drivers/staging/rtl8188eu/core/rtw_mlme_ext.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /******************************************************************************
   3  *
   4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   5  *
   6  ******************************************************************************/
   7 #define _RTW_MLME_EXT_C_
   8
   9 #include <linux/ieee80211.h>
  10 #include <asm/unaligned.h>
  11
  12 #include <osdep_service.h>
  13 #include <drv_types.h>
  14 #include <wifi.h>
  15 #include <rtw_mlme_ext.h>
  16 #include <wlan_bssdef.h>
  17 #include <mlme_osdep.h>
  18 #include <recv_osdep.h>
  19
  20 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  21
  22 /**************************************************
  23 OUI definitions for the vendor specific IE
  24 ***************************************************/
  25 unsigned char   RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  26 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  27 unsigned char   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  28 unsigned char   P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  29 unsigned char   WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  30
  31 unsigned char   WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  32 unsigned char   WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  33
  34 unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
  35 unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
  36
  37 extern unsigned char REALTEK_96B_IE[];
  38
  39 /********************************************************
  40 MCS rate definitions
  41 *********************************************************/
  42 unsigned char   MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  43
  44 /********************************************************
  45 ChannelPlan definitions
  46 *********************************************************/
  47 static struct rt_channel_plan_2g RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  48         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  49         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  50         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  51         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  52         {{10, 11, 12, 13}, 4},                                  /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  53         {{}, 0},                                                                        /*  0x05, RT_CHANNEL_DOMAIN_2G_NULL */
  54 };
  55
  56 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  57         /*  0x00 ~ 0x1F , Old Define ===== */
  58         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  59         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  60         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  61         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  62         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  63         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  64         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  65         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  66         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  67         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  68         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  69         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  70         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  71         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  72         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  73         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  74         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
  75         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
  76         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  77         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
  78         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
  79         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
  80         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
  81         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  82         {0x05}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
  83         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
  84         {0x00}, /* 0x1A, */
  85         {0x00}, /* 0x1B, */
  86         {0x00}, /* 0x1C, */
  87         {0x00}, /* 0x1D, */
  88         {0x00}, /* 0x1E, */
  89         {0x05}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
  90         /*  0x20 ~ 0x7F , New Define ===== */
  91         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
  92         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
  93         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
  94         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
  95         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
  96         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
  97         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
  98         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
  99         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 100         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 101         {0x00}, /* 0x2A, */
 102         {0x00}, /* 0x2B, */
 103         {0x00}, /* 0x2C, */
 104         {0x00}, /* 0x2D, */
 105         {0x00}, /* 0x2E, */
 106         {0x00}, /* 0x2F, */
 107         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 108         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 109         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 110         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 111         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 112         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 113         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 114         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 115         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 116         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 117         {0x00}, /* 0x3A, */
 118         {0x00}, /* 0x3B, */
 119         {0x00}, /* 0x3C, */
 120         {0x00}, /* 0x3D, */
 121         {0x00}, /* 0x3E, */
 122         {0x00}, /* 0x3F, */
 123         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 124         {0x03}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G */
 125 };
 126
 127 static const struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {
 128         0x03
 129 }; /* use the combination for max channel numbers */
 130
 131 /*
 132  * Search the @param channel_num in given @param channel_set
 133  * @ch_set: the given channel set
 134  * @ch: the given channel number
 135  *
 136  * return the index of channel_num in channel_set, -1 if not found
 137  */
 138 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 139 {
 140         int i;
 141
 142         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 143                 if (ch == ch_set[i].ChannelNum)
 144                         break;
 145         }
 146
 147         if (i >= ch_set[i].ChannelNum)
 148                 return -1;
 149         return i;
 150 }
 151
 152 struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
 153 {
 154         struct xmit_frame                       *pmgntframe;
 155         struct xmit_buf                         *pxmitbuf;
 156
 157         pmgntframe = rtw_alloc_xmitframe(pxmitpriv);
 158         if (!pmgntframe) {
 159                 DBG_88E("%s, alloc xmitframe fail\n", __func__);
 160                 return NULL;
 161         }
 162
 163         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
 164         if (!pxmitbuf) {
 165                 DBG_88E("%s, alloc xmitbuf fail\n", __func__);
 166                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
 167                 return NULL;
 168         }
 169         pmgntframe->frame_tag = MGNT_FRAMETAG;
 170         pmgntframe->pxmitbuf = pxmitbuf;
 171         pmgntframe->buf_addr = pxmitbuf->pbuf;
 172         pxmitbuf->priv_data = pmgntframe;
 173         return pmgntframe;
 174 }
 175
 176 /****************************************************************************
 177
 178 Following are some TX functions for WiFi MLME
 179
 180 *****************************************************************************/
 181
 182 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
 183 {
 184         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 185
 186         pmlmeext->tx_rate = rate;
 187         DBG_88E("%s(): rate = %x\n", __func__, rate);
 188 }
 189
 190 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
 191 {
 192         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 193
 194         memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
 195
 196         pattrib->hdrlen = 24;
 197         pattrib->nr_frags = 1;
 198         pattrib->priority = 7;
 199         pattrib->mac_id = 0;
 200         pattrib->qsel = 0x12;
 201
 202         pattrib->pktlen = 0;
 203
 204         if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
 205                 pattrib->raid = 6;/* b mode */
 206         else
 207                 pattrib->raid = 5;/* a/g mode */
 208
 209         pattrib->encrypt = _NO_PRIVACY_;
 210         pattrib->bswenc = false;
 211
 212         pattrib->qos_en = false;
 213         pattrib->ht_en = false;
 214         pattrib->bwmode = HT_CHANNEL_WIDTH_20;
 215         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 216         pattrib->sgi = false;
 217
 218         pattrib->seqnum = pmlmeext->mgnt_seq;
 219
 220         pattrib->retry_ctrl = true;
 221 }
 222
 223 static void dump_mgntframe(struct adapter *padapter,
 224                            struct xmit_frame *pmgntframe)
 225 {
 226         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 227                 return;
 228
 229         rtw_hal_mgnt_xmit(padapter, pmgntframe);
 230 }
 231
 232 static s32 dump_mgntframe_and_wait(struct adapter *padapter,
 233                                    struct xmit_frame *pmgntframe,
 234                                    int timeout_ms)
 235 {
 236         s32 ret = _FAIL;
 237         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
 238         struct submit_ctx sctx;
 239
 240         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 241                 return ret;
 242
 243         rtw_sctx_init(&sctx, timeout_ms);
 244         pxmitbuf->sctx = &sctx;
 245
 246         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
 247
 248         if (ret == _SUCCESS)
 249                 ret = rtw_sctx_wait(&sctx);
 250
 251         return ret;
 252 }
 253
 254 static s32 dump_mgntframe_and_wait_ack(struct adapter *padapter,
 255                                        struct xmit_frame *pmgntframe)
 256 {
 257         s32 ret = _FAIL;
 258         u32 timeout_ms = 500;/*   500ms */
 259         struct xmit_priv        *pxmitpriv = &padapter->xmitpriv;
 260
 261         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 262                 return -1;
 263
 264         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex))
 265                 return _FAIL;
 266         pxmitpriv->ack_tx = true;
 267
 268         pmgntframe->ack_report = 1;
 269         if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
 270                 ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
 271
 272         pxmitpriv->ack_tx = false;
 273         mutex_unlock(&pxmitpriv->ack_tx_mutex);
 274
 275         return ret;
 276 }
 277
 278 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
 279 {
 280         u8 *ssid_ie;
 281         uint ssid_len_ori;
 282         int len_diff = 0;
 283
 284         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
 285
 286         if (ssid_ie && ssid_len_ori > 0) {
 287                 switch (hidden_ssid_mode) {
 288                 case 1: {
 289                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
 290                         u32 remain_len = 0;
 291
 292                         remain_len = ies_len - (next_ie - ies);
 293
 294                         ssid_ie[1] = 0;
 295                         memcpy(ssid_ie+2, next_ie, remain_len);
 296                         len_diff -= ssid_len_ori;
 297
 298                         break;
 299                 }
 300                 case 2:
 301                         memset(&ssid_ie[2], 0, ssid_len_ori);
 302                         break;
 303                 default:
 304                         break;
 305                 }
 306         }
 307
 308         return len_diff;
 309 }
 310
 311 static void issue_beacon(struct adapter *padapter, int timeout_ms)
 312 {
 313         struct xmit_frame       *pmgntframe;
 314         struct pkt_attrib       *pattrib;
 315         unsigned char   *pframe;
 316         struct ieee80211_hdr *pwlanhdr;
 317         __le16 *fctrl;
 318         unsigned int    rate_len;
 319         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 320         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 321         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 322         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 323         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 324         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 325
 326         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 327         if (!pmgntframe) {
 328                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 329                 return;
 330         }
 331 #if defined(CONFIG_88EU_AP_MODE)
 332         spin_lock_bh(&pmlmepriv->bcn_update_lock);
 333 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 334
 335         /* update attribute */
 336         pattrib = &pmgntframe->attrib;
 337         update_mgntframe_attrib(padapter, pattrib);
 338         pattrib->qsel = 0x10;
 339
 340         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 341
 342         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 343         pwlanhdr = (struct ieee80211_hdr *)pframe;
 344
 345         fctrl = &pwlanhdr->frame_control;
 346         *(fctrl) = 0;
 347
 348         ether_addr_copy(pwlanhdr->addr1, bc_addr);
 349         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
 350         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
 351
 352         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
 353         /* pmlmeext->mgnt_seq++; */
 354         SetFrameSubType(pframe, WIFI_BEACON);
 355
 356         pframe += sizeof(struct ieee80211_hdr_3addr);
 357         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 358
 359         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 360                 int len_diff;
 361                 u8 *wps_ie;
 362                 uint wps_ielen;
 363                 u8 sr = 0;
 364
 365                 memcpy(pframe, cur_network->ies, cur_network->ie_length);
 366                 len_diff = update_hidden_ssid(
 367                         pframe+_BEACON_IE_OFFSET_
 368                         , cur_network->ie_length-_BEACON_IE_OFFSET_
 369                         , pmlmeinfo->hidden_ssid_mode
 370                         );
 371                 pframe += (cur_network->ie_length+len_diff);
 372                 pattrib->pktlen += (cur_network->ie_length+len_diff);
 373                 wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
 374                         pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
 375                 if (wps_ie && wps_ielen > 0)
 376                         rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
 377                 if (sr != 0)
 378                         set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
 379                 else
 380                         _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
 381
 382                 goto _issue_bcn;
 383         }
 384
 385         /* below for ad-hoc mode */
 386
 387         /* timestamp will be inserted by hardware */
 388         pframe += 8;
 389         pattrib->pktlen += 8;
 390
 391         /*  beacon interval: 2 bytes */
 392
 393         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
 394
 395         pframe += 2;
 396         pattrib->pktlen += 2;
 397
 398         /*  capability info: 2 bytes */
 399
 400         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
 401
 402         pframe += 2;
 403         pattrib->pktlen += 2;
 404
 405         /*  SSID */
 406         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 407
 408         /*  supported rates... */
 409         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 410         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 411
 412         /*  DS parameter set */
 413         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 414
 415         {
 416                 u8 erpinfo = 0;
 417                 u32 ATIMWindow;
 418                 /*  IBSS Parameter Set... */
 419                 ATIMWindow = 0;
 420                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 421
 422                 /* ERP IE */
 423                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 424         }
 425
 426         /*  EXTERNDED SUPPORTED RATE */
 427         if (rate_len > 8)
 428                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 429         /* todo:HT for adhoc */
 430 _issue_bcn:
 431
 432 #if defined(CONFIG_88EU_AP_MODE)
 433         pmlmepriv->update_bcn = false;
 434
 435         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
 436 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 437
 438         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
 439                 DBG_88E("beacon frame too large\n");
 440                 return;
 441         }
 442
 443         pattrib->last_txcmdsz = pattrib->pktlen;
 444
 445         /* DBG_88E("issue bcn_sz=%d\n", pattrib->last_txcmdsz); */
 446         if (timeout_ms > 0)
 447                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
 448         else
 449                 dump_mgntframe(padapter, pmgntframe);
 450 }
 451
 452 static void issue_probersp(struct adapter *padapter, unsigned char *da)
 453 {
 454         struct xmit_frame                       *pmgntframe;
 455         struct pkt_attrib                       *pattrib;
 456         unsigned char                                   *pframe;
 457         struct ieee80211_hdr *pwlanhdr;
 458         __le16 *fctrl;
 459         unsigned char                                   *mac, *bssid;
 460         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 461 #if defined(CONFIG_88EU_AP_MODE)
 462         u8 *pwps_ie;
 463         uint wps_ielen;
 464         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 465 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 466         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 467         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 468         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 469         unsigned int    rate_len;
 470
 471         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 472         if (!pmgntframe) {
 473                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 474                 return;
 475         }
 476
 477         /* update attribute */
 478         pattrib = &pmgntframe->attrib;
 479         update_mgntframe_attrib(padapter, pattrib);
 480
 481         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 482
 483         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 484         pwlanhdr = (struct ieee80211_hdr *)pframe;
 485
 486         mac = myid(&(padapter->eeprompriv));
 487         bssid = cur_network->MacAddress;
 488
 489         fctrl = &pwlanhdr->frame_control;
 490         *(fctrl) = 0;
 491         ether_addr_copy(pwlanhdr->addr1, da);
 492         ether_addr_copy(pwlanhdr->addr2, mac);
 493         ether_addr_copy(pwlanhdr->addr3, bssid);
 494
 495         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 496         pmlmeext->mgnt_seq++;
 497         SetFrameSubType(fctrl, WIFI_PROBERSP);
 498
 499         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 500         pattrib->pktlen = pattrib->hdrlen;
 501         pframe += pattrib->hdrlen;
 502
 503         if (cur_network->ie_length > MAX_IE_SZ)
 504                 return;
 505
 506 #if defined(CONFIG_88EU_AP_MODE)
 507         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 508                 pwps_ie = rtw_get_wps_ie(cur_network->ies+_FIXED_IE_LENGTH_, cur_network->ie_length-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
 509
 510                 /* inerset & update wps_probe_resp_ie */
 511                 if ((pmlmepriv->wps_probe_resp_ie != NULL) && pwps_ie && (wps_ielen > 0)) {
 512                         uint wps_offset, remainder_ielen;
 513                         u8 *premainder_ie;
 514
 515                         wps_offset = (uint)(pwps_ie - cur_network->ies);
 516
 517                         premainder_ie = pwps_ie + wps_ielen;
 518
 519                         remainder_ielen = cur_network->ie_length - wps_offset - wps_ielen;
 520
 521                         memcpy(pframe, cur_network->ies, wps_offset);
 522                         pframe += wps_offset;
 523                         pattrib->pktlen += wps_offset;
 524
 525                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
 526                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
 527                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
 528                                 pframe += wps_ielen+2;
 529                                 pattrib->pktlen += wps_ielen+2;
 530                         }
 531
 532                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
 533                                 memcpy(pframe, premainder_ie, remainder_ielen);
 534                                 pframe += remainder_ielen;
 535                                 pattrib->pktlen += remainder_ielen;
 536                         }
 537                 } else {
 538                         memcpy(pframe, cur_network->ies, cur_network->ie_length);
 539                         pframe += cur_network->ie_length;
 540                         pattrib->pktlen += cur_network->ie_length;
 541                 }
 542         } else
 543 #endif
 544         {
 545                 /* timestamp will be inserted by hardware */
 546                 pframe += 8;
 547                 pattrib->pktlen += 8;
 548
 549                 /*  beacon interval: 2 bytes */
 550
 551                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
 552
 553                 pframe += 2;
 554                 pattrib->pktlen += 2;
 555
 556                 /*  capability info: 2 bytes */
 557
 558                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
 559
 560                 pframe += 2;
 561                 pattrib->pktlen += 2;
 562
 563                 /* below for ad-hoc mode */
 564
 565                 /*  SSID */
 566                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 567
 568                 /*  supported rates... */
 569                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 570                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 571
 572                 /*  DS parameter set */
 573                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 574
 575                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 576                         u8 erpinfo = 0;
 577                         u32 ATIMWindow;
 578                         /*  IBSS Parameter Set... */
 579                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
 580                         ATIMWindow = 0;
 581                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 582
 583                         /* ERP IE */
 584                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 585                 }
 586
 587                 /*  EXTERNDED SUPPORTED RATE */
 588                 if (rate_len > 8)
 589                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 590                 /* todo:HT for adhoc */
 591         }
 592
 593         pattrib->last_txcmdsz = pattrib->pktlen;
 594
 595         dump_mgntframe(padapter, pmgntframe);
 596 }
 597
 598 static int issue_probereq(struct adapter *padapter,
 599                           struct ndis_802_11_ssid *pssid, u8 *da,
 600                           bool wait_ack)
 601 {
 602         int ret = _FAIL;
 603         struct xmit_frame               *pmgntframe;
 604         struct pkt_attrib               *pattrib;
 605         unsigned char                   *pframe;
 606         struct ieee80211_hdr *pwlanhdr;
 607         __le16 *fctrl;
 608         unsigned char                   *mac;
 609         unsigned char                   bssrate[NumRates];
 610         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
 611         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 612         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 613         int     bssrate_len = 0;
 614         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 615
 616         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+%s\n", __func__));
 617
 618         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 619         if (!pmgntframe)
 620                 goto exit;
 621
 622         /* update attribute */
 623         pattrib = &pmgntframe->attrib;
 624         update_mgntframe_attrib(padapter, pattrib);
 625
 626         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 627
 628         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 629         pwlanhdr = (struct ieee80211_hdr *)pframe;
 630
 631         mac = myid(&(padapter->eeprompriv));
 632
 633         fctrl = &pwlanhdr->frame_control;
 634         *(fctrl) = 0;
 635
 636         if (da) {
 637                 /*      unicast probe request frame */
 638                 ether_addr_copy(pwlanhdr->addr1, da);
 639                 ether_addr_copy(pwlanhdr->addr3, da);
 640         } else {
 641                 /*      broadcast probe request frame */
 642                 ether_addr_copy(pwlanhdr->addr1, bc_addr);
 643                 ether_addr_copy(pwlanhdr->addr3, bc_addr);
 644         }
 645
 646         ether_addr_copy(pwlanhdr->addr2, mac);
 647
 648         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 649         pmlmeext->mgnt_seq++;
 650         SetFrameSubType(pframe, WIFI_PROBEREQ);
 651
 652         pframe += sizeof(struct ieee80211_hdr_3addr);
 653         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 654
 655         if (pssid)
 656                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
 657         else
 658                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
 659
 660         get_rate_set(padapter, bssrate, &bssrate_len);
 661
 662         if (bssrate_len > 8) {
 663                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
 664                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
 665         } else {
 666                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
 667         }
 668
 669         /* add wps_ie for wps2.0 */
 670         if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
 671                 memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
 672                 pframe += pmlmepriv->wps_probe_req_ie_len;
 673                 pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
 674         }
 675
 676         pattrib->last_txcmdsz = pattrib->pktlen;
 677
 678         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
 679                  ("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
 680
 681         if (wait_ack) {
 682                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
 683         } else {
 684                 dump_mgntframe(padapter, pmgntframe);
 685                 ret = _SUCCESS;
 686         }
 687
 688 exit:
 689         return ret;
 690 }
 691
 692 static int issue_probereq_ex(struct adapter *padapter,
 693                              struct ndis_802_11_ssid *pssid, u8 *da,
 694                              int try_cnt, int wait_ms)
 695 {
 696         int ret;
 697         int i = 0;
 698         unsigned long start = jiffies;
 699
 700         do {
 701                 ret = issue_probereq(padapter, pssid, da, wait_ms > 0);
 702
 703                 i++;
 704
 705                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
 706                         break;
 707
 708                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
 709                         msleep(wait_ms);
 710
 711         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
 712
 713         if (ret != _FAIL) {
 714                 ret = _SUCCESS;
 715                 goto exit;
 716         }
 717
 718         if (try_cnt && wait_ms) {
 719                 if (da)
 720                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
