kernel/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c

   1 /******************************************************************************
   2  *
   3  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  * You should have received a copy of the GNU General Public License along with
  15  * this program; if not, write to the Free Software Foundation, Inc.,
  16  * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
  17  *
  18  *
  19  ******************************************************************************/
  20 #define _RTW_MLME_EXT_C_
  21
  22 #include <linux/ieee80211.h>
  23
  24 #include <osdep_service.h>
  25 #include <drv_types.h>
  26 #include <wifi.h>
  27 #include <rtw_mlme_ext.h>
  28 #include <wlan_bssdef.h>
  29 #include <mlme_osdep.h>
  30 #include <recv_osdep.h>
  31
  32 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  33
  34 /**************************************************
  35 OUI definitions for the vendor specific IE
  36 ***************************************************/
  37 unsigned char   RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  38 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  39 unsigned char   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  40 unsigned char   P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  41 unsigned char   WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  42
  43 unsigned char   WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  44 unsigned char   WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  45
  46 unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
  47 unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
  48
  49 extern unsigned char REALTEK_96B_IE[];
  50
  51 /********************************************************
  52 MCS rate definitions
  53 *********************************************************/
  54 unsigned char   MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  55 unsigned char   MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  56
  57 /********************************************************
  58 ChannelPlan definitions
  59 *********************************************************/
  60 static struct rt_channel_plan_2g RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  61         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  62         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  63         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  64         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  65         {{10, 11, 12, 13}, 4},                                  /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  66         {{}, 0},                                                                        /*  0x05, RT_CHANNEL_DOMAIN_2G_NULL */
  67 };
  68
  69 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  70         /*  0x00 ~ 0x1F , Old Define ===== */
  71         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  72         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  73         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  74         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  75         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  76         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  77         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  78         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  79         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  80         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  81         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  82         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  83         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  84         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  85         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  86         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  87         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
  88         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
  89         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  90         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
  91         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
  92         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
  93         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
  94         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  95         {0x05}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
  96         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
  97         {0x00}, /* 0x1A, */
  98         {0x00}, /* 0x1B, */
  99         {0x00}, /* 0x1C, */
 100         {0x00}, /* 0x1D, */
 101         {0x00}, /* 0x1E, */
 102         {0x05}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
 103         /*  0x20 ~ 0x7F , New Define ===== */
 104         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 105         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 106         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 107         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 108         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 109         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 110         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 111         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 112         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 113         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 114         {0x00}, /* 0x2A, */
 115         {0x00}, /* 0x2B, */
 116         {0x00}, /* 0x2C, */
 117         {0x00}, /* 0x2D, */
 118         {0x00}, /* 0x2E, */
 119         {0x00}, /* 0x2F, */
 120         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 121         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 122         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 123         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 124         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 125         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 126         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 127         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 128         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 129         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 130         {0x00}, /* 0x3A, */
 131         {0x00}, /* 0x3B, */
 132         {0x00}, /* 0x3C, */
 133         {0x00}, /* 0x3D, */
 134         {0x00}, /* 0x3E, */
 135         {0x00}, /* 0x3F, */
 136         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 137         {0x03}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G */
 138 };
 139
 140 static struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03}; /* use the combination for max channel numbers */
 141
 142 /*
 143  * Search the @param channel_num in given @param channel_set
 144  * @ch_set: the given channel set
 145  * @ch: the given channel number
 146  *
 147  * return the index of channel_num in channel_set, -1 if not found
 148  */
 149 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 150 {
 151         int i;
 152         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 153                 if (ch == ch_set[i].ChannelNum)
 154                         break;
 155         }
 156
 157         if (i >= ch_set[i].ChannelNum)
 158                 return -1;
 159         return i;
 160 }
 161
 162 struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
 163 {
 164         struct xmit_frame                       *pmgntframe;
 165         struct xmit_buf                         *pxmitbuf;
 166
 167         pmgntframe = rtw_alloc_xmitframe(pxmitpriv);
 168         if (pmgntframe == NULL) {
 169                 DBG_88E("%s, alloc xmitframe fail\n", __func__);
 170                 return NULL;
 171         }
 172
 173         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
 174         if (pxmitbuf == NULL) {
 175                 DBG_88E("%s, alloc xmitbuf fail\n", __func__);
 176                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
 177                 return NULL;
 178         }
 179         pmgntframe->frame_tag = MGNT_FRAMETAG;
 180         pmgntframe->pxmitbuf = pxmitbuf;
 181         pmgntframe->buf_addr = pxmitbuf->pbuf;
 182         pxmitbuf->priv_data = pmgntframe;
 183         return pmgntframe;
 184 }
 185
 186 /****************************************************************************
 187
 188 Following are some TX functions for WiFi MLME
 189
 190 *****************************************************************************/
 191
 192 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
 193 {
 194         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 195
 196         pmlmeext->tx_rate = rate;
 197         DBG_88E("%s(): rate = %x\n", __func__, rate);
 198 }
 199
 200 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
 201 {
 202         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 203
 204         memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
 205
 206         pattrib->hdrlen = 24;
 207         pattrib->nr_frags = 1;
 208         pattrib->priority = 7;
 209         pattrib->mac_id = 0;
 210         pattrib->qsel = 0x12;
 211
 212         pattrib->pktlen = 0;
 213
 214         if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
 215                 pattrib->raid = 6;/* b mode */
 216         else
 217                 pattrib->raid = 5;/* a/g mode */
 218
 219         pattrib->encrypt = _NO_PRIVACY_;
 220         pattrib->bswenc = false;
 221
 222         pattrib->qos_en = false;
 223         pattrib->ht_en = false;
 224         pattrib->bwmode = HT_CHANNEL_WIDTH_20;
 225         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 226         pattrib->sgi = false;
 227
 228         pattrib->seqnum = pmlmeext->mgnt_seq;
 229
 230         pattrib->retry_ctrl = true;
 231 }
 232
 233 static void dump_mgntframe(struct adapter *padapter,
 234                            struct xmit_frame *pmgntframe)
 235 {
 236         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 237                 return;
 238
 239         rtw_hal_mgnt_xmit(padapter, pmgntframe);
 240 }
 241
 242 static s32 dump_mgntframe_and_wait(struct adapter *padapter,
 243                                    struct xmit_frame *pmgntframe,
 244                                    int timeout_ms)
 245 {
 246         s32 ret = _FAIL;
 247         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
 248         struct submit_ctx sctx;
 249
 250         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 251                 return ret;
 252
 253         rtw_sctx_init(&sctx, timeout_ms);
 254         pxmitbuf->sctx = &sctx;
 255
 256         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
 257
 258         if (ret == _SUCCESS)
 259                 ret = rtw_sctx_wait(&sctx);
 260
 261         return ret;
 262 }
 263
 264 static s32 dump_mgntframe_and_wait_ack(struct adapter *padapter,
 265                                        struct xmit_frame *pmgntframe)
 266 {
 267         s32 ret = _FAIL;
 268         u32 timeout_ms = 500;/*   500ms */
 269         struct xmit_priv        *pxmitpriv = &padapter->xmitpriv;
 270
 271         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 272                 return -1;
 273
 274         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex))
 275                 return _FAIL;
 276         pxmitpriv->ack_tx = true;
 277
 278         pmgntframe->ack_report = 1;
 279         if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS) {
 280                 ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
 281         }
 282
 283         pxmitpriv->ack_tx = false;
 284         mutex_unlock(&pxmitpriv->ack_tx_mutex);
 285
 286         return ret;
 287 }
 288
 289 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
 290 {
 291         u8 *ssid_ie;
 292         int ssid_len_ori;
 293         int len_diff = 0;
 294
 295         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
 296
 297         if (ssid_ie && ssid_len_ori > 0) {
 298                 switch (hidden_ssid_mode) {
 299                 case 1: {
 300                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
 301                         u32 remain_len = 0;
 302
 303                         remain_len = ies_len - (next_ie - ies);
 304
 305                         ssid_ie[1] = 0;
 306                         memcpy(ssid_ie+2, next_ie, remain_len);
 307                         len_diff -= ssid_len_ori;
 308
 309                         break;
 310                 }
 311                 case 2:
 312                         memset(&ssid_ie[2], 0, ssid_len_ori);
 313                         break;
 314                 default:
 315                         break;
 316                 }
 317         }
 318
 319         return len_diff;
 320 }
 321
 322 static void issue_beacon(struct adapter *padapter, int timeout_ms)
 323 {
 324         struct xmit_frame       *pmgntframe;
 325         struct pkt_attrib       *pattrib;
 326         unsigned char   *pframe;
 327         struct rtw_ieee80211_hdr *pwlanhdr;
 328         __le16 *fctrl;
 329         unsigned int    rate_len;
 330         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 331         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 332         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 333         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 334         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 335         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 336
 337         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 338         if (pmgntframe == NULL) {
 339                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 340                 return;
 341         }
 342 #if defined(CONFIG_88EU_AP_MODE)
 343         spin_lock_bh(&pmlmepriv->bcn_update_lock);
 344 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 345
 346         /* update attribute */
 347         pattrib = &pmgntframe->attrib;
 348         update_mgntframe_attrib(padapter, pattrib);
 349         pattrib->qsel = 0x10;
 350
 351         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 352
 353         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 354         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
 355
 356
 357         fctrl = &(pwlanhdr->frame_ctl);
 358         *(fctrl) = 0;
 359
 360         memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
 361         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
 362         memcpy(pwlanhdr->addr3, cur_network->MacAddress, ETH_ALEN);
 363
 364         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
 365         /* pmlmeext->mgnt_seq++; */
 366         SetFrameSubType(pframe, WIFI_BEACON);
 367
 368         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
 369         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 370
 371         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 372                 int len_diff;
 373                 u8 *wps_ie;
 374                 uint wps_ielen;
 375                 u8 sr = 0;
 376                 memcpy(pframe, cur_network->IEs, cur_network->IELength);
 377                 len_diff = update_hidden_ssid(
 378                         pframe+_BEACON_IE_OFFSET_
 379                         , cur_network->IELength-_BEACON_IE_OFFSET_
 380                         , pmlmeinfo->hidden_ssid_mode
 381                         );
 382                 pframe += (cur_network->IELength+len_diff);
 383                 pattrib->pktlen += (cur_network->IELength+len_diff);
 384                 wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct rtw_ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
 385                         pattrib->pktlen-sizeof(struct rtw_ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
 386                 if (wps_ie && wps_ielen > 0)
 387                         rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
 388                 if (sr != 0)
 389                         set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
 390                 else
 391                         _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
 392
 393                 goto _issue_bcn;
 394         }
 395
 396         /* below for ad-hoc mode */
 397
 398         /* timestamp will be inserted by hardware */
 399         pframe += 8;
 400         pattrib->pktlen += 8;
 401
 402         /*  beacon interval: 2 bytes */
 403
 404         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 405
 406         pframe += 2;
 407         pattrib->pktlen += 2;
 408
 409         /*  capability info: 2 bytes */
 410
 411         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 412
 413         pframe += 2;
 414         pattrib->pktlen += 2;
 415
 416         /*  SSID */
 417         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 418
 419         /*  supported rates... */
 420         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 421         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 422
 423         /*  DS parameter set */
 424         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 425
 426         {
 427                 u8 erpinfo = 0;
 428                 u32 ATIMWindow;
 429                 /*  IBSS Parameter Set... */
 430                 ATIMWindow = 0;
 431                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 432
 433                 /* ERP IE */
 434                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 435         }
 436
 437         /*  EXTERNDED SUPPORTED RATE */
 438         if (rate_len > 8)
 439                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 440         /* todo:HT for adhoc */
 441 _issue_bcn:
 442
 443 #if defined(CONFIG_88EU_AP_MODE)
 444         pmlmepriv->update_bcn = false;
 445
 446         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
 447 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 448
 449         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
 450                 DBG_88E("beacon frame too large\n");
 451                 return;
 452         }
 453
 454         pattrib->last_txcmdsz = pattrib->pktlen;
 455
 456         /* DBG_88E("issue bcn_sz=%d\n", pattrib->last_txcmdsz); */
 457         if (timeout_ms > 0)
 458                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
 459         else
 460                 dump_mgntframe(padapter, pmgntframe);
 461 }
 462
 463 static void issue_probersp(struct adapter *padapter, unsigned char *da)
 464 {
 465         struct xmit_frame                       *pmgntframe;
 466         struct pkt_attrib                       *pattrib;
 467         unsigned char                                   *pframe;
 468         struct rtw_ieee80211_hdr        *pwlanhdr;
 469         __le16 *fctrl;
 470         unsigned char                                   *mac, *bssid;
 471         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 472 #if defined(CONFIG_88EU_AP_MODE)
 473         u8 *pwps_ie;
 474         uint wps_ielen;
 475         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 476 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 477         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 478         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 479         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 480         unsigned int    rate_len;
 481
 482         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 483         if (pmgntframe == NULL) {
 484                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 485                 return;
 486         }
 487
 488         /* update attribute */
 489         pattrib = &pmgntframe->attrib;
 490         update_mgntframe_attrib(padapter, pattrib);
 491
 492         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 493
 494         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 495         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
 496
 497         mac = myid(&(padapter->eeprompriv));
 498         bssid = cur_network->MacAddress;
 499
 500         fctrl = &(pwlanhdr->frame_ctl);
 501         *(fctrl) = 0;
 502         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
 503         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
 504         memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
 505
 506         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 507         pmlmeext->mgnt_seq++;
 508         SetFrameSubType(fctrl, WIFI_PROBERSP);
 509
 510         pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 511         pattrib->pktlen = pattrib->hdrlen;
 512         pframe += pattrib->hdrlen;
 513
 514         if (cur_network->IELength > MAX_IE_SZ)
 515                 return;
 516
 517 #if defined(CONFIG_88EU_AP_MODE)
 518         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 519                 pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
 520
 521                 /* inerset & update wps_probe_resp_ie */
 522                 if ((pmlmepriv->wps_probe_resp_ie != NULL) && pwps_ie && (wps_ielen > 0)) {
 523                         uint wps_offset, remainder_ielen;
 524                         u8 *premainder_ie;
 525
 526                         wps_offset = (uint)(pwps_ie - cur_network->IEs);
 527
 528                         premainder_ie = pwps_ie + wps_ielen;
 529
 530                         remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
 531
 532                         memcpy(pframe, cur_network->IEs, wps_offset);
 533                         pframe += wps_offset;
 534                         pattrib->pktlen += wps_offset;
 535
 536                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
 537                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
 538                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
 539                                 pframe += wps_ielen+2;
 540                                 pattrib->pktlen += wps_ielen+2;
 541                         }
 542
 543                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
 544                                 memcpy(pframe, premainder_ie, remainder_ielen);
 545                                 pframe += remainder_ielen;
 546                                 pattrib->pktlen += remainder_ielen;
 547                         }
 548                 } else {
 549                         memcpy(pframe, cur_network->IEs, cur_network->IELength);
 550                         pframe += cur_network->IELength;
 551                         pattrib->pktlen += cur_network->IELength;
 552                 }
 553         } else
 554 #endif
 555         {
 556                 /* timestamp will be inserted by hardware */
 557                 pframe += 8;
 558                 pattrib->pktlen += 8;
 559
 560                 /*  beacon interval: 2 bytes */
 561
 562                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 563
 564                 pframe += 2;
 565                 pattrib->pktlen += 2;
 566
 567                 /*  capability info: 2 bytes */
 568
 569                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 570
 571                 pframe += 2;
 572                 pattrib->pktlen += 2;
 573
 574                 /* below for ad-hoc mode */
 575
 576                 /*  SSID */
 577                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 578
 579                 /*  supported rates... */
 580                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 581                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 582
 583                 /*  DS parameter set */
 584                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 585
 586                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 587                         u8 erpinfo = 0;
 588                         u32 ATIMWindow;
 589                         /*  IBSS Parameter Set... */
 590                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
 591                         ATIMWindow = 0;
 592                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 593
 594                         /* ERP IE */
 595                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 596                 }
 597
 598
 599                 /*  EXTERNDED SUPPORTED RATE */
 600                 if (rate_len > 8)
 601                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 602                 /* todo:HT for adhoc */
 603         }
 604
 605         pattrib->last_txcmdsz = pattrib->pktlen;
 606
 607         dump_mgntframe(padapter, pmgntframe);
 608
 609         return;
 610 }
 611
 612 static int _issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, int wait_ack)
 613 {
 614         int ret = _FAIL;
 615         struct xmit_frame               *pmgntframe;
 616         struct pkt_attrib               *pattrib;
 617         unsigned char                   *pframe;
 618         struct rtw_ieee80211_hdr        *pwlanhdr;
 619         __le16 *fctrl;
 620         unsigned char                   *mac;
 621         unsigned char                   bssrate[NumRates];
 622         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
 623         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 624         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 625         int     bssrate_len = 0;
 626         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 627
 628         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+issue_probereq\n"));
 629
 630         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 631         if (pmgntframe == NULL)
 632                 goto exit;
 633
 634         /* update attribute */
 635         pattrib = &pmgntframe->attrib;
 636         update_mgntframe_attrib(padapter, pattrib);
 637
 638
 639         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 640
 641         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 642         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
 643
 644         mac = myid(&(padapter->eeprompriv));
 645
 646         fctrl = &(pwlanhdr->frame_ctl);
 647         *(fctrl) = 0;
 648
 649         if (da) {
 650                 /*      unicast probe request frame */
 651                 memcpy(pwlanhdr->addr1, da, ETH_ALEN);
 652                 memcpy(pwlanhdr->addr3, da, ETH_ALEN);
 653         } else {
 654                 /*      broadcast probe request frame */
 655                 memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
 656                 memcpy(pwlanhdr->addr3, bc_addr, ETH_ALEN);
 657         }
 658
 659         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
 660
 661         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 662         pmlmeext->mgnt_seq++;
 663         SetFrameSubType(pframe, WIFI_PROBEREQ);
 664
 665         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
 666         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 667
 668         if (pssid)
 669                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
 670         else
 671                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
 672
 673         get_rate_set(padapter, bssrate, &bssrate_len);
 674
 675         if (bssrate_len > 8) {
 676                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
 677                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
 678         } else {
 679                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
 680         }
 681
 682         /* add wps_ie for wps2.0 */
 683         if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
 684                 memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
 685                 pframe += pmlmepriv->wps_probe_req_ie_len;
 686                 pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
 687         }
 688
 689         pattrib->last_txcmdsz = pattrib->pktlen;
 690
 691         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
 692                  ("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
 693
 694         if (wait_ack) {
 695                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
 696         } else {
 697                 dump_mgntframe(padapter, pmgntframe);
 698                 ret = _SUCCESS;
 699         }
 700
 701 exit:
 702         return ret;
 703 }
 704
 705 static inline void issue_probereq(struct adapter *padapter,
 706                                   struct ndis_802_11_ssid *pssid, u8 *da)
 707 {
 708         _issue_probereq(padapter, pssid, da, false);
 709 }
 710
 711 static int issue_probereq_ex(struct adapter *padapter,
 712                              struct ndis_802_11_ssid *pssid, u8 *da,
 713                              int try_cnt, int wait_ms)
 714 {
 715         int ret;
 716         int i = 0;
 717         u32 start = jiffies;
 718
 719         do {
 720                 ret = _issue_probereq(padapter, pssid, da, wait_ms > 0 ? true : false);
 721
 722                 i++;
 723
 724                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
 725                         break;
 726
 727                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
 728                         msleep(wait_ms);
 729
 730         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
 731
 732         if (ret != _FAIL) {
 733                 ret = _SUCCESS;
 734                 goto exit;
 735         }
