drivers/staging/vt6655/wmgr.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  *
  20  * File: wmgr.c
  21  *
  22  * Purpose: Handles the 802.11 management functions
  23  *
  24  * Author: Lyndon Chen
  25  *
  26  * Date: May 8, 2002
  27  *
  28  * Functions:
  29  *      nsMgrObjectInitial - Initialize Management Object data structure
  30  *      vMgrObjectReset - Reset Management Object data structure
  31  *      vMgrAssocBeginSta - Start associate function
  32  *      vMgrReAssocBeginSta - Start reassociate function
  33  *      vMgrDisassocBeginSta - Start disassociate function
  34  *      s_vMgrRxAssocRequest - Handle Rcv associate_request
  35  *      s_vMgrRxAssocResponse - Handle Rcv associate_response
  36  *      vMrgAuthenBeginSta - Start authentication function
  37  *      vMgrDeAuthenDeginSta - Start deauthentication function
  38  *      s_vMgrRxAuthentication - Handle Rcv authentication
  39  *      s_vMgrRxAuthenSequence_1 - Handle Rcv authentication sequence 1
  40  *      s_vMgrRxAuthenSequence_2 - Handle Rcv authentication sequence 2
  41  *      s_vMgrRxAuthenSequence_3 - Handle Rcv authentication sequence 3
  42  *      s_vMgrRxAuthenSequence_4 - Handle Rcv authentication sequence 4
  43  *      s_vMgrRxDisassociation - Handle Rcv disassociation
  44  *      s_vMgrRxBeacon - Handle Rcv Beacon
  45  *      vMgrCreateOwnIBSS - Create ad_hoc IBSS or AP BSS
  46  *      vMgrJoinBSSBegin - Join BSS function
  47  *      s_vMgrSynchBSS - Synch & adopt BSS parameters
  48  *      s_MgrMakeBeacon - Create Baecon frame
  49  *      s_MgrMakeProbeResponse - Create Probe Response frame
  50  *      s_MgrMakeAssocRequest - Create Associate Request frame
  51  *      s_MgrMakeReAssocRequest - Create ReAssociate Request frame
  52  *      s_vMgrRxProbeResponse - Handle Rcv probe_response
  53  *      s_vMrgRxProbeRequest - Handle Rcv probe_request
  54  *      bMgrPrepareBeaconToSend - Prepare Beacon frame
  55  *      s_vMgrLogStatus - Log 802.11 Status
  56  *      vMgrRxManagePacket - Rcv management frame dispatch function
  57  *      s_vMgrFormatTIM- Assembler TIM field of beacon
  58  *      vMgrTimerInit- Initial 1-sec and command call back funtions
  59  *
  60  * Revision History:
  61  *
  62  */
  63
  64 #include "tmacro.h"
  65 #include "desc.h"
  66 #include "device.h"
  67 #include "card.h"
  68 #include "channel.h"
  69 #include "80211hdr.h"
  70 #include "80211mgr.h"
  71 #include "wmgr.h"
  72 #include "wcmd.h"
  73 #include "mac.h"
  74 #include "bssdb.h"
  75 #include "power.h"
  76 #include "datarate.h"
  77 #include "baseband.h"
  78 #include "rxtx.h"
  79 #include "wpa.h"
  80 #include "rf.h"
  81 #include "iowpa.h"
  82
  83 #define PLICE_DEBUG
  84
  85 /*---------------------  Static Definitions -------------------------*/
  86
  87 /*---------------------  Static Classes  ----------------------------*/
  88
  89 /*---------------------  Static Variables  --------------------------*/
  90 static int msglevel = MSG_LEVEL_INFO;
  91 //static int          msglevel                =MSG_LEVEL_DEBUG;
  92
  93 /*---------------------  Static Functions  --------------------------*/
  94 //2008-8-4 <add> by chester
  95 static bool ChannelExceedZoneType(
  96         PSDevice pDevice,
  97         unsigned char byCurrChannel
  98 );
  99
 100 // Association/diassociation functions
 101 static
 102 PSTxMgmtPacket
 103 s_MgrMakeAssocRequest(
 104         PSDevice pDevice,
 105         PSMgmtObject pMgmt,
 106         unsigned char *pDAddr,
 107         unsigned short wCurrCapInfo,
 108         unsigned short wListenInterval,
 109         PWLAN_IE_SSID pCurrSSID,
 110         PWLAN_IE_SUPP_RATES pCurrRates,
 111         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 112 );
 113
 114 static
 115 void
 116 s_vMgrRxAssocRequest(
 117         PSDevice pDevice,
 118         PSMgmtObject pMgmt,
 119         PSRxMgmtPacket pRxPacket,
 120         unsigned int uNodeIndex
 121 );
 122
 123 static
 124 PSTxMgmtPacket
 125 s_MgrMakeReAssocRequest(
 126         PSDevice pDevice,
 127         PSMgmtObject pMgmt,
 128         unsigned char *pDAddr,
 129         unsigned short wCurrCapInfo,
 130         unsigned short wListenInterval,
 131         PWLAN_IE_SSID pCurrSSID,
 132         PWLAN_IE_SUPP_RATES pCurrRates,
 133         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 134 );
 135
 136 static
 137 void
 138 s_vMgrRxAssocResponse(
 139         PSDevice pDevice,
 140         PSMgmtObject pMgmt,
 141         PSRxMgmtPacket pRxPacket,
 142         bool bReAssocType
 143 );
 144
 145 static
 146 void
 147 s_vMgrRxDisassociation(
 148         PSDevice pDevice,
 149         PSMgmtObject pMgmt,
 150         PSRxMgmtPacket pRxPacket
 151 );
 152
 153 // Authentication/deauthen functions
 154 static
 155 void
 156 s_vMgrRxAuthenSequence_1(
 157         PSDevice pDevice,
 158         PSMgmtObject pMgmt,
 159         PWLAN_FR_AUTHEN pFrame
 160 );
 161
 162 static
 163 void
 164 s_vMgrRxAuthenSequence_2(
 165         PSDevice pDevice,
 166         PSMgmtObject pMgmt,
 167         PWLAN_FR_AUTHEN pFrame
 168 );
 169
 170 static
 171 void
 172 s_vMgrRxAuthenSequence_3(
 173         PSDevice pDevice,
 174         PSMgmtObject pMgmt,
 175         PWLAN_FR_AUTHEN pFrame
 176 );
 177
 178 static
 179 void
 180 s_vMgrRxAuthenSequence_4(
 181         PSDevice pDevice,
 182         PSMgmtObject pMgmt,
 183         PWLAN_FR_AUTHEN pFrame
 184 );
 185
 186 static
 187 void
 188 s_vMgrRxAuthentication(
 189         PSDevice pDevice,
 190         PSMgmtObject pMgmt,
 191         PSRxMgmtPacket pRxPacket
 192 );
 193
 194 static
 195 void
 196 s_vMgrRxDeauthentication(
 197         PSDevice pDevice,
 198         PSMgmtObject pMgmt,
 199         PSRxMgmtPacket pRxPacket
 200 );
 201
 202 // Scan functions
 203 // probe request/response functions
 204 static
 205 void
 206 s_vMgrRxProbeRequest(
 207         PSDevice pDevice,
 208         PSMgmtObject pMgmt,
 209         PSRxMgmtPacket pRxPacket
 210 );
 211
 212 static
 213 void
 214 s_vMgrRxProbeResponse(
 215         PSDevice pDevice,
 216         PSMgmtObject pMgmt,
 217         PSRxMgmtPacket pRxPacket
 218 );
 219
 220 // beacon functions
 221 static
 222 void
 223 s_vMgrRxBeacon(
 224         PSDevice pDevice,
 225         PSMgmtObject pMgmt,
 226         PSRxMgmtPacket pRxPacket,
 227         bool bInScan
