != 0) &&
5468             (wlanevents[evt_code].parmsize != evt_sz)) {
5469                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_,
5470                          ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
5471                          evt_code, wlanevents[evt_code].parmsize, evt_sz));
5472                 goto _abort_event_;
5473         }
5474
5475         peventbuf += 2;
5476
5477         if (peventbuf) {
5478                 event_callback = wlanevents[evt_code].event_callback;
5479                 event_callback(padapter, (u8 *)peventbuf);
5480
5481         }
5482
5483 _abort_event_:
5484         return H2C_SUCCESS;
5485 }
5486
5487 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5488 {
5489         if (send_beacon(padapter) == _FAIL) {
5490                 DBG_88E("issue_beacon, fail!\n");
5491                 return H2C_PARAMETERS_ERROR;
5492         }
5493 #ifdef CONFIG_88EU_AP_MODE
5494         else { /* tx bc/mc frames after update TIM */
5495                 struct sta_info *psta_bmc;
5496                 struct list_head *xmitframe_plist, *xmitframe_phead;
5497                 struct xmit_frame *pxmitframe = NULL;
5498                 struct sta_priv  *pstapriv = &padapter->stapriv;
5499
5500                 /* for BC/MC Frames */
5501                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
5502                 if (!psta_bmc)
5503                         return H2C_SUCCESS;
5504
5505                 if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5506                         msleep(10);/*  10ms, ATIM(HIQ) Windows */
5507                         spin_lock_bh(&psta_bmc->sleep_q.lock);
5508
5509                         xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5510                         xmitframe_plist = xmitframe_phead->next;
5511
5512                         while (xmitframe_phead != xmitframe_plist) {
5513                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
5514
5515                                 xmitframe_plist = xmitframe_plist->next;
5516
5517                                 list_del_init(&pxmitframe->list);
5518
5519                                 psta_bmc->sleepq_len--;
5520                                 if (psta_bmc->sleepq_len > 0)
5521                                         pxmitframe->attrib.mdata = 1;
5522                                 else
5523                                         pxmitframe->attrib.mdata = 0;
5524
5525                                 pxmitframe->attrib.triggered = 1;
5526
5527                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5528
5529                                 spin_unlock_bh(&psta_bmc->sleep_q.lock);
5530                                 if (rtw_hal_xmit(padapter, pxmitframe))
5531                                         rtw_os_xmit_complete(padapter, pxmitframe);
5532                                 spin_lock_bh(&psta_bmc->sleep_q.lock);
5533                         }
5534                         spin_unlock_bh(&psta_bmc->sleep_q.lock);
5535                 }
5536         }
5537 #endif
5538         return H2C_SUCCESS;
5539 }
5540
5541 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5542 {
5543         struct set_ch_parm *set_ch_parm;
5544         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5545
5546         if (!pbuf)
5547                 return H2C_PARAMETERS_ERROR;
5548
5549         set_ch_parm = (struct set_ch_parm *)pbuf;
5550
5551         DBG_88E(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
5552                 FUNC_NDEV_ARG(padapter->pnetdev),
5553                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
5554
5555         pmlmeext->cur_channel = set_ch_parm->ch;
5556         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5557         pmlmeext->cur_bwmode = set_ch_parm->bw;
5558
5559         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5560
5561         return  H2C_SUCCESS;
5562 }
5563
5564 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5565 {
5566         struct SetChannelPlan_param *setChannelPlan_param;
5567         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5568
5569         if (!pbuf)
5570                 return H2C_PARAMETERS_ERROR;
5571
5572         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5573
5574         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5575         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5576
5577         return  H2C_SUCCESS;
5578 }