 721                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
 722                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 723                                 jiffies_to_msecs(jiffies - start));
 724                 else
 725                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
 726                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
 727                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 728                                 jiffies_to_msecs(jiffies - start));
 729         }
 730 exit:
 731         return ret;
 732 }
 733
 734 /*  if psta == NULL, indicate we are station(client) now... */
 735 static void issue_auth(struct adapter *padapter, struct sta_info *psta,
 736                        unsigned short status)
 737 {
 738         struct xmit_frame *pmgntframe;
 739         struct pkt_attrib *pattrib;
 740         unsigned char *pframe;
 741         struct ieee80211_hdr *pwlanhdr;
 742         __le16 *fctrl;
 743         unsigned int val32;
 744         u16 val16;
 745 #ifdef CONFIG_88EU_AP_MODE
 746         __le16 le_val16;
 747 #endif
 748         int use_shared_key = 0;
 749         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 750         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 751         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 752         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
 753
 754         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 755         if (pmgntframe == NULL)
 756                 return;
 757
 758         /* update attribute */
 759         pattrib = &pmgntframe->attrib;
 760         update_mgntframe_attrib(padapter, pattrib);
 761
 762         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 763
 764         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 765         pwlanhdr = (struct ieee80211_hdr *)pframe;
 766
 767         fctrl = &pwlanhdr->frame_control;
 768         *(fctrl) = 0;
 769
 770         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 771         pmlmeext->mgnt_seq++;
 772         SetFrameSubType(pframe, WIFI_AUTH);
 773
 774         pframe += sizeof(struct ieee80211_hdr_3addr);
 775         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 776
 777         if (psta) {/*  for AP mode */
 778 #ifdef CONFIG_88EU_AP_MODE
 779
 780                 ether_addr_copy(pwlanhdr->addr1, psta->hwaddr);
 781                 ether_addr_copy(pwlanhdr->addr2,
 782                                 myid(&(padapter->eeprompriv)));
 783                 ether_addr_copy(pwlanhdr->addr3,
 784                                 myid(&(padapter->eeprompriv)));
 785
 786                 /*  setting auth algo number */
 787                 val16 = (u16)psta->authalg;
 788
 789                 if (status != _STATS_SUCCESSFUL_)
 790                         val16 = 0;
 791
 792                 if (val16) {
 793                         le_val16 = cpu_to_le16(val16);
 794                         use_shared_key = 1;
 795                 } else {
 796                         le_val16 = 0;
 797                 }
 798
 799                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_val16,
 800                                           &pattrib->pktlen);
 801
 802                 /*  setting auth seq number */
 803                 val16 = (u16)psta->auth_seq;
 804                 le_val16 = cpu_to_le16(val16);
 805                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_val16,
 806                                           &pattrib->pktlen);
 807
 808                 /*  setting status code... */
 809                 val16 = status;
 810                 le_val16 = cpu_to_le16(val16);
 811                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_,
 812                                           &le_val16, &pattrib->pktlen);
 813
 814                 /*  added challenging text... */
 815                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
 816                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
 817 #endif
 818         } else {
 819                 __le32 le_tmp32;
 820                 __le16 le_tmp16;
 821
 822                 ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
 823                 ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
 824                 ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
 825
 826                 /*  setting auth algo number */
 827                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
 828                 if (val16)
 829                         use_shared_key = 1;
 830
 831                 /* setting IV for auth seq #3 */
 832                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 833                         val32 = (pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30);
 834                         le_tmp32 = cpu_to_le32(val32);
 835                         pframe = rtw_set_fixed_ie(pframe, 4, &le_tmp32,
 836                                                   &pattrib->pktlen);
 837
 838                         pattrib->iv_len = 4;
 839                 }
 840
 841                 le_tmp16 = cpu_to_le16(val16);
 842                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_tmp16,
 843                                           &pattrib->pktlen);
 844
 845                 /*  setting auth seq number */
 846                 val16 = pmlmeinfo->auth_seq;
 847                 le_tmp16 = cpu_to_le16(val16);
 848                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_tmp16,
 849                                           &pattrib->pktlen);
 850
 851                 /*  setting status code... */
 852                 le_tmp16 = cpu_to_le16(status);
 853                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &le_tmp16,
 854                                           &pattrib->pktlen);
 855
 856                 /*  then checking to see if sending challenging text... */
 857                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 858                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
 859
 860                         SetPrivacy(fctrl);
 861
 862                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 863
 864                         pattrib->encrypt = _WEP40_;
 865
 866                         pattrib->icv_len = 4;
 867
 868                         pattrib->pktlen += pattrib->icv_len;
 869                 }
 870         }
 871
 872         pattrib->last_txcmdsz = pattrib->pktlen;
 873
 874         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
 875         DBG_88E("%s\n", __func__);
 876         dump_mgntframe(padapter, pmgntframe);
 877 }
 878
 879 #ifdef CONFIG_88EU_AP_MODE
 880 static void issue_asocrsp(struct adapter *padapter, unsigned short status,
 881                           struct sta_info *pstat, int pkt_type)
 882 {
 883         struct xmit_frame       *pmgntframe;
 884         struct ieee80211_hdr *pwlanhdr;
 885         struct pkt_attrib *pattrib;
 886         unsigned char   *pbuf, *pframe;
 887         unsigned short val;
 888         __le16 *fctrl;
 889         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 890         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 891         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 892         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 893         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
 894         u8 *ie = pnetwork->ies;
 895         __le16 lestatus, leval;
 896
 897         DBG_88E("%s\n", __func__);
 898
 899         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 900         if (!pmgntframe)
 901                 return;
 902
 903         /* update attribute */
 904         pattrib = &pmgntframe->attrib;
 905         update_mgntframe_attrib(padapter, pattrib);
 906
 907         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 908
 909         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 910         pwlanhdr = (struct ieee80211_hdr *)pframe;
 911
 912         fctrl = &pwlanhdr->frame_control;
 913         *(fctrl) = 0;
 914
 915         ether_addr_copy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr);
 916         ether_addr_copy((void *)GetAddr2Ptr(pwlanhdr),
 917                         myid(&(padapter->eeprompriv)));
 918         ether_addr_copy((void *)GetAddr3Ptr(pwlanhdr), pnetwork->MacAddress);
 919
 920         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 921         pmlmeext->mgnt_seq++;
 922         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
 923                 SetFrameSubType(pwlanhdr, pkt_type);
 924         else
 925                 return;
 926
 927         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 928         pattrib->pktlen += pattrib->hdrlen;
 929         pframe += pattrib->hdrlen;
 930
 931         /* capability */
 932         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
 933
 934         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, &val, &pattrib->pktlen);
 935
 936         lestatus = cpu_to_le16(status);
 937         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &lestatus,
 938                                   &pattrib->pktlen);
 939
 940         leval = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
 941         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, &leval, &pattrib->pktlen);
 942
 943         if (pstat->bssratelen <= 8) {
 944                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
 945         } else {
 946                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
 947                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
 948         }
 949
 950         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
 951                 uint ie_len = 0;
 952
 953                 /* FILL HT CAP INFO IE */
 954                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
 955                 if (pbuf && ie_len > 0) {
 956                         memcpy(pframe, pbuf, ie_len+2);
 957                         pframe += (ie_len+2);
 958                         pattrib->pktlen += (ie_len+2);
 959                 }
 960
 961                 /* FILL HT ADD INFO IE */
 962                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
 963                 if (pbuf && ie_len > 0) {
 964                         memcpy(pframe, pbuf, ie_len+2);
 965                         pframe += (ie_len+2);
 966                         pattrib->pktlen += (ie_len+2);
 967                 }
 968         }
 969
 970         /* FILL WMM IE */
 971         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
 972                 uint ie_len = 0;
 973                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
 974
 975                 for (pbuf = ie + _BEACON_IE_OFFSET_;; pbuf += (ie_len + 2)) {
 976                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_ - (ie_len + 2)));
 977                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
 978                                 memcpy(pframe, pbuf, ie_len+2);
 979                                 pframe += (ie_len+2);
 980                                 pattrib->pktlen += (ie_len+2);
 981                                 break;
 982                         }
 983
 984                         if ((pbuf == NULL) || (ie_len == 0))
 985                                 break;
 986                 }
 987         }
 988
 989         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
 990                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
 991
 992         /* add WPS IE ie for wps 2.0 */
 993         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
 994                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
 995
 996                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
 997                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
 998         }
 999
1000         pattrib->last_txcmdsz = pattrib->pktlen;
1001         dump_mgntframe(padapter, pmgntframe);
1002 }
1003 #endif /* CONFIG_88EU_AP_MODE */
1004
1005 static void issue_assocreq(struct adapter *padapter)
1006 {
1007         int ret = _FAIL;
1008         struct xmit_frame       *pmgntframe;
1009         struct pkt_attrib       *pattrib;
1010         unsigned char           *pframe, *p;
1011         struct ieee80211_hdr *pwlanhdr;
1012         __le16 *fctrl;
1013         unsigned int    i, j, ie_len, index = 0;
1014         unsigned char bssrate[NumRates], sta_bssrate[NumRates];
1015         struct ndis_802_11_var_ie *pIE;
1016         struct registry_priv    *pregpriv = &padapter->registrypriv;
1017         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
1018         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1019         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1020         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1021         int     bssrate_len = 0, sta_bssrate_len = 0;
1022         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1023
1024         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1025         if (!pmgntframe)
1026                 goto exit;
1027
1028         /* update attribute */
1029         pattrib = &pmgntframe->attrib;
1030         update_mgntframe_attrib(padapter, pattrib);
1031
1032         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1033         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1034         pwlanhdr = (struct ieee80211_hdr *)pframe;
1035
1036         fctrl = &pwlanhdr->frame_control;
1037         *(fctrl) = 0;
1038         ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
1039         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1040         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1041
1042         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1043         pmlmeext->mgnt_seq++;
1044         SetFrameSubType(pframe, WIFI_ASSOCREQ);
1045
1046         pframe += sizeof(struct ieee80211_hdr_3addr);
1047         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1048
1049         /* caps */
1050
1051         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.ies), 2);
1052
1053         pframe += 2;
1054         pattrib->pktlen += 2;
1055
1056         /* listen interval */
1057         /* todo: listen interval for power saving */
1058         put_unaligned_le16(3, pframe);
1059         pframe += 2;
1060         pattrib->pktlen += 2;
1061
1062         /* SSID */
1063         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
1064
1065         /* supported rate & extended supported rate */
1066
1067         /*  Check if the AP's supported rates are also supported by STA. */
1068         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
1069
1070         if (pmlmeext->cur_channel == 14)/*  for JAPAN, channel 14 can only uses B Mode(CCK) */
1071                 sta_bssrate_len = 4;
1072
1073         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1074                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1075                         break;
1076                 DBG_88E("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
1077         }
1078
1079         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1080                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1081                         break;
1082
1083                 /*  Check if the AP's supported rates are also supported by STA. */
1084                 for (j = 0; j < sta_bssrate_len; j++) {
1085                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
1086                         if ((pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
1087                                         == (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK))
1088                                 break;
1089                 }
1090
1091                 if (j == sta_bssrate_len) {
1092                         /*  the rate is not supported by STA */
1093                         DBG_88E("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
1094                 } else {
1095                         /*  the rate is supported by STA */
1096                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
1097                 }
1098         }
1099
1100         bssrate_len = index;
1101         DBG_88E("bssrate_len=%d\n", bssrate_len);
1102
1103         if (bssrate_len == 0) {
1104                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
1105                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1106                 goto exit; /* don't connect to AP if no joint supported rate */
1107         }
1108
1109         if (bssrate_len > 8) {
1110                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
1111                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
1112         } else {
1113                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
1114         }
1115
1116         /* RSN */
1117         p = rtw_get_ie((pmlmeinfo->network.ies + sizeof(struct ndis_802_11_fixed_ie)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.ie_length - sizeof(struct ndis_802_11_fixed_ie)));
1118         if (p)
1119                 pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
1120
1121         /* HT caps */
1122         if (padapter->mlmepriv.htpriv.ht_option) {
1123                 p = rtw_get_ie((pmlmeinfo->network.ies + sizeof(struct ndis_802_11_fixed_ie)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.ie_length - sizeof(struct ndis_802_11_fixed_ie)));
1124                 if ((p != NULL) && (!(is_ap_in_tkip(padapter)))) {
1125                         memcpy(&pmlmeinfo->HT_caps, p + 2, sizeof(struct ieee80211_ht_cap));
1126
1127                         /* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
1128                         if (pregpriv->cbw40_enable == 0)
1129                                 pmlmeinfo->HT_caps.cap_info &= cpu_to_le16(~(BIT(6) | BIT(1)));
1130                         else
1131                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(BIT(1));
1132
1133                         /* todo: disable SM power save mode */
1134                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x000c);
1135
1136                         if (pregpriv->rx_stbc)
1137                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0100);/* RX STBC One spatial stream */
1138                         memcpy((u8 *)&pmlmeinfo->HT_caps.mcs, MCS_rate_1R, 16);
1139                         pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
1140                 }
1141         }
1142
1143         /* vendor specific IE, such as WPA, WMM, WPS */
1144         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pmlmeinfo->network.ie_length; i += (pIE->Length + 2)) {
1145                 pIE = (struct ndis_802_11_var_ie *)(pmlmeinfo->network.ies + i);
1146
1147                 switch (pIE->ElementID) {
1148                 case _VENDOR_SPECIFIC_IE_:
1149                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
1150                             (!memcmp(pIE->data, WMM_OUI, 4)) ||
1151                             (!memcmp(pIE->data, WPS_OUI, 4))) {
1152                                 if (!padapter->registrypriv.wifi_spec) {
1153                                         /* Commented by Kurt 20110629 */
1154                                         /* In some older APs, WPS handshake */
1155                                         /* would be fail if we append vender extensions informations to AP */
1156                                         if (!memcmp(pIE->data, WPS_OUI, 4))
1157                                                 pIE->Length = 14;
1158                                 }
1159                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
1160                         }
1161                         break;
1162                 default:
1163                         break;
1164                 }
1165         }
1166
1167         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1168                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
1169
1170         pattrib->last_txcmdsz = pattrib->pktlen;
1171         dump_mgntframe(padapter, pmgntframe);
1172
1173         ret = _SUCCESS;
1174
1175 exit:
1176         if (ret == _SUCCESS)
1177                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
1178         else
1179                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
1180 }
1181
1182 /* when wait_ack is true, this function should be called at process context */
1183 static int _issue_nulldata(struct adapter *padapter, unsigned char *da,
1184                            unsigned int power_mode, bool wait_ack)
1185 {
1186         int ret = _FAIL;
1187         struct xmit_frame                       *pmgntframe;
1188         struct pkt_attrib                       *pattrib;
1189         unsigned char                                   *pframe;
1190         struct ieee80211_hdr *pwlanhdr;
1191         __le16 *fctrl;
1192         struct xmit_priv        *pxmitpriv;
1193         struct mlme_ext_priv    *pmlmeext;
1194         struct mlme_ext_info    *pmlmeinfo;
1195         struct wlan_bssid_ex    *pnetwork;
1196
1197         if (!padapter)
1198                 goto exit;
1199
1200         pxmitpriv = &(padapter->xmitpriv);
1201         pmlmeext = &(padapter->mlmeextpriv);
1202         pmlmeinfo = &(pmlmeext->mlmext_info);
1203         pnetwork = &(pmlmeinfo->network);
1204
1205         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1206         if (!pmgntframe)
1207                 goto exit;
1208
1209         /* update attribute */
1210         pattrib = &pmgntframe->attrib;
1211         update_mgntframe_attrib(padapter, pattrib);
1212         pattrib->retry_ctrl = false;
1213
1214         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1215
1216         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1217         pwlanhdr = (struct ieee80211_hdr *)pframe;
1218
1219         fctrl = &pwlanhdr->frame_control;
1220         *(fctrl) = 0;
1221
1222         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1223                 SetFrDs(fctrl);
1224         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1225                 SetToDs(fctrl);
1226
1227         if (power_mode)
1228                 SetPwrMgt(fctrl);
1229
1230         ether_addr_copy(pwlanhdr->addr1, da);
1231         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1232         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1233
1234         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1235         pmlmeext->mgnt_seq++;
1236         SetFrameSubType(pframe, WIFI_DATA_NULL);
1237
1238         pframe += sizeof(struct ieee80211_hdr_3addr);
1239         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1240
1241         pattrib->last_txcmdsz = pattrib->pktlen;
1242
1243         if (wait_ack) {
1244                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1245         } else {
1246                 dump_mgntframe(padapter, pmgntframe);
1247                 ret = _SUCCESS;
1248         }
1249
1250 exit:
1251         return ret;
1252 }
1253
1254 /* when wait_ms > 0 , this function should be called at process context */
1255 /* da == NULL for station mode */
1256 int issue_nulldata(struct adapter *padapter, unsigned char *da,
1257                    unsigned int power_mode, int try_cnt, int wait_ms)
1258 {
1259         int ret;
1260         int i = 0;
1261         unsigned long start = jiffies;
1262         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1263         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1264         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1265
1266         /* da == NULL, assume it's null data for sta to ap*/
1267         if (da == NULL)
1268                 da = pnetwork->MacAddress;
1269
1270         do {
1271                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0);
1272
1273                 i++;
1274
1275                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1276                         break;
1277
1278                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1279                         msleep(wait_ms);
1280         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1281
1282         if (ret != _FAIL) {
1283                 ret = _SUCCESS;
1284                 goto exit;
1285         }
1286
1287         if (try_cnt && wait_ms) {
1288                 if (da)
1289                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1290                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1291                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1292                                 jiffies_to_msecs(jiffies - start));
1293                 else
1294                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1295                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1296                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1297                                 jiffies_to_msecs(jiffies - start));
1298         }
1299 exit:
1300         return ret;
1301 }
1302
1303 /* when wait_ack is true, this function should be called at process context */
1304 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
1305                                u16 tid, bool wait_ack)
1306 {
1307         int ret = _FAIL;
1308         struct xmit_frame                       *pmgntframe;
1309         struct pkt_attrib                       *pattrib;
1310         unsigned char                                   *pframe;
1311         struct ieee80211_hdr *pwlanhdr;
1312         __le16 *fctrl;
1313         unsigned short *qc;
1314         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1315         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1316         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1317         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1318
1319         DBG_88E("%s\n", __func__);
1320
1321         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1322         if (!pmgntframe)
1323                 goto exit;
1324
1325         /* update attribute */
1326         pattrib = &pmgntframe->attrib;
1327         update_mgntframe_attrib(padapter, pattrib);
1328
1329         pattrib->hdrlen += 2;
1330         pattrib->qos_en = true;
1331         pattrib->eosp = 1;
1332         pattrib->ack_policy = 0;
1333         pattrib->mdata = 0;
1334
1335         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1336
1337         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1338         pwlanhdr = (struct ieee80211_hdr *)pframe;
1339
1340         fctrl = &pwlanhdr->frame_control;
1341         *(fctrl) = 0;
1342
1343         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1344                 SetFrDs(fctrl);
1345         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1346                 SetToDs(fctrl);
1347
1348         if (pattrib->mdata)
1349                 SetMData(fctrl);
1350
1351         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
1352
1353         SetPriority(qc, tid);
1354
1355         SetEOSP(qc, pattrib->eosp);
1356
1357         SetAckpolicy(qc, pattrib->ack_policy);
1358
1359         ether_addr_copy(pwlanhdr->addr1, da);
1360         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1361         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1362
1363         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1364         pmlmeext->mgnt_seq++;
1365         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
1366
1367         pframe += sizeof(struct ieee80211_qos_hdr);
1368         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
1369
1370         pattrib->last_txcmdsz = pattrib->pktlen;
1371
1372         if (wait_ack) {
1373                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1374         } else {
1375                 dump_mgntframe(padapter, pmgntframe);
1376                 ret = _SUCCESS;
1377         }
1378
1379 exit:
1380         return ret;
1381 }
1382
1383 /* when wait_ms > 0 , this function should be called at process context */
1384 /* da == NULL for station mode */
1385 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
1386                        u16 tid, int try_cnt, int wait_ms)
1387 {
1388         int ret;
1389         int i = 0;
1390         unsigned long start = jiffies;
1391         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1392         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1393         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1394
1395         /* da == NULL, assume it's null data for sta to ap*/
1396         if (da == NULL)
1397                 da = pnetwork->MacAddress;
1398
1399         do {
1400                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0);
1401
1402                 i++;
1403
1404                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1405                         break;
1406
1407                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1408                         msleep(wait_ms);
1409         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1410