 736
 737         if (try_cnt && wait_ms) {
 738                 if (da)
 739                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
 740                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
 741                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
 742                 else
 743                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
 744                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
 745                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
 746         }
 747 exit:
 748         return ret;
 749 }
 750
 751 /*  if psta == NULL, indicate we are station(client) now... */
 752 static void issue_auth(struct adapter *padapter, struct sta_info *psta,
 753                        unsigned short status)
 754 {
 755         struct xmit_frame *pmgntframe;
 756         struct pkt_attrib *pattrib;
 757         unsigned char *pframe;
 758         struct rtw_ieee80211_hdr *pwlanhdr;
 759         __le16 *fctrl;
 760         unsigned int val32;
 761         u16 val16;
 762 #ifdef CONFIG_88EU_AP_MODE
 763         __le16 le_val16;
 764 #endif
 765         int use_shared_key = 0;
 766         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 767         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 768         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 769         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
 770
 771         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 772         if (pmgntframe == NULL)
 773                 return;
 774
 775         /* update attribute */
 776         pattrib = &pmgntframe->attrib;
 777         update_mgntframe_attrib(padapter, pattrib);
 778
 779         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 780
 781         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 782         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
 783
 784         fctrl = &(pwlanhdr->frame_ctl);
 785         *(fctrl) = 0;
 786
 787         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 788         pmlmeext->mgnt_seq++;
 789         SetFrameSubType(pframe, WIFI_AUTH);
 790
 791         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
 792         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 793
 794
 795         if (psta) {/*  for AP mode */
 796 #ifdef CONFIG_88EU_AP_MODE
 797
 798                 memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);
 799                 memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
 800                 memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
 801
 802
 803                 /*  setting auth algo number */
 804                 val16 = (u16)psta->authalg;
 805
 806                 if (status != _STATS_SUCCESSFUL_)
 807                         val16 = 0;
 808
 809                 if (val16) {
 810                         le_val16 = cpu_to_le16(val16);
 811                         use_shared_key = 1;
 812                 } else {
 813                         le_val16 = 0;
 814                 }
 815
 816                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_val16,
 817                                           &pattrib->pktlen);
 818
 819                 /*  setting auth seq number */
 820                 val16 = (u16)psta->auth_seq;
 821                 le_val16 = cpu_to_le16(val16);
 822                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_val16,
 823                                           &pattrib->pktlen);
 824
 825                 /*  setting status code... */
 826                 val16 = status;
 827                 le_val16 = cpu_to_le16(val16);
 828                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_,
 829                                           &le_val16, &pattrib->pktlen);
 830
 831                 /*  added challenging text... */
 832                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
 833                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
 834 #endif
 835         } else {
 836                 __le32 le_tmp32;
 837                 __le16 le_tmp16;
 838                 memcpy(pwlanhdr->addr1, pnetwork->MacAddress, ETH_ALEN);
 839                 memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
 840                 memcpy(pwlanhdr->addr3, pnetwork->MacAddress, ETH_ALEN);
 841
 842                 /*  setting auth algo number */
 843                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
 844                 if (val16)
 845                         use_shared_key = 1;
 846
 847                 /* setting IV for auth seq #3 */
 848                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 849                         val32 = (pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30);
 850                         le_tmp32 = cpu_to_le32(val32);
 851                         pframe = rtw_set_fixed_ie(pframe, 4, &le_tmp32,
 852                                                   &pattrib->pktlen);
 853
 854                         pattrib->iv_len = 4;
 855                 }
 856
 857                 le_tmp16 = cpu_to_le16(val16);
 858                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_tmp16,
 859                                           &pattrib->pktlen);
 860
 861                 /*  setting auth seq number */
 862                 val16 = pmlmeinfo->auth_seq;
 863                 le_tmp16 = cpu_to_le16(val16);
 864                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_tmp16,
 865                                           &pattrib->pktlen);
 866
 867
 868                 /*  setting status code... */
 869                 le_tmp16 = cpu_to_le16(status);
 870                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &le_tmp16,
 871                                           &pattrib->pktlen);
 872
 873                 /*  then checking to see if sending challenging text... */
 874                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 875                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
 876
 877                         SetPrivacy(fctrl);
 878
 879                         pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 880
 881                         pattrib->encrypt = _WEP40_;
 882
 883                         pattrib->icv_len = 4;
 884
 885                         pattrib->pktlen += pattrib->icv_len;
 886                 }
 887         }
 888
 889         pattrib->last_txcmdsz = pattrib->pktlen;
 890
 891         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
 892         DBG_88E("%s\n", __func__);
 893         dump_mgntframe(padapter, pmgntframe);
 894
 895         return;
 896 }
 897
 898
 899 #ifdef CONFIG_88EU_AP_MODE
 900 static void issue_asocrsp(struct adapter *padapter, unsigned short status,
 901                           struct sta_info *pstat, int pkt_type)
 902 {
 903         struct xmit_frame       *pmgntframe;
 904         struct rtw_ieee80211_hdr        *pwlanhdr;
 905         struct pkt_attrib *pattrib;
 906         unsigned char   *pbuf, *pframe;
 907         unsigned short val;
 908         __le16 *fctrl;
 909         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 910         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 911         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 912         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 913         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
 914         u8 *ie = pnetwork->IEs;
 915         __le16 lestatus, leval;
 916
 917         DBG_88E("%s\n", __func__);
 918
 919         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 920         if (pmgntframe == NULL)
 921                 return;
 922
 923         /* update attribute */
 924         pattrib = &pmgntframe->attrib;
 925         update_mgntframe_attrib(padapter, pattrib);
 926
 927
 928         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 929
 930         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 931         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
 932
 933         fctrl = &(pwlanhdr->frame_ctl);
 934         *(fctrl) = 0;
 935
 936         memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
 937         memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
 938         memcpy((void *)GetAddr3Ptr(pwlanhdr), pnetwork->MacAddress, ETH_ALEN);
 939
 940
 941         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 942         pmlmeext->mgnt_seq++;
 943         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
 944                 SetFrameSubType(pwlanhdr, pkt_type);
 945         else
 946                 return;
 947
 948         pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 949         pattrib->pktlen += pattrib->hdrlen;
 950         pframe += pattrib->hdrlen;
 951
 952         /* capability */
 953         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
 954
 955         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, &val, &pattrib->pktlen);
 956
 957         lestatus = cpu_to_le16(status);
 958         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &lestatus,
 959                                   &pattrib->pktlen);
 960
 961         leval = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
 962         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, &leval, &pattrib->pktlen);
 963
 964         if (pstat->bssratelen <= 8) {
 965                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
 966         } else {
 967                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
 968                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
 969         }
 970
 971         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
 972                 uint ie_len = 0;
 973
 974                 /* FILL HT CAP INFO IE */
 975                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 976                 if (pbuf && ie_len > 0) {
 977                         memcpy(pframe, pbuf, ie_len+2);
 978                         pframe += (ie_len+2);
 979                         pattrib->pktlen += (ie_len+2);
 980                 }
 981
 982                 /* FILL HT ADD INFO IE */
 983                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 984                 if (pbuf && ie_len > 0) {
 985                         memcpy(pframe, pbuf, ie_len+2);
 986                         pframe += (ie_len+2);
 987                         pattrib->pktlen += (ie_len+2);
 988                 }
 989         }
 990
 991         /* FILL WMM IE */
 992         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
 993                 uint ie_len = 0;
 994                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
 995
 996                 for (pbuf = ie + _BEACON_IE_OFFSET_;; pbuf += (ie_len + 2)) {
 997                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
 998                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
 999                                 memcpy(pframe, pbuf, ie_len+2);
1000                                 pframe += (ie_len+2);
1001                                 pattrib->pktlen += (ie_len+2);
1002                                 break;
1003                         }
1004
1005                         if ((pbuf == NULL) || (ie_len == 0))
1006                                 break;
1007                 }
1008         }
1009
1010         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1011                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
1012
1013         /* add WPS IE ie for wps 2.0 */
1014         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
1015                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
1016
1017                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
1018                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
1019         }
1020
1021         pattrib->last_txcmdsz = pattrib->pktlen;
1022         dump_mgntframe(padapter, pmgntframe);
1023 }
1024 #endif /* CONFIG_88EU_AP_MODE */
1025
1026 static void issue_assocreq(struct adapter *padapter)
1027 {
1028         int ret = _FAIL;
1029         struct xmit_frame       *pmgntframe;
1030         struct pkt_attrib       *pattrib;
1031         unsigned char           *pframe, *p;
1032         struct rtw_ieee80211_hdr        *pwlanhdr;
1033         __le16 *fctrl;
1034         __le16          le_tmp;
1035         unsigned int    i, j, ie_len, index = 0;
1036         unsigned char   rf_type, bssrate[NumRates], sta_bssrate[NumRates];
1037         struct ndis_802_11_var_ie *pIE;
1038         struct registry_priv    *pregpriv = &padapter->registrypriv;
1039         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
1040         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1041         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1042         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1043         int     bssrate_len = 0, sta_bssrate_len = 0;
1044         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1045
1046         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1047         if (pmgntframe == NULL)
1048                 goto exit;
1049
1050         /* update attribute */
1051         pattrib = &pmgntframe->attrib;
1052         update_mgntframe_attrib(padapter, pattrib);
1053
1054         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1055         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1056         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1057
1058         fctrl = &(pwlanhdr->frame_ctl);
1059         *(fctrl) = 0;
1060         memcpy(pwlanhdr->addr1, pnetwork->MacAddress, ETH_ALEN);
1061         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
1062         memcpy(pwlanhdr->addr3, pnetwork->MacAddress, ETH_ALEN);
1063
1064         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1065         pmlmeext->mgnt_seq++;
1066         SetFrameSubType(pframe, WIFI_ASSOCREQ);
1067
1068         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
1069         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
1070
1071         /* caps */
1072
1073         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
1074
1075         pframe += 2;
1076         pattrib->pktlen += 2;
1077
1078         /* listen interval */
1079         /* todo: listen interval for power saving */
1080         le_tmp = cpu_to_le16(3);
1081         memcpy(pframe , (unsigned char *)&le_tmp, 2);
1082         pframe += 2;
1083         pattrib->pktlen += 2;
1084
1085         /* SSID */
1086         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
1087
1088         /* supported rate & extended supported rate */
1089
1090         /*  Check if the AP's supported rates are also supported by STA. */
1091         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
1092
1093         if (pmlmeext->cur_channel == 14)/*  for JAPAN, channel 14 can only uses B Mode(CCK) */
1094                 sta_bssrate_len = 4;
1095
1096         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1097                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1098                         break;
1099                 DBG_88E("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
1100         }
1101
1102         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1103                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1104                         break;
1105
1106                 /*  Check if the AP's supported rates are also supported by STA. */
1107                 for (j = 0; j < sta_bssrate_len; j++) {
1108                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
1109                         if ((pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
1110                                         == (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK))
1111                                 break;
1112                 }
1113
1114                 if (j == sta_bssrate_len) {
1115                         /*  the rate is not supported by STA */
1116                         DBG_88E("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
1117                 } else {
1118                         /*  the rate is supported by STA */
1119                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
1120                 }
1121         }
1122
1123         bssrate_len = index;
1124         DBG_88E("bssrate_len=%d\n", bssrate_len);
1125
1126         if (bssrate_len == 0) {
1127                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
1128                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1129                 goto exit; /* don't connect to AP if no joint supported rate */
1130         }
1131
1132
1133         if (bssrate_len > 8) {
1134                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
1135                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
1136         } else {
1137                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
1138         }
1139
1140         /* RSN */
1141         p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1142         if (p != NULL)
1143                 pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
1144
1145         /* HT caps */
1146         if (padapter->mlmepriv.htpriv.ht_option) {
1147                 p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1148                 if ((p != NULL) && (!(is_ap_in_tkip(padapter)))) {
1149                         memcpy(&(pmlmeinfo->HT_caps), (p + 2), sizeof(struct HT_caps_element));
1150
1151                         /* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
1152                         if (pregpriv->cbw40_enable == 0)
1153                                 pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info &= cpu_to_le16(~(BIT(6) | BIT(1)));
1154                         else
1155                                 pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(BIT(1));
1156
1157                         /* todo: disable SM power save mode */
1158                         pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x000c);
1159
1160                         rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
1161                         switch (rf_type) {
1162                         case RF_1T1R:
1163                                 if (pregpriv->rx_stbc)
1164                                         pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);/* RX STBC One spatial stream */
1165                                 memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
1166                                 break;
1167                         case RF_2T2R:
1168                         case RF_1T2R:
1169                         default:
1170                                 if ((pregpriv->rx_stbc == 0x3) ||/* enable for 2.4/5 GHz */
1171                                     ((pmlmeext->cur_wireless_mode & WIRELESS_11_24N) && (pregpriv->rx_stbc == 0x1)) || /* enable for 2.4GHz */
1172                                     (pregpriv->wifi_spec == 1)) {
1173                                         DBG_88E("declare supporting RX STBC\n");
1174                                         pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0200);/* RX STBC two spatial stream */
1175                                 }
1176                                 memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R, 16);
1177                                 break;
1178                         }
1179                         pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len , (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
1180                 }
1181         }
1182
1183         /* vendor specific IE, such as WPA, WMM, WPS */
1184         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pmlmeinfo->network.IELength; i += (pIE->Length + 2)) {
1185                 pIE = (struct ndis_802_11_var_ie *)(pmlmeinfo->network.IEs + i);
1186
1187                 switch (pIE->ElementID) {
1188                 case _VENDOR_SPECIFIC_IE_:
1189                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
1190                             (!memcmp(pIE->data, WMM_OUI, 4)) ||
1191                             (!memcmp(pIE->data, WPS_OUI, 4))) {
1192                                 if (!padapter->registrypriv.wifi_spec) {
1193                                         /* Commented by Kurt 20110629 */
1194                                         /* In some older APs, WPS handshake */
1195                                         /* would be fail if we append vender extensions informations to AP */
1196                                         if (!memcmp(pIE->data, WPS_OUI, 4))
1197                                                 pIE->Length = 14;
1198                                 }
1199                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
1200                         }
1201                         break;
1202                 default:
1203                         break;
1204                 }
1205         }
1206
1207         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1208                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
1209
1210         pattrib->last_txcmdsz = pattrib->pktlen;
1211         dump_mgntframe(padapter, pmgntframe);
1212
1213         ret = _SUCCESS;
1214
1215 exit:
1216         if (ret == _SUCCESS)
1217                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
1218         else
1219                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
1220
1221         return;
1222 }
1223
1224 /* when wait_ack is true, this function should be called at process context */
1225 static int _issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int wait_ack)
1226 {
1227         int ret = _FAIL;
1228         struct xmit_frame                       *pmgntframe;
1229         struct pkt_attrib                       *pattrib;
1230         unsigned char                                   *pframe;
1231         struct rtw_ieee80211_hdr        *pwlanhdr;
1232         __le16 *fctrl;
1233         struct xmit_priv        *pxmitpriv;
1234         struct mlme_ext_priv    *pmlmeext;
1235         struct mlme_ext_info    *pmlmeinfo;
1236         struct wlan_bssid_ex    *pnetwork;
1237
1238         if (!padapter)
1239                 goto exit;
1240
1241         pxmitpriv = &(padapter->xmitpriv);
1242         pmlmeext = &(padapter->mlmeextpriv);
1243         pmlmeinfo = &(pmlmeext->mlmext_info);
1244         pnetwork = &(pmlmeinfo->network);
1245
1246         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1247         if (pmgntframe == NULL)
1248                 goto exit;
1249
1250         /* update attribute */
1251         pattrib = &pmgntframe->attrib;
1252         update_mgntframe_attrib(padapter, pattrib);
1253         pattrib->retry_ctrl = false;
1254
1255         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1256
1257         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1258         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1259
1260         fctrl = &(pwlanhdr->frame_ctl);
1261         *(fctrl) = 0;
1262
1263         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1264                 SetFrDs(fctrl);
1265         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1266                 SetToDs(fctrl);
1267
1268         if (power_mode)
1269                 SetPwrMgt(fctrl);
1270
1271         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
1272         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
1273         memcpy(pwlanhdr->addr3, pnetwork->MacAddress, ETH_ALEN);
1274
1275         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1276         pmlmeext->mgnt_seq++;
1277         SetFrameSubType(pframe, WIFI_DATA_NULL);
1278
1279         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
1280         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
1281
1282         pattrib->last_txcmdsz = pattrib->pktlen;
1283
1284         if (wait_ack) {
1285                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1286         } else {
1287                 dump_mgntframe(padapter, pmgntframe);
1288                 ret = _SUCCESS;
1289         }
1290
1291 exit:
1292         return ret;
1293 }
1294
1295
1296 /* when wait_ms > 0 , this function should be called at process context */
1297 /* da == NULL for station mode */
1298 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
1299 {
1300         int ret;
1301         int i = 0;
1302         u32 start = jiffies;
1303         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1304         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1305         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1306
1307         /* da == NULL, assume it's null data for sta to ap*/
1308         if (da == NULL)
1309                 da = pnetwork->MacAddress;
1310
1311         do {
1312                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0 ? true : false);
1313
1314                 i++;
1315
1316                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1317                         break;
1318
1319                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1320                         msleep(wait_ms);
1321         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1322
1323         if (ret != _FAIL) {
1324                 ret = _SUCCESS;
1325                 goto exit;
1326         }
1327
1328         if (try_cnt && wait_ms) {
1329                 if (da)
1330                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1331                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1332                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
1333                 else
1334                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1335                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1336                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
1337         }
1338 exit:
1339         return ret;
1340 }
1341
1342 /* when wait_ack is true, this function should be called at process context */
1343 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int wait_ack)
1344 {
1345         int ret = _FAIL;
1346         struct xmit_frame                       *pmgntframe;
1347         struct pkt_attrib                       *pattrib;
1348         unsigned char                                   *pframe;
1349         struct rtw_ieee80211_hdr        *pwlanhdr;
1350         __le16 *fctrl;
1351         unsigned short *qc;
1352         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1353         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1354         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1355         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1356
1357         DBG_88E("%s\n", __func__);
1358
1359         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1360         if (pmgntframe == NULL)
1361                 goto exit;
1362
1363         /* update attribute */
1364         pattrib = &pmgntframe->attrib;
1365         update_mgntframe_attrib(padapter, pattrib);
1366
1367         pattrib->hdrlen += 2;
1368         pattrib->qos_en = true;
1369         pattrib->eosp = 1;
1370         pattrib->ack_policy = 0;
1371         pattrib->mdata = 0;
1372
1373         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1374
1375         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1376         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1377
1378         fctrl = &(pwlanhdr->frame_ctl);
1379         *(fctrl) = 0;
1380
1381         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1382                 SetFrDs(fctrl);
1383         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1384                 SetToDs(fctrl);
1385
1386         if (pattrib->mdata)
1387                 SetMData(fctrl);
1388
1389         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
1390
1391         SetPriority(qc, tid);
1392
1393         SetEOSP(qc, pattrib->eosp);
1394
1395         SetAckpolicy(qc, pattrib->ack_policy);
1396
1397         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
1398         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
1399         memcpy(pwlanhdr->addr3, pnetwork->MacAddress, ETH_ALEN);
1400
1401         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1402         pmlmeext->mgnt_seq++;
1403         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
1404
1405         pframe += sizeof(struct rtw_ieee80211_hdr_3addr_qos);
1406         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr_qos);
1407
1408         pattrib->last_txcmdsz = pattrib->pktlen;
1409
1410         if (wait_ack) {
1411                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1412         } else {
1413                 dump_mgntframe(padapter, pmgntframe);
1414                 ret = _SUCCESS;
1415         }
1416
1417 exit:
1418         return ret;
1419 }
1420
1421 /* when wait_ms > 0 , this function should be called at process context */
1422 /* da == NULL for station mode */
1423 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
1424 {
1425         int ret;
1426         int i = 0;
1427         u32 start = jiffies;
1428         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1429         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1430         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1431
1432         /* da == NULL, assume it's null data for sta to ap*/
1433         if (da == NULL)
1434                 da = pnetwork->MacAddress;
1435
1436         do {