 228 );
 229
 230 static
 231 void
 232 s_vMgrFormatTIM(
 233         PSMgmtObject pMgmt,
 234         PWLAN_IE_TIM pTIM
 235 );
 236
 237 static
 238 PSTxMgmtPacket
 239 s_MgrMakeBeacon(
 240         PSDevice pDevice,
 241         PSMgmtObject pMgmt,
 242         unsigned short wCurrCapInfo,
 243         unsigned short wCurrBeaconPeriod,
 244         unsigned int uCurrChannel,
 245         unsigned short wCurrATIMWinodw,
 246         PWLAN_IE_SSID pCurrSSID,
 247         unsigned char *pCurrBSSID,
 248         PWLAN_IE_SUPP_RATES pCurrSuppRates,
 249         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 250 );
 251
 252 // Association response
 253 static
 254 PSTxMgmtPacket
 255 s_MgrMakeAssocResponse(
 256         PSDevice pDevice,
 257         PSMgmtObject pMgmt,
 258         unsigned short wCurrCapInfo,
 259         unsigned short wAssocStatus,
 260         unsigned short wAssocAID,
 261         unsigned char *pDstAddr,
 262         PWLAN_IE_SUPP_RATES pCurrSuppRates,
 263         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 264 );
 265
 266 // ReAssociation response
 267 static
 268 PSTxMgmtPacket
 269 s_MgrMakeReAssocResponse(
 270         PSDevice pDevice,
 271         PSMgmtObject pMgmt,
 272         unsigned short wCurrCapInfo,
 273         unsigned short wAssocStatus,
 274         unsigned short wAssocAID,
 275         unsigned char *pDstAddr,
 276         PWLAN_IE_SUPP_RATES pCurrSuppRates,
 277         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 278 );
 279
 280 // Probe response
 281 static
 282 PSTxMgmtPacket
 283 s_MgrMakeProbeResponse(
 284         PSDevice pDevice,
 285         PSMgmtObject pMgmt,
 286         unsigned short wCurrCapInfo,
 287         unsigned short wCurrBeaconPeriod,
 288         unsigned int uCurrChannel,
 289         unsigned short wCurrATIMWinodw,
 290         unsigned char *pDstAddr,
 291         PWLAN_IE_SSID pCurrSSID,
 292         unsigned char *pCurrBSSID,
 293         PWLAN_IE_SUPP_RATES pCurrSuppRates,
 294         PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
 295         unsigned char byPHYType
 296 );
 297
 298 // received status
 299 static
 300 void
 301 s_vMgrLogStatus(
 302         PSMgmtObject pMgmt,
 303         unsigned short wStatus
 304 );
 305
 306 static
 307 void
 308 s_vMgrSynchBSS(
 309         PSDevice      pDevice,
 310         unsigned int uBSSMode,
 311         PKnownBSS     pCurr,
 312         PCMD_STATUS  pStatus
 313 );
 314
 315 static bool
 316 s_bCipherMatch(
 317         PKnownBSS                        pBSSNode,
 318         NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
 319         unsigned char *pbyCCSPK,
 320         unsigned char *pbyCCSGK
 321 );
 322
 323 static void  Encyption_Rebuild(
 324         PSDevice pDevice,
 325         PKnownBSS pCurr
 326 );
 327
 328 /*---------------------  Export Variables  --------------------------*/
 329
 330 /*---------------------  Export Functions  --------------------------*/
 331
 332 /*+
 333  *
 334  * Routine Description:
 335  *    Allocates and initializes the Management object.
 336  *
 337  * Return Value:
 338  *    Ndis_staus.
 339  *
 340  -*/
 341
 342 void
 343 vMgrObjectInit(
 344         void *hDeviceContext
 345 )
 346 {
 347         PSDevice     pDevice = (PSDevice)hDeviceContext;
 348         PSMgmtObject    pMgmt = pDevice->pMgmt;
 349         int ii;
 350
 351         pMgmt->pbyPSPacketPool = &pMgmt->byPSPacketPool[0];
 352         pMgmt->pbyMgmtPacketPool = &pMgmt->byMgmtPacketPool[0];
 353         pMgmt->uCurrChannel = pDevice->uChannel;
 354         for (ii = 0; ii < WLAN_BSSID_LEN; ii++) {
 355                 pMgmt->abyDesireBSSID[ii] = 0xFF;
 356         }
 357         pMgmt->sAssocInfo.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 358         //memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN +1);
 359         pMgmt->byCSSPK = KEY_CTL_NONE;
 360         pMgmt->byCSSGK = KEY_CTL_NONE;
 361         pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
 362         BSSvClearBSSList((void *)pDevice, false);
 363
 364         return;
 365 }
 366
 367 /*+
 368  *
 369  * Routine Description:
 370  *    Initializes timer object
 371  *
 372  * Return Value:
 373  *    Ndis_staus.
 374  *
 375  -*/
 376
 377 void
 378 vMgrTimerInit(
 379         void *hDeviceContext
 380 )
 381 {
 382         PSDevice     pDevice = (PSDevice)hDeviceContext;
 383         PSMgmtObject    pMgmt = pDevice->pMgmt;
 384
 385         init_timer(&pMgmt->sTimerSecondCallback);
 386         pMgmt->sTimerSecondCallback.data = (unsigned long) pDevice;
 387         pMgmt->sTimerSecondCallback.function = (TimerFunction)BSSvSecondCallBack;
 388         pMgmt->sTimerSecondCallback.expires = RUN_AT(HZ);
 389
 390         init_timer(&pDevice->sTimerCommand);
 391         pDevice->sTimerCommand.data = (unsigned long) pDevice;
 392         pDevice->sTimerCommand.function = (TimerFunction)vCommandTimer;
 393         pDevice->sTimerCommand.expires = RUN_AT(HZ);
 394
 395 #ifdef TxInSleep
 396         init_timer(&pDevice->sTimerTxData);
 397         pDevice->sTimerTxData.data = (unsigned long) pDevice;
 398         pDevice->sTimerTxData.function = (TimerFunction)BSSvSecondTxData;
 399         pDevice->sTimerTxData.expires = RUN_AT(10*HZ);      //10s callback
 400         pDevice->fTxDataInSleep = false;
 401         pDevice->IsTxDataTrigger = false;
 402         pDevice->nTxDataTimeCout = 0;
 403 #endif
 404
 405         pDevice->cbFreeCmdQueue = CMD_Q_SIZE;
 406         pDevice->uCmdDequeueIdx = 0;
 407         pDevice->uCmdEnqueueIdx = 0;
 408
 409         return;
 410 }
 411
 412 /*+
 413  *
 414  * Routine Description:
 415  *    Reset the management object structure.
 416  *
 417  * Return Value:
 418  *    None.
 419  *
 420  -*/
 421
 422 void
 423 vMgrObjectReset(
 424         void *hDeviceContext
 425 )
 426 {
 427         PSDevice         pDevice = (PSDevice)hDeviceContext;
 428         PSMgmtObject        pMgmt = pDevice->pMgmt;
 429
 430         pMgmt->eCurrMode = WMAC_MODE_STANDBY;
 431         pMgmt->eCurrState = WMAC_STATE_IDLE;
 432         pDevice->bEnablePSMode = false;
 433         // TODO: timer
 434
 435         return;
 436 }
 437
 438 /*+
 439  *
 440  * Routine Description:
 441  *    Start the station association procedure.  Namely, send an
 442  *    association request frame to the AP.