1411         if (ret != _FAIL) {
1412                 ret = _SUCCESS;
1413                 goto exit;
1414         }
1415
1416         if (try_cnt && wait_ms) {
1417                 if (da)
1418                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1419                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1420                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1421                                 jiffies_to_msecs(jiffies - start));
1422                 else
1423                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1424                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1425                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1426                                 jiffies_to_msecs(jiffies - start));
1427         }
1428 exit:
1429         return ret;
1430 }
1431
1432 static int _issue_deauth(struct adapter *padapter, unsigned char *da,
1433                          unsigned short reason, bool wait_ack)
1434 {
1435         struct xmit_frame                       *pmgntframe;
1436         struct pkt_attrib                       *pattrib;
1437         unsigned char                                   *pframe;
1438         struct ieee80211_hdr *pwlanhdr;
1439         __le16 *fctrl;
1440         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1441         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1442         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1443         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1444         int ret = _FAIL;
1445         __le16 le_tmp;
1446
1447         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1448         if (pmgntframe == NULL)
1449                 goto exit;
1450
1451         /* update attribute */
1452         pattrib = &pmgntframe->attrib;
1453         update_mgntframe_attrib(padapter, pattrib);
1454         pattrib->retry_ctrl = false;
1455
1456         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1457
1458         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1459         pwlanhdr = (struct ieee80211_hdr *)pframe;
1460
1461         fctrl = &pwlanhdr->frame_control;
1462         *(fctrl) = 0;
1463
1464         ether_addr_copy(pwlanhdr->addr1, da);
1465         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1466         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1467
1468         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1469         pmlmeext->mgnt_seq++;
1470         SetFrameSubType(pframe, WIFI_DEAUTH);
1471
1472         pframe += sizeof(struct ieee80211_hdr_3addr);
1473         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1474
1475         le_tmp = cpu_to_le16(reason);
1476         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, &le_tmp,
1477                                   &pattrib->pktlen);
1478
1479         pattrib->last_txcmdsz = pattrib->pktlen;
1480
1481         if (wait_ack) {
1482                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1483         } else {
1484                 dump_mgntframe(padapter, pmgntframe);
1485                 ret = _SUCCESS;
1486         }
1487
1488 exit:
1489         return ret;
1490 }
1491
1492 int issue_deauth(struct adapter *padapter, unsigned char *da,
1493                  unsigned short reason)
1494 {
1495         DBG_88E("%s to %pM\n", __func__, da);
1496         return _issue_deauth(padapter, da, reason, false);
1497 }
1498
1499 static int issue_deauth_ex(struct adapter *padapter, u8 *da,
1500                            unsigned short reason, int try_cnt,
1501                            int wait_ms)
1502 {
1503         int ret;
1504         int i = 0;
1505         unsigned long start = jiffies;
1506
1507         do {
1508                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0);
1509
1510                 i++;
1511
1512                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1513                         break;
1514
1515                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1516                         msleep(wait_ms);
1517         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1518
1519         if (ret != _FAIL) {
1520                 ret = _SUCCESS;
1521                 goto exit;
1522         }
1523
1524         if (try_cnt && wait_ms) {
1525                 if (da)
1526                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1527                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1528                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1529                                 jiffies_to_msecs(jiffies - start));
1530                 else
1531                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1532                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1533                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1534                                 jiffies_to_msecs(jiffies - start));
1535         }
1536 exit:
1537         return ret;
1538 }
1539
1540 static void issue_action_BA(struct adapter *padapter, unsigned char *raddr,
1541                             unsigned char action, unsigned short status)
1542 {
1543         u8 category = RTW_WLAN_CATEGORY_BACK;
1544         u16 start_seq;
1545         u16 BA_para_set;
1546         u16 reason_code;
1547         u16 BA_timeout_value;
1548         __le16  le_tmp;
1549         u16 BA_starting_seqctrl = 0;
1550         enum ht_cap_ampdu_factor max_rx_ampdu_factor;
1551         struct xmit_frame *pmgntframe;
1552         struct pkt_attrib *pattrib;
1553         u8 *pframe;
1554         struct ieee80211_hdr *pwlanhdr;
1555         __le16 *fctrl;
1556         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
1557         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1558         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1559         struct sta_info *psta;
1560         struct sta_priv *pstapriv = &padapter->stapriv;
1561         struct registry_priv *pregpriv = &padapter->registrypriv;
1562         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1563
1564         DBG_88E("%s, category=%d, action=%d, status=%d\n", __func__, category, action, status);
1565
1566         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1567         if (!pmgntframe)
1568                 return;
1569
1570         /* update attribute */
1571         pattrib = &pmgntframe->attrib;
1572         update_mgntframe_attrib(padapter, pattrib);
1573
1574         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1575
1576         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1577         pwlanhdr = (struct ieee80211_hdr *)pframe;
1578
1579         fctrl = &pwlanhdr->frame_control;
1580         *(fctrl) = 0;
1581
1582         ether_addr_copy(pwlanhdr->addr1, raddr);
1583         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1584         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1585
1586         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1587         pmlmeext->mgnt_seq++;
1588         SetFrameSubType(pframe, WIFI_ACTION);
1589
1590         pframe += sizeof(struct ieee80211_hdr_3addr);
1591         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1592
1593         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1594         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1595
1596         if (category == 3) {
1597                 switch (action) {
1598                 case 0: /* ADDBA req */
1599                         do {
1600                                 pmlmeinfo->dialogToken++;
1601                         } while (pmlmeinfo->dialogToken == 0);
1602                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
1603
1604                         BA_para_set = 0x1002 | ((status & 0xf) << 2); /* immediate ack & 64 buffer size */
1605                         le_tmp = cpu_to_le16(BA_para_set);
1606                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1607                                                   &pattrib->pktlen);
1608
1609                         BA_timeout_value = 5000;/*  5ms */
1610                         le_tmp = cpu_to_le16(BA_timeout_value);
1611                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1612                                                   &pattrib->pktlen);
1613
1614                         psta = rtw_get_stainfo(pstapriv, raddr);
1615                         if (psta) {
1616                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
1617
1618                                 DBG_88E("BA_starting_seqctrl=%d for TID=%d\n", start_seq, status & 0x07);
1619
1620                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
1621
1622                                 BA_starting_seqctrl = start_seq << 4;
1623                         }
1624                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
1625                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1626                                                   &pattrib->pktlen);
1627                         break;
1628                 case 1: /* ADDBA rsp */
1629                 {
1630                         struct ADDBA_request *ADDBA_req = &pmlmeinfo->ADDBA_req;
1631
1632                         pframe = rtw_set_fixed_ie(pframe, 1,
1633                                                   &ADDBA_req->dialog_token,
1634                                                   &pattrib->pktlen);
1635                         pframe = rtw_set_fixed_ie(pframe, 2, &status,
1636                                                   &pattrib->pktlen);
1637
1638                         BA_para_set = le16_to_cpu(ADDBA_req->BA_para_set) &
1639                                       0x3f;
1640                         rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
1641                         switch (max_rx_ampdu_factor) {
1642                         case MAX_AMPDU_FACTOR_64K:
1643                                 BA_para_set |= 0x1000; /* 64 buffer size */
1644                                 break;
1645                         case MAX_AMPDU_FACTOR_32K:
1646                                 BA_para_set |= 0x0800; /* 32 buffer size */
1647                                 break;
1648                         case MAX_AMPDU_FACTOR_16K:
1649                                 BA_para_set |= 0x0400; /* 16 buffer size */
1650                                 break;
1651                         case MAX_AMPDU_FACTOR_8K:
1652                                 BA_para_set |= 0x0200; /* 8 buffer size */
1653                                 break;
1654                         default:
1655                                 BA_para_set |= 0x1000; /* 64 buffer size */
1656                                 break;
1657                         }
1658
1659                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
1660                                 BA_para_set = BA_para_set & ~BIT(0);
1661                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
1662                                 BA_para_set = BA_para_set | BIT(0);
1663                         le_tmp = cpu_to_le16(BA_para_set);
1664
1665                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1666                                                   &pattrib->pktlen);
1667                         pframe = rtw_set_fixed_ie(pframe, 2,
1668                                                   &ADDBA_req->BA_timeout_value,
1669                                                   &pattrib->pktlen);
1670                         break;
1671                 }
1672                 case 2:/* DELBA */
1673                         BA_para_set = (status & 0x1F) << 3;
1674                         le_tmp = cpu_to_le16(BA_para_set);
1675                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1676                                                   &pattrib->pktlen);
1677
1678                         reason_code = 37;/* Requested from peer STA as it does not want to use the mechanism */
1679                         le_tmp = cpu_to_le16(reason_code);
1680                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1681                                                   &pattrib->pktlen);
1682                         break;
1683                 default:
1684                         break;
1685                 }
1686         }
1687
1688         pattrib->last_txcmdsz = pattrib->pktlen;
1689
1690         dump_mgntframe(padapter, pmgntframe);
1691 }
1692
1693 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
1694 {
1695         struct list_head *plist, *phead;
1696         unsigned char category, action;
1697         struct xmit_frame                       *pmgntframe;
1698         struct pkt_attrib                       *pattrib;
1699         unsigned char                           *pframe;
1700         struct ieee80211_hdr *pwlanhdr;
1701         __le16 *fctrl;
1702         struct  wlan_network    *pnetwork = NULL;
1703         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1704         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1705         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1706         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1707         struct __queue *queue   = &(pmlmepriv->scanned_queue);
1708         u8 InfoContent[16] = {0};
1709         u8 ICS[8][15];
1710         struct wlan_bssid_ex  *cur_network   = &(pmlmeinfo->network);
1711
1712         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
1713                 return;
1714
1715         if (pmlmeinfo->bwmode_updated)
1716                 return;
1717
1718         DBG_88E("%s\n", __func__);
1719
1720         category = RTW_WLAN_CATEGORY_PUBLIC;
1721         action = ACT_PUBLIC_BSSCOEXIST;
1722
1723         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1724         if (!pmgntframe)
1725                 return;
1726
1727         /* update attribute */
1728         pattrib = &pmgntframe->attrib;
1729         update_mgntframe_attrib(padapter, pattrib);
1730
1731         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1732
1733         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1734         pwlanhdr = (struct ieee80211_hdr *)pframe;
1735
1736         fctrl = &pwlanhdr->frame_control;
1737         *(fctrl) = 0;
1738
1739         ether_addr_copy(pwlanhdr->addr1, cur_network->MacAddress);
1740         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1741         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
1742
1743         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1744         pmlmeext->mgnt_seq++;
1745         SetFrameSubType(pframe, WIFI_ACTION);
1746
1747         pframe += sizeof(struct ieee80211_hdr_3addr);
1748         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1749
1750         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1751         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1752
1753         /*  */
1754         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
1755                 u8 iedata = 0;
1756
1757                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
1758
1759                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
1760         }
1761
1762         /*  */
1763         memset(ICS, 0, sizeof(ICS));
1764         if (pmlmepriv->num_sta_no_ht > 0) {
1765                 int i;
1766
1767                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1768
1769                 phead = get_list_head(queue);
1770                 plist = phead->next;
1771
1772                 while (phead != plist) {
1773                         uint len;
1774                         u8 *p;
1775                         struct wlan_bssid_ex *pbss_network;
1776
1777                         pnetwork = container_of(plist, struct wlan_network, list);
1778
1779                         plist = plist->next;
1780
1781                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
1782
1783                         p = rtw_get_ie(pbss_network->ies + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->ie_length - _FIXED_IE_LENGTH_);
1784                         if ((p == NULL) || (len == 0)) { /* non-HT */
1785                                 if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
1786                                         continue;
1787
1788                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
1789
1790                                 if (ICS[0][0] == 0)
1791                                         ICS[0][0] = 1;
1792                         }
1793                 }
1794                 spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
1795
1796                 for (i = 0; i < 8; i++) {
1797                         if (ICS[i][0] == 1) {
1798                                 int j, k = 0;
1799
1800                                 InfoContent[k] = i;
1801                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
1802                                 k++;
1803
1804                                 for (j = 1; j <= 14; j++) {
1805                                         if (ICS[i][j] == 1) {
1806                                                 if (k < 16) {
1807                                                         InfoContent[k] = j; /* channel number */
1808                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
1809                                                         k++;
1810                                                 }
1811                                         }
1812                                 }
1813
1814                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
1815                         }
1816                 }
1817         }
1818
1819         pattrib->last_txcmdsz = pattrib->pktlen;
1820
1821         dump_mgntframe(padapter, pmgntframe);
1822 }
1823
1824 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
1825 {
1826         struct sta_priv *pstapriv = &padapter->stapriv;
1827         struct sta_info *psta = NULL;
1828         /* struct recv_reorder_ctrl *preorder_ctrl; */
1829         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1830         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1831         u16 tid;
1832
1833         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1834                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1835                         return _SUCCESS;
1836
1837         psta = rtw_get_stainfo(pstapriv, addr);
1838         if (psta == NULL)
1839                 return _SUCCESS;
1840
1841         if (initiator == 0) { /*  recipient */
1842                 for (tid = 0; tid < MAXTID; tid++) {
1843                         if (psta->recvreorder_ctrl[tid].enable) {
1844                                 DBG_88E("rx agg disable tid(%d)\n", tid);
1845                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1846                                 psta->recvreorder_ctrl[tid].enable = false;
1847                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
1848                         }
1849                 }
1850         } else if (initiator == 1) { /*  originator */
1851                 for (tid = 0; tid < MAXTID; tid++) {
1852                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
1853                                 DBG_88E("tx agg disable tid(%d)\n", tid);
1854                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1855                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1856                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1857                         }
1858                 }
1859         }
1860
1861         return _SUCCESS;
1862 }
1863
1864 unsigned int send_beacon(struct adapter *padapter)
1865 {
1866         u8 bxmitok = false;
1867         int     issue = 0;
1868         int poll = 0;
1869
1870         unsigned long start = jiffies;
1871
1872         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
1873         do {
1874                 issue_beacon(padapter, 100);
1875                 issue++;
1876                 do {
1877                         yield();
1878                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
1879                         poll++;
1880                 } while ((poll%10) != 0 && !bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1881         } while (!bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1882
1883         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
1884                 return _FAIL;
1885         if (!bxmitok) {
1886                 DBG_88E("%s fail! %u ms\n", __func__,
1887                         jiffies_to_msecs(jiffies - start));
1888                 return _FAIL;
1889         } else {
1890                 u32 passing_time = jiffies_to_msecs(jiffies - start);
1891
1892                 if (passing_time > 100 || issue > 3)
1893                         DBG_88E("%s success, issue:%d, poll:%d, %u ms\n",
1894                                 __func__, issue, poll,
1895                                 jiffies_to_msecs(jiffies - start));
1896                 return _SUCCESS;
1897         }
1898 }
1899
1900 /****************************************************************************
1901
1902 Following are some utility functions for WiFi MLME
1903
1904 *****************************************************************************/
1905
1906 static void site_survey(struct adapter *padapter)
1907 {
1908         unsigned char           survey_channel = 0, val8;
1909         enum rt_scan_type ScanType = SCAN_PASSIVE;
1910         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1911         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1912         u32 initialgain = 0;
1913         struct rtw_ieee80211_channel *ch;
1914
1915         if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
1916                 ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
1917                 survey_channel = ch->hw_value;
1918                 ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
1919         }
1920
1921         if (survey_channel != 0) {
1922                 /* PAUSE 4-AC Queue when site_survey */
1923                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1924                 /* val8 |= 0x0f; */
1925                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1926                 if (pmlmeext->sitesurvey_res.channel_idx == 0)
1927                         set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
1928                 else
1929                         SelectChannel(padapter, survey_channel);
1930
1931                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
1932                         int i;
1933
1934                         for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
1935                                 if (pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
1936                                         /* todo: to issue two probe req??? */
1937                                         issue_probereq(padapter,
1938                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1939                                                                 NULL, false);
1940                                         /* msleep(SURVEY_TO>>1); */
1941                                         issue_probereq(padapter,
1942                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1943                                                                 NULL, false);
1944                                 }
1945                         }
1946
1947                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1948                                 /* todo: to issue two probe req??? */
1949                                 issue_probereq(padapter, NULL, NULL, false);
1950                                 /* msleep(SURVEY_TO>>1); */
1951                                 issue_probereq(padapter, NULL, NULL, false);
1952                         }
1953
1954                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1955                                 /* todo: to issue two probe req??? */
1956                                 issue_probereq(padapter, NULL, NULL, false);
1957                                 /* msleep(SURVEY_TO>>1); */
1958                                 issue_probereq(padapter, NULL, NULL, false);
1959                         }
1960                 }
1961
1962                 set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1963         } else {
1964                 /*  20100721:Interrupt scan operation here. */
1965                 /*  For SW antenna diversity before link, it needs to switch to another antenna and scan again. */
1966                 /*  It compares the scan result and select better one to do connection. */
1967                 if (rtw_hal_antdiv_before_linked(padapter)) {
1968                         pmlmeext->sitesurvey_res.bss_cnt = 0;
1969                         pmlmeext->sitesurvey_res.channel_idx = -1;
1970                         pmlmeext->chan_scan_time = SURVEY_TO / 2;
1971                         set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1972                         return;
1973                 }
1974
1975                 pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
1976
1977                 /* switch back to the original channel */
1978
1979                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
1980
1981                 /* flush 4-AC Queue after site_survey */
1982                 /* val8 = 0; */
1983                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1984
1985                 /* config MSR */
1986                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
1987
1988                 initialgain = 0xff; /* restore RX GAIN */
1989                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
1990                 /* turn on dynamic functions */
1991                 Restore_DM_Func_Flag(padapter);
1992                 /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
1993
1994                 if (is_client_associated_to_ap(padapter))
1995                         issue_nulldata(padapter, NULL, 0, 3, 500);
1996
1997                 val8 = 0; /* survey done */
1998                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
1999
2000                 report_surveydone_event(padapter);
2001
2002                 pmlmeext->chan_scan_time = SURVEY_TO;
2003                 pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
2004
2005                 issue_action_BSSCoexistPacket(padapter);
2006                 issue_action_BSSCoexistPacket(padapter);
2007                 issue_action_BSSCoexistPacket(padapter);
2008         }
2009 }
2010
2011 /* collect bss info from Beacon and Probe request/response frames. */
2012 static u8 collect_bss_info(struct adapter *padapter,
2013                            struct recv_frame *precv_frame,
2014                            struct wlan_bssid_ex *bssid)
2015 {
2016         int     i;
2017         u32     len;
2018         u8 *p;
2019         u16 val16, subtype;
2020         u8 *pframe = precv_frame->pkt->data;
2021         u32 packet_len = precv_frame->pkt->len;
2022         u8 ie_offset;
2023         struct registry_priv    *pregistrypriv = &padapter->registrypriv;
2024         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2025         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2026
2027         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
2028
2029         if (len > MAX_IE_SZ)
2030                 return _FAIL;
2031
2032         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
2033
2034         subtype = GetFrameSubType(pframe);
2035
2036         if (subtype == WIFI_BEACON) {
2037                 bssid->Reserved[0] = 1;
2038                 ie_offset = _BEACON_IE_OFFSET_;
2039         } else {
2040                 /*  FIXME : more type */
2041                 if (subtype == WIFI_PROBEREQ) {
2042                         ie_offset = _PROBEREQ_IE_OFFSET_;
2043                         bssid->Reserved[0] = 2;
2044                 } else if (subtype == WIFI_PROBERSP) {
2045                         ie_offset = _PROBERSP_IE_OFFSET_;
2046                         bssid->Reserved[0] = 3;
2047                 } else {
2048                         bssid->Reserved[0] = 0;
2049                         ie_offset = _FIXED_IE_LENGTH_;
2050                 }
2051         }
2052
2053         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
2054
2055         /* below is to copy the information element */
2056         bssid->ie_length = len;
2057         memcpy(bssid->ies, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->ie_length);
2058
2059         /* get the signal strength in dBM.raw data */
2060         bssid->Rssi = precv_frame->attrib.phy_info.recvpower;
2061         bssid->PhyInfo.SignalQuality = precv_frame->attrib.phy_info.SignalQuality;/* in percentage */
2062         bssid->PhyInfo.SignalStrength = precv_frame->attrib.phy_info.SignalStrength;/* in percentage */
2063         rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
2064
2065         /*  checking SSID */
2066         p = rtw_get_ie(bssid->ies + ie_offset, _SSID_IE_, &len, bssid->ie_length - ie_offset);