1437                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0 ? true : false);
1438
1439                 i++;
1440
1441                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1442                         break;
1443
1444                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1445                         msleep(wait_ms);
1446         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1447
1448         if (ret != _FAIL) {
1449                 ret = _SUCCESS;
1450                 goto exit;
1451         }
1452
1453         if (try_cnt && wait_ms) {
1454                 if (da)
1455                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1456                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1457                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
1458                 else
1459                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1460                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1461                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
1462         }
1463 exit:
1464         return ret;
1465 }
1466
1467 static int _issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason, u8 wait_ack)
1468 {
1469         struct xmit_frame                       *pmgntframe;
1470         struct pkt_attrib                       *pattrib;
1471         unsigned char                                   *pframe;
1472         struct rtw_ieee80211_hdr        *pwlanhdr;
1473         __le16 *fctrl;
1474         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1475         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1476         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1477         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1478         int ret = _FAIL;
1479         __le16 le_tmp;
1480
1481         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1482         if (pmgntframe == NULL)
1483                 goto exit;
1484
1485         /* update attribute */
1486         pattrib = &pmgntframe->attrib;
1487         update_mgntframe_attrib(padapter, pattrib);
1488         pattrib->retry_ctrl = false;
1489
1490         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1491
1492         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1493         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1494
1495         fctrl = &(pwlanhdr->frame_ctl);
1496         *(fctrl) = 0;
1497
1498         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
1499         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
1500         memcpy(pwlanhdr->addr3, pnetwork->MacAddress, ETH_ALEN);
1501
1502         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1503         pmlmeext->mgnt_seq++;
1504         SetFrameSubType(pframe, WIFI_DEAUTH);
1505
1506         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
1507         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
1508
1509         le_tmp = cpu_to_le16(reason);
1510         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, &le_tmp,
1511                                   &pattrib->pktlen);
1512
1513         pattrib->last_txcmdsz = pattrib->pktlen;
1514
1515
1516         if (wait_ack) {
1517                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1518         } else {
1519                 dump_mgntframe(padapter, pmgntframe);
1520                 ret = _SUCCESS;
1521         }
1522
1523 exit:
1524         return ret;
1525 }
1526
1527 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
1528 {
1529         DBG_88E("%s to %pM\n", __func__, da);
1530         return _issue_deauth(padapter, da, reason, false);
1531 }
1532
1533 static int issue_deauth_ex(struct adapter *padapter, u8 *da,
1534                            unsigned short reason, int try_cnt,
1535                            int wait_ms)
1536 {
1537         int ret;
1538         int i = 0;
1539         u32 start = jiffies;
1540
1541         do {
1542                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0 ? true : false);
1543
1544                 i++;
1545
1546                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1547                         break;
1548
1549                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1550                         msleep(wait_ms);
1551         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1552
1553         if (ret != _FAIL) {
1554                 ret = _SUCCESS;
1555                 goto exit;
1556         }
1557
1558         if (try_cnt && wait_ms) {
1559                 if (da)
1560                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1561                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1562                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
1563                 else
1564                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1565                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1566                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt, rtw_get_passing_time_ms(start));
1567         }
1568 exit:
1569         return ret;
1570 }
1571
1572 void issue_action_spct_ch_switch(struct adapter *padapter, u8 *ra, u8 new_ch, u8 ch_offset)
1573 {
1574         struct xmit_frame                       *pmgntframe;
1575         struct pkt_attrib                       *pattrib;
1576         unsigned char                           *pframe;
1577         struct rtw_ieee80211_hdr        *pwlanhdr;
1578         __le16 *fctrl;
1579         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1580         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1581
1582
1583         DBG_88E(FUNC_NDEV_FMT" ra =%pM, ch:%u, offset:%u\n",
1584                 FUNC_NDEV_ARG(padapter->pnetdev), ra, new_ch, ch_offset);
1585
1586         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1587         if (pmgntframe == NULL)
1588                 return;
1589
1590         /* update attribute */
1591         pattrib = &pmgntframe->attrib;
1592         update_mgntframe_attrib(padapter, pattrib);
1593
1594         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1595
1596         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1597         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1598
1599         fctrl = &(pwlanhdr->frame_ctl);
1600         *(fctrl) = 0;
1601
1602         memcpy(pwlanhdr->addr1, ra, ETH_ALEN); /* RA */
1603         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN); /* TA */
1604         memcpy(pwlanhdr->addr3, ra, ETH_ALEN); /* DA = RA */
1605
1606         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1607         pmlmeext->mgnt_seq++;
1608         SetFrameSubType(pframe, WIFI_ACTION);
1609
1610         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
1611         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
1612
1613         /* category, action */
1614         {
1615                 u8 category, action;
1616                 category = RTW_WLAN_CATEGORY_SPECTRUM_MGMT;
1617                 action = RTW_WLAN_ACTION_SPCT_CHL_SWITCH;
1618
1619                 pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1620                 pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1621         }
1622
1623         pframe = rtw_set_ie_ch_switch(pframe, &(pattrib->pktlen), 0, new_ch, 0);
1624         pframe = rtw_set_ie_secondary_ch_offset(pframe, &(pattrib->pktlen),
1625                 hal_ch_offset_to_secondary_ch_offset(ch_offset));
1626
1627         pattrib->last_txcmdsz = pattrib->pktlen;
1628
1629         dump_mgntframe(padapter, pmgntframe);
1630 }
1631
1632 static void issue_action_BA(struct adapter *padapter, unsigned char *raddr,
1633                             unsigned char action, unsigned short status)
1634 {
1635         u8 category = RTW_WLAN_CATEGORY_BACK;
1636         u16 start_seq;
1637         u16 BA_para_set;
1638         u16 reason_code;
1639         u16 BA_timeout_value;
1640         __le16  le_tmp;
1641         u16 BA_starting_seqctrl = 0;
1642         enum ht_cap_ampdu_factor max_rx_ampdu_factor;
1643         struct xmit_frame *pmgntframe;
1644         struct pkt_attrib *pattrib;
1645         u8 *pframe;
1646         struct rtw_ieee80211_hdr *pwlanhdr;
1647         __le16 *fctrl;
1648         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
1649         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1650         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1651         struct sta_info *psta;
1652         struct sta_priv *pstapriv = &padapter->stapriv;
1653         struct registry_priv *pregpriv = &padapter->registrypriv;
1654         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1655
1656         DBG_88E("%s, category=%d, action=%d, status=%d\n", __func__, category, action, status);
1657
1658         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1659         if (pmgntframe == NULL)
1660                 return;
1661
1662         /* update attribute */
1663         pattrib = &pmgntframe->attrib;
1664         update_mgntframe_attrib(padapter, pattrib);
1665
1666         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1667
1668         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1669         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1670
1671         fctrl = &(pwlanhdr->frame_ctl);
1672         *(fctrl) = 0;
1673
1674         /* memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN); */
1675         memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
1676         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
1677         memcpy(pwlanhdr->addr3, pnetwork->MacAddress, ETH_ALEN);
1678
1679         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1680         pmlmeext->mgnt_seq++;
1681         SetFrameSubType(pframe, WIFI_ACTION);
1682
1683         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
1684         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
1685
1686         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1687         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1688
1689         if (category == 3) {
1690                 switch (action) {
1691                 case 0: /* ADDBA req */
1692                         do {
1693                                 pmlmeinfo->dialogToken++;
1694                         } while (pmlmeinfo->dialogToken == 0);
1695                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
1696
1697                         BA_para_set = 0x1002 | ((status & 0xf) << 2); /* immediate ack & 64 buffer size */
1698                         le_tmp = cpu_to_le16(BA_para_set);
1699                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1700                                                   &pattrib->pktlen);
1701
1702                         BA_timeout_value = 5000;/*  5ms */
1703                         le_tmp = cpu_to_le16(BA_timeout_value);
1704                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1705                                                   &pattrib->pktlen);
1706
1707                         psta = rtw_get_stainfo(pstapriv, raddr);
1708                         if (psta != NULL) {
1709                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
1710
1711                                 DBG_88E("BA_starting_seqctrl=%d for TID=%d\n", start_seq, status & 0x07);
1712
1713                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
1714
1715                                 BA_starting_seqctrl = start_seq << 4;
1716                         }
1717                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
1718                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1719                                                   &pattrib->pktlen);
1720                         break;
1721                 case 1: /* ADDBA rsp */
1722                 {
1723                         struct ADDBA_request *ADDBA_req = &pmlmeinfo->ADDBA_req;
1724
1725                         pframe = rtw_set_fixed_ie(pframe, 1,
1726                                                   &ADDBA_req->dialog_token,
1727                                                   &pattrib->pktlen);
1728                         pframe = rtw_set_fixed_ie(pframe, 2, &status,
1729                                                   &pattrib->pktlen);
1730
1731                         BA_para_set = le16_to_cpu(ADDBA_req->BA_para_set) &
1732                                       0x3f;
1733                         rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
1734                         switch (max_rx_ampdu_factor) {
1735                         case MAX_AMPDU_FACTOR_64K:
1736                                 BA_para_set |= 0x1000; /* 64 buffer size */
1737                                 break;
1738                         case MAX_AMPDU_FACTOR_32K:
1739                                 BA_para_set |= 0x0800; /* 32 buffer size */
1740                                 break;
1741                         case MAX_AMPDU_FACTOR_16K:
1742                                 BA_para_set |= 0x0400; /* 16 buffer size */
1743                                 break;
1744                         case MAX_AMPDU_FACTOR_8K:
1745                                 BA_para_set |= 0x0200; /* 8 buffer size */
1746                                 break;
1747                         default:
1748                                 BA_para_set |= 0x1000; /* 64 buffer size */
1749                                 break;
1750                         }
1751
1752                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
1753                                 BA_para_set = BA_para_set & ~BIT(0);
1754                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
1755                                 BA_para_set = BA_para_set | BIT(0);
1756                         le_tmp = cpu_to_le16(BA_para_set);
1757
1758                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1759                                                   &pattrib->pktlen);
1760                         pframe = rtw_set_fixed_ie(pframe, 2,
1761                                                   &ADDBA_req->BA_timeout_value,
1762                                                   &pattrib->pktlen);
1763                         break;
1764                 }
1765                 case 2:/* DELBA */
1766                         BA_para_set = (status & 0x1F) << 3;
1767                         le_tmp = cpu_to_le16(BA_para_set);
1768                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1769                                                   &pattrib->pktlen);
1770
1771                         reason_code = 37;/* Requested from peer STA as it does not want to use the mechanism */
1772                         le_tmp = cpu_to_le16(reason_code);
1773                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1774                                                   &pattrib->pktlen);
1775                         break;
1776                 default:
1777                         break;
1778                 }
1779         }
1780
1781         pattrib->last_txcmdsz = pattrib->pktlen;
1782
1783         dump_mgntframe(padapter, pmgntframe);
1784 }
1785
1786 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
1787 {
1788         struct list_head *plist, *phead;
1789         unsigned char category, action;
1790         struct xmit_frame                       *pmgntframe;
1791         struct pkt_attrib                       *pattrib;
1792         unsigned char                           *pframe;
1793         struct rtw_ieee80211_hdr        *pwlanhdr;
1794         __le16 *fctrl;
1795         struct  wlan_network    *pnetwork = NULL;
1796         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1797         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1798         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1799         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1800         struct __queue *queue   = &(pmlmepriv->scanned_queue);
1801         u8 InfoContent[16] = {0};
1802         u8 ICS[8][15];
1803         struct wlan_bssid_ex  *cur_network   = &(pmlmeinfo->network);
1804
1805         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
1806                 return;
1807
1808         if (pmlmeinfo->bwmode_updated)
1809                 return;
1810
1811
1812         DBG_88E("%s\n", __func__);
1813
1814
1815         category = RTW_WLAN_CATEGORY_PUBLIC;
1816         action = ACT_PUBLIC_BSSCOEXIST;
1817
1818         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1819         if (pmgntframe == NULL)
1820                 return;
1821
1822         /* update attribute */
1823         pattrib = &pmgntframe->attrib;
1824         update_mgntframe_attrib(padapter, pattrib);
1825
1826         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1827
1828         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1829         pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
1830
1831         fctrl = &(pwlanhdr->frame_ctl);
1832         *(fctrl) = 0;
1833
1834         memcpy(pwlanhdr->addr1, cur_network->MacAddress, ETH_ALEN);
1835         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
1836         memcpy(pwlanhdr->addr3, cur_network->MacAddress, ETH_ALEN);
1837
1838         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1839         pmlmeext->mgnt_seq++;
1840         SetFrameSubType(pframe, WIFI_ACTION);
1841
1842         pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
1843         pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
1844
1845         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1846         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1847
1848
1849         /*  */
1850         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
1851                 u8 iedata = 0;
1852
1853                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
1854
1855                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
1856         }
1857
1858
1859         /*  */
1860         memset(ICS, 0, sizeof(ICS));
1861         if (pmlmepriv->num_sta_no_ht > 0) {
1862                 int i;
1863
1864                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1865
1866                 phead = get_list_head(queue);
1867                 plist = phead->next;
1868
1869                 while (phead != plist) {
1870                         int len;
1871                         u8 *p;
1872                         struct wlan_bssid_ex *pbss_network;
1873
1874                         pnetwork = container_of(plist, struct wlan_network, list);
1875
1876                         plist = plist->next;
1877
1878                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
1879
1880                         p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
1881                         if ((p == NULL) || (len == 0)) { /* non-HT */
1882                                 if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
1883                                         continue;
1884
1885                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
1886
1887                                 if (ICS[0][0] == 0)
1888                                         ICS[0][0] = 1;
1889                         }
1890                 }
1891                 spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
1892
1893                 for (i = 0; i < 8; i++) {
1894                         if (ICS[i][0] == 1) {
1895                                 int j, k = 0;
1896
1897                                 InfoContent[k] = i;
1898                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
1899                                 k++;
1900
1901                                 for (j = 1; j <= 14; j++) {
1902                                         if (ICS[i][j] == 1) {
1903                                                 if (k < 16) {
1904                                                         InfoContent[k] = j; /* channel number */
1905                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
1906                                                         k++;
1907                                                 }
1908                                         }
1909                                 }
1910
1911                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
1912                         }
1913                 }
1914         }
1915
1916
1917         pattrib->last_txcmdsz = pattrib->pktlen;
1918
1919         dump_mgntframe(padapter, pmgntframe);
1920 }
1921
1922 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
1923 {
1924         struct sta_priv *pstapriv = &padapter->stapriv;
1925         struct sta_info *psta = NULL;
1926         /* struct recv_reorder_ctrl *preorder_ctrl; */
1927         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1928         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1929         u16 tid;
1930
1931         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1932                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1933                         return _SUCCESS;
1934
1935         psta = rtw_get_stainfo(pstapriv, addr);
1936         if (psta == NULL)
1937                 return _SUCCESS;
1938
1939         if (initiator == 0) { /*  recipient */
1940                 for (tid = 0; tid < MAXTID; tid++) {
1941                         if (psta->recvreorder_ctrl[tid].enable) {
1942                                 DBG_88E("rx agg disable tid(%d)\n", tid);
1943                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1944                                 psta->recvreorder_ctrl[tid].enable = false;
1945                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
1946                         }
1947                 }
1948         } else if (initiator == 1) { /*  originator */
1949                 for (tid = 0; tid < MAXTID; tid++) {
1950                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
1951                                 DBG_88E("tx agg disable tid(%d)\n", tid);
1952                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1953                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1954                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1955                         }
1956                 }
1957         }
1958
1959         return _SUCCESS;
1960 }
1961
1962 unsigned int send_beacon(struct adapter *padapter)
1963 {
1964         u8 bxmitok = false;
1965         int     issue = 0;
1966         int poll = 0;
1967
1968         u32 start = jiffies;
1969
1970         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
1971         do {
1972                 issue_beacon(padapter, 100);
1973                 issue++;
1974                 do {
1975                         yield();
1976                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
1977                         poll++;
1978                 } while ((poll%10) != 0 && !bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1979         } while (!bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1980
1981         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
1982                 return _FAIL;
1983         if (!bxmitok) {
1984                 DBG_88E("%s fail! %u ms\n", __func__, rtw_get_passing_time_ms(start));
1985                 return _FAIL;
1986         } else {
1987                 u32 passing_time = rtw_get_passing_time_ms(start);
1988
1989                 if (passing_time > 100 || issue > 3)
1990                         DBG_88E("%s success, issue:%d, poll:%d, %u ms\n", __func__, issue, poll, rtw_get_passing_time_ms(start));
1991                 return _SUCCESS;
1992         }
1993 }
1994
1995 /****************************************************************************
1996
1997 Following are some utility functions for WiFi MLME
1998
1999 *****************************************************************************/
2000
2001 static void site_survey(struct adapter *padapter)
2002 {
2003         unsigned char           survey_channel = 0, val8;
2004         enum rt_scan_type ScanType = SCAN_PASSIVE;
2005         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2006         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2007         u32 initialgain = 0;
2008         struct rtw_ieee80211_channel *ch;
2009
2010         if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
2011                 ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
2012                 survey_channel = ch->hw_value;
2013                 ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
2014         }
2015
2016
2017         if (survey_channel != 0) {
2018                 /* PAUSE 4-AC Queue when site_survey */
2019                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
2020                 /* val8 |= 0x0f; */
2021                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
2022                 if (pmlmeext->sitesurvey_res.channel_idx == 0)
2023                         set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2024                 else
2025                         SelectChannel(padapter, survey_channel);
2026
2027                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
2028                         int i;
2029                         for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
2030                                 if (pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
2031                                         /* todo: to issue two probe req??? */
2032                                         issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
2033                                         /* msleep(SURVEY_TO>>1); */
2034                                         issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
2035                                 }
2036                         }
2037
2038                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
2039                                 /* todo: to issue two probe req??? */
2040                                 issue_probereq(padapter, NULL, NULL);
2041                                 /* msleep(SURVEY_TO>>1); */
2042                                 issue_probereq(padapter, NULL, NULL);
2043                         }
2044
2045                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
2046                                 /* todo: to issue two probe req??? */
2047                                 issue_probereq(padapter, NULL, NULL);
2048                                 /* msleep(SURVEY_TO>>1); */
2049                                 issue_probereq(padapter, NULL, NULL);
2050                         }
2051                 }
2052
2053                 set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
2054         } else {
2055
2056                 /*  20100721:Interrupt scan operation here. */
2057                 /*  For SW antenna diversity before link, it needs to switch to another antenna and scan again. */
2058                 /*  It compares the scan result and select better one to do connection. */
2059                 if (rtw_hal_antdiv_before_linked(padapter)) {
2060                         pmlmeext->sitesurvey_res.bss_cnt = 0;
2061                         pmlmeext->sitesurvey_res.channel_idx = -1;
2062                         pmlmeext->chan_scan_time = SURVEY_TO / 2;
2063                         set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
2064                         return;
2065                 }
2066
2067                 pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
2068
2069                 /* switch back to the original channel */
2070
2071                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2072
2073                 /* flush 4-AC Queue after site_survey */
2074                 /* val8 = 0; */
2075                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
2076
2077                 /* config MSR */
2078                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2079
2080                 initialgain = 0xff; /* restore RX GAIN */
2081                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
2082                 /* turn on dynamic functions */
2083                 Restore_DM_Func_Flag(padapter);
2084                 /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
2085
2086                 if (is_client_associated_to_ap(padapter))
2087                         issue_nulldata(padapter, NULL, 0, 3, 500);
2088
2089                 val8 = 0; /* survey done */
2090                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
2091
2092                 report_surveydone_event(padapter);
2093
2094                 pmlmeext->chan_scan_time = SURVEY_TO;
2095                 pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
2096
2097                 issue_action_BSSCoexistPacket(padapter);
2098                 issue_action_BSSCoexistPacket(padapter);
2099                 issue_action_BSSCoexistPacket(padapter);
2100         }
2101         return;
2102 }
2103
2104 /* collect bss info from Beacon and Probe request/response frames. */
2105 static u8 collect_bss_info(struct adapter *padapter,
2106                            struct recv_frame *precv_frame,
2107                            struct wlan_bssid_ex *bssid)
2108 {
2109         int     i;
2110         u32     len;
2111         u8 *p;
2112         u16 val16, subtype;
2113         u8 *pframe = precv_frame->rx_data;
2114         u32     packet_len = precv_frame->len;
2115         u8 ie_offset;
2116         struct registry_priv    *pregistrypriv = &padapter->registrypriv;