 443  *
 444  * Return Value:
 445  *    None.
 446  *
 447  -*/
 448
 449 void
 450 vMgrAssocBeginSta(
 451         void *hDeviceContext,
 452         PSMgmtObject pMgmt,
 453         PCMD_STATUS pStatus
 454 )
 455 {
 456         PSDevice             pDevice = (PSDevice)hDeviceContext;
 457         PSTxMgmtPacket          pTxPacket;
 458
 459         pMgmt->wCurrCapInfo = 0;
 460         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 461         if (pDevice->bEncryptionEnable) {
 462                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 463         }
 464         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 465         if (pMgmt->wListenInterval == 0)
 466                 pMgmt->wListenInterval = 1;    // at least one.
 467
 468         // ERP Phy (802.11g) should support short preamble.
 469         if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 470                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 471                 if (CARDbIsShorSlotTime(pMgmt->pAdapter) == true) {
 472                         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 473                 }
 474         } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 475                 if (CARDbIsShortPreamble(pMgmt->pAdapter) == true) {
 476                         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 477                 }
 478         }
 479         if (pMgmt->b11hEnable == true)
 480                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 481
 482         /* build an assocreq frame and send it */
 483         pTxPacket = s_MgrMakeAssocRequest
 484                 (
 485                         pDevice,
 486                         pMgmt,
 487                         pMgmt->abyCurrBSSID,
 488                         pMgmt->wCurrCapInfo,
 489                         pMgmt->wListenInterval,
 490                         (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 491                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 492                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 493 );
 494
 495         if (pTxPacket != NULL) {
 496                 /* send the frame */
 497                 *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 498                 if (*pStatus == CMD_STATUS_PENDING) {
 499                         pMgmt->eCurrState = WMAC_STATE_ASSOCPENDING;
 500                         *pStatus = CMD_STATUS_SUCCESS;
 501                 }
 502         } else
 503                 *pStatus = CMD_STATUS_RESOURCES;
 504
 505         return;
 506 }
 507
 508 /*+
 509  *
 510  * Routine Description:
 511  *    Start the station re-association procedure.
 512  *
 513  * Return Value:
 514  *    None.
 515  *
 516  -*/
 517
 518 void
 519 vMgrReAssocBeginSta(
 520         void *hDeviceContext,
 521         PSMgmtObject pMgmt,
 522         PCMD_STATUS pStatus
 523 )
 524 {
 525         PSDevice             pDevice = (PSDevice)hDeviceContext;
 526         PSTxMgmtPacket          pTxPacket;
 527
 528         pMgmt->wCurrCapInfo = 0;
 529         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 530         if (pDevice->bEncryptionEnable) {
 531                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 532         }
 533
 534         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 535
 536         if (pMgmt->wListenInterval == 0)
 537                 pMgmt->wListenInterval = 1;    // at least one.
 538
 539         // ERP Phy (802.11g) should support short preamble.
 540         if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 541                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 542                 if (CARDbIsShorSlotTime(pMgmt->pAdapter) == true) {
 543                         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 544                 }
 545         } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 546                 if (CARDbIsShortPreamble(pMgmt->pAdapter) == true) {
 547                         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 548                 }
 549         }
 550         if (pMgmt->b11hEnable == true)
 551                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 552
 553         pTxPacket = s_MgrMakeReAssocRequest
 554                 (
 555                         pDevice,
 556                         pMgmt,
 557                         pMgmt->abyCurrBSSID,
 558                         pMgmt->wCurrCapInfo,
 559                         pMgmt->wListenInterval,
 560                         (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 561                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 562                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 563 );
 564
 565         if (pTxPacket != NULL) {
 566                 /* send the frame */
 567                 *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 568                 if (*pStatus != CMD_STATUS_PENDING) {
 569                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx failed.\n");
 570                 } else {
 571                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx sending.\n");
 572                 }
 573         }
 574
 575         return;
 576 }
 577
 578 /*+
 579  *
 580  * Routine Description:
 581  *    Send an dis-association request frame to the AP.
 582  *
 583  * Return Value:
 584  *    None.
 585  *
 586  -*/
 587
 588 void
 589 vMgrDisassocBeginSta(
 590         void *hDeviceContext,
 591         PSMgmtObject pMgmt,
 592         unsigned char *abyDestAddress,
 593         unsigned short wReason,
 594         PCMD_STATUS pStatus
 595 )
 596 {
 597         PSDevice            pDevice = (PSDevice)hDeviceContext;
 598         PSTxMgmtPacket      pTxPacket = NULL;
 599         WLAN_FR_DISASSOC    sFrame;
 600
 601         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
 602         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DISASSOC_FR_MAXLEN);
 603         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
 604
 605         // Setup the sFrame structure
 606         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
 607         sFrame.len = WLAN_DISASSOC_FR_MAXLEN;
 608
 609         // format fixed field frame structure
 610         vMgrEncodeDisassociation(&sFrame);
 611
 612         // Setup the header
 613         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
 614                 (
 615                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
 616                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DISASSOC)
 617 ));
 618
 619         memcpy(sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
 620         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
 621         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
 622
 623         // Set reason code
 624         *(sFrame.pwReason) = cpu_to_le16(wReason);
 625         pTxPacket->cbMPDULen = sFrame.len;
 626         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
 627
 628         // send the frame
 629         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 630         if (*pStatus == CMD_STATUS_PENDING) {
 631                 pMgmt->eCurrState = WMAC_STATE_IDLE;
 632                 *pStatus = CMD_STATUS_SUCCESS;
 633         }
 634
 635         return;
 636 }
 637
 638 /*+
 639  *
 640  * Routine Description:(AP function)
 641  *    Handle incoming station association request frames.
 642  *
 643  * Return Value:
 644  *    None.