2067         if (!p) {
2068                 DBG_88E("marc: cannot find SSID for survey event\n");
2069                 return _FAIL;
2070         }
2071
2072         if (len) {
2073                 if (len > NDIS_802_11_LENGTH_SSID) {
2074                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2075                         return _FAIL;
2076                 }
2077                 memcpy(bssid->Ssid.Ssid, (p + 2), len);
2078                 bssid->Ssid.SsidLength = len;
2079         } else {
2080                 bssid->Ssid.SsidLength = 0;
2081         }
2082
2083         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
2084
2085         /* checking rate info... */
2086         i = 0;
2087         p = rtw_get_ie(bssid->ies + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->ie_length - ie_offset);
2088         if (p != NULL) {
2089                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
2090                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2091                         return _FAIL;
2092                 }
2093                 memcpy(bssid->SupportedRates, (p + 2), len);
2094                 i = len;
2095         }
2096
2097         p = rtw_get_ie(bssid->ies + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->ie_length - ie_offset);
2098         if (p) {
2099                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i)) {
2100                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2101                         return _FAIL;
2102                 }
2103                 memcpy(bssid->SupportedRates + i, (p + 2), len);
2104         }
2105
2106         /* todo: */
2107         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
2108
2109         if (bssid->ie_length < 12)
2110                 return _FAIL;
2111
2112         /*  Checking for DSConfig */
2113         p = rtw_get_ie(bssid->ies + ie_offset, _DSSET_IE_, &len, bssid->ie_length - ie_offset);
2114
2115         bssid->Configuration.DSConfig = 0;
2116         bssid->Configuration.Length = 0;
2117
2118         if (p) {
2119                 bssid->Configuration.DSConfig = *(p + 2);
2120         } else {/*  In 5G, some ap do not have DSSET IE */
2121                 /*  checking HT info for channel */
2122                 p = rtw_get_ie(bssid->ies + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->ie_length - ie_offset);
2123                 if (p) {
2124                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
2125
2126                         bssid->Configuration.DSConfig = HT_info->primary_channel;
2127                 } else { /*  use current channel */
2128                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
2129                 }
2130         }
2131
2132         if (subtype == WIFI_PROBEREQ) {
2133                 /*  FIXME */
2134                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2135                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2136                 bssid->Privacy = 1;
2137                 return _SUCCESS;
2138         }
2139
2140         bssid->Configuration.BeaconPeriod =
2141                 get_unaligned_le16(rtw_get_beacon_interval_from_ie(bssid->ies));
2142
2143         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
2144
2145         if (val16 & BIT(0)) {
2146                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2147                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2148         } else {
2149                 bssid->InfrastructureMode = Ndis802_11IBSS;
2150                 ether_addr_copy(bssid->MacAddress, GetAddr3Ptr(pframe));
2151         }
2152
2153         if (val16 & BIT(4))
2154                 bssid->Privacy = 1;
2155         else
2156                 bssid->Privacy = 0;
2157
2158         bssid->Configuration.ATIMWindow = 0;
2159
2160         /* 20/40 BSS Coexistence check */
2161         if ((pregistrypriv->wifi_spec == 1) && (!pmlmeinfo->bwmode_updated)) {
2162                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2163
2164                 p = rtw_get_ie(bssid->ies + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->ie_length - ie_offset);
2165                 if (p && len > 0) {
2166                         struct ieee80211_ht_cap *pHT_caps =
2167                                 (struct ieee80211_ht_cap *)(p + 2);
2168
2169                         if (le16_to_cpu(pHT_caps->cap_info) & BIT(14))
2170                                 pmlmepriv->num_FortyMHzIntolerant++;
2171                 } else {
2172                         pmlmepriv->num_sta_no_ht++;
2173                 }
2174         }
2175
2176         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
2177         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
2178                 bssid->PhyInfo.SignalQuality = 101;
2179         return _SUCCESS;
2180 }
2181
2182 static void start_create_ibss(struct adapter *padapter)
2183 {
2184         unsigned short  caps;
2185         u8 val8;
2186         u8 join_type;
2187         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2188         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2189         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2190
2191         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2192         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2193
2194         /* update wireless mode */
2195         update_wireless_mode(padapter);
2196
2197         /* update capability */
2198         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2199         update_capinfo(padapter, caps);
2200         if (caps&cap_IBSS) {/* adhoc master */
2201                 val8 = 0xcf;
2202                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2203
2204                 /* switch channel */
2205                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
2206                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2207
2208                 beacon_timing_control(padapter);
2209
2210                 /* set msr to WIFI_FW_ADHOC_STATE */
2211                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2212                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2213
2214                 /* issue beacon */
2215                 if (send_beacon(padapter) == _FAIL) {
2216                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
2217
2218                         report_join_res(padapter, -1);
2219                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2220                 } else {
2221                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
2222                         join_type = 0;
2223                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
2224
2225                         report_join_res(padapter, 1);
2226                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
2227                 }
2228         } else {
2229                 DBG_88E("%s, invalid cap:%x\n", __func__, caps);
2230                 return;
2231         }
2232 }
2233
2234 static void start_clnt_join(struct adapter *padapter)
2235 {
2236         unsigned short  caps;
2237         u8 val8;
2238         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2239         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2240         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2241         int beacon_timeout;
2242
2243         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2244         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2245
2246         /* update wireless mode */
2247         update_wireless_mode(padapter);
2248
2249         /* update capability */
2250         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2251         update_capinfo(padapter, caps);
2252         if (caps&cap_ESS) {
2253                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
2254
2255                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
2256
2257                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2258
2259                 /* switch channel */
2260                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2261
2262                 /* here wait for receiving the beacon to start auth */
2263                 /* and enable a timer */
2264                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
2265                 set_link_timer(pmlmeext, beacon_timeout);
2266                 mod_timer(&padapter->mlmepriv.assoc_timer, jiffies +
2267                           msecs_to_jiffies((REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO * REASSOC_LIMIT) + beacon_timeout));
2268
2269                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
2270         } else if (caps&cap_IBSS) { /* adhoc client */
2271                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
2272
2273                 val8 = 0xcf;
2274                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2275
2276                 /* switch channel */
2277                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2278
2279                 beacon_timing_control(padapter);
2280
2281                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2282
2283                 report_join_res(padapter, 1);
2284         } else {
2285                 return;
2286         }
2287 }
2288
2289 static void start_clnt_auth(struct adapter *padapter)
2290 {
2291         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2292         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2293
2294         del_timer_sync(&pmlmeext->link_timer);
2295
2296         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
2297         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
2298
2299         pmlmeinfo->auth_seq = 1;
2300         pmlmeinfo->reauth_count = 0;
2301         pmlmeinfo->reassoc_count = 0;
2302         pmlmeinfo->link_count = 0;
2303         pmlmeext->retry = 0;
2304
2305         /*  Because of AP's not receiving deauth before */
2306         /*  AP may: 1)not response auth or 2)deauth us after link is complete */
2307         /*  issue deauth before issuing auth to deal with the situation */
2308         /*      Commented by Albert 2012/07/21 */
2309         /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
2310         issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
2311
2312         DBG_88E_LEVEL(_drv_info_, "start auth\n");
2313         issue_auth(padapter, NULL, 0);
2314
2315         set_link_timer(pmlmeext, REAUTH_TO);
2316 }
2317
2318 static void start_clnt_assoc(struct adapter *padapter)
2319 {
2320         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2321         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2322
2323         del_timer_sync(&pmlmeext->link_timer);
2324
2325         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
2326         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
2327
2328         issue_assocreq(padapter);
2329
2330         set_link_timer(pmlmeext, REASSOC_TO);
2331 }
2332
2333 static unsigned int receive_disconnect(struct adapter *padapter,
2334                                        unsigned char *MacAddr,
2335                                        unsigned short reason)
2336 {
2337         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2338         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2339         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
2340
2341         /* check A3 */
2342         if (memcmp(MacAddr, pnetwork->MacAddress, ETH_ALEN))
2343                 return _SUCCESS;
2344
2345         DBG_88E("%s\n", __func__);
2346
2347         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
2348                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
2349                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2350                         report_del_sta_event(padapter, MacAddr, reason);
2351                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
2352                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2353                         report_join_res(padapter, -2);
2354                 }
2355         }
2356         return _SUCCESS;
2357 }
2358
2359 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
2360 {
2361         struct registry_priv *pregistrypriv;
2362         struct mlme_ext_priv *pmlmeext;
2363         struct rt_channel_info *chplan_new;
2364         u8 channel;
2365         u8 i;
2366
2367         pregistrypriv = &padapter->registrypriv;
2368         pmlmeext = &padapter->mlmeextpriv;
2369
2370         /*  Adjust channel plan by AP Country IE */
2371         if (pregistrypriv->enable80211d &&
2372             (!pmlmeext->update_channel_plan_by_ap_done)) {
2373                 u8 *ie, *p;
2374                 u32 len;
2375                 struct rt_channel_plan chplan_ap;
2376                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
2377                 u8 country[4];
2378                 u8 fcn; /*  first channel number */
2379                 u8 noc; /*  number of channel */
2380                 u8 j, k;
2381
2382                 ie = rtw_get_ie(bssid->ies + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->ie_length - _FIXED_IE_LENGTH_);
2383                 if (!ie)
2384                         return;
2385                 if (len < 6)
2386                         return;
2387                 ie += 2;
2388                 p = ie;
2389                 ie += len;
2390
2391                 memset(country, 0, 4);
2392                 memcpy(country, p, 3);
2393                 p += 3;
2394                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2395                          ("%s: 802.11d country =%s\n", __func__, country));
2396
2397                 i = 0;
2398                 while ((ie - p) >= 3) {
2399                         fcn = *(p++);
2400                         noc = *(p++);
2401                         p++;
2402
2403                         for (j = 0; j < noc; j++) {
2404                                 if (fcn <= 14)
2405                                         channel = fcn + j; /*  2.4 GHz */
2406                                 else
2407                                         channel = fcn + j*4; /*  5 GHz */
2408
2409                                 chplan_ap.Channel[i++] = channel;
2410                         }
2411                 }
2412                 chplan_ap.Len = i;
2413
2414                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
2415
2416                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
2417                 chplan_new = pmlmeext->channel_set;
2418
2419                 i = 0;
2420                 j = 0;
2421                 k = 0;
2422                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
2423                         do {
2424                                 if ((i == MAX_CHANNEL_NUM) ||
2425                                     (chplan_sta[i].ChannelNum == 0) ||
2426                                     (chplan_sta[i].ChannelNum > 14))
2427                                         break;
2428
2429                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
2430                                         break;
2431
2432                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
2433                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2434                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2435                                         i++;
2436                                         j++;
2437                                         k++;
2438                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
2439                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2440                                         chplan_new[k].ScanType = SCAN_PASSIVE;
2441                                         i++;
2442                                         k++;
2443                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
2444                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2445                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2446                                         j++;
2447                                         k++;
2448                                 }
2449                         } while (1);
2450
2451                         /*  change AP not support channel to Passive scan */
2452                         while ((i < MAX_CHANNEL_NUM) &&
2453                                (chplan_sta[i].ChannelNum != 0) &&
2454                                (chplan_sta[i].ChannelNum <= 14)) {
2455                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2456                                 chplan_new[k].ScanType = SCAN_PASSIVE;
2457                                 i++;
2458                                 k++;
2459                         }
2460
2461                         /*  add channel AP supported */
2462                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
2463                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2464                                 chplan_new[k].ScanType = SCAN_ACTIVE;
2465                                 j++;
2466                                 k++;
2467                         }
2468                 } else {
2469                         /*  keep original STA 2.4G channel plan */
2470                         while ((i < MAX_CHANNEL_NUM) &&
2471                                (chplan_sta[i].ChannelNum != 0) &&
2472                                (chplan_sta[i].ChannelNum <= 14)) {
2473                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2474                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
2475                                 i++;
2476                                 k++;
2477                         }
2478
2479                         /*  skip AP 2.4G channel plan */
2480                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
2481                                 j++;
2482                 }
2483
2484                 /*  keep original STA 5G channel plan */
2485                 while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
2486                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2487                         chplan_new[k].ScanType = chplan_sta[i].ScanType;
2488                         i++;
2489                         k++;
2490                 }
2491
2492                 pmlmeext->update_channel_plan_by_ap_done = 1;
2493         }
2494
2495         /*  If channel is used by AP, set channel scan type to active */
2496         channel = bssid->Configuration.DSConfig;
2497         chplan_new = pmlmeext->channel_set;
2498         i = 0;
2499         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
2500                 if (chplan_new[i].ChannelNum == channel) {
2501                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
2502                                 chplan_new[i].ScanType = SCAN_ACTIVE;
2503                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2504                                          ("%s: change channel %d scan type from passive to active\n",
2505                                          __func__, channel));
2506                         }
2507                         break;
2508                 }
2509                 i++;
2510         }
2511 }
2512
2513 /****************************************************************************
2514
2515 Following are the callback functions for each subtype of the management frames
2516
2517 *****************************************************************************/
2518
2519 static unsigned int OnProbeReq(struct adapter *padapter,
2520                                struct recv_frame *precv_frame)
2521 {
2522         unsigned int    ielen;
2523         unsigned char   *p;
2524         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2525         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2526         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2527         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2528         u8 *pframe = precv_frame->pkt->data;
2529         uint len = precv_frame->pkt->len;
2530
2531         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
2532                 return _SUCCESS;
2533
2534         if (!check_fwstate(pmlmepriv, _FW_LINKED) &&
2535             !check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
2536                 return _SUCCESS;
2537
2538         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, &ielen,
2539                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
2540
2541         /* check (wildcard) SSID */
2542         if (p) {
2543                 if ((ielen != 0 && memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength)) ||
2544                     (ielen == 0 && pmlmeinfo->hidden_ssid_mode))
2545                         return _SUCCESS;
2546
2547                 if (check_fwstate(pmlmepriv, _FW_LINKED) &&
2548                     pmlmepriv->cur_network.join_res)
2549                         issue_probersp(padapter, get_sa(pframe));
2550         }
2551         return _SUCCESS;
2552 }
2553
2554 static unsigned int OnProbeRsp(struct adapter *padapter,
2555                                struct recv_frame *precv_frame)
2556 {
2557         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2558
2559         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2560                 report_survey_event(padapter, precv_frame);
2561                 return _SUCCESS;
2562         }
2563
2564         return _SUCCESS;
2565 }
2566
2567 static unsigned int OnBeacon(struct adapter *padapter,
2568                              struct recv_frame *precv_frame)
2569 {
2570         int cam_idx;
2571         struct sta_info *psta;
2572         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2573         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2574         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2575         struct sta_priv *pstapriv = &padapter->stapriv;
2576         u8 *pframe = precv_frame->pkt->data;
2577         uint len = precv_frame->pkt->len;
2578         struct wlan_bssid_ex *pbss;
2579         int ret = _SUCCESS;
2580         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2581
2582         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2583                 report_survey_event(padapter, precv_frame);
2584                 return _SUCCESS;
2585         }
2586
2587         if (!memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN)) {
2588                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
2589                         /* we should update current network before auth, or some IE is wrong */
2590                         pbss = (struct wlan_bssid_ex *)rtw_malloc(sizeof(struct wlan_bssid_ex));
2591                         if (pbss) {
2592                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
2593                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
2594                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
2595                                 }
2596                                 kfree(pbss);
2597                         }
2598
2599                         /* check the vendor of the assoc AP */
2600                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
2601
2602                         /* update TSF Value */
2603                         update_TSF(pmlmeext, pframe, len);
2604
2605                         /* start auth */
2606                         start_clnt_auth(padapter);
2607
2608                         return _SUCCESS;
2609                 }
2610
2611                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
2612                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2613                         if (psta != NULL) {
2614                                 ret = rtw_check_bcn_info(padapter, pframe, len);
2615                                 if (!ret) {
2616                                                 DBG_88E_LEVEL(_drv_info_, "ap has changed, disconnect now\n ");
2617                                                 receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 65535);
2618                                                 return _SUCCESS;
2619                                 }
2620                                 /* update WMM, ERP in the beacon */
2621                                 /* todo: the timer is used instead of the number of the beacon received */
2622                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2623                                         update_beacon_info(padapter, pframe, len, psta);
2624                         }
2625                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2626                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2627                         if (psta != NULL) {
2628                                 /* update WMM, ERP in the beacon */
2629                                 /* todo: the timer is used instead of the number of the beacon received */
2630                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2631                                         update_beacon_info(padapter, pframe, len, psta);
2632                         } else {
2633                                 /* allocate a new CAM entry for IBSS station */
2634                                 cam_idx = allocate_fw_sta_entry(padapter);
2635                                 if (cam_idx == NUM_STA)
2636                                         goto _END_ONBEACON_;
2637
2638                                 /* get supported rate */
2639                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
2640                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
2641                                         goto _END_ONBEACON_;
2642                                 }
2643
2644                                 /* update TSF Value */
2645                                 update_TSF(pmlmeext, pframe, len);
2646
2647                                 /* report sta add event */
2648                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
2649                         }
2650                 }
2651         }
2652
2653 _END_ONBEACON_:
2654
2655         return _SUCCESS;
2656 }
2657
2658 #ifdef CONFIG_88EU_AP_MODE
2659 static unsigned int OnAuth(struct adapter *padapter,
2660                            struct recv_frame *precv_frame)
2661 {
2662         unsigned int    auth_mode, ie_len;
2663         u16 seq;
2664         unsigned char   *sa, *p;
2665         u16 algorithm;
2666         int     status;
2667         static struct sta_info stat;
2668         struct  sta_info        *pstat = NULL;
2669         struct  sta_priv *pstapriv = &padapter->stapriv;
2670         struct security_priv *psecuritypriv = &padapter->securitypriv;
2671         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2672         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2673         u8 *pframe = precv_frame->pkt->data;
2674         uint len = precv_frame->pkt->len;
2675
2676         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2677                 return _FAIL;
2678
2679         DBG_88E("+%s\n", __func__);
2680
2681         sa = GetAddr2Ptr(pframe);
2682
2683         auth_mode = psecuritypriv->dot11AuthAlgrthm;
2684         seq = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + 2));
2685         algorithm = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN));
2686
2687         DBG_88E("auth alg=%x, seq=%X\n", algorithm, seq);
2688
2689         if (auth_mode == 2 && psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
2690             psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
2691                 auth_mode = 0;
2692
2693         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
2694             (algorithm == 0 && auth_mode == 1)) {       /*  rx a open-system auth but shared-key is enabled */
2695                 DBG_88E("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
2696                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
2697
2698                 status = _STATS_NO_SUPP_ALG_;
2699
2700                 goto auth_fail;
2701         }
2702
2703         if (!rtw_access_ctrl(padapter, sa)) {
2704                 status = _STATS_UNABLE_HANDLE_STA_;
2705                 goto auth_fail;
2706         }
2707
2708         pstat = rtw_get_stainfo(pstapriv, sa);
2709         if (!pstat) {
2710                 /*  allocate a new one */
2711                 DBG_88E("going to alloc stainfo for sa=%pM\n", sa);
2712                 pstat = rtw_alloc_stainfo(pstapriv, sa);
2713                 if (!pstat) {
2714                         DBG_88E(" Exceed the upper limit of supported clients...\n");
2715                         status = _STATS_UNABLE_HANDLE_STA_;
2716                         goto auth_fail;
2717                 }
2718
2719                 pstat->state = WIFI_FW_AUTH_NULL;
2720                 pstat->auth_seq = 0;
2721         } else {
2722                 spin_lock_bh(&pstapriv->asoc_list_lock);
2723                 if (!list_empty(&pstat->asoc_list)) {