2117         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2118         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2119
2120         len = packet_len - sizeof(struct rtw_ieee80211_hdr_3addr);
2121
2122         if (len > MAX_IE_SZ)
2123                 return _FAIL;
2124
2125         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
2126
2127         subtype = GetFrameSubType(pframe);
2128
2129         if (subtype == WIFI_BEACON) {
2130                 bssid->Reserved[0] = 1;
2131                 ie_offset = _BEACON_IE_OFFSET_;
2132         } else {
2133                 /*  FIXME : more type */
2134                 if (subtype == WIFI_PROBEREQ) {
2135                         ie_offset = _PROBEREQ_IE_OFFSET_;
2136                         bssid->Reserved[0] = 2;
2137                 } else if (subtype == WIFI_PROBERSP) {
2138                         ie_offset = _PROBERSP_IE_OFFSET_;
2139                         bssid->Reserved[0] = 3;
2140                 } else {
2141                         bssid->Reserved[0] = 0;
2142                         ie_offset = _FIXED_IE_LENGTH_;
2143                 }
2144         }
2145
2146         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
2147
2148         /* below is to copy the information element */
2149         bssid->IELength = len;
2150         memcpy(bssid->IEs, (pframe + sizeof(struct rtw_ieee80211_hdr_3addr)), bssid->IELength);
2151
2152         /* get the signal strength in dBM.raw data */
2153         bssid->Rssi = precv_frame->attrib.phy_info.recvpower;
2154         bssid->PhyInfo.SignalQuality = precv_frame->attrib.phy_info.SignalQuality;/* in percentage */
2155         bssid->PhyInfo.SignalStrength = precv_frame->attrib.phy_info.SignalStrength;/* in percentage */
2156         rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
2157
2158         /*  checking SSID */
2159         p = rtw_get_ie(bssid->IEs + ie_offset, _SSID_IE_, &len, bssid->IELength - ie_offset);
2160         if (p == NULL) {
2161                 DBG_88E("marc: cannot find SSID for survey event\n");
2162                 return _FAIL;
2163         }
2164
2165         if (len) {
2166                 if (len > NDIS_802_11_LENGTH_SSID) {
2167                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2168                         return _FAIL;
2169                 }
2170                 memcpy(bssid->Ssid.Ssid, (p + 2), len);
2171                 bssid->Ssid.SsidLength = len;
2172         } else {
2173                 bssid->Ssid.SsidLength = 0;
2174         }
2175
2176         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
2177
2178         /* checking rate info... */
2179         i = 0;
2180         p = rtw_get_ie(bssid->IEs + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2181         if (p != NULL) {
2182                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
2183                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2184                         return _FAIL;
2185                 }
2186                 memcpy(bssid->SupportedRates, (p + 2), len);
2187                 i = len;
2188         }
2189
2190         p = rtw_get_ie(bssid->IEs + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2191         if (p != NULL) {
2192                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i)) {
2193                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2194                         return _FAIL;
2195                 }
2196                 memcpy(bssid->SupportedRates + i, (p + 2), len);
2197         }
2198
2199         /* todo: */
2200         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
2201
2202         if (bssid->IELength < 12)
2203                 return _FAIL;
2204
2205         /*  Checking for DSConfig */
2206         p = rtw_get_ie(bssid->IEs + ie_offset, _DSSET_IE_, &len, bssid->IELength - ie_offset);
2207
2208         bssid->Configuration.DSConfig = 0;
2209         bssid->Configuration.Length = 0;
2210
2211         if (p) {
2212                 bssid->Configuration.DSConfig = *(p + 2);
2213         } else {/*  In 5G, some ap do not have DSSET IE */
2214                 /*  checking HT info for channel */
2215                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->IELength - ie_offset);
2216                 if (p) {
2217                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
2218                         bssid->Configuration.DSConfig = HT_info->primary_channel;
2219                 } else { /*  use current channel */
2220                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
2221                 }
2222         }
2223
2224         if (subtype == WIFI_PROBEREQ) {
2225                 /*  FIXME */
2226                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2227                 memcpy(bssid->MacAddress, GetAddr2Ptr(pframe), ETH_ALEN);
2228                 bssid->Privacy = 1;
2229                 return _SUCCESS;
2230         }
2231
2232         bssid->Configuration.BeaconPeriod =
2233                 get_unaligned_le16(rtw_get_beacon_interval_from_ie(bssid->IEs));
2234
2235         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
2236
2237         if (val16 & BIT(0)) {
2238                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2239                 memcpy(bssid->MacAddress, GetAddr2Ptr(pframe), ETH_ALEN);
2240         } else {
2241                 bssid->InfrastructureMode = Ndis802_11IBSS;
2242                 memcpy(bssid->MacAddress, GetAddr3Ptr(pframe), ETH_ALEN);
2243         }
2244
2245         if (val16 & BIT(4))
2246                 bssid->Privacy = 1;
2247         else
2248                 bssid->Privacy = 0;
2249
2250         bssid->Configuration.ATIMWindow = 0;
2251
2252         /* 20/40 BSS Coexistence check */
2253         if ((pregistrypriv->wifi_spec == 1) && (!pmlmeinfo->bwmode_updated)) {
2254                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2255                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->IELength - ie_offset);
2256                 if (p && len > 0) {
2257                         struct HT_caps_element  *pHT_caps;
2258                         pHT_caps = (struct HT_caps_element *)(p + 2);
2259
2260                         if (le16_to_cpu(pHT_caps->u.HT_cap_element.HT_caps_info)&BIT(14))
2261                                 pmlmepriv->num_FortyMHzIntolerant++;
2262                 } else {
2263                         pmlmepriv->num_sta_no_ht++;
2264                 }
2265         }
2266
2267         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
2268         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
2269                 bssid->PhyInfo.SignalQuality = 101;
2270         return _SUCCESS;
2271 }
2272
2273 static void start_create_ibss(struct adapter *padapter)
2274 {
2275         unsigned short  caps;
2276         u8 val8;
2277         u8 join_type;
2278         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2279         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2280         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2281         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2282         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2283
2284         /* update wireless mode */
2285         update_wireless_mode(padapter);
2286
2287         /* update capability */
2288         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2289         update_capinfo(padapter, caps);
2290         if (caps&cap_IBSS) {/* adhoc master */
2291                 val8 = 0xcf;
2292                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2293
2294                 /* switch channel */
2295                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
2296                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2297
2298                 beacon_timing_control(padapter);
2299
2300                 /* set msr to WIFI_FW_ADHOC_STATE */
2301                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2302                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2303
2304                 /* issue beacon */
2305                 if (send_beacon(padapter) == _FAIL) {
2306                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
2307
2308                         report_join_res(padapter, -1);
2309                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2310                 } else {
2311                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
2312                         join_type = 0;
2313                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
2314
2315                         report_join_res(padapter, 1);
2316                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
2317                 }
2318         } else {
2319                 DBG_88E("start_create_ibss, invalid cap:%x\n", caps);
2320                 return;
2321         }
2322 }
2323
2324 static void start_clnt_join(struct adapter *padapter)
2325 {
2326         unsigned short  caps;
2327         u8 val8;
2328         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2329         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2330         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2331         int beacon_timeout;
2332
2333         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2334         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2335
2336         /* update wireless mode */
2337         update_wireless_mode(padapter);
2338
2339         /* update capability */
2340         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2341         update_capinfo(padapter, caps);
2342         if (caps&cap_ESS) {
2343                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
2344
2345                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
2346
2347                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2348
2349                 /* switch channel */
2350                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2351
2352                 /* here wait for receiving the beacon to start auth */
2353                 /* and enable a timer */
2354                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
2355                 set_link_timer(pmlmeext, beacon_timeout);
2356                 mod_timer(&padapter->mlmepriv.assoc_timer, jiffies +
2357                           msecs_to_jiffies((REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO * REASSOC_LIMIT) + beacon_timeout));
2358
2359                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
2360         } else if (caps&cap_IBSS) { /* adhoc client */
2361                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
2362
2363                 val8 = 0xcf;
2364                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2365
2366                 /* switch channel */
2367                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2368
2369                 beacon_timing_control(padapter);
2370
2371                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2372
2373                 report_join_res(padapter, 1);
2374         } else {
2375                 return;
2376         }
2377 }
2378
2379 static void start_clnt_auth(struct adapter *padapter)
2380 {
2381         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2382         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2383
2384         del_timer_sync(&pmlmeext->link_timer);
2385
2386         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
2387         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
2388
2389         pmlmeinfo->auth_seq = 1;
2390         pmlmeinfo->reauth_count = 0;
2391         pmlmeinfo->reassoc_count = 0;
2392         pmlmeinfo->link_count = 0;
2393         pmlmeext->retry = 0;
2394
2395
2396         /*  Because of AP's not receiving deauth before */
2397         /*  AP may: 1)not response auth or 2)deauth us after link is complete */
2398         /*  issue deauth before issuing auth to deal with the situation */
2399         /*      Commented by Albert 2012/07/21 */
2400         /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
2401         issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
2402
2403         DBG_88E_LEVEL(_drv_info_, "start auth\n");
2404         issue_auth(padapter, NULL, 0);
2405
2406         set_link_timer(pmlmeext, REAUTH_TO);
2407 }
2408
2409
2410 static void start_clnt_assoc(struct adapter *padapter)
2411 {
2412         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2413         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2414
2415         del_timer_sync(&pmlmeext->link_timer);
2416
2417         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
2418         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
2419
2420         issue_assocreq(padapter);
2421
2422         set_link_timer(pmlmeext, REASSOC_TO);
2423 }
2424
2425 static unsigned int receive_disconnect(struct adapter *padapter,
2426                                        unsigned char *MacAddr,
2427                                        unsigned short reason)
2428 {
2429         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2430         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2431         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
2432
2433         /* check A3 */
2434         if (memcmp(MacAddr, pnetwork->MacAddress, ETH_ALEN))
2435                 return _SUCCESS;
2436
2437         DBG_88E("%s\n", __func__);
2438
2439         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
2440                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
2441                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2442                         report_del_sta_event(padapter, MacAddr, reason);
2443                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
2444                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2445                         report_join_res(padapter, -2);
2446                 }
2447         }
2448         return _SUCCESS;
2449 }
2450
2451 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
2452 {
2453         struct registry_priv *pregistrypriv;
2454         struct mlme_ext_priv *pmlmeext;
2455         struct rt_channel_info *chplan_new;
2456         u8 channel;
2457         u8 i;
2458
2459         pregistrypriv = &padapter->registrypriv;
2460         pmlmeext = &padapter->mlmeextpriv;
2461
2462         /*  Adjust channel plan by AP Country IE */
2463         if (pregistrypriv->enable80211d &&
2464             (!pmlmeext->update_channel_plan_by_ap_done)) {
2465                 u8 *ie, *p;
2466                 u32 len;
2467                 struct rt_channel_plan chplan_ap;
2468                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
2469                 u8 country[4];
2470                 u8 fcn; /*  first channel number */
2471                 u8 noc; /*  number of channel */
2472                 u8 j, k;
2473
2474                 ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
2475                 if (!ie)
2476                         return;
2477                 if (len < 6)
2478                         return;
2479                 ie += 2;
2480                 p = ie;
2481                 ie += len;
2482
2483                 memset(country, 0, 4);
2484                 memcpy(country, p, 3);
2485                 p += 3;
2486                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2487                          ("%s: 802.11d country =%s\n", __func__, country));
2488
2489                 i = 0;
2490                 while ((ie - p) >= 3) {
2491                         fcn = *(p++);
2492                         noc = *(p++);
2493                         p++;
2494
2495                         for (j = 0; j < noc; j++) {
2496                                 if (fcn <= 14)
2497                                         channel = fcn + j; /*  2.4 GHz */
2498                                 else
2499                                         channel = fcn + j*4; /*  5 GHz */
2500
2501                                 chplan_ap.Channel[i++] = channel;
2502                         }
2503                 }
2504                 chplan_ap.Len = i;
2505
2506                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
2507
2508                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
2509                 chplan_new = pmlmeext->channel_set;
2510
2511                 i = 0;
2512                 j = 0;
2513                 k = 0;
2514                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
2515                         do {
2516                                 if ((i == MAX_CHANNEL_NUM) ||
2517                                     (chplan_sta[i].ChannelNum == 0) ||
2518                                     (chplan_sta[i].ChannelNum > 14))
2519                                         break;
2520
2521                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
2522                                         break;
2523
2524                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
2525                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2526                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2527                                         i++;
2528                                         j++;
2529                                         k++;
2530                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
2531                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2532                                         chplan_new[k].ScanType = SCAN_PASSIVE;
2533                                         i++;
2534                                         k++;
2535                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
2536                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2537                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2538                                         j++;
2539                                         k++;
2540                                 }
2541                         } while (1);
2542
2543                         /*  change AP not support channel to Passive scan */
2544                         while ((i < MAX_CHANNEL_NUM) &&
2545                                (chplan_sta[i].ChannelNum != 0) &&
2546                                (chplan_sta[i].ChannelNum <= 14)) {
2547                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2548                                 chplan_new[k].ScanType = SCAN_PASSIVE;
2549                                 i++;
2550                                 k++;
2551                         }
2552
2553                         /*  add channel AP supported */
2554                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
2555                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2556                                 chplan_new[k].ScanType = SCAN_ACTIVE;
2557                                 j++;
2558                                 k++;
2559                         }
2560                 } else {
2561                         /*  keep original STA 2.4G channel plan */
2562                         while ((i < MAX_CHANNEL_NUM) &&
2563                                (chplan_sta[i].ChannelNum != 0) &&
2564                                (chplan_sta[i].ChannelNum <= 14)) {
2565                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2566                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
2567                                 i++;
2568                                 k++;
2569                         }
2570
2571                         /*  skip AP 2.4G channel plan */
2572                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
2573                                 j++;
2574                 }
2575
2576                 /*  keep original STA 5G channel plan */
2577                 while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
2578                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2579                         chplan_new[k].ScanType = chplan_sta[i].ScanType;
2580                         i++;
2581                         k++;
2582                 }
2583
2584                 pmlmeext->update_channel_plan_by_ap_done = 1;
2585         }
2586
2587         /*  If channel is used by AP, set channel scan type to active */
2588         channel = bssid->Configuration.DSConfig;
2589         chplan_new = pmlmeext->channel_set;
2590         i = 0;
2591         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
2592                 if (chplan_new[i].ChannelNum == channel) {
2593                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
2594                                 chplan_new[i].ScanType = SCAN_ACTIVE;
2595                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2596                                          ("%s: change channel %d scan type from passive to active\n",
2597                                          __func__, channel));
2598                         }
2599                         break;
2600                 }
2601                 i++;
2602         }
2603 }
2604
2605 /****************************************************************************
2606
2607 Following are the callback functions for each subtype of the management frames
2608
2609 *****************************************************************************/
2610
2611 static unsigned int OnProbeReq(struct adapter *padapter,
2612                                struct recv_frame *precv_frame)
2613 {
2614         unsigned int    ielen;
2615         unsigned char   *p;
2616         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2617         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2618         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2619         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2620         u8 *pframe = precv_frame->rx_data;
2621         uint len = precv_frame->len;
2622
2623         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
2624                 return _SUCCESS;
2625
2626         if (!check_fwstate(pmlmepriv, _FW_LINKED) &&
2627             !check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
2628                 return _SUCCESS;
2629
2630         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ielen,
2631                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
2632
2633         /* check (wildcard) SSID */
2634         if (p != NULL) {
2635                 if ((ielen != 0 && memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength)) ||
2636                     (ielen == 0 && pmlmeinfo->hidden_ssid_mode))
2637                         return _SUCCESS;
2638
2639                 if (check_fwstate(pmlmepriv, _FW_LINKED) &&
2640                     pmlmepriv->cur_network.join_res)
2641                         issue_probersp(padapter, get_sa(pframe));
2642         }
2643         return _SUCCESS;
2644 }
2645
2646 static unsigned int OnProbeRsp(struct adapter *padapter,
2647                                struct recv_frame *precv_frame)
2648 {
2649         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2650
2651         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2652                 report_survey_event(padapter, precv_frame);
2653                 return _SUCCESS;
2654         }
2655
2656         return _SUCCESS;
2657 }
2658
2659 static unsigned int OnBeacon(struct adapter *padapter,
2660                              struct recv_frame *precv_frame)
2661 {
2662         int cam_idx;
2663         struct sta_info *psta;
2664         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2665         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2666         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2667         struct sta_priv *pstapriv = &padapter->stapriv;
2668         u8 *pframe = precv_frame->rx_data;
2669         uint len = precv_frame->len;
2670         struct wlan_bssid_ex *pbss;
2671         int ret = _SUCCESS;
2672         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2673
2674         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2675                 report_survey_event(padapter, precv_frame);
2676                 return _SUCCESS;
2677         }
2678
2679         if (!memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN)) {
2680                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
2681                         /* we should update current network before auth, or some IE is wrong */
2682                         pbss = (struct wlan_bssid_ex *)rtw_malloc(sizeof(struct wlan_bssid_ex));
2683                         if (pbss) {
2684                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
2685                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
2686                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
2687                                 }
2688                                 kfree(pbss);
2689                         }
2690
2691                         /* check the vendor of the assoc AP */
2692                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct rtw_ieee80211_hdr_3addr), len-sizeof(struct rtw_ieee80211_hdr_3addr));
2693
2694                         /* update TSF Value */
2695                         update_TSF(pmlmeext, pframe, len);
2696
2697                         /* start auth */
2698                         start_clnt_auth(padapter);
2699
2700                         return _SUCCESS;
2701                 }
2702
2703                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
2704                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2705                         if (psta != NULL) {
2706                                 ret = rtw_check_bcn_info(padapter, pframe, len);
2707                                 if (!ret) {
2708                                                 DBG_88E_LEVEL(_drv_info_, "ap has changed, disconnect now\n ");
2709                                                 receive_disconnect(padapter, pmlmeinfo->network.MacAddress , 65535);
2710                                                 return _SUCCESS;
2711                                 }
2712                                 /* update WMM, ERP in the beacon */
2713                                 /* todo: the timer is used instead of the number of the beacon received */
2714                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2715                                         update_beacon_info(padapter, pframe, len, psta);
2716                         }
2717                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2718                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2719                         if (psta != NULL) {
2720                                 /* update WMM, ERP in the beacon */
2721                                 /* todo: the timer is used instead of the number of the beacon received */
2722                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2723                                         update_beacon_info(padapter, pframe, len, psta);
2724                         } else {
2725                                 /* allocate a new CAM entry for IBSS station */
2726                                 cam_idx = allocate_fw_sta_entry(padapter);
2727                                 if (cam_idx == NUM_STA)
2728                                         goto _END_ONBEACON_;
2729
2730                                 /* get supported rate */
2731                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
2732                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
2733                                         goto _END_ONBEACON_;
2734                                 }
2735
2736                                 /* update TSF Value */
2737                                 update_TSF(pmlmeext, pframe, len);
2738
2739                                 /* report sta add event */
2740                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
2741                         }
2742                 }
2743         }
2744
2745 _END_ONBEACON_:
2746
2747         return _SUCCESS;
2748 }
2749
2750 #ifdef CONFIG_88EU_AP_MODE
2751 static unsigned int OnAuth(struct adapter *padapter,
2752                            struct recv_frame *precv_frame)
2753 {
2754         unsigned int    auth_mode, ie_len;
2755         u16 seq;
2756         unsigned char   *sa, *p;
2757         u16 algorithm;
2758         int     status;
2759         static struct sta_info stat;
2760         struct  sta_info        *pstat = NULL;
2761         struct  sta_priv *pstapriv = &padapter->stapriv;
2762         struct security_priv *psecuritypriv = &padapter->securitypriv;
2763         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2764         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2765         u8 *pframe = precv_frame->rx_data;
2766         uint len = precv_frame->len;
2767
2768         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2769                 return _FAIL;
2770
2771         DBG_88E("+OnAuth\n");
2772
2773         sa = GetAddr2Ptr(pframe);
2774
2775         auth_mode = psecuritypriv->dot11AuthAlgrthm;
2776         seq = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + 2));
2777         algorithm = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN));
2778
2779         DBG_88E("auth alg=%x, seq=%X\n", algorithm, seq);
2780
2781         if (auth_mode == 2 && psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