 645  *
 646  -*/
 647
 648 static
 649 void
 650 s_vMgrRxAssocRequest(
 651         PSDevice pDevice,
 652         PSMgmtObject pMgmt,
 653         PSRxMgmtPacket pRxPacket,
 654         unsigned int uNodeIndex
 655 )
 656 {
 657         WLAN_FR_ASSOCREQ    sFrame;
 658         CMD_STATUS          Status;
 659         PSTxMgmtPacket      pTxPacket;
 660         unsigned short wAssocStatus = 0;
 661         unsigned short wAssocAID = 0;
 662         unsigned int uRateLen = WLAN_RATES_MAXLEN;
 663         unsigned char abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 664         unsigned char abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 665
 666         if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 667                 return;
 668         //  node index not found
 669         if (!uNodeIndex)
 670                 return;
 671
 672         //check if node is authenticated
 673         //decode the frame
 674         memset(&sFrame, 0, sizeof(WLAN_FR_ASSOCREQ));
 675         memset(abyCurrSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 676         memset(abyCurrExtSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 677         sFrame.len = pRxPacket->cbMPDULen;
 678         sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
 679
 680         vMgrDecodeAssocRequest(&sFrame);
 681
 682         if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 683                 pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 684                 pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 685                 pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 686                 pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 687                         WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? true : false;
 688                 // Todo: check sta basic rate, if ap can't support, set status code
 689                 if (pDevice->eCurrentPHYType == PHY_TYPE_11B) {
 690                         uRateLen = WLAN_RATES_MAXLEN_11B;
 691                 }
 692                 abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 693                 abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 694                                                  (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 695                                                  uRateLen);
 696                 abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 697                 if (pDevice->eCurrentPHYType == PHY_TYPE_11G) {
 698                         abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 699                                                             (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 700                                                             uRateLen);
 701                 } else {
 702                         abyCurrExtSuppRates[1] = 0;
 703                 }
 704
 705                 RATEvParseMaxRate((void *)pDevice,
 706                                   (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 707                                   (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 708                                   false, // do not change our basic rate
 709                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 710                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 711                                   &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 712                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 713                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 714 );
 715
 716                 // set max tx rate
 717                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 718                         pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 719 #ifdef  PLICE_DEBUG
 720                 printk("RxAssocRequest:wTxDataRate is %d\n", pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate);
 721 #endif
 722                 // Todo: check sta preamble, if ap can't support, set status code
 723                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 724                         WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 725                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 726                         WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 727                 pMgmt->sNodeDBTable[uNodeIndex].wAID = (unsigned short)uNodeIndex;
 728                 wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 729                 wAssocAID = (unsigned short)uNodeIndex;
 730                 // check if ERP support
 731                 if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 732                         pMgmt->sNodeDBTable[uNodeIndex].bERPExist = true;
 733
 734                 if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 735                         // B only STA join
 736                         pDevice->bProtectMode = true;
 737                         pDevice->bNonERPPresent = true;
 738                 }
 739                 if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == false) {
 740                         pDevice->bBarkerPreambleMd = true;
 741                 }
 742
 743                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Associate AID= %d \n", wAssocAID);
 744                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 745                         sFrame.pHdr->sA3.abyAddr2[0],
 746                         sFrame.pHdr->sA3.abyAddr2[1],
 747                         sFrame.pHdr->sA3.abyAddr2[2],
 748                         sFrame.pHdr->sA3.abyAddr2[3],
 749                         sFrame.pHdr->sA3.abyAddr2[4],
 750                         sFrame.pHdr->sA3.abyAddr2[5]
 751                         );
 752                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 753                         pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 754         }//else { TODO: received STA under state1 handle }
 755         else {
 756                 return;
 757         }
 758
 759         // assoc response reply..
 760         pTxPacket = s_MgrMakeAssocResponse
 761                 (
 762                         pDevice,
 763                         pMgmt,
 764                         pMgmt->wCurrCapInfo,
 765                         wAssocStatus,
 766                         wAssocAID,
 767                         sFrame.pHdr->sA3.abyAddr2,
 768                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 769                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 770 );
 771         if (pTxPacket != NULL) {
 772                 if (pDevice->bEnableHostapd) {
 773                         return;
 774                 }
 775                 /* send the frame */
 776                 Status = csMgmt_xmit(pDevice, pTxPacket);
 777                 if (Status != CMD_STATUS_PENDING) {
 778                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx failed\n");
 779                 } else {
 780                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx sending..\n");
 781                 }
 782
 783         }
 784
 785         return;
 786 }
 787
 788 /*+
 789  *
 790  * Description:(AP function)
 791  *      Handle incoming station re-association request frames.
 792  *
 793  * Parameters:
 794  *  In:
 795  *      pMgmt           - Management Object structure
 796  *      pRxPacket       - Received Packet
 797  *  Out:
 798  *      none
 799  *
 800  * Return Value: None.
 801  *
 802  -*/
 803
 804 static
 805 void
 806 s_vMgrRxReAssocRequest(
 807         PSDevice pDevice,
 808         PSMgmtObject pMgmt,
 809         PSRxMgmtPacket pRxPacket,
 810         unsigned int uNodeIndex
 811 )
 812 {
 813         WLAN_FR_REASSOCREQ    sFrame;
 814         CMD_STATUS          Status;
 815         PSTxMgmtPacket      pTxPacket;
 816         unsigned short wAssocStatus = 0;
 817         unsigned short wAssocAID = 0;
 818         unsigned int    uRateLen = WLAN_RATES_MAXLEN;
 819         unsigned char abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 820         unsigned char abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 821
 822         if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 823                 return;
 824         //  node index not found
 825         if (!uNodeIndex)
 826                 return;
 827         //check if node is authenticated
 828         //decode the frame
 829         memset(&sFrame, 0, sizeof(WLAN_FR_REASSOCREQ));
 830         sFrame.len = pRxPacket->cbMPDULen;
 831         sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
 832         vMgrDecodeReassocRequest(&sFrame);
 833
 834         if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 835                 pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 836                 pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 837                 pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 838                 pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 839                         WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? true : false;
 840                 // Todo: check sta basic rate, if ap can't support, set status code
 841
 842                 if (pDevice->eCurrentPHYType == PHY_TYPE_11B) {
 843                         uRateLen = WLAN_RATES_MAXLEN_11B;
 844                 }
 845
 846                 abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 847                 abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 848                                                  (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 849                                                  uRateLen);
 850                 abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 851                 if (pDevice->eCurrentPHYType == PHY_TYPE_11G) {
 852                         abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 853                                                             (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 854                                                             uRateLen);
 855                 } else {
 856                         abyCurrExtSuppRates[1] = 0;
 857                 }
 858
 859                 RATEvParseMaxRate((void *)pDevice,
 860                                   (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 861                                   (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 862                                   false, // do not change our basic rate
 863                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 864                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 865                                   &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 866                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 867                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 868 );
 869
 870                 // set max tx rate
 871                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 872                         pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 873 #ifdef  PLICE_DEBUG
 874                 printk("RxReAssocRequest:TxDataRate is %d\n", pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate);
 875 #endif
 876                 // Todo: check sta preamble, if ap can't support, set status code
 877                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 878                         WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 879                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 880                         WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 881                 pMgmt->sNodeDBTable[uNodeIndex].wAID = (unsigned short)uNodeIndex;
 882                 wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 883                 wAssocAID = (unsigned short)uNodeIndex;
 884
 885                 // if suppurt ERP
 886                 if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 887                         pMgmt->sNodeDBTable[uNodeIndex].bERPExist = true;
 888
 889                 if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 890                         // B only STA join
 891                         pDevice->bProtectMode = true;
 892                         pDevice->bNonERPPresent = true;
 893                 }
 894                 if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == false) {
 895                         pDevice->bBarkerPreambleMd = true;
 896                 }
 897
 898                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Rx ReAssociate AID= %d \n", wAssocAID);
 899                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 900                         sFrame.pHdr->sA3.abyAddr2[0],
 901                         sFrame.pHdr->sA3.abyAddr2[1],
 902                         sFrame.pHdr->sA3.abyAddr2[2],
 903                         sFrame.pHdr->sA3.abyAddr2[3],
 904                         sFrame.pHdr->sA3.abyAddr2[4],
 905                         sFrame.pHdr->sA3.abyAddr2[5]
 906                         );
 907                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 908                         pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 909
 910         }
 911
 912         // assoc response reply..
 913         pTxPacket = s_MgrMakeReAssocResponse
 914                 (
 915                         pDevice,
 916                         pMgmt,
 917                         pMgmt->wCurrCapInfo,
 918                         wAssocStatus,
 919                         wAssocAID,
 920                         sFrame.pHdr->sA3.abyAddr2,
 921                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 922                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 923                         );
 924
 925         if (pTxPacket != NULL) {
 926                 /* send the frame */
 927                 if (pDevice->bEnableHostapd) {
 928                         return;
 929                 }
 930                 Status = csMgmt_xmit(pDevice, pTxPacket);
 931                 if (Status != CMD_STATUS_PENDING) {
 932                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx failed\n");
 933                 } else {
 934                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx sending..\n");
 935                 }
 936         }
 937         return;
 938 }
 939
 940 /*+
 941  *
 942  * Routine Description:
 943  *    Handle incoming association response frames.
 944  *
 945  * Return Value:
 946  *    None.