2724                         list_del_init(&pstat->asoc_list);
2725                         pstapriv->asoc_list_cnt--;
2726                 }
2727                 spin_unlock_bh(&pstapriv->asoc_list_lock);
2728
2729                 if (seq == 1) {
2730                         /* TODO: STA re_auth and auth timeout */
2731                 }
2732         }
2733
2734         spin_lock_bh(&pstapriv->auth_list_lock);
2735         if (list_empty(&pstat->auth_list)) {
2736                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
2737                 pstapriv->auth_list_cnt++;
2738         }
2739         spin_unlock_bh(&pstapriv->auth_list_lock);
2740
2741         if (pstat->auth_seq == 0)
2742                 pstat->expire_to = pstapriv->auth_to;
2743
2744         if ((pstat->auth_seq + 1) != seq) {
2745                 DBG_88E("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2746                         seq, pstat->auth_seq+1);
2747                 status = _STATS_OUT_OF_AUTH_SEQ_;
2748                 goto auth_fail;
2749         }
2750
2751         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2)) {
2752                 if (seq == 1) {
2753                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2754                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
2755                         pstat->expire_to = pstapriv->assoc_to;
2756                         pstat->authalg = algorithm;
2757                 } else {
2758                         DBG_88E("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2759                                 seq, pstat->auth_seq+1);
2760                         status = _STATS_OUT_OF_AUTH_SEQ_;
2761                         goto auth_fail;
2762                 }
2763         } else { /*  shared system or auto authentication */
2764                 if (seq == 1) {
2765                         /* prepare for the challenging txt... */
2766
2767                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2768                         pstat->state |= WIFI_FW_AUTH_STATE;
2769                         pstat->authalg = algorithm;
2770                         pstat->auth_seq = 2;
2771                 } else if (seq == 3) {
2772                         /* checking for challenging txt... */
2773                         DBG_88E("checking for challenging txt...\n");
2774
2775                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, &ie_len,
2776                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
2777
2778                         if ((p == NULL) || (ie_len <= 0)) {
2779                                 DBG_88E("auth rejected because challenge failure!(1)\n");
2780                                 status = _STATS_CHALLENGE_FAIL_;
2781                                 goto auth_fail;
2782                         }
2783
2784                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
2785                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
2786                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
2787                                 /*  challenging txt is correct... */
2788                                 pstat->expire_to =  pstapriv->assoc_to;
2789                         } else {
2790                                 DBG_88E("auth rejected because challenge failure!\n");
2791                                 status = _STATS_CHALLENGE_FAIL_;
2792                                 goto auth_fail;
2793                         }
2794                 } else {
2795                         DBG_88E("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2796                                 seq, pstat->auth_seq+1);
2797                         status = _STATS_OUT_OF_AUTH_SEQ_;
2798                         goto auth_fail;
2799                 }
2800         }
2801
2802         /*  Now, we are going to issue_auth... */
2803         pstat->auth_seq = seq + 1;
2804
2805         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
2806
2807         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
2808                 pstat->auth_seq = 0;
2809
2810         return _SUCCESS;
2811
2812 auth_fail:
2813
2814         if (pstat)
2815                 rtw_free_stainfo(padapter, pstat);
2816
2817         pstat = &stat;
2818         memset((char *)pstat, '\0', sizeof(stat));
2819         pstat->auth_seq = 2;
2820         memcpy(pstat->hwaddr, sa, 6);
2821
2822         issue_auth(padapter, pstat, (unsigned short)status);
2823
2824         return _FAIL;
2825 }
2826 #endif /* CONFIG_88EU_AP_MODE */
2827
2828 static unsigned int OnAuthClient(struct adapter *padapter,
2829                                  struct recv_frame *precv_frame)
2830 {
2831         unsigned int    seq, len, status, offset;
2832         unsigned char   *p;
2833         unsigned int    go2asoc = 0;
2834         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2835         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2836         u8 *pframe = precv_frame->pkt->data;
2837         uint pkt_len = precv_frame->pkt->len;
2838
2839         DBG_88E("%s\n", __func__);
2840
2841         /* check A1 matches or not */
2842         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
2843                 return _SUCCESS;
2844
2845         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
2846                 return _SUCCESS;
2847
2848         offset = (GetPrivacy(pframe)) ? 4 : 0;
2849
2850         seq     = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 2));
2851         status  = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 4));
2852
2853         if (status != 0) {
2854                 DBG_88E("clnt auth fail, status: %d\n", status);
2855                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
2856                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2857                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
2858                         else
2859                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
2860                 }
2861
2862                 set_link_timer(pmlmeext, 1);
2863                 goto authclnt_fail;
2864         }
2865
2866         if (seq == 2) {
2867                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
2868                         /*  legendary shared system */
2869                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, &len,
2870                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
2871
2872                         if (p == NULL)
2873                                 goto authclnt_fail;
2874
2875                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
2876                         pmlmeinfo->auth_seq = 3;
2877                         issue_auth(padapter, NULL, 0);
2878                         set_link_timer(pmlmeext, REAUTH_TO);
2879
2880                         return _SUCCESS;
2881                 } else {
2882                         /*  open system */
2883                         go2asoc = 1;
2884                 }
2885         } else if (seq == 4) {
2886                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2887                         go2asoc = 1;
2888                 else
2889                         goto authclnt_fail;
2890         } else {
2891                 /*  this is also illegal */
2892                 goto authclnt_fail;
2893         }
2894
2895         if (go2asoc) {
2896                 DBG_88E_LEVEL(_drv_info_, "auth success, start assoc\n");
2897                 start_clnt_assoc(padapter);
2898                 return _SUCCESS;
2899         }
2900 authclnt_fail:
2901         return _FAIL;
2902 }
2903
2904 static unsigned int OnAssocReq(struct adapter *padapter,
2905                                struct recv_frame *precv_frame)
2906 {
2907 #ifdef CONFIG_88EU_AP_MODE
2908         u16 capab_info;
2909         struct rtw_ieee802_11_elems elems;
2910         struct sta_info *pstat;
2911         unsigned char           reassoc, *p, *pos, *wpa_ie;
2912         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
2913         int             i, wpa_ie_len, left;
2914         unsigned char           supportRate[16];
2915         int                                     supportRateNum;
2916         unsigned short          status = _STATS_SUCCESSFUL_;
2917         unsigned short          frame_type, ie_offset = 0;
2918         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2919         struct security_priv *psecuritypriv = &padapter->securitypriv;
2920         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2921         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2922         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2923         struct sta_priv *pstapriv = &padapter->stapriv;
2924         u8 *pframe = precv_frame->pkt->data;
2925         uint ie_len, pkt_len = precv_frame->pkt->len;
2926
2927         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2928                 return _FAIL;
2929
2930         frame_type = GetFrameSubType(pframe);
2931         if (frame_type == WIFI_ASSOCREQ) {
2932                 reassoc = 0;
2933                 ie_offset = _ASOCREQ_IE_OFFSET_;
2934         } else { /*  WIFI_REASSOCREQ */
2935                 reassoc = 1;
2936                 ie_offset = _REASOCREQ_IE_OFFSET_;
2937         }
2938
2939         if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
2940                 DBG_88E("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
2941                        "\n", reassoc, (unsigned long)pkt_len);
2942                 return _FAIL;
2943         }
2944
2945         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2946         if (!pstat) {
2947                 status = _RSON_CLS2_;
2948                 goto asoc_class2_error;
2949         }
2950
2951         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
2952
2953         left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
2954         pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
2955
2956         DBG_88E("%s\n", __func__);
2957
2958         /*  check if this stat has been successfully authenticated/assocated */
2959         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
2960                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
2961                         status = _RSON_CLS2_;
2962                         goto asoc_class2_error;
2963                 } else {
2964                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
2965                         pstat->state |= WIFI_FW_ASSOC_STATE;
2966                 }
2967         } else {
2968                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
2969                 pstat->state |= WIFI_FW_ASSOC_STATE;
2970         }
2971         pstat->capability = capab_info;
2972         /* now parse all ieee802_11 ie to point to elems */
2973         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
2974             !elems.ssid) {
2975                 DBG_88E("STA %pM sent invalid association request\n",
2976                         pstat->hwaddr);
2977                 status = _STATS_FAILURE_;
2978                 goto OnAssocReqFail;
2979         }
2980
2981         /*  now we should check all the fields... */
2982         /*  checking SSID */
2983         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
2984                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
2985         if (!p)
2986                 status = _STATS_FAILURE_;
2987
2988         if (ie_len == 0) { /*  broadcast ssid, however it is not allowed in assocreq */
2989                 status = _STATS_FAILURE_;
2990         } else {
2991                 /*  check if ssid match */
2992                 if (memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
2993                         status = _STATS_FAILURE_;
2994
2995                 if (ie_len != cur->Ssid.SsidLength)
2996                         status = _STATS_FAILURE_;
2997         }
2998
2999         if (_STATS_SUCCESSFUL_ != status)
3000                 goto OnAssocReqFail;
3001
3002         /*  check if the supported rate is ok */
3003         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3004         if (p == NULL) {
3005                 DBG_88E("Rx a sta assoc-req which supported rate is empty!\n");
3006                 /*  use our own rate set as statoin used */
3007                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
3008                 /* supportRateNum = AP_BSSRATE_LEN; */
3009
3010                 status = _STATS_FAILURE_;
3011                 goto OnAssocReqFail;
3012         } else {
3013                 memcpy(supportRate, p+2, ie_len);
3014                 supportRateNum = ie_len;
3015
3016                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_, &ie_len,
3017                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3018                 if (p !=  NULL) {
3019                         if (supportRateNum <= sizeof(supportRate)) {
3020                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
3021                                 supportRateNum += ie_len;
3022                         }
3023                 }
3024         }
3025
3026         /* todo: mask supportRate between AP & STA -> move to update raid */
3027         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
3028
3029         /* update station supportRate */
3030         pstat->bssratelen = supportRateNum;
3031         memcpy(pstat->bssrateset, supportRate, supportRateNum);
3032         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
3033
3034         /* check RSN/WPA/WPS */
3035         pstat->dot8021xalg = 0;
3036         pstat->wpa_psk = 0;
3037         pstat->wpa_group_cipher = 0;
3038         pstat->wpa2_group_cipher = 0;
3039         pstat->wpa_pairwise_cipher = 0;
3040         pstat->wpa2_pairwise_cipher = 0;
3041         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
3042         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
3043                 int group_cipher = 0, pairwise_cipher = 0;
3044
3045                 wpa_ie = elems.rsn_ie;
3046                 wpa_ie_len = elems.rsn_ie_len;
3047
3048                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3049                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3050                         pstat->wpa_psk |= BIT(1);
3051
3052                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
3053                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
3054
3055                         if (!pstat->wpa2_group_cipher)
3056                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3057
3058                         if (!pstat->wpa2_pairwise_cipher)
3059                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3060                 } else {
3061                         status = WLAN_STATUS_INVALID_IE;
3062                 }
3063         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
3064                 int group_cipher = 0, pairwise_cipher = 0;
3065
3066                 wpa_ie = elems.wpa_ie;
3067                 wpa_ie_len = elems.wpa_ie_len;
3068
3069                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3070                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3071                         pstat->wpa_psk |= BIT(0);
3072
3073                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
3074                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
3075
3076                         if (!pstat->wpa_group_cipher)
3077                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3078
3079                         if (!pstat->wpa_pairwise_cipher)
3080                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3081                 } else {
3082                         status = WLAN_STATUS_INVALID_IE;
3083                 }
3084         } else {
3085                 wpa_ie = NULL;
3086                 wpa_ie_len = 0;
3087         }
3088
3089         if (_STATS_SUCCESSFUL_ != status)
3090                 goto OnAssocReqFail;
3091
3092         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
3093         if (!wpa_ie) {
3094                 if (elems.wps_ie) {
3095                         DBG_88E("STA included WPS IE in "
3096                                    "(Re)Association Request - assume WPS is "
3097                                    "used\n");
3098                         pstat->flags |= WLAN_STA_WPS;
3099                         /* wpabuf_free(sta->wps_ie); */
3100                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
3101                         /*                              elems.wps_ie_len - 4); */
3102                 } else {
3103                         DBG_88E("STA did not include WPA/RSN IE "
3104                                    "in (Re)Association Request - possible WPS "
3105                                    "use\n");
3106                         pstat->flags |= WLAN_STA_MAYBE_WPS;
3107                 }
3108
3109                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
3110                 /*  that the selected registrar of AP is _FLASE */
3111                 if ((psecuritypriv->wpa_psk > 0) && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
3112                         if (pmlmepriv->wps_beacon_ie) {
3113                                 u8 selected_registrar = 0;
3114
3115                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
3116
3117                                 if (!selected_registrar) {
3118                                         DBG_88E("selected_registrar is false , or AP is not ready to do WPS\n");
3119
3120                                         status = _STATS_UNABLE_HANDLE_STA_;
3121
3122                                         goto OnAssocReqFail;
3123                                 }
3124                         }
3125                 }
3126         } else {
3127                 int copy_len;
3128
3129                 if (psecuritypriv->wpa_psk == 0) {
3130                         DBG_88E("STA %pM: WPA/RSN IE in association "
3131                         "request, but AP don't support WPA/RSN\n", pstat->hwaddr);
3132
3133                         status = WLAN_STATUS_INVALID_IE;
3134
3135                         goto OnAssocReqFail;
3136                 }
3137
3138                 if (elems.wps_ie) {
3139                         DBG_88E("STA included WPS IE in "
3140                                    "(Re)Association Request - WPS is "
3141                                    "used\n");
3142                         pstat->flags |= WLAN_STA_WPS;
3143                         copy_len = 0;
3144                 } else {
3145                         copy_len = min_t(int, wpa_ie_len + 2, sizeof(pstat->wpa_ie));
3146                 }
3147                 if (copy_len > 0)
3148                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
3149         }
3150         /*  check if there is WMM IE & support WWM-PS */
3151         pstat->flags &= ~WLAN_STA_WME;
3152         pstat->qos_option = 0;
3153         pstat->qos_info = 0;
3154         pstat->has_legacy_ac = true;
3155         pstat->uapsd_vo = 0;
3156         pstat->uapsd_vi = 0;
3157         pstat->uapsd_be = 0;
3158         pstat->uapsd_bk = 0;
3159         if (pmlmepriv->qospriv.qos_option) {
3160                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
3161                 for (;;) {
3162                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3163                         if (p != NULL) {
3164                                 if (!memcmp(p+2, WMM_IE, 6)) {
3165                                         pstat->flags |= WLAN_STA_WME;
3166
3167                                         pstat->qos_option = 1;
3168                                         pstat->qos_info = *(p+8);
3169
3170                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
3171
3172                                         if ((pstat->qos_info&0xf) != 0xf)
3173                                                 pstat->has_legacy_ac = true;
3174                                         else
3175                                                 pstat->has_legacy_ac = false;
3176
3177                                         if (pstat->qos_info&0xf) {
3178                                                 if (pstat->qos_info&BIT(0))
3179                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
3180                                                 else
3181                                                         pstat->uapsd_vo = 0;
3182
3183                                                 if (pstat->qos_info&BIT(1))
3184                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
3185                                                 else
3186                                                         pstat->uapsd_vi = 0;
3187
3188                                                 if (pstat->qos_info&BIT(2))
3189                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
3190                                                 else
3191                                                         pstat->uapsd_bk = 0;
3192
3193                                                 if (pstat->qos_info&BIT(3))
3194                                                         pstat->uapsd_be = BIT(0)|BIT(1);
3195                                                 else
3196                                                         pstat->uapsd_be = 0;
3197                                         }
3198                                         break;
3199                                 }
3200                         } else {
3201                                 break;
3202                         }
3203                         p = p + ie_len + 2;
3204                 }
3205         }
3206
3207         /* save HT capabilities in the sta object */
3208         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
3209         if (elems.ht_capabilities &&
3210             elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
3211                 pstat->flags |= WLAN_STA_HT;
3212
3213                 pstat->flags |= WLAN_STA_WME;
3214
3215                 memcpy(&pstat->htpriv.ht_cap,
3216                        elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
3217         } else {
3218                 pstat->flags &= ~WLAN_STA_HT;
3219         }
3220         if ((!pmlmepriv->htpriv.ht_option) && (pstat->flags&WLAN_STA_HT)) {
3221                 status = _STATS_FAILURE_;
3222                 goto OnAssocReqFail;
3223         }
3224
3225         if ((pstat->flags & WLAN_STA_HT) &&
3226             ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
3227             (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
3228                 DBG_88E("HT: %pM tried to "
3229                         "use TKIP with HT association\n", pstat->hwaddr);
3230
3231                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
3232                 /* goto OnAssocReqFail; */
3233         }
3234
3235         pstat->flags |= WLAN_STA_NONERP;
3236         for (i = 0; i < pstat->bssratelen; i++) {
3237                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
3238                         pstat->flags &= ~WLAN_STA_NONERP;
3239                         break;
3240                 }
3241         }
3242
3243         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3244                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
3245         else
3246                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3247
3248         if (status != _STATS_SUCCESSFUL_)
3249                 goto OnAssocReqFail;
3250
3251         /* TODO: identify_proprietary_vendor_ie(); */
3252         /*  Realtek proprietary IE */
3253         /*  identify if this is Broadcom sta */
3254         /*  identify if this is ralink sta */
3255         /*  Customer proprietary IE */
3256
3257         /* get a unique AID */
3258         if (pstat->aid > 0) {
3259                 DBG_88E("  old AID %d\n", pstat->aid);
3260         } else {
3261                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
3262                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
3263                                 break;
3264
3265                 /* if (pstat->aid > NUM_STA) { */
3266                 if (pstat->aid > pstapriv->max_num_sta) {
3267                         pstat->aid = 0;
3268
3269                         DBG_88E("  no room for more AIDs\n");
3270
3271                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3272
3273                         goto OnAssocReqFail;
3274                 } else {
3275                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
3276                         DBG_88E("allocate new AID=(%d)\n", pstat->aid);
3277                 }
3278         }
3279
3280         pstat->state &= (~WIFI_FW_ASSOC_STATE);
3281         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
3282
3283         spin_lock_bh(&pstapriv->auth_list_lock);
3284         if (!list_empty(&pstat->auth_list)) {
3285                 list_del_init(&pstat->auth_list);
3286                 pstapriv->auth_list_cnt--;
3287         }
3288         spin_unlock_bh(&pstapriv->auth_list_lock);
3289
3290         spin_lock_bh(&pstapriv->asoc_list_lock);
3291         if (list_empty(&pstat->asoc_list)) {
3292                 pstat->expire_to = pstapriv->expire_to;
3293                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
3294                 pstapriv->asoc_list_cnt++;
3295         }
3296         spin_unlock_bh(&pstapriv->asoc_list_lock);
3297
3298         /*  now the station is qualified to join our BSS... */
3299         if ((pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_ == status)) {
3300                 /* 1 bss_cap_update & sta_info_update */
3301                 bss_cap_update_on_sta_join(padapter, pstat);
3302                 sta_info_update(padapter, pstat);
3303
3304                 /* issue assoc rsp before notify station join event. */
3305                 if (frame_type == WIFI_ASSOCREQ)
3306                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3307                 else
3308                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3309
3310                 /* 2 - report to upper layer */
3311                 DBG_88E("indicate_sta_join_event to upper layer - hostapd\n");
3312                 rtw_indicate_sta_assoc_event(padapter, pstat);
3313
3314                 /* 3-(1) report sta add event */
3315                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
3316         }
3317
3318         return _SUCCESS;
3319
3320 asoc_class2_error:
3321
3322         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
3323
3324         return _FAIL;
3325
3326 OnAssocReqFail:
3327
3328         pstat->aid = 0;
3329         if (frame_type == WIFI_ASSOCREQ)
3330                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3331         else
3332                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3333
3334 #endif /* CONFIG_88EU_AP_MODE */
3335
3336         return _FAIL;
3337 }
3338
3339 static unsigned int OnAssocRsp(struct adapter *padapter,
3340                                struct recv_frame *precv_frame)
3341 {
3342         uint i;
3343         int res;
3344         unsigned short  status;
3345         struct ndis_802_11_var_ie *pIE;
3346         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3347         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3348         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3349         /* struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network); */
3350         u8 *pframe = precv_frame->pkt->data;
3351         uint pkt_len = precv_frame->pkt->len;
3352
3353         DBG_88E("%s\n", __func__);
3354
3355         /* check A1 matches or not */
3356         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
3357                 return _SUCCESS;
3358
3359         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
3360                 return _SUCCESS;
3361
3362         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
3363                 return _SUCCESS;
3364
3365         del_timer_sync(&pmlmeext->link_timer);
3366
3367         /* status */
3368         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
3369         if (status > 0) {
3370                 DBG_88E("assoc reject, status code: %d\n", status);
3371                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
3372                 res = -4;
3373                 goto report_assoc_result;
3374         }
3375
3376         /* get capabilities */
3377         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3378
3379         /* set slot time */
3380         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
3381
3382         /* AID */
3383         pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
3384         res = pmlmeinfo->aid;
3385
3386         /* following are moved to join event callback function */
3387         /* to handle HT, WMM, rate adaptive, update MAC reg */
3388         /* for not to handle the synchronous IO in the tasklet */