2782             psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
2783                 auth_mode = 0;
2784
2785         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
2786             (algorithm == 0 && auth_mode == 1)) {       /*  rx a open-system auth but shared-key is enabled */
2787                 DBG_88E("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
2788                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
2789
2790                 status = _STATS_NO_SUPP_ALG_;
2791
2792                 goto auth_fail;
2793         }
2794
2795         if (!rtw_access_ctrl(padapter, sa)) {
2796                 status = _STATS_UNABLE_HANDLE_STA_;
2797                 goto auth_fail;
2798         }
2799
2800         pstat = rtw_get_stainfo(pstapriv, sa);
2801         if (pstat == NULL) {
2802                 /*  allocate a new one */
2803                 DBG_88E("going to alloc stainfo for sa=%pM\n", sa);
2804                 pstat = rtw_alloc_stainfo(pstapriv, sa);
2805                 if (pstat == NULL) {
2806                         DBG_88E(" Exceed the upper limit of supported clients...\n");
2807                         status = _STATS_UNABLE_HANDLE_STA_;
2808                         goto auth_fail;
2809                 }
2810
2811                 pstat->state = WIFI_FW_AUTH_NULL;
2812                 pstat->auth_seq = 0;
2813         } else {
2814                 spin_lock_bh(&pstapriv->asoc_list_lock);
2815                 if (!list_empty(&pstat->asoc_list)) {
2816                         list_del_init(&pstat->asoc_list);
2817                         pstapriv->asoc_list_cnt--;
2818                 }
2819                 spin_unlock_bh(&pstapriv->asoc_list_lock);
2820
2821                 if (seq == 1) {
2822                         /* TODO: STA re_auth and auth timeout */
2823                 }
2824         }
2825
2826         spin_lock_bh(&pstapriv->auth_list_lock);
2827         if (list_empty(&pstat->auth_list)) {
2828                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
2829                 pstapriv->auth_list_cnt++;
2830         }
2831         spin_unlock_bh(&pstapriv->auth_list_lock);
2832
2833         if (pstat->auth_seq == 0)
2834                 pstat->expire_to = pstapriv->auth_to;
2835
2836         if ((pstat->auth_seq + 1) != seq) {
2837                 DBG_88E("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2838                         seq, pstat->auth_seq+1);
2839                 status = _STATS_OUT_OF_AUTH_SEQ_;
2840                 goto auth_fail;
2841         }
2842
2843         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2)) {
2844                 if (seq == 1) {
2845                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2846                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
2847                         pstat->expire_to = pstapriv->assoc_to;
2848                         pstat->authalg = algorithm;
2849                 } else {
2850                         DBG_88E("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2851                                 seq, pstat->auth_seq+1);
2852                         status = _STATS_OUT_OF_AUTH_SEQ_;
2853                         goto auth_fail;
2854                 }
2855         } else { /*  shared system or auto authentication */
2856                 if (seq == 1) {
2857                         /* prepare for the challenging txt... */
2858
2859                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2860                         pstat->state |= WIFI_FW_AUTH_STATE;
2861                         pstat->authalg = algorithm;
2862                         pstat->auth_seq = 2;
2863                 } else if (seq == 3) {
2864                         /* checking for challenging txt... */
2865                         DBG_88E("checking for challenging txt...\n");
2866
2867                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_ , _CHLGETXT_IE_, (int *)&ie_len,
2868                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
2869
2870                         if ((p == NULL) || (ie_len <= 0)) {
2871                                 DBG_88E("auth rejected because challenge failure!(1)\n");
2872                                 status = _STATS_CHALLENGE_FAIL_;
2873                                 goto auth_fail;
2874                         }
2875
2876                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
2877                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
2878                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
2879                                 /*  challenging txt is correct... */
2880                                 pstat->expire_to =  pstapriv->assoc_to;
2881                         } else {
2882                                 DBG_88E("auth rejected because challenge failure!\n");
2883                                 status = _STATS_CHALLENGE_FAIL_;
2884                                 goto auth_fail;
2885                         }
2886                 } else {
2887                         DBG_88E("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2888                                 seq, pstat->auth_seq+1);
2889                         status = _STATS_OUT_OF_AUTH_SEQ_;
2890                         goto auth_fail;
2891                 }
2892         }
2893
2894         /*  Now, we are going to issue_auth... */
2895         pstat->auth_seq = seq + 1;
2896
2897         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
2898
2899         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
2900                 pstat->auth_seq = 0;
2901
2902         return _SUCCESS;
2903
2904 auth_fail:
2905
2906         if (pstat)
2907                 rtw_free_stainfo(padapter, pstat);
2908
2909         pstat = &stat;
2910         memset((char *)pstat, '\0', sizeof(stat));
2911         pstat->auth_seq = 2;
2912         memcpy(pstat->hwaddr, sa, 6);
2913
2914         issue_auth(padapter, pstat, (unsigned short)status);
2915
2916         return _FAIL;
2917 }
2918 #endif /* CONFIG_88EU_AP_MODE */
2919
2920 static unsigned int OnAuthClient(struct adapter *padapter,
2921                                  struct recv_frame *precv_frame)
2922 {
2923         unsigned int    seq, len, status, offset;
2924         unsigned char   *p;
2925         unsigned int    go2asoc = 0;
2926         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2927         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2928         u8 *pframe = precv_frame->rx_data;
2929         uint pkt_len = precv_frame->len;
2930
2931         DBG_88E("%s\n", __func__);
2932
2933         /* check A1 matches or not */
2934         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
2935                 return _SUCCESS;
2936
2937         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
2938                 return _SUCCESS;
2939
2940         offset = (GetPrivacy(pframe)) ? 4 : 0;
2941
2942         seq     = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 2));
2943         status  = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 4));
2944
2945         if (status != 0) {
2946                 DBG_88E("clnt auth fail, status: %d\n", status);
2947                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
2948                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2949                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
2950                         else
2951                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
2952                 }
2953
2954                 set_link_timer(pmlmeext, 1);
2955                 goto authclnt_fail;
2956         }
2957
2958         if (seq == 2) {
2959                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
2960                         /*  legendary shared system */
2961                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&len,
2962                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
2963
2964                         if (p == NULL)
2965                                 goto authclnt_fail;
2966
2967                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
2968                         pmlmeinfo->auth_seq = 3;
2969                         issue_auth(padapter, NULL, 0);
2970                         set_link_timer(pmlmeext, REAUTH_TO);
2971
2972                         return _SUCCESS;
2973                 } else {
2974                         /*  open system */
2975                         go2asoc = 1;
2976                 }
2977         } else if (seq == 4) {
2978                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2979                         go2asoc = 1;
2980                 else
2981                         goto authclnt_fail;
2982         } else {
2983                 /*  this is also illegal */
2984                 goto authclnt_fail;
2985         }
2986
2987         if (go2asoc) {
2988                 DBG_88E_LEVEL(_drv_info_, "auth success, start assoc\n");
2989                 start_clnt_assoc(padapter);
2990                 return _SUCCESS;
2991         }
2992 authclnt_fail:
2993         return _FAIL;
2994 }
2995
2996 static unsigned int OnAssocReq(struct adapter *padapter,
2997                                struct recv_frame *precv_frame)
2998 {
2999 #ifdef CONFIG_88EU_AP_MODE
3000         u16 capab_info;
3001         struct rtw_ieee802_11_elems elems;
3002         struct sta_info *pstat;
3003         unsigned char           reassoc, *p, *pos, *wpa_ie;
3004         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
3005         int             i, ie_len, wpa_ie_len, left;
3006         unsigned char           supportRate[16];
3007         int                                     supportRateNum;
3008         unsigned short          status = _STATS_SUCCESSFUL_;
3009         unsigned short          frame_type, ie_offset = 0;
3010         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3011         struct security_priv *psecuritypriv = &padapter->securitypriv;
3012         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3013         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3014         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
3015         struct sta_priv *pstapriv = &padapter->stapriv;
3016         u8 *pframe = precv_frame->rx_data;
3017         uint pkt_len = precv_frame->len;
3018
3019         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3020                 return _FAIL;
3021
3022         frame_type = GetFrameSubType(pframe);
3023         if (frame_type == WIFI_ASSOCREQ) {
3024                 reassoc = 0;
3025                 ie_offset = _ASOCREQ_IE_OFFSET_;
3026         } else { /*  WIFI_REASSOCREQ */
3027                 reassoc = 1;
3028                 ie_offset = _REASOCREQ_IE_OFFSET_;
3029         }
3030
3031
3032         if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
3033                 DBG_88E("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
3034                        "\n", reassoc, (unsigned long)pkt_len);
3035                 return _FAIL;
3036         }
3037
3038         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3039         if (pstat == NULL) {
3040                 status = _RSON_CLS2_;
3041                 goto asoc_class2_error;
3042         }
3043
3044         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
3045
3046         left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
3047         pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
3048
3049
3050         DBG_88E("%s\n", __func__);
3051
3052         /*  check if this stat has been successfully authenticated/assocated */
3053         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
3054                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
3055                         status = _RSON_CLS2_;
3056                         goto asoc_class2_error;
3057                 } else {
3058                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
3059                         pstat->state |= WIFI_FW_ASSOC_STATE;
3060                 }
3061         } else {
3062                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
3063                 pstat->state |= WIFI_FW_ASSOC_STATE;
3064         }
3065         pstat->capability = capab_info;
3066         /* now parse all ieee802_11 ie to point to elems */
3067         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
3068             !elems.ssid) {
3069                 DBG_88E("STA %pM sent invalid association request\n",
3070                         pstat->hwaddr);
3071                 status = _STATS_FAILURE_;
3072                 goto OnAssocReqFail;
3073         }
3074
3075
3076         /*  now we should check all the fields... */
3077         /*  checking SSID */
3078         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
3079                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3080         if (p == NULL)
3081                 status = _STATS_FAILURE_;
3082
3083         if (ie_len == 0) { /*  broadcast ssid, however it is not allowed in assocreq */
3084                 status = _STATS_FAILURE_;
3085         } else {
3086                 /*  check if ssid match */
3087                 if (memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
3088                         status = _STATS_FAILURE_;
3089
3090                 if (ie_len != cur->Ssid.SsidLength)
3091                         status = _STATS_FAILURE_;
3092         }
3093
3094         if (_STATS_SUCCESSFUL_ != status)
3095                 goto OnAssocReqFail;
3096
3097         /*  check if the supported rate is ok */
3098         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3099         if (p == NULL) {
3100                 DBG_88E("Rx a sta assoc-req which supported rate is empty!\n");
3101                 /*  use our own rate set as statoin used */
3102                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
3103                 /* supportRateNum = AP_BSSRATE_LEN; */
3104
3105                 status = _STATS_FAILURE_;
3106                 goto OnAssocReqFail;
3107         } else {
3108                 memcpy(supportRate, p+2, ie_len);
3109                 supportRateNum = ie_len;
3110
3111                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_ , &ie_len,
3112                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3113                 if (p !=  NULL) {
3114                         if (supportRateNum <= sizeof(supportRate)) {
3115                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
3116                                 supportRateNum += ie_len;
3117                         }
3118                 }
3119         }
3120
3121         /* todo: mask supportRate between AP & STA -> move to update raid */
3122         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
3123
3124         /* update station supportRate */
3125         pstat->bssratelen = supportRateNum;
3126         memcpy(pstat->bssrateset, supportRate, supportRateNum);
3127         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
3128
3129         /* check RSN/WPA/WPS */
3130         pstat->dot8021xalg = 0;
3131         pstat->wpa_psk = 0;
3132         pstat->wpa_group_cipher = 0;
3133         pstat->wpa2_group_cipher = 0;
3134         pstat->wpa_pairwise_cipher = 0;
3135         pstat->wpa2_pairwise_cipher = 0;
3136         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
3137         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
3138                 int group_cipher = 0, pairwise_cipher = 0;
3139
3140                 wpa_ie = elems.rsn_ie;
3141                 wpa_ie_len = elems.rsn_ie_len;
3142
3143                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3144                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3145                         pstat->wpa_psk |= BIT(1);
3146
3147                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
3148                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
3149
3150                         if (!pstat->wpa2_group_cipher)
3151                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3152
3153                         if (!pstat->wpa2_pairwise_cipher)
3154                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3155                 } else {
3156                         status = WLAN_STATUS_INVALID_IE;
3157                 }
3158         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
3159                 int group_cipher = 0, pairwise_cipher = 0;
3160
3161                 wpa_ie = elems.wpa_ie;
3162                 wpa_ie_len = elems.wpa_ie_len;
3163
3164                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3165                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3166                         pstat->wpa_psk |= BIT(0);
3167
3168                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
3169                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
3170
3171                         if (!pstat->wpa_group_cipher)
3172                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3173
3174                         if (!pstat->wpa_pairwise_cipher)
3175                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3176                 } else {
3177                         status = WLAN_STATUS_INVALID_IE;
3178                 }
3179         } else {
3180                 wpa_ie = NULL;
3181                 wpa_ie_len = 0;
3182         }
3183
3184         if (_STATS_SUCCESSFUL_ != status)
3185                 goto OnAssocReqFail;
3186
3187         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
3188         if (wpa_ie == NULL) {
3189                 if (elems.wps_ie) {
3190                         DBG_88E("STA included WPS IE in "
3191                                    "(Re)Association Request - assume WPS is "
3192                                    "used\n");
3193                         pstat->flags |= WLAN_STA_WPS;
3194                         /* wpabuf_free(sta->wps_ie); */
3195                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
3196                         /*                              elems.wps_ie_len - 4); */
3197                 } else {
3198                         DBG_88E("STA did not include WPA/RSN IE "
3199                                    "in (Re)Association Request - possible WPS "
3200                                    "use\n");
3201                         pstat->flags |= WLAN_STA_MAYBE_WPS;
3202                 }
3203
3204
3205                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
3206                 /*  that the selected registrar of AP is _FLASE */
3207                 if ((psecuritypriv->wpa_psk > 0) && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
3208                         if (pmlmepriv->wps_beacon_ie) {
3209                                 u8 selected_registrar = 0;
3210
3211                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR , &selected_registrar, NULL);
3212
3213                                 if (!selected_registrar) {
3214                                         DBG_88E("selected_registrar is false , or AP is not ready to do WPS\n");
3215
3216                                         status = _STATS_UNABLE_HANDLE_STA_;
3217
3218                                         goto OnAssocReqFail;
3219                                 }
3220                         }
3221                 }
3222         } else {
3223                 int copy_len;
3224
3225                 if (psecuritypriv->wpa_psk == 0) {
3226                         DBG_88E("STA %pM: WPA/RSN IE in association "
3227                         "request, but AP don't support WPA/RSN\n", pstat->hwaddr);
3228
3229                         status = WLAN_STATUS_INVALID_IE;
3230
3231                         goto OnAssocReqFail;
3232                 }
3233
3234                 if (elems.wps_ie) {
3235                         DBG_88E("STA included WPS IE in "
3236                                    "(Re)Association Request - WPS is "
3237                                    "used\n");
3238                         pstat->flags |= WLAN_STA_WPS;
3239                         copy_len = 0;
3240                 } else {
3241                         copy_len = min_t(int, wpa_ie_len + 2, sizeof(pstat->wpa_ie));
3242                 }
3243                 if (copy_len > 0)
3244                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
3245         }
3246         /*  check if there is WMM IE & support WWM-PS */
3247         pstat->flags &= ~WLAN_STA_WME;
3248         pstat->qos_option = 0;
3249         pstat->qos_info = 0;
3250         pstat->has_legacy_ac = true;
3251         pstat->uapsd_vo = 0;
3252         pstat->uapsd_vi = 0;
3253         pstat->uapsd_be = 0;
3254         pstat->uapsd_bk = 0;
3255         if (pmlmepriv->qospriv.qos_option) {
3256                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
3257                 for (;;) {
3258                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3259                         if (p != NULL) {
3260                                 if (!memcmp(p+2, WMM_IE, 6)) {
3261                                         pstat->flags |= WLAN_STA_WME;
3262
3263                                         pstat->qos_option = 1;
3264                                         pstat->qos_info = *(p+8);
3265
3266                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
3267
3268                                         if ((pstat->qos_info&0xf) != 0xf)
3269                                                 pstat->has_legacy_ac = true;
3270                                         else
3271                                                 pstat->has_legacy_ac = false;
3272
3273                                         if (pstat->qos_info&0xf) {
3274                                                 if (pstat->qos_info&BIT(0))
3275                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
3276                                                 else
3277                                                         pstat->uapsd_vo = 0;
3278
3279                                                 if (pstat->qos_info&BIT(1))
3280                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
3281                                                 else
3282                                                         pstat->uapsd_vi = 0;
3283
3284                                                 if (pstat->qos_info&BIT(2))
3285                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
3286                                                 else
3287                                                         pstat->uapsd_bk = 0;
3288
3289                                                 if (pstat->qos_info&BIT(3))
3290                                                         pstat->uapsd_be = BIT(0)|BIT(1);
3291                                                 else
3292                                                         pstat->uapsd_be = 0;
3293                                         }
3294                                         break;
3295                                 }
3296                         } else {
3297                                 break;
3298                         }
3299                         p = p + ie_len + 2;
3300                 }
3301         }
3302
3303         /* save HT capabilities in the sta object */
3304         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct rtw_ieee80211_ht_cap));
3305         if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct rtw_ieee80211_ht_cap)) {
3306                 pstat->flags |= WLAN_STA_HT;
3307
3308                 pstat->flags |= WLAN_STA_WME;
3309
3310                 memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct rtw_ieee80211_ht_cap));
3311         } else {
3312                 pstat->flags &= ~WLAN_STA_HT;
3313         }
3314         if ((!pmlmepriv->htpriv.ht_option) && (pstat->flags&WLAN_STA_HT)) {
3315                 status = _STATS_FAILURE_;
3316                 goto OnAssocReqFail;
3317         }
3318
3319         if ((pstat->flags & WLAN_STA_HT) &&
3320             ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
3321             (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
3322                 DBG_88E("HT: %pM tried to "
3323                         "use TKIP with HT association\n", pstat->hwaddr);
3324
3325                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
3326                 /* goto OnAssocReqFail; */
3327         }
3328
3329         pstat->flags |= WLAN_STA_NONERP;
3330         for (i = 0; i < pstat->bssratelen; i++) {
3331                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
3332                         pstat->flags &= ~WLAN_STA_NONERP;
3333                         break;
3334                 }
3335         }
3336
3337         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3338                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
3339         else
3340                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3341
3342
3343
3344         if (status != _STATS_SUCCESSFUL_)
3345                 goto OnAssocReqFail;
3346
3347         /* TODO: identify_proprietary_vendor_ie(); */
3348         /*  Realtek proprietary IE */
3349         /*  identify if this is Broadcom sta */
3350         /*  identify if this is ralink sta */
3351         /*  Customer proprietary IE */
3352
3353         /* get a unique AID */
3354         if (pstat->aid > 0) {
3355                 DBG_88E("  old AID %d\n", pstat->aid);
3356         } else {
3357                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
3358                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
3359                                 break;
3360
3361                 /* if (pstat->aid > NUM_STA) { */
3362                 if (pstat->aid > pstapriv->max_num_sta) {
3363                         pstat->aid = 0;
3364
3365                         DBG_88E("  no room for more AIDs\n");
3366
3367                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3368
3369                         goto OnAssocReqFail;
3370                 } else {
3371                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
3372                         DBG_88E("allocate new AID=(%d)\n", pstat->aid);
3373                 }
3374         }
3375
3376         pstat->state &= (~WIFI_FW_ASSOC_STATE);
3377         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
3378
3379         spin_lock_bh(&pstapriv->auth_list_lock);
3380         if (!list_empty(&pstat->auth_list)) {
3381                 list_del_init(&pstat->auth_list);
3382                 pstapriv->auth_list_cnt--;
3383         }
3384         spin_unlock_bh(&pstapriv->auth_list_lock);
3385
3386         spin_lock_bh(&pstapriv->asoc_list_lock);
3387         if (list_empty(&pstat->asoc_list)) {
3388                 pstat->expire_to = pstapriv->expire_to;
3389                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
3390                 pstapriv->asoc_list_cnt++;
3391         }
3392         spin_unlock_bh(&pstapriv->asoc_list_lock);
3393
3394         /*  now the station is qualified to join our BSS... */
3395         if ((pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_ == status)) {
3396                 /* 1 bss_cap_update & sta_info_update */
3397                 bss_cap_update_on_sta_join(padapter, pstat);
3398                 sta_info_update(padapter, pstat);
3399
3400                 /* issue assoc rsp before notify station join event. */
3401                 if (frame_type == WIFI_ASSOCREQ)
3402                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3403                 else
3404                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3405
3406                 /* 2 - report to upper layer */
3407                 DBG_88E("indicate_sta_join_event to upper layer - hostapd\n");
3408                 rtw_indicate_sta_assoc_event(padapter, pstat);
3409
3410                 /* 3-(1) report sta add event */
3411                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
3412         }
3413
3414         return _SUCCESS;
3415
3416 asoc_class2_error:
3417
3418         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
3419
3420         return _FAIL;
3421
3422 OnAssocReqFail:
3423
3424         pstat->aid = 0;
3425         if (frame_type == WIFI_ASSOCREQ)
3426                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3427         else
3428                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3429
3430 #endif /* CONFIG_88EU_AP_MODE */
3431
3432         return _FAIL;
3433 }
3434
3435 static unsigned int OnAssocRsp(struct adapter *padapter,
3436                                struct recv_frame *precv_frame)
3437 {
3438         uint i;
3439         int res;
3440         unsigned short  status;
3441         struct ndis_802_11_var_ie *pIE;
3442         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3443         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3444         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3445         /* struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network); */
3446         u8 *pframe = precv_frame->rx_data;
3447         uint pkt_len = precv_frame->len;
3448
3449         DBG_88E("%s\n", __func__);
3450
3451         /* check A1 matches or not */
3452         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
3453                 return _SUCCESS;
3454
3455         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