 947  *
 948  -*/
 949
 950 static
 951 void
 952 s_vMgrRxAssocResponse(
 953         PSDevice pDevice,
 954         PSMgmtObject pMgmt,
 955         PSRxMgmtPacket pRxPacket,
 956         bool bReAssocType
 957 )
 958 {
 959         WLAN_FR_ASSOCRESP   sFrame;
 960         PWLAN_IE_SSID   pItemSSID;
 961         unsigned char *pbyIEs;
 962         viawget_wpa_header *wpahdr;
 963
 964         if (pMgmt->eCurrState == WMAC_STATE_ASSOCPENDING ||
 965             pMgmt->eCurrState == WMAC_STATE_ASSOC) {
 966                 sFrame.len = pRxPacket->cbMPDULen;
 967                 sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
 968                 // decode the frame
 969                 vMgrDecodeAssocResponse(&sFrame);
 970                 if ((sFrame.pwCapInfo == 0) ||
 971                     (sFrame.pwStatus == 0) ||
 972                     (sFrame.pwAid == 0) ||
 973                     (sFrame.pSuppRates == 0)) {
 974                         DBG_PORT80(0xCC);
 975                         return;
 976                 }
 977
 978                 pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.Capabilities = *(sFrame.pwCapInfo);
 979                 pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.StatusCode = *(sFrame.pwStatus);
 980                 pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.AssociationId = *(sFrame.pwAid);
 981                 pMgmt->sAssocInfo.AssocInfo.AvailableResponseFixedIEs |= 0x07;
 982
 983                 pMgmt->sAssocInfo.AssocInfo.ResponseIELength = sFrame.len - 24 - 6;
 984                 pMgmt->sAssocInfo.AssocInfo.OffsetResponseIEs = pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs + pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 985                 pbyIEs = pMgmt->sAssocInfo.abyIEs;
 986                 pbyIEs += pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 987                 memcpy(pbyIEs, (sFrame.pBuf + 24 + 6), pMgmt->sAssocInfo.AssocInfo.ResponseIELength);
 988
 989                 // save values and set current BSS state
 990                 if (cpu_to_le16((*(sFrame.pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
 991                         // set AID
 992                         pMgmt->wCurrAID = cpu_to_le16((*(sFrame.pwAid)));
 993                         if ((pMgmt->wCurrAID >> 14) != (BIT0 | BIT1)) {
 994                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "AID from AP, has two msb clear.\n");
 995                         }
 996                         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Association Successful, AID=%d.\n", pMgmt->wCurrAID & ~(BIT14 | BIT15));
 997                         pMgmt->eCurrState = WMAC_STATE_ASSOC;
 998                         BSSvUpdateAPNode((void *)pDevice, sFrame.pwCapInfo, sFrame.pSuppRates, sFrame.pExtSuppRates);
 999                         pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
1000                         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Link with AP(SSID): %s\n", pItemSSID->abySSID);
1001                         pDevice->bLinkPass = true;
1002                         pDevice->uBBVGADiffCount = 0;
1003                         if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1004                                 if (skb_tailroom(pDevice->skb) < (sizeof(viawget_wpa_header) + pMgmt->sAssocInfo.AssocInfo.ResponseIELength +
1005                                                                   pMgmt->sAssocInfo.AssocInfo.RequestIELength)) {    //data room not enough
1006                                         dev_kfree_skb(pDevice->skb);
1007                                         pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1008                                 }
1009                                 wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1010                                 wpahdr->type = VIAWGET_ASSOC_MSG;
1011                                 wpahdr->resp_ie_len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1012                                 wpahdr->req_ie_len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1013                                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header), pMgmt->sAssocInfo.abyIEs, wpahdr->req_ie_len);
1014                                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header) + wpahdr->req_ie_len,
1015                                        pbyIEs,
1016                                        wpahdr->resp_ie_len
1017 );
1018                                 skb_put(pDevice->skb, sizeof(viawget_wpa_header) + wpahdr->resp_ie_len + wpahdr->req_ie_len);
1019                                 pDevice->skb->dev = pDevice->wpadev;
1020                                 skb_reset_mac_header(pDevice->skb);
1021                                 pDevice->skb->pkt_type = PACKET_HOST;
1022                                 pDevice->skb->protocol = htons(ETH_P_802_2);
1023                                 memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1024                                 netif_rx(pDevice->skb);
1025                                 pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1026                         }
1027
1028 //2008-0409-07, <Add> by Einsn Liu
1029 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1030                         {
1031                                 unsigned char buf[512];
1032                                 size_t len;
1033                                 union iwreq_data  wrqu;
1034                                 int we_event;
1035
1036                                 memset(buf, 0, 512);
1037
1038                                 len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1039                                 if (len)        {
1040                                         memcpy(buf, pMgmt->sAssocInfo.abyIEs, len);
1041                                         memset(&wrqu, 0, sizeof(wrqu));
1042                                         wrqu.data.length = len;
1043                                         we_event = IWEVASSOCREQIE;
1044                                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1045                                 }
1046
1047                                 memset(buf, 0, 512);
1048                                 len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1049
1050                                 if (len)        {
1051                                         memcpy(buf, pbyIEs, len);
1052                                         memset(&wrqu, 0, sizeof(wrqu));
1053                                         wrqu.data.length = len;
1054                                         we_event = IWEVASSOCRESPIE;
1055                                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1056                                 }
1057
1058                                 memset(&wrqu, 0, sizeof(wrqu));
1059                                 memcpy(wrqu.ap_addr.sa_data, &pMgmt->abyCurrBSSID[0], ETH_ALEN);
1060                                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1061                                 wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1062                         }
1063 #endif //#ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1064 //End Add -- //2008-0409-07, <Add> by Einsn Liu
1065                 } else {
1066                         if (bReAssocType) {
1067                                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1068                         } else {
1069                                 // jump back to the auth state and indicate the error
1070                                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1071                         }
1072                         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(sFrame.pwStatus))));
1073                 }
1074
1075         }
1076
1077 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1078 //need clear flags related to Networkmanager
1079
1080         pDevice->bwextcount = 0;
1081         pDevice->bWPASuppWextEnabled = false;
1082 #endif
1083
1084         if (pMgmt->eCurrState == WMAC_STATE_ASSOC)
1085                 timer_expire(pDevice->sTimerCommand, 0);
1086         return;
1087 }
1088
1089 /*+
1090  *
1091  * Routine Description:
1092  *    Start the station authentication procedure.  Namely, send an
1093  *    authentication frame to the AP.
1094  *
1095  * Return Value:
1096  *    None.
1097  *
1098  -*/
1099
1100 void
1101 vMgrAuthenBeginSta(
1102         void *hDeviceContext,
1103         PSMgmtObject  pMgmt,
1104         PCMD_STATUS pStatus
1105 )
1106 {
1107         PSDevice     pDevice = (PSDevice)hDeviceContext;
1108         WLAN_FR_AUTHEN  sFrame;
1109         PSTxMgmtPacket  pTxPacket = NULL;
1110
1111         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1112         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1113         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
1114         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
1115         sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1116         vMgrEncodeAuthen(&sFrame);
1117         /* insert values */
1118         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1119                 (
1120                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1121                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)
1122 ));
1123         memcpy(sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
1124         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1125         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1126         if (pMgmt->bShareKeyAlgorithm)
1127                 *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_SHAREDKEY);
1128         else
1129                 *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_OPENSYSTEM);
1130
1131         *(sFrame.pwAuthSequence) = cpu_to_le16(1);
1132         /* Adjust the length fields */
1133         pTxPacket->cbMPDULen = sFrame.len;
1134         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1135
1136         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1137         if (*pStatus == CMD_STATUS_PENDING) {
1138                 pMgmt->eCurrState = WMAC_STATE_AUTHPENDING;
1139                 *pStatus = CMD_STATUS_SUCCESS;
1140         }
1141
1142         return;
1143 }
1144
1145 /*+
1146  *
1147  * Routine Description:
1148  *    Start the station(AP) deauthentication procedure.  Namely, send an
1149  *    deauthentication frame to the AP or Sta.