3389         for (i = 6 + WLAN_HDR_A3_LEN; i < pkt_len;) {
3390                 pIE = (struct ndis_802_11_var_ie *)(pframe + i);
3391
3392                 switch (pIE->ElementID) {
3393                 case _VENDOR_SPECIFIC_IE_:
3394                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6)) /* WMM */
3395                                 WMM_param_handler(padapter, pIE);
3396                         break;
3397                 case _HT_CAPABILITY_IE_:        /* HT caps */
3398                         HT_caps_handler(padapter, pIE);
3399                         break;
3400                 case _HT_EXTRA_INFO_IE_:        /* HT info */
3401                         HT_info_handler(padapter, pIE);
3402                         break;
3403                 case _ERPINFO_IE_:
3404                         ERP_IE_handler(padapter, pIE);
3405                 default:
3406                         break;
3407                 }
3408
3409                 i += (pIE->Length + 2);
3410         }
3411
3412         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
3413         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
3414
3415         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
3416
3417 report_assoc_result:
3418         if (res > 0)
3419                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
3420         else
3421                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
3422
3423         report_join_res(padapter, res);
3424
3425         return _SUCCESS;
3426 }
3427
3428 static unsigned int OnDeAuth(struct adapter *padapter,
3429                              struct recv_frame *precv_frame)
3430 {
3431         unsigned short  reason;
3432         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3433         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3434         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3435         u8 *pframe = precv_frame->pkt->data;
3436         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3437
3438         /* check A3 */
3439         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3440                 return _SUCCESS;
3441
3442         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3443
3444         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3445
3446 #ifdef CONFIG_88EU_AP_MODE
3447         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3448                 struct sta_info *psta;
3449                 struct sta_priv *pstapriv = &padapter->stapriv;
3450
3451                 DBG_88E_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
3452                               reason, GetAddr2Ptr(pframe));
3453
3454                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3455                 if (psta) {
3456                         u8 updated = 0;
3457
3458                         spin_lock_bh(&pstapriv->asoc_list_lock);
3459                         if (!list_empty(&psta->asoc_list)) {
3460                                 list_del_init(&psta->asoc_list);
3461                                 pstapriv->asoc_list_cnt--;
3462                                 updated = ap_free_sta(padapter, psta, false, reason);
3463                         }
3464                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3465
3466                         associated_clients_update(padapter, updated);
3467                 }
3468
3469                 return _SUCCESS;
3470         } else
3471 #endif
3472         {
3473                 DBG_88E_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM\n",
3474                               reason, GetAddr3Ptr(pframe));
3475
3476                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3477         }
3478         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3479         return _SUCCESS;
3480 }
3481
3482 static unsigned int OnDisassoc(struct adapter *padapter,
3483                                struct recv_frame *precv_frame)
3484 {
3485         u16 reason;
3486         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3487         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3488         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3489         u8 *pframe = precv_frame->pkt->data;
3490         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3491
3492         /* check A3 */
3493         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3494                 return _SUCCESS;
3495
3496         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3497
3498         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3499
3500 #ifdef CONFIG_88EU_AP_MODE
3501         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3502                 struct sta_info *psta;
3503                 struct sta_priv *pstapriv = &padapter->stapriv;
3504
3505                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3506                               reason, GetAddr2Ptr(pframe));
3507
3508                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3509                 if (psta) {
3510                         u8 updated = 0;
3511
3512                         spin_lock_bh(&pstapriv->asoc_list_lock);
3513                         if (!list_empty(&psta->asoc_list)) {
3514                                 list_del_init(&psta->asoc_list);
3515                                 pstapriv->asoc_list_cnt--;
3516                                 updated = ap_free_sta(padapter, psta, false, reason);
3517                         }
3518                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3519
3520                         associated_clients_update(padapter, updated);
3521                 }
3522
3523                 return _SUCCESS;
3524         } else
3525 #endif
3526         {
3527                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3528                               reason, GetAddr3Ptr(pframe));
3529
3530                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3531         }
3532         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3533         return _SUCCESS;
3534 }
3535
3536 static unsigned int OnAtim(struct adapter *padapter,
3537                            struct recv_frame *precv_frame)
3538 {
3539         DBG_88E("%s\n", __func__);
3540         return _SUCCESS;
3541 }
3542
3543 static unsigned int on_action_spct(struct adapter *padapter,
3544                                    struct recv_frame *precv_frame)
3545 {
3546         struct sta_info *psta = NULL;
3547         struct sta_priv *pstapriv = &padapter->stapriv;
3548         u8 *pframe = precv_frame->pkt->data;
3549         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3550         u8 category;
3551         u8 action;
3552
3553         DBG_88E(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
3554
3555         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3556
3557         if (!psta)
3558                 goto exit;
3559
3560         category = frame_body[0];
3561         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
3562                 goto exit;
3563
3564         action = frame_body[1];
3565         switch (action) {
3566         case RTW_WLAN_ACTION_SPCT_MSR_REQ:
3567         case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
3568         case RTW_WLAN_ACTION_SPCT_TPC_REQ:
3569         case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
3570                 break;
3571         case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
3572                 break;
3573         default:
3574                 break;
3575         }
3576
3577 exit:
3578         return _FAIL;
3579 }
3580
3581 static unsigned int OnAction_qos(struct adapter *padapter,
3582                                  struct recv_frame *precv_frame)
3583 {
3584         return _SUCCESS;
3585 }
3586
3587 static unsigned int OnAction_dls(struct adapter *padapter,
3588                                  struct recv_frame *precv_frame)
3589 {
3590         return _SUCCESS;
3591 }
3592
3593 static unsigned int OnAction_back(struct adapter *padapter,
3594                                   struct recv_frame *precv_frame)
3595 {
3596         u8 *addr;
3597         struct sta_info *psta = NULL;
3598         struct recv_reorder_ctrl *preorder_ctrl;
3599         unsigned char           *frame_body;
3600         unsigned char           category, action;
3601         unsigned short  tid, status, reason_code = 0;
3602         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3603         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3604         u8 *pframe = precv_frame->pkt->data;
3605         struct sta_priv *pstapriv = &padapter->stapriv;
3606         /* check RA matches or not */
3607         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe),
3608                    ETH_ALEN))/* for if1, sta/ap mode */
3609                 return _SUCCESS;
3610
3611         DBG_88E("%s\n", __func__);
3612
3613         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3614                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3615                         return _SUCCESS;
3616
3617         addr = GetAddr2Ptr(pframe);
3618         psta = rtw_get_stainfo(pstapriv, addr);
3619
3620         if (!psta)
3621                 return _SUCCESS;
3622
3623         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3624
3625         category = frame_body[0];
3626         if (category == RTW_WLAN_CATEGORY_BACK) { /*  representing Block Ack */
3627                 if (!pmlmeinfo->HT_enable)
3628                         return _SUCCESS;
3629                 action = frame_body[1];
3630                 DBG_88E("%s, action=%d\n", __func__, action);
3631                 switch (action) {
3632                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
3633                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
3634                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
3635
3636                         /* 37 = reject ADDBA Req */
3637                         issue_action_BA(padapter, addr,
3638                                         RTW_WLAN_ACTION_ADDBA_RESP,
3639                                         pmlmeinfo->accept_addba_req ? 0 : 37);
3640                         break;
3641                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
3642                         status = get_unaligned_le16(&frame_body[3]);
3643                         tid = (frame_body[5] >> 2) & 0x7;
3644                         if (status == 0) {      /* successful */
3645                                 DBG_88E("agg_enable for TID=%d\n", tid);
3646                                 psta->htpriv.agg_enable_bitmap |= 1 << tid;
3647                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3648                         } else {
3649                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3650                         }
3651                         break;
3652                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
3653                         if ((frame_body[3] & BIT(3)) == 0) {
3654                                 psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3655                                 psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3656                                 reason_code = get_unaligned_le16(&frame_body[4]);
3657                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
3658                                 tid = (frame_body[3] >> 4) & 0x0F;
3659                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
3660                                 preorder_ctrl->enable = false;
3661                                 preorder_ctrl->indicate_seq = 0xffff;
3662                         }
3663                         DBG_88E("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
3664                         /* todo: how to notify the host while receiving DELETE BA */
3665                         break;
3666                 default:
3667                         break;
3668                 }
3669         }
3670         return _SUCCESS;
3671 }
3672
3673 static s32 rtw_action_public_decache(struct recv_frame *recv_frame, s32 token)
3674 {
3675         struct adapter *adapter = recv_frame->adapter;
3676         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
3677         u8 *frame = recv_frame->pkt->data;
3678         u16 seq_ctrl = ((recv_frame->attrib.seq_num&0xffff) << 4) |
3679                 (recv_frame->attrib.frag_num & 0xf);
3680
3681         if (GetRetry(frame)) {
3682                 if (token >= 0) {
3683                         if ((seq_ctrl == mlmeext->action_public_rxseq) && (token == mlmeext->action_public_dialog_token)) {
3684                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
3685                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
3686                                 return _FAIL;
3687                         }
3688                 } else {
3689                         if (seq_ctrl == mlmeext->action_public_rxseq) {
3690                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
3691                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
3692                                 return _FAIL;
3693                         }
3694                 }
3695         }
3696
3697         mlmeext->action_public_rxseq = seq_ctrl;
3698
3699         if (token >= 0)
3700                 mlmeext->action_public_dialog_token = token;
3701
3702         return _SUCCESS;
3703 }
3704
3705 static unsigned int on_action_public_p2p(struct recv_frame *precv_frame)
3706 {
3707         u8 *pframe = precv_frame->pkt->data;
3708         u8 *frame_body;
3709         u8 dialogToken = 0;
3710
3711         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3712         dialogToken = frame_body[7];
3713
3714         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
3715                 return _FAIL;
3716
3717         return _SUCCESS;
3718 }
3719
3720 static unsigned int on_action_public_vendor(struct recv_frame *precv_frame)
3721 {
3722         unsigned int ret = _FAIL;
3723         u8 *pframe = precv_frame->pkt->data;
3724         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3725
3726         if (!memcmp(frame_body + 2, P2P_OUI, 4))
3727                 ret = on_action_public_p2p(precv_frame);
3728
3729         return ret;
3730 }
3731
3732 static unsigned int on_action_public_default(struct recv_frame *precv_frame,
3733                                              u8 action)
3734 {
3735         unsigned int ret = _FAIL;
3736         u8 *pframe = precv_frame->pkt->data;
3737         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3738         u8 token;
3739
3740         token = frame_body[2];
3741
3742         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
3743                 goto exit;
3744
3745         ret = _SUCCESS;
3746
3747 exit:
3748         return ret;
3749 }
3750
3751 static unsigned int on_action_public(struct adapter *padapter,
3752                                      struct recv_frame *precv_frame)
3753 {
3754         unsigned int ret = _FAIL;
3755         u8 *pframe = precv_frame->pkt->data;
3756         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3757         u8 category, action;
3758
3759         /* check RA matches or not */
3760         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
3761                 goto exit;
3762
3763         category = frame_body[0];
3764         if (category != RTW_WLAN_CATEGORY_PUBLIC)
3765                 goto exit;
3766
3767         action = frame_body[1];
3768         switch (action) {
3769         case ACT_PUBLIC_VENDOR:
3770                 ret = on_action_public_vendor(precv_frame);
3771                 break;
3772         default:
3773                 ret = on_action_public_default(precv_frame, action);
3774                 break;
3775         }
3776
3777 exit:
3778         return ret;
3779 }
3780
3781 static unsigned int OnAction_ht(struct adapter *padapter,
3782                                 struct recv_frame *precv_frame)
3783 {
3784         return _SUCCESS;
3785 }
3786
3787 static unsigned int OnAction_wmm(struct adapter *padapter,
3788                                  struct recv_frame *precv_frame)
3789 {
3790         return _SUCCESS;
3791 }
3792
3793 static unsigned int OnAction_p2p(struct adapter *padapter,
3794                                  struct recv_frame *precv_frame)
3795 {
3796         return _SUCCESS;
3797 }
3798
3799 static unsigned int DoReserved(struct adapter *padapter,
3800                                struct recv_frame *precv_frame)
3801 {
3802         return _SUCCESS;
3803 }
3804
3805 static struct action_handler OnAction_tbl[] = {
3806         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
3807         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
3808         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
3809         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
3810         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
3811         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
3812         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
3813         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
3814         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
3815         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
3816         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
3817 };
3818
3819 static unsigned int OnAction(struct adapter *padapter,
3820                              struct recv_frame *precv_frame)
3821 {
3822         int i;
3823         unsigned char   category;
3824         struct action_handler *ptable;
3825         unsigned char   *frame_body;
3826         u8 *pframe = precv_frame->pkt->data;
3827
3828         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3829
3830         category = frame_body[0];
3831
3832         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
3833                 ptable = &OnAction_tbl[i];
3834                 if (category == ptable->num)
3835                         ptable->func(padapter, precv_frame);
3836         }
3837         return _SUCCESS;
3838 }
3839
3840 /****************************************************************************
3841
3842 Following are the initialization functions for WiFi MLME
3843
3844 *****************************************************************************/
3845
3846 static struct mlme_handler mlme_sta_tbl[] = {
3847         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
3848         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
3849         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
3850         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
3851         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
3852         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
3853
3854         /*----------------------------------------------------------
3855                                         below 2 are reserved
3856         -----------------------------------------------------------*/
3857         {0,                                     "DoReserved",           &DoReserved},
3858         {0,                                     "DoReserved",           &DoReserved},
3859         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
3860         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
3861         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
3862         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
3863         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
3864         {WIFI_ACTION,           "OnAction",             &OnAction},
3865 };
3866
3867 int init_hw_mlme_ext(struct adapter *padapter)
3868 {
3869         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3870
3871         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3872         return _SUCCESS;
3873 }
3874
3875 static void init_mlme_ext_priv_value(struct adapter *padapter)
3876 {
3877         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3878         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3879         unsigned char   mixed_datarate[NumRates] = {
3880                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3881                 _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_,
3882                  _48M_RATE_, _54M_RATE_, 0xff
3883         };
3884         unsigned char   mixed_basicrate[NumRates] = {
3885                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3886                 _12M_RATE_, _24M_RATE_, 0xff,
3887         };
3888
3889         atomic_set(&pmlmeext->event_seq, 0);
3890         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
3891
3892         pmlmeext->cur_channel = padapter->registrypriv.channel;
3893         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
3894         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
3895         pmlmeext->oper_channel = pmlmeext->cur_channel;
3896         pmlmeext->oper_bwmode = pmlmeext->cur_bwmode;
3897         pmlmeext->oper_ch_offset = pmlmeext->cur_ch_offset;
3898         pmlmeext->retry = 0;
3899
3900         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
3901
3902         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
3903         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
3904
3905         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
3906
3907         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3908         pmlmeext->sitesurvey_res.channel_idx = 0;
3909         pmlmeext->sitesurvey_res.bss_cnt = 0;
3910         pmlmeext->scan_abort = false;
3911
3912         pmlmeinfo->state = WIFI_FW_NULL_STATE;
3913         pmlmeinfo->reauth_count = 0;
3914         pmlmeinfo->reassoc_count = 0;
3915         pmlmeinfo->link_count = 0;
3916         pmlmeinfo->auth_seq = 0;
3917         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
3918         pmlmeinfo->key_index = 0;
3919         pmlmeinfo->iv = 0;
3920
3921         pmlmeinfo->enc_algo = _NO_PRIVACY_;
3922         pmlmeinfo->authModeToggle = 0;
3923
3924         memset(pmlmeinfo->chg_txt, 0, 128);
3925
3926         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
3927         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
3928
3929         pmlmeinfo->dialogToken = 0;
3930
3931         pmlmeext->action_public_rxseq = 0xffff;
3932         pmlmeext->action_public_dialog_token = 0xff;
3933 }
3934
3935 static int has_channel(struct rt_channel_info *channel_set,
3936                                            u8 chanset_size,
3937                                            u8 chan)
3938 {
3939         int i;
3940
3941         for (i = 0; i < chanset_size; i++) {
3942                 if (channel_set[i].ChannelNum == chan)
3943                         return 1;
3944         }
3945         return 0;
3946 }
3947
3948 static void init_channel_list(struct adapter *padapter,
3949                               struct rt_channel_info *channel_set,
3950                               u8 chanset_size,
3951                               struct p2p_channels *channel_list)
3952 {
3953         struct p2p_oper_class_map op_class[] = {
3954                 { IEEE80211G,  81,   1,  13,  1, BW20 },
3955                 { IEEE80211G,  82,  14,  14,  1, BW20 },
3956                 { -1, 0, 0, 0, 0, BW20 }
3957         };
3958
3959         int cla, op;
3960
3961         cla = 0;
3962
3963         for (op = 0; op_class[op].op_class; op++) {
3964                 u8 ch;
3965                 struct p2p_oper_class_map *o = &op_class[op];
3966                 struct p2p_reg_class *reg = NULL;
3967
3968                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
3969                         if (!has_channel(channel_set, chanset_size, ch))
3970                                 continue;
3971
3972                         if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
3973                                 continue;
3974
3975                         if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
3976                             ((o->bw == BW40MINUS) || (o->bw == BW40PLUS)))
3977                                 continue;
3978
3979                         if (reg == NULL) {
3980                                 reg = &channel_list->reg_class[cla];
3981                                 cla++;
3982                                 reg->reg_class = o->op_class;
3983                                 reg->channels = 0;
3984                         }
3985                         reg->channel[reg->channels] = ch;
3986                         reg->channels++;
3987                 }
3988         }
3989         channel_list->reg_classes = cla;
3990 }
3991
3992 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan,
3993                            struct rt_channel_info *channel_set)
3994 {
3995         u8 index, chanset_size = 0;
3996         u8 b2_4GBand = false;
3997         u8 Index2G = 0;
3998
3999         memset(channel_set, 0, sizeof(struct rt_channel_info) * MAX_CHANNEL_NUM);
4000
4001         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
4002                 DBG_88E("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
4003                 return chanset_size;
4004         }
4005
4006         if (padapter->registrypriv.wireless_mode & WIRELESS_11G) {
4007                 b2_4GBand = true;
4008                 if (ChannelPlan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
4009                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
4010                 else
4011                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
4012         }
4013
4014         if (b2_4GBand) {
4015                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
4016                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
4017
4018                         if ((ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN) ||/* Channel 1~11 is active, and 12~14 is passive */
4019                             (ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G)) {
4020                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
4021                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4022                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
4023                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
4024                         } else if (ChannelPlan == RT_CHANNEL_DOMAIN_WORLD_WIDE_13 ||
4025                                    Index2G == RT_CHANNEL_DOMAIN_2G_WORLD) {/*  channel 12~13, passive scan */
4026                                 if (channel_set[chanset_size].ChannelNum <= 11)
4027                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4028                                 else
4029                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
4030                         } else {
4031                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4032                         }
4033
4034                         chanset_size++;
4035                 }
4036         }
4037         return chanset_size;
4038 }
4039
4040 int     init_mlme_ext_priv(struct adapter *padapter)
4041 {
4042         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4043         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4044         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4045         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4046
4047         pmlmeext->padapter = padapter;
4048
4049         init_mlme_ext_priv_value(padapter);
4050         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
4051
4052         init_mlme_ext_timer(padapter);
4053
4054 #ifdef CONFIG_88EU_AP_MODE
4055         init_mlme_ap_info(padapter);
4056 #endif
4057
4058         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
4059         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
4060
4061         pmlmeext->chan_scan_time = SURVEY_TO;
4062         pmlmeext->mlmeext_init = true;
4063
4064         pmlmeext->active_keep_alive_check = true;
4065
4066         return _SUCCESS;
4067 }
4068
4069 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
4070 {
4071         struct adapter *padapter = pmlmeext->padapter;
4072
4073         if (!padapter)
4074                 return;
4075
4076         if (padapter->bDriverStopped) {
4077                 del_timer_sync(&pmlmeext->survey_timer);
4078                 del_timer_sync(&pmlmeext->link_timer);
4079         }
4080 }
4081
4082 static void _mgt_dispatcher(struct adapter *padapter,
4083                             struct mlme_handler *ptable,
4084                             struct recv_frame *precv_frame)
4085 {
4086         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4087         u8 *pframe = precv_frame->pkt->data;
4088
4089         if (ptable->func) {
4090                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4091                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4092                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4093                         return;
4094                 ptable->func(padapter, precv_frame);
4095         }
4096 }
4097
4098 void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame)