3456                 return _SUCCESS;
3457
3458         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
3459                 return _SUCCESS;
3460
3461         del_timer_sync(&pmlmeext->link_timer);
3462
3463         /* status */
3464         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
3465         if (status > 0) {
3466                 DBG_88E("assoc reject, status code: %d\n", status);
3467                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
3468                 res = -4;
3469                 goto report_assoc_result;
3470         }
3471
3472         /* get capabilities */
3473         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3474
3475         /* set slot time */
3476         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
3477
3478         /* AID */
3479         pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
3480         res = pmlmeinfo->aid;
3481
3482         /* following are moved to join event callback function */
3483         /* to handle HT, WMM, rate adaptive, update MAC reg */
3484         /* for not to handle the synchronous IO in the tasklet */
3485         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
3486                 pIE = (struct ndis_802_11_var_ie *)(pframe + i);
3487
3488                 switch (pIE->ElementID) {
3489                 case _VENDOR_SPECIFIC_IE_:
3490                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6)) /* WMM */
3491                                 WMM_param_handler(padapter, pIE);
3492                         break;
3493                 case _HT_CAPABILITY_IE_:        /* HT caps */
3494                         HT_caps_handler(padapter, pIE);
3495                         break;
3496                 case _HT_EXTRA_INFO_IE_:        /* HT info */
3497                         HT_info_handler(padapter, pIE);
3498                         break;
3499                 case _ERPINFO_IE_:
3500                         ERP_IE_handler(padapter, pIE);
3501                 default:
3502                         break;
3503                 }
3504
3505                 i += (pIE->Length + 2);
3506         }
3507
3508         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
3509         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
3510
3511         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
3512
3513 report_assoc_result:
3514         if (res > 0) {
3515                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
3516         } else {
3517                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
3518         }
3519
3520         report_join_res(padapter, res);
3521
3522         return _SUCCESS;
3523 }
3524
3525 static unsigned int OnDeAuth(struct adapter *padapter,
3526                              struct recv_frame *precv_frame)
3527 {
3528         unsigned short  reason;
3529         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3530         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3531         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3532         u8 *pframe = precv_frame->rx_data;
3533         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3534
3535         /* check A3 */
3536         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3537                 return _SUCCESS;
3538
3539         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3540
3541         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3542
3543 #ifdef CONFIG_88EU_AP_MODE
3544         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3545                 struct sta_info *psta;
3546                 struct sta_priv *pstapriv = &padapter->stapriv;
3547
3548                 DBG_88E_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
3549                               reason, GetAddr2Ptr(pframe));
3550
3551                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3552                 if (psta) {
3553                         u8 updated = 0;
3554
3555                         spin_lock_bh(&pstapriv->asoc_list_lock);
3556                         if (!list_empty(&psta->asoc_list)) {
3557                                 list_del_init(&psta->asoc_list);
3558                                 pstapriv->asoc_list_cnt--;
3559                                 updated = ap_free_sta(padapter, psta, false, reason);
3560                         }
3561                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3562
3563                         associated_clients_update(padapter, updated);
3564                 }
3565
3566
3567                 return _SUCCESS;
3568         } else
3569 #endif
3570         {
3571                 DBG_88E_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM\n",
3572                               reason, GetAddr3Ptr(pframe));
3573
3574                 receive_disconnect(padapter, GetAddr3Ptr(pframe) , reason);
3575         }
3576         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3577         return _SUCCESS;
3578 }
3579
3580 static unsigned int OnDisassoc(struct adapter *padapter,
3581                                struct recv_frame *precv_frame)
3582 {
3583         u16 reason;
3584         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3585         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3586         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3587         u8 *pframe = precv_frame->rx_data;
3588         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3589
3590         /* check A3 */
3591         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3592                 return _SUCCESS;
3593
3594         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3595
3596         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3597
3598 #ifdef CONFIG_88EU_AP_MODE
3599         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3600                 struct sta_info *psta;
3601                 struct sta_priv *pstapriv = &padapter->stapriv;
3602
3603                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3604                               reason, GetAddr2Ptr(pframe));
3605
3606                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3607                 if (psta) {
3608                         u8 updated = 0;
3609
3610                         spin_lock_bh(&pstapriv->asoc_list_lock);
3611                         if (!list_empty(&psta->asoc_list)) {
3612                                 list_del_init(&psta->asoc_list);
3613                                 pstapriv->asoc_list_cnt--;
3614                                 updated = ap_free_sta(padapter, psta, false, reason);
3615                         }
3616                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3617
3618                         associated_clients_update(padapter, updated);
3619                 }
3620
3621                 return _SUCCESS;
3622         } else
3623 #endif
3624         {
3625                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3626                               reason, GetAddr3Ptr(pframe));
3627
3628                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3629         }
3630         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3631         return _SUCCESS;
3632 }
3633
3634 static unsigned int OnAtim(struct adapter *padapter,
3635                            struct recv_frame *precv_frame)
3636 {
3637         DBG_88E("%s\n", __func__);
3638         return _SUCCESS;
3639 }
3640
3641 static unsigned int on_action_spct(struct adapter *padapter,
3642                                    struct recv_frame *precv_frame)
3643 {
3644         struct sta_info *psta = NULL;
3645         struct sta_priv *pstapriv = &padapter->stapriv;
3646         u8 *pframe = precv_frame->rx_data;
3647         u8 *frame_body = (u8 *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
3648         u8 category;
3649         u8 action;
3650
3651         DBG_88E(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
3652
3653         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3654
3655         if (!psta)
3656                 goto exit;
3657
3658         category = frame_body[0];
3659         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
3660                 goto exit;
3661
3662         action = frame_body[1];
3663         switch (action) {
3664         case RTW_WLAN_ACTION_SPCT_MSR_REQ:
3665         case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
3666         case RTW_WLAN_ACTION_SPCT_TPC_REQ:
3667         case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
3668                 break;
3669         case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
3670                 break;
3671         default:
3672                 break;
3673         }
3674
3675 exit:
3676         return _FAIL;
3677 }
3678
3679 static unsigned int OnAction_qos(struct adapter *padapter,
3680                                  struct recv_frame *precv_frame)
3681 {
3682         return _SUCCESS;
3683 }
3684
3685 static unsigned int OnAction_dls(struct adapter *padapter,
3686                                  struct recv_frame *precv_frame)
3687 {
3688         return _SUCCESS;
3689 }
3690
3691 static unsigned int OnAction_back(struct adapter *padapter,
3692                                   struct recv_frame *precv_frame)
3693 {
3694         u8 *addr;
3695         struct sta_info *psta = NULL;
3696         struct recv_reorder_ctrl *preorder_ctrl;
3697         unsigned char           *frame_body;
3698         unsigned char           category, action;
3699         unsigned short  tid, status, reason_code = 0;
3700         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3701         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3702         u8 *pframe = precv_frame->rx_data;
3703         struct sta_priv *pstapriv = &padapter->stapriv;
3704         /* check RA matches or not */
3705         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe),
3706                    ETH_ALEN))/* for if1, sta/ap mode */
3707                 return _SUCCESS;
3708
3709         DBG_88E("%s\n", __func__);
3710
3711         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3712                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3713                         return _SUCCESS;
3714
3715         addr = GetAddr2Ptr(pframe);
3716         psta = rtw_get_stainfo(pstapriv, addr);
3717
3718         if (psta == NULL)
3719                 return _SUCCESS;
3720
3721         frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
3722
3723         category = frame_body[0];
3724         if (category == RTW_WLAN_CATEGORY_BACK) { /*  representing Block Ack */
3725                 if (!pmlmeinfo->HT_enable)
3726                         return _SUCCESS;
3727                 action = frame_body[1];
3728                 DBG_88E("%s, action=%d\n", __func__, action);
3729                 switch (action) {
3730                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
3731                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
3732                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
3733
3734                         if (pmlmeinfo->bAcceptAddbaReq)
3735                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 0);
3736                         else
3737                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 37);/* reject ADDBA Req */
3738                         break;
3739                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
3740                         status = get_unaligned_le16(&frame_body[3]);
3741                         tid = (frame_body[5] >> 2) & 0x7;
3742                         if (status == 0) {      /* successful */
3743                                 DBG_88E("agg_enable for TID=%d\n", tid);
3744                                 psta->htpriv.agg_enable_bitmap |= 1 << tid;
3745                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3746                         } else {
3747                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3748                         }
3749                         break;
3750                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
3751                         if ((frame_body[3] & BIT(3)) == 0) {
3752                                 psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3753                                 psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3754                                 reason_code = get_unaligned_le16(&frame_body[4]);
3755                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
3756                                 tid = (frame_body[3] >> 4) & 0x0F;
3757                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
3758                                 preorder_ctrl->enable = false;
3759                                 preorder_ctrl->indicate_seq = 0xffff;
3760                         }
3761                         DBG_88E("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
3762                         /* todo: how to notify the host while receiving DELETE BA */
3763                         break;
3764                 default:
3765                         break;
3766                 }
3767         }
3768         return _SUCCESS;
3769 }
3770
3771 static s32 rtw_action_public_decache(struct recv_frame *recv_frame, s32 token)
3772 {
3773         struct adapter *adapter = recv_frame->adapter;
3774         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
3775         u8 *frame = recv_frame->rx_data;
3776         u16 seq_ctrl = ((recv_frame->attrib.seq_num&0xffff) << 4) |
3777                 (recv_frame->attrib.frag_num & 0xf);
3778
3779         if (GetRetry(frame)) {
3780                 if (token >= 0) {
3781                         if ((seq_ctrl == mlmeext->action_public_rxseq) && (token == mlmeext->action_public_dialog_token)) {
3782                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
3783                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
3784                                 return _FAIL;
3785                         }
3786                 } else {
3787                         if (seq_ctrl == mlmeext->action_public_rxseq) {
3788                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
3789                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
3790                                 return _FAIL;
3791                         }
3792                 }
3793         }
3794
3795         mlmeext->action_public_rxseq = seq_ctrl;
3796
3797         if (token >= 0)
3798                 mlmeext->action_public_dialog_token = token;
3799
3800         return _SUCCESS;
3801 }
3802
3803 static unsigned int on_action_public_p2p(struct recv_frame *precv_frame)
3804 {
3805         u8 *pframe = precv_frame->rx_data;
3806         u8 *frame_body;
3807         u8 dialogToken = 0;
3808         frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
3809
3810         dialogToken = frame_body[7];
3811
3812         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
3813                 return _FAIL;
3814
3815         return _SUCCESS;
3816 }
3817
3818 static unsigned int on_action_public_vendor(struct recv_frame *precv_frame)
3819 {
3820         unsigned int ret = _FAIL;
3821         u8 *pframe = precv_frame->rx_data;
3822         u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
3823
3824         if (!memcmp(frame_body + 2, P2P_OUI, 4))
3825                 ret = on_action_public_p2p(precv_frame);
3826
3827         return ret;
3828 }
3829
3830 static unsigned int on_action_public_default(struct recv_frame *precv_frame, u8 action)
3831 {
3832         unsigned int ret = _FAIL;
3833         u8 *pframe = precv_frame->rx_data;
3834         u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
3835         u8 token;
3836
3837         token = frame_body[2];
3838
3839         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
3840                 goto exit;
3841
3842         ret = _SUCCESS;
3843
3844 exit:
3845         return ret;
3846 }
3847
3848 static unsigned int on_action_public(struct adapter *padapter,
3849                                      struct recv_frame *precv_frame)
3850 {
3851         unsigned int ret = _FAIL;
3852         u8 *pframe = precv_frame->rx_data;
3853         u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
3854         u8 category, action;
3855
3856         /* check RA matches or not */
3857         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
3858                 goto exit;
3859
3860         category = frame_body[0];
3861         if (category != RTW_WLAN_CATEGORY_PUBLIC)
3862                 goto exit;
3863
3864         action = frame_body[1];
3865         switch (action) {
3866         case ACT_PUBLIC_VENDOR:
3867                 ret = on_action_public_vendor(precv_frame);
3868                 break;
3869         default:
3870                 ret = on_action_public_default(precv_frame, action);
3871                 break;
3872         }
3873
3874 exit:
3875         return ret;
3876 }
3877
3878 static unsigned int OnAction_ht(struct adapter *padapter,
3879                                 struct recv_frame *precv_frame)
3880 {
3881         return _SUCCESS;
3882 }
3883
3884 static unsigned int OnAction_wmm(struct adapter *padapter,
3885                                  struct recv_frame *precv_frame)
3886 {
3887         return _SUCCESS;
3888 }
3889
3890 static unsigned int OnAction_p2p(struct adapter *padapter,
3891                                  struct recv_frame *precv_frame)
3892 {
3893         return _SUCCESS;
3894 }
3895
3896 static unsigned int DoReserved(struct adapter *padapter,
3897                                struct recv_frame *precv_frame)
3898 {
3899         return _SUCCESS;
3900 }
3901
3902 static struct action_handler OnAction_tbl[] = {
3903         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
3904         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
3905         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
3906         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
3907         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
3908         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
3909         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
3910         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
3911         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
3912         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
3913         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
3914 };
3915
3916 static unsigned int OnAction(struct adapter *padapter,
3917                              struct recv_frame *precv_frame)
3918 {
3919         int i;
3920         unsigned char   category;
3921         struct action_handler *ptable;
3922         unsigned char   *frame_body;
3923         u8 *pframe = precv_frame->rx_data;
3924
3925         frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
3926
3927         category = frame_body[0];
3928
3929         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
3930                 ptable = &OnAction_tbl[i];
3931                 if (category == ptable->num)
3932                         ptable->func(padapter, precv_frame);
3933         }
3934         return _SUCCESS;
3935 }
3936
3937 /****************************************************************************
3938
3939 Following are the initialization functions for WiFi MLME
3940
3941 *****************************************************************************/
3942
3943 static struct mlme_handler mlme_sta_tbl[] = {
3944         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
3945         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
3946         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
3947         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
3948         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
3949         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
3950
3951         /*----------------------------------------------------------
3952                                         below 2 are reserved
3953         -----------------------------------------------------------*/
3954         {0,                                     "DoReserved",           &DoReserved},
3955         {0,                                     "DoReserved",           &DoReserved},
3956         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
3957         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
3958         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
3959         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
3960         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
3961         {WIFI_ACTION,           "OnAction",             &OnAction},
3962 };
3963
3964 int init_hw_mlme_ext(struct adapter *padapter)
3965 {
3966         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3967
3968         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3969         return _SUCCESS;
3970 }
3971
3972 static void init_mlme_ext_priv_value(struct adapter *padapter)
3973 {
3974         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3975         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3976         unsigned char   mixed_datarate[NumRates] = {
3977                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3978                 _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_,
3979                  _48M_RATE_, _54M_RATE_, 0xff
3980         };
3981         unsigned char   mixed_basicrate[NumRates] = {
3982                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3983                 _12M_RATE_, _24M_RATE_, 0xff,
3984         };
3985
3986         atomic_set(&pmlmeext->event_seq, 0);
3987         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
3988
3989         pmlmeext->cur_channel = padapter->registrypriv.channel;
3990         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
3991         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
3992         pmlmeext->oper_channel = pmlmeext->cur_channel;
3993         pmlmeext->oper_bwmode = pmlmeext->cur_bwmode;
3994         pmlmeext->oper_ch_offset = pmlmeext->cur_ch_offset;
3995         pmlmeext->retry = 0;
3996
3997         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
3998
3999         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
4000         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
4001
4002         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
4003
4004         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
4005         pmlmeext->sitesurvey_res.channel_idx = 0;
4006         pmlmeext->sitesurvey_res.bss_cnt = 0;
4007         pmlmeext->scan_abort = false;
4008
4009         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4010         pmlmeinfo->reauth_count = 0;
4011         pmlmeinfo->reassoc_count = 0;
4012         pmlmeinfo->link_count = 0;
4013         pmlmeinfo->auth_seq = 0;
4014         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
4015         pmlmeinfo->key_index = 0;
4016         pmlmeinfo->iv = 0;
4017
4018         pmlmeinfo->enc_algo = _NO_PRIVACY_;
4019         pmlmeinfo->authModeToggle = 0;
4020
4021         memset(pmlmeinfo->chg_txt, 0, 128);
4022
4023         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
4024         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
4025
4026         pmlmeinfo->dialogToken = 0;
4027
4028         pmlmeext->action_public_rxseq = 0xffff;
4029         pmlmeext->action_public_dialog_token = 0xff;
4030 }
4031
4032 static int has_channel(struct rt_channel_info *channel_set,
4033                                            u8 chanset_size,
4034                                            u8 chan) {
4035         int i;
4036
4037         for (i = 0; i < chanset_size; i++) {
4038                 if (channel_set[i].ChannelNum == chan)
4039                         return 1;
4040         }
4041         return 0;
4042 }
4043
4044 static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
4045                                                           u8 chanset_size,
4046                                                           struct p2p_channels *channel_list) {
4047         struct p2p_oper_class_map op_class[] = {
4048                 { IEEE80211G,  81,   1,  13,  1, BW20 },
4049                 { IEEE80211G,  82,  14,  14,  1, BW20 },
4050                 { -1, 0, 0, 0, 0, BW20 }
4051         };
4052
4053         int cla, op;
4054
4055         cla = 0;
4056
4057         for (op = 0; op_class[op].op_class; op++) {
4058                 u8 ch;
4059                 struct p2p_oper_class_map *o = &op_class[op];
4060                 struct p2p_reg_class *reg = NULL;
4061
4062                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
4063                         if (!has_channel(channel_set, chanset_size, ch)) {
4064                                 continue;
4065                         }
4066
4067                         if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
4068                                 continue;
4069
4070                         if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
4071                             ((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
4072                                 continue;
4073
4074                         if (reg == NULL) {
4075                                 reg = &channel_list->reg_class[cla];
4076                                 cla++;
4077                                 reg->reg_class = o->op_class;
4078                                 reg->channels = 0;
4079                         }
4080                         reg->channel[reg->channels] = ch;
4081                         reg->channels++;
4082                 }
4083         }
4084         channel_list->reg_classes = cla;
4085 }
4086
4087 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
4088 {
4089         u8 index, chanset_size = 0;
4090         u8 b2_4GBand = false;
4091         u8 Index2G = 0;
4092
4093         memset(channel_set, 0, sizeof(struct rt_channel_info) * MAX_CHANNEL_NUM);
4094
4095         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
4096                 DBG_88E("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
4097                 return chanset_size;
4098         }
4099
4100         if (padapter->registrypriv.wireless_mode & WIRELESS_11G) {
4101                 b2_4GBand = true;
4102                 if (RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
4103                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
4104                 else
4105                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
4106         }
4107
4108         if (b2_4GBand) {
4109                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
4110                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
4111
4112                         if ((RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) ||/* Channel 1~11 is active, and 12~14 is passive */
4113                             (RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G == ChannelPlan)) {
4114                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
4115                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4116                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
4117                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
4118                         } else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
4119                                    RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) {/*  channel 12~13, passive scan */
4120                                 if (channel_set[chanset_size].ChannelNum <= 11)
4121                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4122                                 else
4123                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
4124                         } else {
4125                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4126                         }
4127
4128                         chanset_size++;
4129                 }
4130         }
4131         return chanset_size;
4132 }
4133
4134 int     init_mlme_ext_priv(struct adapter *padapter)
4135 {
4136         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4137         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4138         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4139         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4140
4141         pmlmeext->padapter = padapter;
4142
4143         init_mlme_ext_priv_value(padapter);
4144         pmlmeinfo->bAcceptAddbaReq = pregistrypriv->bAcceptAddbaReq;
4145
4146         init_mlme_ext_timer(padapter);
4147
4148 #ifdef CONFIG_88EU_AP_MODE
4149         init_mlme_ap_info(padapter);
4150 #endif
4151
4152         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
4153         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
4154
4155         pmlmeext->chan_scan_time = SURVEY_TO;
4156         pmlmeext->mlmeext_init = true;
4157
4158
4159         pmlmeext->active_keep_alive_check = true;
4160
4161         return _SUCCESS;
4162 }
4163
4164 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
4165 {
4166         struct adapter *padapter = pmlmeext->padapter;
4167
4168         if (!padapter)
4169                 return;
4170
4171         if (padapter->bDriverStopped) {
4172                 del_timer_sync(&pmlmeext->survey_timer);
4173                 del_timer_sync(&pmlmeext->link_timer);
4174         }
4175 }
4176
4177 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, struct recv_frame *precv_frame)