1150  *
1151  * Return Value:
1152  *    None.
1153  *
1154  -*/
1155
1156 void
1157 vMgrDeAuthenBeginSta(
1158         void *hDeviceContext,
1159         PSMgmtObject  pMgmt,
1160         unsigned char *abyDestAddress,
1161         unsigned short wReason,
1162         PCMD_STATUS pStatus
1163 )
1164 {
1165         PSDevice            pDevice = (PSDevice)hDeviceContext;
1166         WLAN_FR_DEAUTHEN    sFrame;
1167         PSTxMgmtPacket      pTxPacket = NULL;
1168
1169         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1170         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DEAUTHEN_FR_MAXLEN);
1171         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
1172         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
1173         sFrame.len = WLAN_DEAUTHEN_FR_MAXLEN;
1174         vMgrEncodeDeauthen(&sFrame);
1175         /* insert values */
1176         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1177                 (
1178                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1179                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DEAUTHEN)
1180 ));
1181
1182         memcpy(sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
1183         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1184         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1185
1186         *(sFrame.pwReason) = cpu_to_le16(wReason);       // deauthen. bcs left BSS
1187         /* Adjust the length fields */
1188         pTxPacket->cbMPDULen = sFrame.len;
1189         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1190
1191         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1192         if (*pStatus == CMD_STATUS_PENDING) {
1193                 *pStatus = CMD_STATUS_SUCCESS;
1194         }
1195
1196         return;
1197 }
1198
1199 /*+
1200  *
1201  * Routine Description:
1202  *    Handle incoming authentication frames.
1203  *
1204  * Return Value:
1205  *    None.
1206  *
1207  -*/
1208
1209 static
1210 void
1211 s_vMgrRxAuthentication(
1212         PSDevice pDevice,
1213         PSMgmtObject pMgmt,
1214         PSRxMgmtPacket pRxPacket
1215 )
1216 {
1217         WLAN_FR_AUTHEN  sFrame;
1218
1219         // we better be an AP or a STA in AUTHPENDING otherwise ignore
1220         if (!(pMgmt->eCurrMode == WMAC_MODE_ESS_AP ||
1221               pMgmt->eCurrState == WMAC_STATE_AUTHPENDING)) {
1222                 return;
1223         }
1224
1225         // decode the frame
1226         sFrame.len = pRxPacket->cbMPDULen;
1227         sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
1228         vMgrDecodeAuthen(&sFrame);
1229         switch (cpu_to_le16((*(sFrame.pwAuthSequence)))) {
1230         case 1:
1231                 //AP function
1232                 s_vMgrRxAuthenSequence_1(pDevice, pMgmt, &sFrame);
1233                 break;
1234         case 2:
1235                 s_vMgrRxAuthenSequence_2(pDevice, pMgmt, &sFrame);
1236                 break;
1237         case 3:
1238                 //AP function
1239                 s_vMgrRxAuthenSequence_3(pDevice, pMgmt, &sFrame);
1240                 break;
1241         case 4:
1242                 s_vMgrRxAuthenSequence_4(pDevice, pMgmt, &sFrame);
1243                 break;
1244         default:
1245                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Auth Sequence error, seq = %d\n",
1246                         cpu_to_le16((*(sFrame.pwAuthSequence))));
1247                 break;
1248         }
1249         return;
1250 }
1251
1252 /*+
1253  *
1254  * Routine Description:
1255  *   Handles incoming authen frames with sequence 1.  Currently
1256  *   assumes we're an AP.  So far, no one appears to use authentication
1257  *   in Ad-Hoc mode.
1258  *
1259  * Return Value:
1260  *    None.
1261  *
1262  -*/
1263
1264 static
1265 void
1266 s_vMgrRxAuthenSequence_1(
1267         PSDevice pDevice,
1268         PSMgmtObject pMgmt,
1269         PWLAN_FR_AUTHEN pFrame
1270 )
1271 {
1272         PSTxMgmtPacket      pTxPacket = NULL;
1273         unsigned int    uNodeIndex;
1274         WLAN_FR_AUTHEN      sFrame;
1275         PSKeyItem           pTransmitKey;
1276
1277         // Insert a Node entry
1278         if (!BSSDBbIsSTAInNodeDB(pMgmt, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1279                 BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
1280                 memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, pFrame->pHdr->sA3.abyAddr2,
1281                        WLAN_ADDR_LEN);
1282         }
1283
1284         if (pMgmt->bShareKeyAlgorithm) {
1285                 pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_KNOWN;
1286                 pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 1;
1287         } else {
1288                 pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1289         }
1290
1291         // send auth reply
1292         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1293         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1294         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
1295         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
1296         sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1297         // format buffer structure
1298         vMgrEncodeAuthen(&sFrame);
1299         // insert values
1300         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1301                 (
1302                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1303                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1304                         WLAN_SET_FC_ISWEP(0)
1305 ));
1306         memcpy(sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1307         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1308         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1309         *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1310         *(sFrame.pwAuthSequence) = cpu_to_le16(2);
1311
1312         if (cpu_to_le16(*(pFrame->pwAuthAlgorithm)) == WLAN_AUTH_ALG_SHAREDKEY) {
1313                 if (pMgmt->bShareKeyAlgorithm)
1314                         *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1315                 else
1316                         *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1317         } else {
1318                 if (pMgmt->bShareKeyAlgorithm)
1319                         *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1320                 else
1321                         *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1322         }
1323
1324         if (pMgmt->bShareKeyAlgorithm &&
1325             (cpu_to_le16(*(sFrame.pwStatus)) == WLAN_MGMT_STATUS_SUCCESS)) {
1326                 sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1327                 sFrame.len += WLAN_CHALLENGE_IE_LEN;
1328                 sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1329                 sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1330                 memset(pMgmt->abyChallenge, 0, WLAN_CHALLENGE_LEN);
1331                 // get group key
1332                 if (KeybGetTransmitKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, GROUP_KEY, &pTransmitKey) == true) {
1333                         rc4_init(&pDevice->SBox, pDevice->abyPRNG, pTransmitKey->uKeyLength+3);
1334                         rc4_encrypt(&pDevice->SBox, pMgmt->abyChallenge, pMgmt->abyChallenge, WLAN_CHALLENGE_LEN);
1335                 }
1336                 memcpy(sFrame.pChallenge->abyChallenge, pMgmt->abyChallenge , WLAN_CHALLENGE_LEN);
1337         }
1338
1339         /* Adjust the length fields */
1340         pTxPacket->cbMPDULen = sFrame.len;
1341         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1342         // send the frame
1343         if (pDevice->bEnableHostapd) {
1344                 return;
1345         }
1346         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx.. \n");
1347         if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1348                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx failed.\n");
1349         }
1350         return;
1351 }
1352
1353 /*+
1354  *
1355  * Routine Description:
1356  *   Handles incoming auth frames with sequence number 2.  Currently
1357  *   assumes we're a station.
1358  *
1359  *
1360  * Return Value:
1361  *    None.