4099 {
4100         int index;
4101         struct mlme_handler *ptable;
4102 #ifdef CONFIG_88EU_AP_MODE
4103         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4104 #endif /* CONFIG_88EU_AP_MODE */
4105         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4106         u8 *pframe = precv_frame->pkt->data;
4107         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
4108
4109         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
4110                  ("+%s: type(0x%x) subtype(0x%x)\n", __func__,
4111                   (unsigned int)GetFrameType(pframe),
4112                   (unsigned int)GetFrameSubType(pframe)));
4113
4114         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
4115                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
4116                          ("%s: type(0x%x) error!\n", __func__,
4117                           (unsigned int)GetFrameType(pframe)));
4118                 return;
4119         }
4120
4121         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4122         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4123             memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4124                 return;
4125
4126         ptable = mlme_sta_tbl;
4127
4128         index = GetFrameSubType(pframe) >> 4;
4129
4130         if (index > 13) {
4131                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type=%d\n", index));
4132                 return;
4133         }
4134         ptable += index;
4135
4136         if (psta) {
4137                 if (GetRetry(pframe)) {
4138                         if (precv_frame->attrib.seq_num ==
4139                             psta->RxMgmtFrameSeqNum) {
4140                                 /* drop the duplicate management frame */
4141                                 DBG_88E("Drop duplicate management frame with seq_num=%d.\n",
4142                                         precv_frame->attrib.seq_num);
4143                                 return;
4144                         }
4145                 }
4146                 psta->RxMgmtFrameSeqNum = precv_frame->attrib.seq_num;
4147         }
4148
4149 #ifdef CONFIG_88EU_AP_MODE
4150         switch (GetFrameSubType(pframe)) {
4151         case WIFI_AUTH:
4152                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
4153                         ptable->func = &OnAuth;
4154                 else
4155                         ptable->func = &OnAuthClient;
4156                 /* fall through */
4157         case WIFI_ASSOCREQ:
4158         case WIFI_REASSOCREQ:
4159         case WIFI_PROBEREQ:
4160         case WIFI_BEACON:
4161         case WIFI_ACTION:
4162                 _mgt_dispatcher(padapter, ptable, precv_frame);
4163                 break;
4164         default:
4165                 _mgt_dispatcher(padapter, ptable, precv_frame);
4166                 break;
4167         }
4168 #else
4169         _mgt_dispatcher(padapter, ptable, precv_frame);
4170 #endif
4171 }
4172
4173 /****************************************************************************
4174
4175 Following are the functions to report events
4176
4177 *****************************************************************************/
4178
4179 void report_survey_event(struct adapter *padapter,
4180                          struct recv_frame *precv_frame)
4181 {
4182         struct cmd_obj *pcmd_obj;
4183         u8 *pevtcmd;
4184         u32 cmdsz;
4185         struct survey_event     *psurvey_evt;
4186         struct C2HEvent_Header *pc2h_evt_hdr;
4187         struct mlme_ext_priv *pmlmeext;
4188         struct cmd_priv *pcmdpriv;
4189
4190         if (!padapter)
4191                 return;
4192
4193         pmlmeext = &padapter->mlmeextpriv;
4194         pcmdpriv = &padapter->cmdpriv;
4195
4196         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4197         if (!pcmd_obj)
4198                 return;
4199
4200         cmdsz = sizeof(struct survey_event) + sizeof(struct C2HEvent_Header);
4201         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4202         if (!pevtcmd) {
4203                 kfree(pcmd_obj);
4204                 return;
4205         }
4206
4207         INIT_LIST_HEAD(&pcmd_obj->list);
4208
4209         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4210         pcmd_obj->cmdsz = cmdsz;
4211         pcmd_obj->parmbuf = pevtcmd;
4212
4213         pcmd_obj->rsp = NULL;
4214         pcmd_obj->rspsz  = 0;
4215
4216         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4217         pc2h_evt_hdr->len = sizeof(struct survey_event);
4218         pc2h_evt_hdr->ID = _Survey_EVT_;
4219         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4220
4221         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4222
4223         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4224                 kfree(pcmd_obj);
4225                 kfree(pevtcmd);
4226                 return;
4227         }
4228
4229         process_80211d(padapter, &psurvey_evt->bss);
4230
4231         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4232
4233         pmlmeext->sitesurvey_res.bss_cnt++;
4234 }
4235
4236 void report_surveydone_event(struct adapter *padapter)
4237 {
4238         struct cmd_obj *pcmd_obj;
4239         u8 *pevtcmd;
4240         u32 cmdsz;
4241         struct surveydone_event *psurveydone_evt;
4242         struct C2HEvent_Header  *pc2h_evt_hdr;
4243         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4244         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4245
4246         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4247         if (!pcmd_obj)
4248                 return;
4249
4250         cmdsz = sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header);
4251         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4252         if (!pevtcmd) {
4253                 kfree(pcmd_obj);
4254                 return;
4255         }
4256
4257         INIT_LIST_HEAD(&pcmd_obj->list);
4258
4259         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4260         pcmd_obj->cmdsz = cmdsz;
4261         pcmd_obj->parmbuf = pevtcmd;
4262
4263         pcmd_obj->rsp = NULL;
4264         pcmd_obj->rspsz  = 0;
4265
4266         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4267         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4268         pc2h_evt_hdr->ID = _SurveyDone_EVT_;
4269         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4270
4271         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4272         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4273
4274         DBG_88E("survey done event(%x)\n", psurveydone_evt->bss_cnt);
4275
4276         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4277 }
4278
4279 void report_join_res(struct adapter *padapter, int res)
4280 {
4281         struct cmd_obj *pcmd_obj;
4282         u8 *pevtcmd;
4283         u32 cmdsz;
4284         struct joinbss_event            *pjoinbss_evt;
4285         struct C2HEvent_Header  *pc2h_evt_hdr;
4286         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4287         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4288         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4289
4290         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4291         if (!pcmd_obj)
4292                 return;
4293
4294         cmdsz = sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header);
4295         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4296         if (!pevtcmd) {
4297                 kfree(pcmd_obj);
4298                 return;
4299         }
4300
4301         INIT_LIST_HEAD(&pcmd_obj->list);
4302
4303         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4304         pcmd_obj->cmdsz = cmdsz;
4305         pcmd_obj->parmbuf = pevtcmd;
4306
4307         pcmd_obj->rsp = NULL;
4308         pcmd_obj->rspsz  = 0;
4309
4310         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4311         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4312         pc2h_evt_hdr->ID = _JoinBss_EVT_;
4313         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4314
4315         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4316         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4317         pjoinbss_evt->network.join_res  = res;
4318         pjoinbss_evt->network.aid = res;
4319
4320         DBG_88E("%s(%d)\n", __func__, res);
4321
4322         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4323
4324         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4325 }
4326
4327 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr,
4328                           unsigned short reason)
4329 {
4330         struct cmd_obj *pcmd_obj;
4331         u8 *pevtcmd;
4332         u32 cmdsz;
4333         struct sta_info *psta;
4334         int     mac_id;
4335         struct stadel_event                     *pdel_sta_evt;
4336         struct C2HEvent_Header  *pc2h_evt_hdr;
4337         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4338         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4339
4340         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4341         if (!pcmd_obj)
4342                 return;
4343
4344         cmdsz = sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header);
4345         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4346         if (!pevtcmd) {
4347                 kfree(pcmd_obj);
4348                 return;
4349         }
4350
4351         INIT_LIST_HEAD(&pcmd_obj->list);
4352
4353         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4354         pcmd_obj->cmdsz = cmdsz;
4355         pcmd_obj->parmbuf = pevtcmd;
4356
4357         pcmd_obj->rsp = NULL;
4358         pcmd_obj->rspsz  = 0;
4359
4360         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4361         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4362         pc2h_evt_hdr->ID = _DelSTA_EVT_;
4363         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4364
4365         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4366         ether_addr_copy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr);
4367         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4368
4369         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4370         if (psta)
4371                 mac_id = (int)psta->mac_id;
4372         else
4373                 mac_id = -1;
4374
4375         pdel_sta_evt->mac_id = mac_id;
4376
4377         DBG_88E("%s: delete STA, mac_id =%d\n", __func__, mac_id);
4378
4379         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4380 }
4381
4382 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr,
4383                           int cam_idx)
4384 {
4385         struct cmd_obj *pcmd_obj;
4386         u8 *pevtcmd;
4387         u32 cmdsz;
4388         struct stassoc_event            *padd_sta_evt;
4389         struct C2HEvent_Header  *pc2h_evt_hdr;
4390         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4391         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4392
4393         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4394         if (!pcmd_obj)
4395                 return;
4396
4397         cmdsz = sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header);
4398         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4399         if (!pevtcmd) {
4400                 kfree(pcmd_obj);
4401                 return;
4402         }
4403
4404         INIT_LIST_HEAD(&pcmd_obj->list);
4405
4406         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4407         pcmd_obj->cmdsz = cmdsz;
4408         pcmd_obj->parmbuf = pevtcmd;
4409
4410         pcmd_obj->rsp = NULL;
4411         pcmd_obj->rspsz  = 0;
4412
4413         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4414         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4415         pc2h_evt_hdr->ID = _AddSTA_EVT_;
4416         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4417
4418         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4419         ether_addr_copy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr);
4420         padd_sta_evt->cam_id = cam_idx;
4421
4422         DBG_88E("%s: add STA\n", __func__);
4423
4424         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4425 }
4426
4427 /****************************************************************************
4428
4429 Following are the event callback functions
4430
4431 *****************************************************************************/
4432
4433 /* for sta/adhoc mode */
4434 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4435 {
4436         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4437         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4438         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4439
4440         /* ERP */
4441         VCS_update(padapter, psta);
4442
4443         /* HT */
4444         if (pmlmepriv->htpriv.ht_option) {
4445                 psta->htpriv.ht_option = true;
4446
4447                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4448
4449                 if (support_short_GI(padapter, &pmlmeinfo->HT_caps))
4450                         psta->htpriv.sgi = true;
4451
4452                 psta->qos_option = true;
4453         } else {
4454                 psta->htpriv.ht_option = false;
4455
4456                 psta->htpriv.ampdu_enable = false;
4457
4458                 psta->htpriv.sgi = false;
4459                 psta->qos_option = false;
4460         }
4461         psta->htpriv.bwmode = pmlmeext->cur_bwmode;
4462         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4463
4464         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4465         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4466
4467         /* QoS */
4468         if (pmlmepriv->qospriv.qos_option)
4469                 psta->qos_option = true;
4470
4471         psta->state = _FW_LINKED;
4472 }
4473
4474 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4475 {
4476         struct sta_info         *psta, *psta_bmc;
4477         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4478         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4479         struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
4480         struct sta_priv         *pstapriv = &padapter->stapriv;
4481         u8 join_type;
4482         u16 media_status;
4483
4484         if (join_res < 0) {
4485                 join_type = 1;
4486                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4487                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4488
4489                 /* restore to initial setting. */
4490                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4491
4492                 goto exit_mlmeext_joinbss_event_callback;
4493         }
4494
4495         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4496                 /* for bc/mc */
4497                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
4498                 if (psta_bmc) {
4499                         pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
4500                         update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
4501                         Update_RA_Entry(padapter, psta_bmc->mac_id);
4502                 }
4503         }
4504
4505         /* turn on dynamic functions */
4506         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4507
4508         /*  update IOT-related issue */
4509         update_IOT_info(padapter);
4510
4511         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
4512
4513         /* BCN interval */
4514         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4515
4516         /* update capability */
4517         update_capinfo(padapter, pmlmeinfo->capability);
4518
4519         /* WMM, Update EDCA param */
4520         WMMOnAssocRsp(padapter);
4521
4522         /* HT */
4523         HTOnAssocRsp(padapter);
4524
4525         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4526
4527         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
4528         if (psta) { /* only for infra. mode */
4529                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4530
4531                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4532
4533                 /* set per sta rate after updating HT cap. */
4534                 set_sta_rate(padapter, psta);
4535                 rtw_hal_set_hwreg(padapter, HW_VAR_TX_RPT_MAX_MACID, (u8 *)&psta->mac_id);
4536                 media_status = (psta->mac_id<<8)|1; /*   MACID|OPMODE: 1 means connect */
4537                 rtw_hal_set_hwreg(padapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
4538         }
4539
4540         join_type = 2;
4541         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4542
4543         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4544                 /*  correcting TSF */
4545                 correct_TSF(padapter, pmlmeext);
4546         }
4547         rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4548
4549 exit_mlmeext_joinbss_event_callback:
4550
4551         DBG_88E("=>%s\n", __func__);
4552 }
4553
4554 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4555 {
4556         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
4557         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4558         u8 join_type;
4559
4560         DBG_88E("%s\n", __func__);
4561
4562         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4563                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {/* adhoc master or sta_count>1 */
4564                         /* nothing to do */
4565                 } else { /* adhoc client */
4566                         /*  correcting TSF */
4567                         correct_TSF(padapter, pmlmeext);
4568
4569                         /* start beacon */
4570                         if (send_beacon(padapter) == _FAIL) {
4571                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4572                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4573                                 return;
4574                         }
4575                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4576                 }
4577
4578                 join_type = 2;
4579                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4580         }
4581
4582         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4583
4584         /* rate radaptive */
4585         Update_RA_Entry(padapter, psta->mac_id);
4586
4587         /* update adhoc sta_info */
4588         update_sta_info(padapter, psta);
4589 }
4590
4591 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4592 {
4593         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4594         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4595
4596         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter)) {
4597                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4598                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4599
4600                 /* restore to initial setting. */
4601                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4602
4603                 /* switch to the 20M Hz mode after disconnect */
4604                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4605                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4606
4607                 /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4608                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4609
4610                 flush_all_cam_entry(padapter);
4611
4612                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4613
4614                 /* set MSR to no link state -> infra. mode */
4615                 Set_MSR(padapter, _HW_STATE_STATION_);
4616
4617                 del_timer_sync(&pmlmeext->link_timer);
4618         }
4619 }
4620
4621 /****************************************************************************
4622
4623 Following are the functions for the timer handlers
4624
4625 *****************************************************************************/
4626
4627 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4628 {
4629         u8 ret = false;
4630
4631         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta)) &&
4632             sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta) &&
4633             sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta))
4634                 ret = false;
4635         else
4636                 ret = true;
4637
4638         sta_update_last_rx_pkts(psta);
4639
4640         return ret;
4641 }
4642
4643 void linked_status_chk(struct adapter *padapter)
4644 {
4645         u32     i;
4646         struct sta_info         *psta;
4647         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
4648         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4649         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4650         struct sta_priv         *pstapriv = &padapter->stapriv;
4651
4652         if (is_client_associated_to_ap(padapter)) {
4653                 /* linked infrastructure client mode */
4654
4655                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
4656                 int rx_chk_limit;
4657
4658                 rx_chk_limit = 4;
4659                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
4660                 if (psta) {
4661                         bool is_p2p_enable = false;
4662
4663                         if (!chk_ap_is_alive(padapter, psta))
4664                                 rx_chk = _FAIL;
4665
4666                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
4667                                 tx_chk = _FAIL;
4668
4669                         if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
4670                                 u8 backup_oper_channel = 0;
4671
4672                                 /* switch to correct channel of current network  before issue keep-alive frames */
4673                                 if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
4674                                         backup_oper_channel = rtw_get_oper_ch(padapter);
4675                                         SelectChannel(padapter, pmlmeext->cur_channel);
4676                                 }
4677
4678                                 if (rx_chk != _SUCCESS)
4679                                         issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
4680
4681                                 if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
4682                                         tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
4683                                         /* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
4684                                         if (tx_chk == _SUCCESS && !is_p2p_enable)
4685                                                 rx_chk = _SUCCESS;
4686                                 }
4687
4688                                 /* back to the original operation channel */
4689                                 if (backup_oper_channel > 0)
4690                                         SelectChannel(padapter, backup_oper_channel);
4691                         } else {
4692                                 if (rx_chk != _SUCCESS) {
4693                                         if (pmlmeext->retry == 0) {
4694                                                 issue_probereq(padapter,
4695                                                 &pmlmeinfo->network.Ssid,
4696                                                 pmlmeinfo->network.MacAddress,
4697                                                                         false);
4698                                                 issue_probereq(padapter,
4699                                                 &pmlmeinfo->network.Ssid,
4700                                                 pmlmeinfo->network.MacAddress,
4701                                                                         false);
4702                                                 issue_probereq(padapter,
4703                                                 &pmlmeinfo->network.Ssid,
4704                                                 pmlmeinfo->network.MacAddress,
4705                                                                         false);
4706                                         }
4707                                 }
4708
4709                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf)
4710                                         tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
4711                         }
4712
4713                         if (rx_chk == _FAIL) {
4714                                 pmlmeext->retry++;
4715                                 if (pmlmeext->retry > rx_chk_limit) {
4716                                         DBG_88E_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
4717                                                       FUNC_ADPT_ARG(padapter));
4718                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress,
4719                                                            WLAN_REASON_EXPIRATION_CHK);
4720                                         return;
4721                                 }
4722                         } else {
4723                                 pmlmeext->retry = 0;
4724                         }
4725
4726                         if (tx_chk == _FAIL) {
4727                                 pmlmeinfo->link_count &= 0xf;
4728                         } else {
4729                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
4730                                 pmlmeinfo->link_count = 0;
4731                         }
4732                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
4733         } else if (is_client_associated_to_ibss(padapter)) {
4734                 /* linked IBSS mode */
4735                 /* for each assoc list entry to check the rx pkt counter */
4736                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
4737                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
4738                                 psta = pmlmeinfo->FW_sta_info[i].psta;
4739
4740                                 if (!psta)
4741                                         continue;
4742                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
4743                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
4744                                                 pmlmeinfo->FW_sta_info[i].retry++;
4745                                         } else {
4746                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
4747                                                 pmlmeinfo->FW_sta_info[i].status = 0;
4748                                                 report_del_sta_event(padapter, psta->hwaddr
4749                                                         , 65535/*  indicate disconnect caused by no rx */
4750                                         );
4751                                         }
4752                                 } else {
4753                                         pmlmeinfo->FW_sta_info[i].retry = 0;
4754                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
4755                                 }
4756                         }
4757                 }
4758         }
4759 }
4760
4761 void survey_timer_hdl(struct timer_list *t)
4762 {
4763         struct adapter *padapter = from_timer(padapter, t,
4764                                               mlmeextpriv.survey_timer);
4765         struct cmd_obj  *ph2c;
4766         struct sitesurvey_parm  *psurveyPara;
4767         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
4768         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4769
4770         /* issue rtw_sitesurvey_cmd */
4771         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
4772                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
4773                         pmlmeext->sitesurvey_res.channel_idx++;
4774
4775                 if (pmlmeext->scan_abort) {
4776                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
4777                         DBG_88E("%s idx:%d\n", __func__
4778                                 , pmlmeext->sitesurvey_res.channel_idx);
4779
4780                         pmlmeext->scan_abort = false;/* reset */
4781                 }
4782
4783                 ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4784                 if (!ph2c)
4785                         goto exit_survey_timer_hdl;
4786
4787                 psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
4788                 if (!psurveyPara) {
4789                         kfree(ph2c);
4790                         goto exit_survey_timer_hdl;
4791                 }
4792
4793                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, _SiteSurvey_CMD_);
4794                 rtw_enqueue_cmd(pcmdpriv, ph2c);
4795         }
4796
4797 exit_survey_timer_hdl:
4798         return;
4799 }
4800
4801 void link_timer_hdl(struct timer_list *t)