4178 {
4179         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4180         u8 *pframe = precv_frame->rx_data;
4181
4182         if (ptable->func) {
4183                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4184                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4185                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4186                         return;
4187                 ptable->func(padapter, precv_frame);
4188         }
4189 }
4190
4191 void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame)
4192 {
4193         int index;
4194         struct mlme_handler *ptable;
4195 #ifdef CONFIG_88EU_AP_MODE
4196         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4197 #endif /* CONFIG_88EU_AP_MODE */
4198         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4199         u8 *pframe = precv_frame->rx_data;
4200         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
4201
4202         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
4203                  ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
4204                   (unsigned int)GetFrameType(pframe),
4205                   (unsigned int)GetFrameSubType(pframe)));
4206
4207         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
4208                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
4209                          ("mgt_dispatcher: type(0x%x) error!\n",
4210                           (unsigned int)GetFrameType(pframe)));
4211                 return;
4212         }
4213
4214         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4215         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4216             memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4217                 return;
4218
4219         ptable = mlme_sta_tbl;
4220
4221         index = GetFrameSubType(pframe) >> 4;
4222
4223         if (index > 13) {
4224                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type=%d\n", index));
4225                 return;
4226         }
4227         ptable += index;
4228
4229         if (psta != NULL) {
4230                 if (GetRetry(pframe)) {
4231                         if (precv_frame->attrib.seq_num ==
4232                             psta->RxMgmtFrameSeqNum) {
4233                                 /* drop the duplicate management frame */
4234                                 DBG_88E("Drop duplicate management frame with seq_num=%d.\n",
4235                                         precv_frame->attrib.seq_num);
4236                                 return;
4237                         }
4238                 }
4239                 psta->RxMgmtFrameSeqNum = precv_frame->attrib.seq_num;
4240         }
4241
4242 #ifdef CONFIG_88EU_AP_MODE
4243         switch (GetFrameSubType(pframe)) {
4244         case WIFI_AUTH:
4245                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
4246                         ptable->func = &OnAuth;
4247                 else
4248                         ptable->func = &OnAuthClient;
4249                 /* fall through */
4250         case WIFI_ASSOCREQ:
4251         case WIFI_REASSOCREQ:
4252         case WIFI_PROBEREQ:
4253         case WIFI_BEACON:
4254         case WIFI_ACTION:
4255                 _mgt_dispatcher(padapter, ptable, precv_frame);
4256                 break;
4257         default:
4258                 _mgt_dispatcher(padapter, ptable, precv_frame);
4259                 break;
4260         }
4261 #else
4262         _mgt_dispatcher(padapter, ptable, precv_frame);
4263 #endif
4264 }
4265
4266 /****************************************************************************
4267
4268 Following are the functions to report events
4269
4270 *****************************************************************************/
4271
4272 void report_survey_event(struct adapter *padapter,
4273                          struct recv_frame *precv_frame)
4274 {
4275         struct cmd_obj *pcmd_obj;
4276         u8 *pevtcmd;
4277         u32 cmdsz;
4278         struct survey_event     *psurvey_evt;
4279         struct C2HEvent_Header *pc2h_evt_hdr;
4280         struct mlme_ext_priv *pmlmeext;
4281         struct cmd_priv *pcmdpriv;
4282
4283         if (!padapter)
4284                 return;
4285
4286         pmlmeext = &padapter->mlmeextpriv;
4287         pcmdpriv = &padapter->cmdpriv;
4288
4289
4290         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4291         if (pcmd_obj == NULL)
4292                 return;
4293
4294         cmdsz = sizeof(struct survey_event) + sizeof(struct C2HEvent_Header);
4295         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4296         if (pevtcmd == NULL) {
4297                 kfree(pcmd_obj);
4298                 return;
4299         }
4300
4301         INIT_LIST_HEAD(&pcmd_obj->list);
4302
4303         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4304         pcmd_obj->cmdsz = cmdsz;
4305         pcmd_obj->parmbuf = pevtcmd;
4306
4307         pcmd_obj->rsp = NULL;
4308         pcmd_obj->rspsz  = 0;
4309
4310         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4311         pc2h_evt_hdr->len = sizeof(struct survey_event);
4312         pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
4313         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4314
4315         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4316
4317         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4318                 kfree(pcmd_obj);
4319                 kfree(pevtcmd);
4320                 return;
4321         }
4322
4323         process_80211d(padapter, &psurvey_evt->bss);
4324
4325         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4326
4327         pmlmeext->sitesurvey_res.bss_cnt++;
4328
4329         return;
4330 }
4331
4332 void report_surveydone_event(struct adapter *padapter)
4333 {
4334         struct cmd_obj *pcmd_obj;
4335         u8 *pevtcmd;
4336         u32 cmdsz;
4337         struct surveydone_event *psurveydone_evt;
4338         struct C2HEvent_Header  *pc2h_evt_hdr;
4339         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4340         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4341
4342         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4343         if (pcmd_obj == NULL)
4344                 return;
4345
4346         cmdsz = sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header);
4347         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4348         if (pevtcmd == NULL) {
4349                 kfree(pcmd_obj);
4350                 return;
4351         }
4352
4353         INIT_LIST_HEAD(&pcmd_obj->list);
4354
4355         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4356         pcmd_obj->cmdsz = cmdsz;
4357         pcmd_obj->parmbuf = pevtcmd;
4358
4359         pcmd_obj->rsp = NULL;
4360         pcmd_obj->rspsz  = 0;
4361
4362         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4363         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4364         pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
4365         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4366
4367         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4368         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4369
4370         DBG_88E("survey done event(%x)\n", psurveydone_evt->bss_cnt);
4371
4372         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4373
4374         return;
4375 }
4376
4377 void report_join_res(struct adapter *padapter, int res)
4378 {
4379         struct cmd_obj *pcmd_obj;
4380         u8 *pevtcmd;
4381         u32 cmdsz;
4382         struct joinbss_event            *pjoinbss_evt;
4383         struct C2HEvent_Header  *pc2h_evt_hdr;
4384         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4385         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4386         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4387
4388         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4389         if (pcmd_obj == NULL)
4390                 return;
4391
4392         cmdsz = sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header);
4393         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4394         if (pevtcmd == NULL) {
4395                 kfree(pcmd_obj);
4396                 return;
4397         }
4398
4399         INIT_LIST_HEAD(&pcmd_obj->list);
4400
4401         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4402         pcmd_obj->cmdsz = cmdsz;
4403         pcmd_obj->parmbuf = pevtcmd;
4404
4405         pcmd_obj->rsp = NULL;
4406         pcmd_obj->rspsz  = 0;
4407
4408         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4409         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4410         pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
4411         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4412
4413         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4414         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4415         pjoinbss_evt->network.join_res  = res;
4416         pjoinbss_evt->network.aid = res;
4417
4418         DBG_88E("report_join_res(%d)\n", res);
4419
4420
4421         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4422
4423
4424         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4425
4426         return;
4427 }
4428
4429 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4430 {
4431         struct cmd_obj *pcmd_obj;
4432         u8 *pevtcmd;
4433         u32 cmdsz;
4434         struct sta_info *psta;
4435         int     mac_id;
4436         struct stadel_event                     *pdel_sta_evt;
4437         struct C2HEvent_Header  *pc2h_evt_hdr;
4438         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4439         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4440
4441         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4442         if (pcmd_obj == NULL)
4443                 return;
4444
4445         cmdsz = sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header);
4446         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4447         if (pevtcmd == NULL) {
4448                 kfree(pcmd_obj);
4449                 return;
4450         }
4451
4452         INIT_LIST_HEAD(&pcmd_obj->list);
4453
4454         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4455         pcmd_obj->cmdsz = cmdsz;
4456         pcmd_obj->parmbuf = pevtcmd;
4457
4458         pcmd_obj->rsp = NULL;
4459         pcmd_obj->rspsz  = 0;
4460
4461         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4462         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4463         pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
4464         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4465
4466         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4467         memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
4468         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4469
4470
4471         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4472         if (psta)
4473                 mac_id = (int)psta->mac_id;
4474         else
4475                 mac_id = -1;
4476
4477         pdel_sta_evt->mac_id = mac_id;
4478
4479         DBG_88E("report_del_sta_event: delete STA, mac_id =%d\n", mac_id);
4480
4481         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4482
4483         return;
4484 }
4485
4486 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
4487 {
4488         struct cmd_obj *pcmd_obj;
4489         u8 *pevtcmd;
4490         u32 cmdsz;
4491         struct stassoc_event            *padd_sta_evt;
4492         struct C2HEvent_Header  *pc2h_evt_hdr;
4493         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4494         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4495
4496         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4497         if (pcmd_obj == NULL)
4498                 return;
4499
4500         cmdsz = sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header);
4501         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4502         if (pevtcmd == NULL) {
4503                 kfree(pcmd_obj);
4504                 return;
4505         }
4506
4507         INIT_LIST_HEAD(&pcmd_obj->list);
4508
4509         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4510         pcmd_obj->cmdsz = cmdsz;
4511         pcmd_obj->parmbuf = pevtcmd;
4512
4513         pcmd_obj->rsp = NULL;
4514         pcmd_obj->rspsz  = 0;
4515
4516         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4517         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4518         pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
4519         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4520
4521         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4522         memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
4523         padd_sta_evt->cam_id = cam_idx;
4524
4525         DBG_88E("report_add_sta_event: add STA\n");
4526
4527         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4528
4529         return;
4530 }
4531
4532
4533 /****************************************************************************
4534
4535 Following are the event callback functions
4536
4537 *****************************************************************************/
4538
4539 /* for sta/adhoc mode */
4540 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4541 {
4542         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4543         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4544         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4545
4546         /* ERP */
4547         VCS_update(padapter, psta);
4548
4549         /* HT */
4550         if (pmlmepriv->htpriv.ht_option) {
4551                 psta->htpriv.ht_option = true;
4552
4553                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4554
4555                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps)))
4556                         psta->htpriv.sgi = true;
4557
4558                 psta->qos_option = true;
4559         } else {
4560                 psta->htpriv.ht_option = false;
4561
4562                 psta->htpriv.ampdu_enable = false;
4563
4564                 psta->htpriv.sgi = false;
4565                 psta->qos_option = false;
4566         }
4567         psta->htpriv.bwmode = pmlmeext->cur_bwmode;
4568         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4569
4570         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4571         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4572
4573         /* QoS */
4574         if (pmlmepriv->qospriv.qos_option)
4575                 psta->qos_option = true;
4576
4577
4578         psta->state = _FW_LINKED;
4579 }
4580
4581 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4582 {
4583         struct sta_info         *psta, *psta_bmc;
4584         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4585         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4586         struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
4587         struct sta_priv         *pstapriv = &padapter->stapriv;
4588         u8 join_type;
4589         u16 media_status;
4590
4591         if (join_res < 0) {
4592                 join_type = 1;
4593                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4594                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4595
4596                 /* restore to initial setting. */
4597                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4598
4599                 goto exit_mlmeext_joinbss_event_callback;
4600         }
4601
4602         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4603                 /* for bc/mc */
4604                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
4605                 if (psta_bmc) {
4606                         pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
4607                         update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
4608                         Update_RA_Entry(padapter, psta_bmc->mac_id);
4609                 }
4610         }
4611
4612
4613         /* turn on dynamic functions */
4614         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4615
4616         /*  update IOT-related issue */
4617         update_IOT_info(padapter);
4618
4619         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
4620
4621         /* BCN interval */
4622         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4623
4624         /* update capability */
4625         update_capinfo(padapter, pmlmeinfo->capability);
4626
4627         /* WMM, Update EDCA param */
4628         WMMOnAssocRsp(padapter);
4629
4630         /* HT */
4631         HTOnAssocRsp(padapter);
4632
4633         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4634
4635         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
4636         if (psta) { /* only for infra. mode */
4637                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4638
4639                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4640
4641                 /* set per sta rate after updating HT cap. */
4642                 set_sta_rate(padapter, psta);
4643                 rtw_hal_set_hwreg(padapter, HW_VAR_TX_RPT_MAX_MACID, (u8 *)&psta->mac_id);
4644                 media_status = (psta->mac_id<<8)|1; /*   MACID|OPMODE: 1 means connect */
4645                 rtw_hal_set_hwreg(padapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
4646         }
4647
4648         join_type = 2;
4649         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4650
4651         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4652                 /*  correcting TSF */
4653                 correct_TSF(padapter, pmlmeext);
4654         }
4655         rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4656
4657 exit_mlmeext_joinbss_event_callback:
4658
4659         DBG_88E("=>%s\n", __func__);
4660 }
4661
4662 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4663 {
4664         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
4665         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4666         u8 join_type;
4667
4668         DBG_88E("%s\n", __func__);
4669
4670         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4671                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {/* adhoc master or sta_count>1 */
4672                         /* nothing to do */
4673                 } else { /* adhoc client */
4674                         /*  correcting TSF */
4675                         correct_TSF(padapter, pmlmeext);
4676
4677                         /* start beacon */
4678                         if (send_beacon(padapter) == _FAIL) {
4679                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4680                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4681                                 return;
4682                         }
4683                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4684                 }
4685
4686                 join_type = 2;
4687                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4688         }
4689
4690         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4691
4692         /* rate radaptive */
4693         Update_RA_Entry(padapter, psta->mac_id);
4694
4695         /* update adhoc sta_info */
4696         update_sta_info(padapter, psta);
4697 }
4698
4699 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4700 {
4701         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4702         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4703
4704         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter)) {
4705                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4706                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4707
4708                 /* restore to initial setting. */
4709                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4710
4711                 /* switch to the 20M Hz mode after disconnect */
4712                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4713                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4714
4715                 /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4716                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4717
4718
4719                 flush_all_cam_entry(padapter);
4720
4721                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4722
4723                 /* set MSR to no link state -> infra. mode */
4724                 Set_MSR(padapter, _HW_STATE_STATION_);
4725
4726                 del_timer_sync(&pmlmeext->link_timer);
4727         }
4728 }
4729
4730 /****************************************************************************
4731
4732 Following are the functions for the timer handlers
4733
4734 *****************************************************************************/
4735 void _linked_rx_signal_strehgth_display(struct adapter *padapter);
4736 void _linked_rx_signal_strehgth_display(struct adapter *padapter)
4737 {
4738         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4739       struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4740         u8 mac_id;
4741         int UndecoratedSmoothedPWDB;
4742         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
4743                 mac_id = 0;
4744         else if ((pmlmeinfo->state&0x03) == _HW_STATE_AP_)
4745                 mac_id = 2;
4746
4747         rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &mac_id);
4748
4749         rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
4750         DBG_88E("UndecoratedSmoothedPWDB:%d\n", UndecoratedSmoothedPWDB);
4751 }
4752
4753 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4754 {
4755         u8 ret = false;
4756
4757         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta)) &&
4758             sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta) &&
4759             sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta))
4760                 ret = false;
4761         else
4762                 ret = true;
4763
4764         sta_update_last_rx_pkts(psta);
4765
4766         return ret;
4767 }
4768
4769 void linked_status_chk(struct adapter *padapter)
4770 {
4771         u32     i;
4772         struct sta_info         *psta;
4773         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
4774         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4775         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4776         struct sta_priv         *pstapriv = &padapter->stapriv;
4777
4778         if (padapter->bRxRSSIDisplay)
4779                 _linked_rx_signal_strehgth_display(padapter);
4780
4781         if (is_client_associated_to_ap(padapter)) {
4782                 /* linked infrastructure client mode */
4783
4784                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
4785                 int rx_chk_limit;
4786
4787                 rx_chk_limit = 4;
4788                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
4789                 if (psta != NULL) {
4790                         bool is_p2p_enable = false;
4791
4792                         if (!chk_ap_is_alive(padapter, psta))
4793                                 rx_chk = _FAIL;
4794
4795                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
4796                                 tx_chk = _FAIL;
4797
4798                         if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
4799                                 u8 backup_oper_channel = 0;
4800
4801                                 /* switch to correct channel of current network  before issue keep-alive frames */
4802                                 if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
4803                                         backup_oper_channel = rtw_get_oper_ch(padapter);
4804                                         SelectChannel(padapter, pmlmeext->cur_channel);
4805                                 }
4806
4807                                 if (rx_chk != _SUCCESS)
4808                                         issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
4809
4810                                 if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
4811                                         tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
4812                                         /* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
4813                                         if (tx_chk == _SUCCESS && !is_p2p_enable)
4814                                                 rx_chk = _SUCCESS;
4815                                 }
4816
4817                                 /* back to the original operation channel */
4818                                 if (backup_oper_channel > 0)
4819                                         SelectChannel(padapter, backup_oper_channel);
4820                         } else {
4821                                 if (rx_chk != _SUCCESS) {
4822                                         if (pmlmeext->retry == 0) {
4823                                                 issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
4824                                                 issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
4825                                                 issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
4826                                         }
4827                                 }
4828
4829                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) {
4830                                         tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
4831                                 }
4832                         }
4833
4834                         if (rx_chk == _FAIL) {
4835                                 pmlmeext->retry++;
4836                                 if (pmlmeext->retry > rx_chk_limit) {
4837                                         DBG_88E_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
4838                                                       FUNC_ADPT_ARG(padapter));
4839                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress,
4840                                                            WLAN_REASON_EXPIRATION_CHK);
4841                                         return;
4842                                 }
4843                         } else {
4844                                 pmlmeext->retry = 0;
4845                         }
4846
4847                         if (tx_chk == _FAIL) {
4848                                 pmlmeinfo->link_count &= 0xf;
4849                         } else {
4850                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
4851                                 pmlmeinfo->link_count = 0;
4852                         }
4853                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
4854         } else if (is_client_associated_to_ibss(padapter)) {
4855                 /* linked IBSS mode */
4856                 /* for each assoc list entry to check the rx pkt counter */
4857                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
4858                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
4859                                 psta = pmlmeinfo->FW_sta_info[i].psta;
4860
4861                                 if (NULL == psta)
4862                                         continue;
4863                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
4864                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
4865                                                 pmlmeinfo->FW_sta_info[i].retry++;
4866                                         } else {
4867                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
4868                                                 pmlmeinfo->FW_sta_info[i].status = 0;
4869                                                 report_del_sta_event(padapter, psta->hwaddr
4870                                                         , 65535/*  indicate disconnect caused by no rx */
4871                                         );
4872                                         }
4873                                 } else {
4874                                         pmlmeinfo->FW_sta_info[i].retry = 0;
4875                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
4876                                 }
4877                         }
4878                 }
4879         }
4880 }
4881
4882 void survey_timer_hdl(unsigned long data)
4883 {
4884         struct adapter *padapter = (struct adapter *)data;
4885         struct cmd_obj  *ph2c;
4886         struct sitesurvey_parm  *psurveyPara;
4887         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
4888         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4889
4890         /* issue rtw_sitesurvey_cmd */
4891         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
4892                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
4893                         pmlmeext->sitesurvey_res.channel_idx++;
4894
4895                 if (pmlmeext->scan_abort) {
4896                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
4897                         DBG_88E("%s idx:%d\n", __func__
4898                                 , pmlmeext->sitesurvey_res.channel_idx);
4899
4900                         pmlmeext->scan_abort = false;/* reset */
4901                 }
4902
4903                 ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4904                 if (ph2c == NULL)