1362  *
1363  -*/
1364
1365 static
1366 void
1367 s_vMgrRxAuthenSequence_2(
1368         PSDevice pDevice,
1369         PSMgmtObject pMgmt,
1370         PWLAN_FR_AUTHEN pFrame
1371 )
1372 {
1373         WLAN_FR_AUTHEN      sFrame;
1374         PSTxMgmtPacket      pTxPacket = NULL;
1375
1376         switch (cpu_to_le16((*(pFrame->pwAuthAlgorithm)))) {
1377         case WLAN_AUTH_ALG_OPENSYSTEM:
1378                 if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1379                         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Successful.\n");
1380                         pMgmt->eCurrState = WMAC_STATE_AUTH;
1381                         timer_expire(pDevice->sTimerCommand, 0);
1382                 } else {
1383                         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Failed.\n");
1384                         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1385                         pMgmt->eCurrState = WMAC_STATE_IDLE;
1386                 }
1387                 if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT) {
1388 //                spin_unlock_irq(&pDevice->lock);
1389 //                vCommandTimerWait((void *)pDevice, 0);
1390 //                spin_lock_irq(&pDevice->lock);
1391                 }
1392
1393                 break;
1394
1395         case WLAN_AUTH_ALG_SHAREDKEY:
1396
1397                 if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1398                         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1399                         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1400                         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
1401                         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
1402                         sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1403                         // format buffer structure
1404                         vMgrEncodeAuthen(&sFrame);
1405                         // insert values
1406                         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1407                                 (
1408                                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1409                                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1410                                         WLAN_SET_FC_ISWEP(1)
1411 ));
1412                         memcpy(sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1413                         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1414                         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1415                         *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1416                         *(sFrame.pwAuthSequence) = cpu_to_le16(3);
1417                         *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1418                         sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1419                         sFrame.len += WLAN_CHALLENGE_IE_LEN;
1420                         sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1421                         sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1422                         memcpy(sFrame.pChallenge->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN);
1423                         // Adjust the length fields
1424                         pTxPacket->cbMPDULen = sFrame.len;
1425                         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1426                         // send the frame
1427                         if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1428                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx failed.\n");
1429                         }
1430                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx ...\n");
1431                 } else {
1432                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:rx Auth_reply sequence_2 status error ...\n");
1433                         if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT) {
1434 //                    spin_unlock_irq(&pDevice->lock);
1435 //                    vCommandTimerWait((void *)pDevice, 0);
1436 //                    spin_lock_irq(&pDevice->lock);
1437                         }
1438                         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1439                 }
1440                 break;
1441         default:
1442                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt: rx auth.seq = 2 unknown AuthAlgorithm=%d\n", cpu_to_le16((*(pFrame->pwAuthAlgorithm))));
1443                 break;
1444         }
1445         return;
1446 }
1447
1448 /*+
1449  *
1450  * Routine Description:
1451  *   Handles incoming authen frames with sequence 3.  Currently
1452  *   assumes we're an AP.  This function assumes the frame has
1453  *   already been successfully decrypted.
1454  *
1455  *
1456  * Return Value:
1457  *    None.
1458  *
1459  -*/
1460
1461 static
1462 void
1463 s_vMgrRxAuthenSequence_3(
1464         PSDevice pDevice,
1465         PSMgmtObject pMgmt,
1466         PWLAN_FR_AUTHEN pFrame
1467 )
1468 {
1469         PSTxMgmtPacket      pTxPacket = NULL;
1470         unsigned int uStatusCode = 0;
1471         unsigned int uNodeIndex = 0;
1472         WLAN_FR_AUTHEN      sFrame;
1473
1474         if (!WLAN_GET_FC_ISWEP(pFrame->pHdr->sA3.wFrameCtl)) {
1475                 uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1476                 goto reply;
1477         }
1478         if (BSSDBbIsSTAInNodeDB(pMgmt, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1479                 if (pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence != 1) {
1480                         uStatusCode = WLAN_MGMT_STATUS_RX_AUTH_NOSEQ;
1481                         goto reply;
1482                 }
1483                 if (memcmp(pMgmt->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN) != 0) {
1484                         uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1485                         goto reply;
1486                 }
1487         } else {
1488                 uStatusCode = WLAN_MGMT_STATUS_UNSPEC_FAILURE;
1489                 goto reply;
1490         }
1491
1492         if (uNodeIndex) {
1493                 pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1494                 pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 0;
1495         }
1496         uStatusCode = WLAN_MGMT_STATUS_SUCCESS;
1497         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Challenge text check ok..\n");
1498
1499 reply:
1500         // send auth reply
1501         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1502         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1503         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
1504         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
1505         sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1506         // format buffer structure
1507         vMgrEncodeAuthen(&sFrame);
1508         /* insert values */
1509         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1510                 (
1511                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1512                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1513                         WLAN_SET_FC_ISWEP(0)
1514 ));
1515         memcpy(sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1516         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1517         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1518         *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1519         *(sFrame.pwAuthSequence) = cpu_to_le16(4);
1520         *(sFrame.pwStatus) = cpu_to_le16(uStatusCode);
1521
1522         /* Adjust the length fields */
1523         pTxPacket->cbMPDULen = sFrame.len;
1524         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1525         // send the frame
1526         if (pDevice->bEnableHostapd) {
1527                 return;
1528         }
1529         if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1530                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_4 tx failed.\n");
1531         }
1532         return;
1533 }
1534
1535 /*+
1536  *
1537  * Routine Description:
1538  *   Handles incoming authen frames with sequence 4
1539  *
1540  *
1541  * Return Value:
1542  *    None.
1543  *
1544  -*/
1545 static
1546 void
1547 s_vMgrRxAuthenSequence_4(
1548         PSDevice pDevice,
1549         PSMgmtObject pMgmt,
1550         PWLAN_FR_AUTHEN pFrame
1551 )
1552 {
1553         if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1554                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Successful.\n");
1555                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1556                 timer_expire(pDevice->sTimerCommand, 0);
1557         } else{
1558                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Failed.\n");
1559                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1560                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1561         }
1562
1563         if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT) {
1564 //        spin_unlock_irq(&pDevice->lock);
1565 //        vCommandTimerWait((void *)pDevice, 0);
1566 //        spin_lock_irq(&pDevice->lock);
1567         }
1568 }
1569
1570 /*+
1571  *
1572  * Routine Description:
1573  *   Handles incoming disassociation frames
1574  *
1575  *
1576  * Return Value:
1577  *    None.
1578  *
1579  -*/
1580
1581 static
1582 void
1583 s_vMgrRxDisassociation(
1584         PSDevice pDevice,
1585         PSMgmtObject pMgmt,
1586         PSRxMgmtPacket pRxPacket
1587 )
1588 {
1589         WLAN_FR_DISASSOC    sFrame;
1590         unsigned int uNodeIndex = 0;
1591 //    CMD_STATUS          CmdStatus;
1592         viawget_wpa_header *wpahdr;
1593
1594         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
1595                 // if is acting an AP..
1596                 // a STA is leaving this BSS..