4802 {
4803         struct adapter *padapter = from_timer(padapter, t,
4804                                             mlmeextpriv.link_timer);
4805         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4806         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4807
4808         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
4809                 DBG_88E("%s:no beacon while connecting\n", __func__);
4810                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4811                 report_join_res(padapter, -3);
4812         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
4813                 /* re-auth timer */
4814                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
4815                         pmlmeinfo->state = 0;
4816                         report_join_res(padapter, -1);
4817                         return;
4818                 }
4819
4820                 DBG_88E("%s: auth timeout and try again\n", __func__);
4821                 pmlmeinfo->auth_seq = 1;
4822                 issue_auth(padapter, NULL, 0);
4823                 set_link_timer(pmlmeext, REAUTH_TO);
4824         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
4825                 /* re-assoc timer */
4826                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
4827                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4828                         report_join_res(padapter, -2);
4829                         return;
4830                 }
4831
4832                 DBG_88E("%s: assoc timeout and try again\n", __func__);
4833                 issue_assocreq(padapter);
4834                 set_link_timer(pmlmeext, REASSOC_TO);
4835         }
4836 }
4837
4838 void addba_timer_hdl(struct timer_list *t)
4839 {
4840         struct sta_info *psta = from_timer(psta, t, addba_retry_timer);
4841         struct ht_priv  *phtpriv;
4842
4843         if (!psta)
4844                 return;
4845
4846         phtpriv = &psta->htpriv;
4847
4848         if ((phtpriv->ht_option) && (phtpriv->ampdu_enable)) {
4849                 if (phtpriv->candidate_tid_bitmap)
4850                         phtpriv->candidate_tid_bitmap = 0x0;
4851         }
4852 }
4853
4854 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
4855 {
4856         u8 type;
4857         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4858         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4859         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
4860
4861         if (psetop->mode == Ndis802_11APMode) {
4862                 pmlmeinfo->state = WIFI_FW_AP_STATE;
4863                 type = _HW_STATE_AP_;
4864         } else if (psetop->mode == Ndis802_11Infrastructure) {
4865                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
4866                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
4867                 type = _HW_STATE_STATION_;
4868         } else if (psetop->mode == Ndis802_11IBSS) {
4869                 type = _HW_STATE_ADHOC_;
4870         } else {
4871                 type = _HW_STATE_NOLINK_;
4872         }
4873
4874         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
4875         /* Set_NETYPE0_MSR(padapter, type); */
4876
4877         return H2C_SUCCESS;
4878 }
4879
4880 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
4881 {
4882         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4883         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4884         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4885         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4886         /* u32  initialgain; */
4887
4888         if (pparm->InfrastructureMode == Ndis802_11APMode) {
4889 #ifdef CONFIG_88EU_AP_MODE
4890
4891                 if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
4892                         /* todo: */
4893                         return H2C_SUCCESS;
4894                 }
4895 #endif
4896         }
4897
4898         /* below is for ad-hoc master */
4899         if (pparm->InfrastructureMode == Ndis802_11IBSS) {
4900                 rtw_joinbss_reset(padapter);
4901
4902                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4903                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4904                 pmlmeinfo->ERP_enable = 0;
4905                 pmlmeinfo->WMM_enable = 0;
4906                 pmlmeinfo->HT_enable = 0;
4907                 pmlmeinfo->HT_caps_enable = 0;
4908                 pmlmeinfo->HT_info_enable = 0;
4909                 pmlmeinfo->agg_enable_bitmap = 0;
4910                 pmlmeinfo->candidate_tid_bitmap = 0;
4911
4912                 /* disable dynamic functions, such as high power, DIG */
4913                 Save_DM_Func_Flag(padapter);
4914                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
4915
4916                 /* config the initial gain under linking, need to write the BB registers */
4917                 /* initialgain = 0x1E; */
4918                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
4919
4920                 /* cancel link timer */
4921                 del_timer_sync(&pmlmeext->link_timer);
4922
4923                 /* clear CAM */
4924                 flush_all_cam_entry(padapter);
4925
4926                 memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, ie_length));
4927                 pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
4928
4929                 if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
4930                         return H2C_PARAMETERS_ERROR;
4931
4932                 memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
4933
4934                 start_create_ibss(padapter);
4935         }
4936
4937         return H2C_SUCCESS;
4938 }
4939
4940 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
4941 {
4942         u8 join_type;
4943         struct ndis_802_11_var_ie *pIE;
4944         struct registry_priv    *pregpriv = &padapter->registrypriv;
4945         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4946         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4947         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4948         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4949         u32 i;
4950
4951         /* check already connecting to AP or not */
4952         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
4953                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
4954                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
4955
4956                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4957
4958                 /* clear CAM */
4959                 flush_all_cam_entry(padapter);
4960
4961                 del_timer_sync(&pmlmeext->link_timer);
4962
4963                 /* set MSR to nolink -> infra. mode */
4964                 Set_MSR(padapter, _HW_STATE_STATION_);
4965
4966                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4967         }
4968
4969         rtw_antenna_select_cmd(padapter, pparm->PhyInfo.Optimum_antenna, false);
4970
4971         rtw_joinbss_reset(padapter);
4972
4973         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4974         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4975         pmlmeinfo->ERP_enable = 0;
4976         pmlmeinfo->WMM_enable = 0;
4977         pmlmeinfo->HT_enable = 0;
4978         pmlmeinfo->HT_caps_enable = 0;
4979         pmlmeinfo->HT_info_enable = 0;
4980         pmlmeinfo->agg_enable_bitmap = 0;
4981         pmlmeinfo->candidate_tid_bitmap = 0;
4982         pmlmeinfo->bwmode_updated = false;
4983
4984         memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, ie_length));
4985         pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
4986
4987         if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
4988                 return H2C_PARAMETERS_ERROR;
4989
4990         memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
4991
4992         /* Check AP vendor to move rtw_joinbss_cmd() */
4993
4994         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pnetwork->ie_length;) {
4995                 pIE = (struct ndis_802_11_var_ie *)(pnetwork->ies + i);
4996
4997                 switch (pIE->ElementID) {
4998                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
4999                         if (!memcmp(pIE->data, WMM_OUI, 4))
5000                                 pmlmeinfo->WMM_enable = 1;
5001                         break;
5002                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
5003                         pmlmeinfo->HT_caps_enable = 1;
5004                         break;
5005                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
5006                         pmlmeinfo->HT_info_enable = 1;
5007
5008                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5009                         {
5010                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5011
5012                                 if ((pregpriv->cbw40_enable) &&  (pht_info->infos[0] & BIT(2))) {
5013                                         /* switch to the 40M Hz mode according to the AP */
5014                                         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
5015                                         switch (pht_info->infos[0] & 0x3) {
5016                                         case 1:
5017                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5018                                                 break;
5019                                         case 3:
5020                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5021                                                 break;
5022                                         default:
5023                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5024                                                 break;
5025                                 }
5026
5027                                         DBG_88E("set ch/bw before connected\n");
5028                                 }
5029                         }
5030                         break;
5031                 default:
5032                         break;
5033                 }
5034
5035                 i += (pIE->Length + 2);
5036         }
5037         /* disable dynamic functions, such as high power, DIG */
5038
5039         /* config the initial gain under linking, need to write the BB registers */
5040
5041         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
5042         join_type = 0;
5043         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5044
5045         /* cancel link timer */
5046         del_timer_sync(&pmlmeext->link_timer);
5047
5048         start_clnt_join(padapter);
5049
5050         return H2C_SUCCESS;
5051 }
5052
5053 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5054 {
5055         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5056         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5057         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5058         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5059         u8 val8;
5060
5061         if (is_client_associated_to_ap(padapter))
5062                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5063
5064         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5065         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5066
5067         /* restore to initial setting. */
5068         update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
5069
5070         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5071                 /* Stop BCN */
5072                 val8 = 0;
5073                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5074         }
5075
5076         /* set MSR to no link state -> infra. mode */
5077         Set_MSR(padapter, _HW_STATE_STATION_);
5078
5079         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5080
5081         /* switch to the 20M Hz mode after disconnect */
5082         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5083         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5084
5085         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5086
5087         flush_all_cam_entry(padapter);
5088
5089         del_timer_sync(&pmlmeext->link_timer);
5090
5091         rtw_free_uc_swdec_pending_queue(padapter);
5092
5093         return  H2C_SUCCESS;
5094 }
5095
5096 static int rtw_scan_ch_decision(struct adapter *padapter,
5097                                 struct rtw_ieee80211_channel *out,
5098                                 u32 out_num,
5099                                 struct rtw_ieee80211_channel *in, u32 in_num)
5100 {
5101         int i, j;
5102         int set_idx;
5103         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5104
5105         /* clear out first */
5106         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5107
5108         /* acquire channels from in */
5109         j = 0;
5110         for (i = 0; i < in_num; i++) {
5111                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5112                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED) &&
5113                     set_idx >= 0) {
5114                         out[j] = in[i];
5115
5116                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5117                                 out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5118
5119                         j++;
5120                 }
5121                 if (j >= out_num)
5122                         break;
5123         }
5124
5125         /* if out is empty, use channel_set as default */
5126         if (j == 0) {
5127                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5128                         out[i].hw_value = pmlmeext->channel_set[i].ChannelNum;
5129
5130                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5131                                 out[i].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5132
5133                         j++;
5134                 }
5135         }
5136
5137         return j;
5138 }
5139
5140 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5141 {
5142         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5143         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5144         u8 bdelayscan = false;
5145         u8 val8;
5146         u32     initialgain;
5147         u32     i;
5148
5149         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5150                 /* for first time sitesurvey_cmd */
5151                 rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, NULL);
5152
5153                 pmlmeext->sitesurvey_res.state = SCAN_START;
5154                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5155                 pmlmeext->sitesurvey_res.channel_idx = 0;
5156
5157                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5158                         if (pparm->ssid[i].SsidLength) {
5159                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
5160                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = pparm->ssid[i].SsidLength;
5161                         } else {
5162                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = 0;
5163                         }
5164                 }
5165
5166                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5167                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5168                         , pparm->ch, pparm->ch_num
5169         );
5170
5171                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5172
5173                 /* issue null data if associating to the AP */
5174                 if (is_client_associated_to_ap(padapter)) {
5175                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5176
5177                         issue_nulldata(padapter, NULL, 1, 3, 500);
5178
5179                         bdelayscan = true;
5180                 }
5181                 if (bdelayscan) {
5182                         /* delay 50ms to protect nulldata(1). */
5183                         set_survey_timer(pmlmeext, 50);
5184                         return H2C_SUCCESS;
5185                 }
5186         }
5187
5188         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5189                 /* disable dynamic functions, such as high power, DIG */
5190                 Save_DM_Func_Flag(padapter);
5191                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5192
5193                 /* config the initial gain under scanning, need to write the BB registers */
5194                 initialgain = 0x1E;
5195
5196                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5197
5198                 /* set MSR to no link state */
5199                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5200
5201                 val8 = 1; /* under site survey */
5202                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5203
5204                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5205         }
5206
5207         site_survey(padapter);
5208
5209         return H2C_SUCCESS;
5210 }
5211
5212 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5213 {
5214         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5215         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5216         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5217
5218         if (pparm->mode < 4)
5219                 pmlmeinfo->auth_algo = pparm->mode;
5220         return  H2C_SUCCESS;
5221 }
5222
5223 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5224 {
5225         unsigned short                          ctrl;
5226         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5227         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5228         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5229         unsigned char                                   null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5230
5231         /* main tx key for wep. */
5232         if (pparm->set_tx)
5233                 pmlmeinfo->key_index = pparm->keyid;
5234
5235         /* write cam */
5236         ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5237
5238         DBG_88E_LEVEL(_drv_info_, "set group key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) "
5239                         "keyid:%d\n", pparm->algorithm, pparm->keyid);
5240         write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
5241
5242         return H2C_SUCCESS;
5243 }
5244
5245 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5246 {
5247         u16 ctrl = 0;
5248         u8 cam_id;/* cam_entry */
5249         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5250         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5251         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5252
5253         /* cam_entry: */
5254         /* 0~3 for default key */
5255
5256         /* for concurrent mode (ap+sta): */
5257         /* default key is disable, using sw encrypt/decrypt */
5258         /* cam_entry = 4 for sta mode (macid = 0) */
5259         /* cam_entry(macid+3) = 5 ~ N for ap mode (aid = 1~N, macid = 2 ~N) */
5260
5261         /* for concurrent mode (sta+sta): */
5262         /* default key is disable, using sw encrypt/decrypt */
5263         /* cam_entry = 4 mapping to macid = 0 */
5264         /* cam_entry = 5 mapping to macid = 2 */
5265
5266         cam_id = 4;
5267
5268         DBG_88E_LEVEL(_drv_info_, "set pairwise key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) camid:%d\n",
5269                       pparm->algorithm, cam_id);
5270         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
5271                 struct sta_info *psta;
5272                 struct sta_priv *pstapriv = &padapter->stapriv;
5273
5274                 if (pparm->algorithm == _NO_PRIVACY_)   /*  clear cam entry */ {
5275                         clear_cam_entry(padapter, pparm->id);
5276                         return H2C_SUCCESS_RSP;
5277                 }
5278
5279                 psta = rtw_get_stainfo(pstapriv, pparm->addr);
5280                 if (psta) {
5281                         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5282
5283                         DBG_88E("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
5284
5285                         if ((psta->mac_id < 1) || (psta->mac_id > (NUM_STA-4))) {
5286                                 DBG_88E("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
5287                                 return H2C_REJECTED;
5288                         }
5289
5290                         cam_id = psta->mac_id + 3;/* 0~3 for default key, cmd_id = macid + 3, macid = aid+1; */
5291
5292                         DBG_88E("Write CAM, mac_addr =%pM, cam_entry=%d\n",
5293                                 pparm->addr, cam_id);
5294
5295                         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5296
5297                         return H2C_SUCCESS_RSP;
5298                 } else {
5299                         DBG_88E("r871x_set_stakey_hdl(): sta has been free\n");
5300                         return H2C_REJECTED;
5301                 }
5302         }
5303
5304         /* below for sta mode */
5305
5306         if (pparm->algorithm == _NO_PRIVACY_) { /*  clear cam entry */
5307                 clear_cam_entry(padapter, pparm->id);
5308                 return H2C_SUCCESS;
5309         }
5310         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5311         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5312         pmlmeinfo->enc_algo = pparm->algorithm;
5313         return H2C_SUCCESS;
5314 }
5315
5316 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5317 {
5318         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5319         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5320         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5321
5322         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5323
5324         if (!psta)
5325                 return  H2C_SUCCESS;
5326
5327         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5328             ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5329                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5330                 mod_timer(&psta->addba_retry_timer,
5331                           jiffies + msecs_to_jiffies(ADDBA_TO));
5332         } else {
5333                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5334         }
5335         return  H2C_SUCCESS;
5336 }
5337
5338 u8 set_tx_beacon_cmd(struct adapter *padapter)
5339 {
5340         struct cmd_obj  *ph2c;
5341         struct wlan_bssid_ex    *ptxBeacon_parm;
5342         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5343         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5344         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5345         u8 res = _SUCCESS;
5346         int len_diff = 0;
5347
5348         ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
5349         if (!ph2c) {
5350                 res = _FAIL;
5351                 goto exit;
5352         }
5353
5354         ptxBeacon_parm = kmemdup(&(pmlmeinfo->network),
5355                                 sizeof(struct wlan_bssid_ex), GFP_ATOMIC);
5356         if (ptxBeacon_parm == NULL) {
5357                 kfree(ph2c);
5358                 res = _FAIL;
5359                 goto exit;
5360         }
5361
5362         len_diff = update_hidden_ssid(ptxBeacon_parm->ies+_BEACON_IE_OFFSET_,
5363                                       ptxBeacon_parm->ie_length-_BEACON_IE_OFFSET_,
5364                                       pmlmeinfo->hidden_ssid_mode);
5365         ptxBeacon_parm->ie_length += len_diff;
5366
5367         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, _TX_Beacon_CMD_);
5368
5369         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5370
5371 exit:
5372         return res;
5373 }
5374
5375 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5376 {
5377         u8 evt_code;
5378         u16 evt_sz;
5379         uint    *peventbuf;
5380         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5381
5382         peventbuf = (uint *)pbuf;
5383         evt_sz = (u16)(*peventbuf&0xffff);
5384         evt_code = (u8)((*peventbuf>>16)&0xff);
5385
5386         /*  checking if event code is valid */
5387         if (evt_code >= MAX_C2HEVT) {
5388                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
5389                 goto _abort_event_;
5390         }
5391
5392         /*  checking if event size match the event parm size */
5393         if ((wlanevents[evt_code].parmsize != 0) &&
5394             (wlanevents[evt_code].parmsize != evt_sz)) {
5395                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_,
5396                          ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
5397                          evt_code, wlanevents[evt_code].parmsize, evt_sz));
5398                 goto _abort_event_;
5399         }
5400
5401         peventbuf += 2;
5402
5403         if (peventbuf) {
5404                 event_callback = wlanevents[evt_code].event_callback;
5405                 event_callback(padapter, (u8 *)peventbuf);
5406         }
5407
5408 _abort_event_:
5409         return H2C_SUCCESS;
5410 }
5411
5412 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5413 {
5414         if (send_beacon(padapter) == _FAIL) {
5415                 DBG_88E("issue_beacon, fail!\n");
5416                 return H2C_PARAMETERS_ERROR;
5417         }
5418 #ifdef CONFIG_88EU_AP_MODE
5419         else { /* tx bc/mc frames after update TIM */
5420                 struct sta_info *psta_bmc;
5421                 struct list_head *xmitframe_plist, *xmitframe_phead;
5422                 struct xmit_frame *pxmitframe = NULL;
5423                 struct sta_priv  *pstapriv = &padapter->stapriv;
5424
5425                 /* for BC/MC Frames */
5426                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
5427                 if (!psta_bmc)
5428                         return H2C_SUCCESS;
5429
5430                 if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5431                         msleep(10);/*  10ms, ATIM(HIQ) Windows */
5432                         spin_lock_bh(&psta_bmc->sleep_q.lock);
5433
5434                         xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5435                         xmitframe_plist = xmitframe_phead->next;
5436
5437                         while (xmitframe_phead != xmitframe_plist) {
5438                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
5439
5440                                 xmitframe_plist = xmitframe_plist->next;
5441
5442                                 list_del_init(&pxmitframe->list);
5443
5444                                 psta_bmc->sleepq_len--;
5445                                 if (psta_bmc->sleepq_len > 0)
5446                                         pxmitframe->attrib.mdata = 1;
5447                                 else
5448                                         pxmitframe->attrib.mdata = 0;
5449
5450                                 pxmitframe->attrib.triggered = 1;
5451
5452                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5453
5454                                 spin_unlock_bh(&psta_bmc->sleep_q.lock);
5455                                 if (rtw_hal_xmit(padapter, pxmitframe))
5456                                         rtw_os_xmit_complete(padapter, pxmitframe);
5457                                 spin_lock_bh(&psta_bmc->sleep_q.lock);
5458                         }
5459                         spin_unlock_bh(&psta_bmc->sleep_q.lock);
5460                 }
5461         }
5462 #endif
5463         return H2C_SUCCESS;
5464 }
5465
5466 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5467 {
5468         struct set_ch_parm *set_ch_parm;
5469         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5470
5471         if (!pbuf)
5472                 return H2C_PARAMETERS_ERROR;
5473
5474         set_ch_parm = (struct set_ch_parm *)pbuf;
5475
5476         DBG_88E(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
5477                 FUNC_NDEV_ARG(padapter->pnetdev),
5478                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
5479
5480         pmlmeext->cur_channel = set_ch_parm->ch;
5481         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5482         pmlmeext->cur_bwmode = set_ch_parm->bw;
5483
5484         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5485
5486         return  H2C_SUCCESS;
5487 }
5488
5489 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5490 {
5491         struct SetChannelPlan_param *setChannelPlan_param;
5492         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5493
5494         if (!pbuf)
5495                 return H2C_PARAMETERS_ERROR;
5496
5497         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5498
5499         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5500         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5501
5502         return  H2C_SUCCESS;
5503 }