4905                         goto exit_survey_timer_hdl;
4906
4907                 psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
4908                 if (psurveyPara == NULL) {
4909                         kfree(ph2c);
4910                         goto exit_survey_timer_hdl;
4911                 }
4912
4913                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
4914                 rtw_enqueue_cmd(pcmdpriv, ph2c);
4915         }
4916
4917
4918 exit_survey_timer_hdl:
4919         return;
4920 }
4921
4922 void link_timer_hdl(unsigned long data)
4923 {
4924         struct adapter *padapter = (struct adapter *)data;
4925         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4926         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4927
4928         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
4929                 DBG_88E("link_timer_hdl:no beacon while connecting\n");
4930                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4931                 report_join_res(padapter, -3);
4932         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
4933                 /* re-auth timer */
4934                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
4935                         pmlmeinfo->state = 0;
4936                         report_join_res(padapter, -1);
4937                         return;
4938                 }
4939
4940                 DBG_88E("link_timer_hdl: auth timeout and try again\n");
4941                 pmlmeinfo->auth_seq = 1;
4942                 issue_auth(padapter, NULL, 0);
4943                 set_link_timer(pmlmeext, REAUTH_TO);
4944         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
4945                 /* re-assoc timer */
4946                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
4947                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4948                         report_join_res(padapter, -2);
4949                         return;
4950                 }
4951
4952                 DBG_88E("link_timer_hdl: assoc timeout and try again\n");
4953                 issue_assocreq(padapter);
4954                 set_link_timer(pmlmeext, REASSOC_TO);
4955         }
4956         return;
4957 }
4958
4959 void addba_timer_hdl(unsigned long data)
4960 {
4961         struct sta_info *psta = (struct sta_info *)data;
4962         struct ht_priv  *phtpriv;
4963
4964         if (!psta)
4965                 return;
4966
4967         phtpriv = &psta->htpriv;
4968
4969         if ((phtpriv->ht_option) && (phtpriv->ampdu_enable)) {
4970                 if (phtpriv->candidate_tid_bitmap)
4971                         phtpriv->candidate_tid_bitmap = 0x0;
4972         }
4973 }
4974
4975 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
4976 {
4977         u8 type;
4978         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4979         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4980         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
4981
4982         if (psetop->mode == Ndis802_11APMode) {
4983                 pmlmeinfo->state = WIFI_FW_AP_STATE;
4984                 type = _HW_STATE_AP_;
4985         } else if (psetop->mode == Ndis802_11Infrastructure) {
4986                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
4987                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
4988                 type = _HW_STATE_STATION_;
4989         } else if (psetop->mode == Ndis802_11IBSS) {
4990                 type = _HW_STATE_ADHOC_;
4991         } else {
4992                 type = _HW_STATE_NOLINK_;
4993         }
4994
4995         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
4996         /* Set_NETYPE0_MSR(padapter, type); */
4997
4998         return H2C_SUCCESS;
4999 }
5000
5001 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
5002 {
5003         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5004         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5005         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5006         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
5007         /* u32  initialgain; */
5008
5009
5010         if (pparm->InfrastructureMode == Ndis802_11APMode) {
5011 #ifdef CONFIG_88EU_AP_MODE
5012
5013                 if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
5014                         /* todo: */
5015                         return H2C_SUCCESS;
5016                 }
5017 #endif
5018         }
5019
5020         /* below is for ad-hoc master */
5021         if (pparm->InfrastructureMode == Ndis802_11IBSS) {
5022                 rtw_joinbss_reset(padapter);
5023
5024                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5025                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5026                 pmlmeinfo->ERP_enable = 0;
5027                 pmlmeinfo->WMM_enable = 0;
5028                 pmlmeinfo->HT_enable = 0;
5029                 pmlmeinfo->HT_caps_enable = 0;
5030                 pmlmeinfo->HT_info_enable = 0;
5031                 pmlmeinfo->agg_enable_bitmap = 0;
5032                 pmlmeinfo->candidate_tid_bitmap = 0;
5033
5034                 /* disable dynamic functions, such as high power, DIG */
5035                 Save_DM_Func_Flag(padapter);
5036                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5037
5038                 /* config the initial gain under linking, need to write the BB registers */
5039                 /* initialgain = 0x1E; */
5040                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
5041
5042                 /* cancel link timer */
5043                 del_timer_sync(&pmlmeext->link_timer);
5044
5045                 /* clear CAM */
5046                 flush_all_cam_entry(padapter);
5047
5048                 memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, IELength));
5049                 pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
5050
5051                 if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
5052                         return H2C_PARAMETERS_ERROR;
5053
5054                 memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
5055
5056                 start_create_ibss(padapter);
5057         }
5058
5059         return H2C_SUCCESS;
5060 }
5061
5062 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5063 {
5064         u8 join_type;
5065         struct ndis_802_11_var_ie *pIE;
5066         struct registry_priv    *pregpriv = &padapter->registrypriv;
5067         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5068         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5069         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5070         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
5071         u32 i;
5072
5073         /* check already connecting to AP or not */
5074         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
5075                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
5076                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
5077
5078                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5079
5080                 /* clear CAM */
5081                 flush_all_cam_entry(padapter);
5082
5083                 del_timer_sync(&pmlmeext->link_timer);
5084
5085                 /* set MSR to nolink -> infra. mode */
5086                 Set_MSR(padapter, _HW_STATE_STATION_);
5087
5088
5089                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5090         }
5091
5092         rtw_antenna_select_cmd(padapter, pparm->PhyInfo.Optimum_antenna, false);
5093
5094         rtw_joinbss_reset(padapter);
5095
5096         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5097         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5098         pmlmeinfo->ERP_enable = 0;
5099         pmlmeinfo->WMM_enable = 0;
5100         pmlmeinfo->HT_enable = 0;
5101         pmlmeinfo->HT_caps_enable = 0;
5102         pmlmeinfo->HT_info_enable = 0;
5103         pmlmeinfo->agg_enable_bitmap = 0;
5104         pmlmeinfo->candidate_tid_bitmap = 0;
5105         pmlmeinfo->bwmode_updated = false;
5106
5107         memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, IELength));
5108         pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
5109
5110         if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
5111                 return H2C_PARAMETERS_ERROR;
5112
5113         memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
5114
5115         /* Check AP vendor to move rtw_joinbss_cmd() */
5116
5117         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pnetwork->IELength;) {
5118                 pIE = (struct ndis_802_11_var_ie *)(pnetwork->IEs + i);
5119
5120                 switch (pIE->ElementID) {
5121                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
5122                         if (!memcmp(pIE->data, WMM_OUI, 4))
5123                                 pmlmeinfo->WMM_enable = 1;
5124                         break;
5125                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
5126                         pmlmeinfo->HT_caps_enable = 1;
5127                         break;
5128                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
5129                         pmlmeinfo->HT_info_enable = 1;
5130
5131                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5132                         {
5133                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5134
5135                                 if ((pregpriv->cbw40_enable) &&  (pht_info->infos[0] & BIT(2))) {
5136                                         /* switch to the 40M Hz mode according to the AP */
5137                                         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
5138                                         switch (pht_info->infos[0] & 0x3) {
5139                                         case 1:
5140                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5141                                                 break;
5142                                         case 3:
5143                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5144                                                 break;
5145                                         default:
5146                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5147                                                 break;
5148                                 }
5149
5150                                         DBG_88E("set ch/bw before connected\n");
5151                                 }
5152                         }
5153                         break;
5154                 default:
5155                         break;
5156                 }
5157
5158                 i += (pIE->Length + 2);
5159         }
5160         /* disable dynamic functions, such as high power, DIG */
5161
5162         /* config the initial gain under linking, need to write the BB registers */
5163
5164         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
5165         join_type = 0;
5166         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5167
5168         /* cancel link timer */
5169         del_timer_sync(&pmlmeext->link_timer);
5170
5171         start_clnt_join(padapter);
5172
5173         return H2C_SUCCESS;
5174 }
5175
5176 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5177 {
5178         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5179         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5180         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5181         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5182         u8 val8;
5183
5184         if (is_client_associated_to_ap(padapter))
5185                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5186
5187         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5188         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5189
5190         /* restore to initial setting. */
5191         update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
5192
5193         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5194                 /* Stop BCN */
5195                 val8 = 0;
5196                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5197         }
5198
5199
5200         /* set MSR to no link state -> infra. mode */
5201         Set_MSR(padapter, _HW_STATE_STATION_);
5202
5203         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5204
5205         /* switch to the 20M Hz mode after disconnect */
5206         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5207         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5208
5209         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5210
5211         flush_all_cam_entry(padapter);
5212
5213         del_timer_sync(&pmlmeext->link_timer);
5214
5215         rtw_free_uc_swdec_pending_queue(padapter);
5216
5217         return  H2C_SUCCESS;
5218 }
5219
5220 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
5221         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
5222 {
5223         int i, j;
5224         int set_idx;
5225         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5226
5227         /* clear out first */
5228         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5229
5230         /* acquire channels from in */
5231         j = 0;
5232         for (i = 0; i < in_num; i++) {
5233                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5234                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED) &&
5235                     set_idx >= 0) {
5236                         out[j] = in[i];
5237
5238                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5239                                 out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5240
5241                         j++;
5242                 }
5243                 if (j >= out_num)
5244                         break;
5245         }
5246
5247         /* if out is empty, use channel_set as default */
5248         if (j == 0) {
5249                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5250                         out[i].hw_value = pmlmeext->channel_set[i].ChannelNum;
5251
5252                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5253                                 out[i].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5254
5255                         j++;
5256                 }
5257         }
5258
5259         return j;
5260 }
5261
5262 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5263 {
5264         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5265         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5266         u8 bdelayscan = false;
5267         u8 val8;
5268         u32     initialgain;
5269         u32     i;
5270
5271         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5272                 /* for first time sitesurvey_cmd */
5273                 rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, NULL);
5274
5275                 pmlmeext->sitesurvey_res.state = SCAN_START;
5276                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5277                 pmlmeext->sitesurvey_res.channel_idx = 0;
5278
5279                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5280                         if (pparm->ssid[i].SsidLength) {
5281                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
5282                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = pparm->ssid[i].SsidLength;
5283                         } else {
5284                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = 0;
5285                         }
5286                 }
5287
5288                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5289                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5290                         , pparm->ch, pparm->ch_num
5291         );
5292
5293                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5294
5295                 /* issue null data if associating to the AP */
5296                 if (is_client_associated_to_ap(padapter)) {
5297                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5298
5299                         issue_nulldata(padapter, NULL, 1, 3, 500);
5300
5301                         bdelayscan = true;
5302                 }
5303                 if (bdelayscan) {
5304                         /* delay 50ms to protect nulldata(1). */
5305                         set_survey_timer(pmlmeext, 50);
5306                         return H2C_SUCCESS;
5307                 }
5308         }
5309
5310         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5311                 /* disable dynamic functions, such as high power, DIG */
5312                 Save_DM_Func_Flag(padapter);
5313                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5314
5315                 /* config the initial gain under scanning, need to write the BB registers */
5316                 initialgain = 0x1E;
5317
5318                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5319
5320                 /* set MSR to no link state */
5321                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5322
5323                 val8 = 1; /* under site survey */
5324                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5325
5326                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5327         }
5328
5329         site_survey(padapter);
5330
5331         return H2C_SUCCESS;
5332 }
5333
5334 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5335 {
5336         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5337         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5338         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5339
5340         if (pparm->mode < 4)
5341                 pmlmeinfo->auth_algo = pparm->mode;
5342         return  H2C_SUCCESS;
5343 }
5344
5345 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5346 {
5347         unsigned short                          ctrl;
5348         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5349         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5350         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5351         unsigned char                                   null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5352
5353         /* main tx key for wep. */
5354         if (pparm->set_tx)
5355                 pmlmeinfo->key_index = pparm->keyid;
5356
5357         /* write cam */
5358         ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5359
5360         DBG_88E_LEVEL(_drv_info_, "set group key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) "
5361                         "keyid:%d\n", pparm->algorithm, pparm->keyid);
5362         write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
5363
5364         return H2C_SUCCESS;
5365 }
5366
5367 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5368 {
5369         u16 ctrl = 0;
5370         u8 cam_id;/* cam_entry */
5371         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5372         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5373         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5374
5375         /* cam_entry: */
5376         /* 0~3 for default key */
5377
5378         /* for concurrent mode (ap+sta): */
5379         /* default key is disable, using sw encrypt/decrypt */
5380         /* cam_entry = 4 for sta mode (macid = 0) */
5381         /* cam_entry(macid+3) = 5 ~ N for ap mode (aid = 1~N, macid = 2 ~N) */
5382
5383         /* for concurrent mode (sta+sta): */
5384         /* default key is disable, using sw encrypt/decrypt */
5385         /* cam_entry = 4 mapping to macid = 0 */
5386         /* cam_entry = 5 mapping to macid = 2 */
5387
5388         cam_id = 4;
5389
5390         DBG_88E_LEVEL(_drv_info_, "set pairwise key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) camid:%d\n",
5391                       pparm->algorithm, cam_id);
5392         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
5393                 struct sta_info *psta;
5394                 struct sta_priv *pstapriv = &padapter->stapriv;
5395
5396                 if (pparm->algorithm == _NO_PRIVACY_)   /*  clear cam entry */ {
5397                         clear_cam_entry(padapter, pparm->id);
5398                         return H2C_SUCCESS_RSP;
5399                 }
5400
5401                 psta = rtw_get_stainfo(pstapriv, pparm->addr);
5402                 if (psta) {
5403                         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5404
5405                         DBG_88E("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
5406
5407                         if ((psta->mac_id < 1) || (psta->mac_id > (NUM_STA-4))) {
5408                                 DBG_88E("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
5409                                 return H2C_REJECTED;
5410                         }
5411
5412                         cam_id = psta->mac_id + 3;/* 0~3 for default key, cmd_id = macid + 3, macid = aid+1; */
5413
5414                         DBG_88E("Write CAM, mac_addr =%pM, cam_entry=%d\n",
5415                                 pparm->addr, cam_id);
5416
5417                         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5418
5419                         return H2C_SUCCESS_RSP;
5420                 } else {
5421                         DBG_88E("r871x_set_stakey_hdl(): sta has been free\n");
5422                         return H2C_REJECTED;
5423                 }
5424         }
5425
5426         /* below for sta mode */
5427
5428         if (pparm->algorithm == _NO_PRIVACY_) { /*  clear cam entry */
5429                 clear_cam_entry(padapter, pparm->id);
5430                 return H2C_SUCCESS;
5431         }
5432         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5433         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5434         pmlmeinfo->enc_algo = pparm->algorithm;
5435         return H2C_SUCCESS;
5436 }
5437
5438 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5439 {
5440         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5441         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5442         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5443
5444         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5445
5446         if (!psta)
5447                 return  H2C_SUCCESS;
5448
5449         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5450             ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5451                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5452                 mod_timer(&psta->addba_retry_timer,
5453                           jiffies + msecs_to_jiffies(ADDBA_TO));
5454         } else {
5455                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5456         }
5457         return  H2C_SUCCESS;
5458 }
5459
5460 u8 set_tx_beacon_cmd(struct adapter *padapter)
5461 {
5462         struct cmd_obj  *ph2c;
5463         struct wlan_bssid_ex    *ptxBeacon_parm;
5464         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5465         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5466         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5467         u8 res = _SUCCESS;
5468         int len_diff = 0;
5469
5470
5471         ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
5472         if (ph2c == NULL) {
5473                 res = _FAIL;
5474                 goto exit;
5475         }
5476
5477         ptxBeacon_parm = kmemdup(&(pmlmeinfo->network),
5478                                 sizeof(struct wlan_bssid_ex), GFP_KERNEL);
5479         if (ptxBeacon_parm == NULL) {
5480                 kfree(ph2c);
5481                 res = _FAIL;
5482                 goto exit;
5483         }
5484
5485         len_diff = update_hidden_ssid(ptxBeacon_parm->IEs+_BEACON_IE_OFFSET_,
5486                                       ptxBeacon_parm->IELength-_BEACON_IE_OFFSET_,
5487                                       pmlmeinfo->hidden_ssid_mode);
5488         ptxBeacon_parm->IELength += len_diff;
5489
5490         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));
5491
5492         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5493
5494
5495 exit:
5496
5497
5498         return res;
5499 }
5500
5501 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5502 {
5503         u8 evt_code;
5504         u16 evt_sz;
5505         uint    *peventbuf;
5506         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5507
5508         peventbuf = (uint *)pbuf;
5509         evt_sz = (u16)(*peventbuf&0xffff);
5510         evt_code = (u8)((*peventbuf>>16)&0xff);
5511
5512         /*  checking if event code is valid */
5513         if (evt_code >= MAX_C2HEVT) {
5514                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
5515                 goto _abort_event_;
5516         }
5517
5518         /*  checking if event size match the event parm size */
5519         if ((wlanevents[evt_code].parmsize != 0) &&
5520             (wlanevents[evt_code].parmsize != evt_sz)) {
5521                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_,
5522                          ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
5523                          evt_code, wlanevents[evt_code].parmsize, evt_sz));
5524                 goto _abort_event_;
5525         }
5526
5527         peventbuf += 2;
5528
5529         if (peventbuf) {
5530                 event_callback = wlanevents[evt_code].event_callback;
5531                 event_callback(padapter, (u8 *)peventbuf);
5532
5533         }
5534
5535 _abort_event_:
5536         return H2C_SUCCESS;
5537 }
5538
5539 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5540 {
5541         if (send_beacon(padapter) == _FAIL) {
5542                 DBG_88E("issue_beacon, fail!\n");
5543                 return H2C_PARAMETERS_ERROR;
5544         }
5545 #ifdef CONFIG_88EU_AP_MODE
5546         else { /* tx bc/mc frames after update TIM */
5547                 struct sta_info *psta_bmc;
5548                 struct list_head *xmitframe_plist, *xmitframe_phead;
5549                 struct xmit_frame *pxmitframe = NULL;
5550                 struct sta_priv  *pstapriv = &padapter->stapriv;
5551
5552                 /* for BC/MC Frames */
5553                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
5554                 if (!psta_bmc)
5555                         return H2C_SUCCESS;
5556
5557                 if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5558                         msleep(10);/*  10ms, ATIM(HIQ) Windows */
5559                         spin_lock_bh(&psta_bmc->sleep_q.lock);
5560
5561                         xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5562                         xmitframe_plist = xmitframe_phead->next;
5563
5564                         while (xmitframe_phead != xmitframe_plist) {
5565                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
5566
5567                                 xmitframe_plist = xmitframe_plist->next;
5568
5569                                 list_del_init(&pxmitframe->list);
5570
5571                                 psta_bmc->sleepq_len--;
5572                                 if (psta_bmc->sleepq_len > 0)
5573                                         pxmitframe->attrib.mdata = 1;
5574                                 else
5575                                         pxmitframe->attrib.mdata = 0;
5576
5577                                 pxmitframe->attrib.triggered = 1;
5578
5579                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5580
5581                                 spin_unlock_bh(&psta_bmc->sleep_q.lock);
5582                                 if (rtw_hal_xmit(padapter, pxmitframe))
5583                                         rtw_os_xmit_complete(padapter, pxmitframe);
5584                                 spin_lock_bh(&psta_bmc->sleep_q.lock);
5585                         }
5586                         spin_unlock_bh(&psta_bmc->sleep_q.lock);
5587                 }
5588         }
5589 #endif
5590         return H2C_SUCCESS;
5591 }
5592
5593 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5594 {
5595         struct set_ch_parm *set_ch_parm;
5596         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5597
5598         if (!pbuf)
5599                 return H2C_PARAMETERS_ERROR;
5600
5601         set_ch_parm = (struct set_ch_parm *)pbuf;
5602
5603         DBG_88E(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
5604                 FUNC_NDEV_ARG(padapter->pnetdev),
5605                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
5606
5607         pmlmeext->cur_channel = set_ch_parm->ch;
5608         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5609         pmlmeext->cur_bwmode = set_ch_parm->bw;
5610
5611         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5612
5613         return  H2C_SUCCESS;
5614 }
5615
5616 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5617 {
5618         struct SetChannelPlan_param *setChannelPlan_param;
5619         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5620
5621         if (!pbuf)
5622                 return H2C_PARAMETERS_ERROR;
5623
5624         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5625
5626         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5627         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5628
5629         return  H2C_SUCCESS;
5630 }