1597                 sFrame.len = pRxPacket->cbMPDULen;
1598                 sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
1599                 if (BSSDBbIsSTAInNodeDB(pMgmt, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1600                         BSSvRemoveOneNode(pDevice, uNodeIndex);
1601                 } else {
1602                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx disassoc, sta not found\n");
1603                 }
1604         } else if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) {
1605                 sFrame.len = pRxPacket->cbMPDULen;
1606                 sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
1607                 vMgrDecodeDisassociation(&sFrame);
1608                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP disassociated me, reason=%d.\n", cpu_to_le16(*(sFrame.pwReason)));
1609                 //TODO: do something let upper layer know or
1610                 //try to send associate packet again because of inactivity timeout
1611                 if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1612                         wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1613                         wpahdr->type = VIAWGET_DISASSOC_MSG;
1614                         wpahdr->resp_ie_len = 0;
1615                         wpahdr->req_ie_len = 0;
1616                         skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1617                         pDevice->skb->dev = pDevice->wpadev;
1618                         skb_reset_mac_header(pDevice->skb);
1619
1620                         pDevice->skb->pkt_type = PACKET_HOST;
1621                         pDevice->skb->protocol = htons(ETH_P_802_2);
1622                         memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1623                         netif_rx(pDevice->skb);
1624                         pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1625                 }
1626
1627 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1628                 {
1629                         union iwreq_data  wrqu;
1630                         memset(&wrqu, 0, sizeof(wrqu));
1631                         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1632                         printk("wireless_send_event--->SIOCGIWAP(disassociated)\n");
1633                         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1634                 }
1635 #endif
1636         }
1637         /* else, ignore it */
1638
1639         return;
1640 }
1641
1642 /*+
1643  *
1644  * Routine Description:
1645  *   Handles incoming deauthentication frames
1646  *
1647  *
1648  * Return Value:
1649  *    None.
1650  *
1651  -*/
1652
1653 static
1654 void
1655 s_vMgrRxDeauthentication(
1656         PSDevice pDevice,
1657         PSMgmtObject pMgmt,
1658         PSRxMgmtPacket pRxPacket
1659 )
1660 {
1661         WLAN_FR_DEAUTHEN    sFrame;
1662         unsigned int uNodeIndex = 0;
1663         viawget_wpa_header *wpahdr;
1664
1665         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
1666                 //Todo:
1667                 // if is acting an AP..
1668                 // a STA is leaving this BSS..
1669                 sFrame.len = pRxPacket->cbMPDULen;
1670                 sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
1671                 if (BSSDBbIsSTAInNodeDB(pMgmt, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1672                         BSSvRemoveOneNode(pDevice, uNodeIndex);
1673                 } else {
1674                         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Rx deauth, sta not found\n");
1675                 }
1676         } else {
1677                 if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) {
1678                         sFrame.len = pRxPacket->cbMPDULen;
1679                         sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
1680                         vMgrDecodeDeauthen(&sFrame);
1681                         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO  "AP deauthed me, reason=%d.\n", cpu_to_le16((*(sFrame.pwReason))));
1682                         // TODO: update BSS list for specific BSSID if pre-authentication case
1683                         if (ether_addr_equal(sFrame.pHdr->sA3.abyAddr3,
1684                                              pMgmt->abyCurrBSSID)) {
1685                                 if (pMgmt->eCurrState >= WMAC_STATE_AUTHPENDING) {
1686                                         pMgmt->sNodeDBTable[0].bActive = false;
1687                                         pMgmt->eCurrMode = WMAC_MODE_STANDBY;
1688                                         pMgmt->eCurrState = WMAC_STATE_IDLE;
1689                                         netif_stop_queue(pDevice->dev);
1690                                         pDevice->bLinkPass = false;
1691                                 }
1692                         }
1693
1694                         if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1695                                 wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1696                                 wpahdr->type = VIAWGET_DISASSOC_MSG;
1697                                 wpahdr->resp_ie_len = 0;
1698                                 wpahdr->req_ie_len = 0;
1699                                 skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1700                                 pDevice->skb->dev = pDevice->wpadev;
1701                                 skb_reset_mac_header(pDevice->skb);
1702                                 pDevice->skb->pkt_type = PACKET_HOST;
1703                                 pDevice->skb->protocol = htons(ETH_P_802_2);
1704                                 memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1705                                 netif_rx(pDevice->skb);
1706                                 pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1707                         }
1708
1709 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1710                         {
1711                                 union iwreq_data  wrqu;
1712                                 memset(&wrqu, 0, sizeof(wrqu));
1713                                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1714                                 PRINT_K("wireless_send_event--->SIOCGIWAP(disauthen)\n");
1715                                 wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1716                         }
1717 #endif
1718
1719                 }
1720                 /* else, ignore it.  TODO: IBSS authentication service
1721                    would be implemented here */
1722         };
1723         return;
1724 }
1725
1726 //2008-8-4 <add> by chester
1727 /*+
1728  *
1729  * Routine Description:
1730  * check if current channel is match ZoneType.
1731  *for USA:1~11;
1732  *      Japan:1~13;
1733  *      Europe:1~13
1734  * Return Value:
1735  *               True:exceed;
1736  *                False:normal case
1737  -*/
1738 static bool
1739 ChannelExceedZoneType(
1740         PSDevice pDevice,
1741         unsigned char byCurrChannel
1742 )
1743 {
1744         bool exceed = false;
1745
1746         switch (pDevice->byZoneType) {
1747         case 0x00:                  //USA:1~11
1748                 if ((byCurrChannel < 1) || (byCurrChannel > 11))
1749                         exceed = true;
1750                 break;
1751         case 0x01:                  //Japan:1~13
1752         case 0x02:                  //Europe:1~13
1753                 if ((byCurrChannel < 1) || (byCurrChannel > 13))
1754                         exceed = true;
1755                 break;
1756         default:                    //reserve for other zonetype
1757                 break;
1758         }
1759
1760         return exceed;
1761 }
1762
1763 /*+
1764  *
1765  * Routine Description:
1766  *   Handles and analysis incoming beacon frames.
1767  *
1768  *
1769  * Return Value:
1770  *    None.
1771  *
1772  -*/
1773
1774 static
1775 void
1776 s_vMgrRxBeacon(
1777         PSDevice pDevice,
1778         PSMgmtObject pMgmt,
1779         PSRxMgmtPacket pRxPacket,
1780         bool bInScan
1781 )
1782 {
1783         PKnownBSS           pBSSList;
1784         WLAN_FR_BEACON      sFrame;
1785         QWORD               qwTSFOffset;
1786         bool bIsBSSIDEqual = false;
1787         bool bIsSSIDEqual = false;
1788         bool bTSFLargeDiff = false;
1789         bool bTSFOffsetPostive = false;
1790         bool bUpdateTSF = false;
1791         bool bIsAPBeacon = false;
1792         bool bIsChannelEqual = false;
1793         unsigned int uLocateByteIndex;
1794         unsigned char byTIMBitOn = 0;
1795         unsigned short wAIDNumber = 0;
1796         unsigned int uNodeIndex;
1797         QWORD               qwTimestamp, qwLocalTSF;
1798         QWORD               qwCurrTSF;
1799         unsigned short wStartIndex = 0;
1800         unsigned short wAIDIndex = 0;
1801         unsigned char byCurrChannel = pRxPacket->byRxChannel;
1802         ERPObject           sERP;
1803         unsigned int uRateLen = WLAN_RATES_MAXLEN;
1804         bool bChannelHit = false;
1805         bool bUpdatePhyParameter = false;
1806         unsigned char byIEChannel = 0;
1807
1808         memset(&sFrame, 0, sizeof(WLAN_FR_BEACON));
1809         sFrame.len = pRxPacket->cbMPDULen;
1810         sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
1811
1812         // decode the beacon frame
1813         vMgrDecodeBeacon(&sFrame);
1814
1815         if ((sFrame.pwBeaconInterval == 0) ||
1816             (sFrame.pwCapInfo == 0) ||
1817             (sFrame.pSSID == 0) ||
1818             (sFrame.pSuppRates == 0)) {
1819                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx beacon frame error\n");
1820                 return;
1821         }
1822
1823         if (sFrame.pDSParms != NULL) {
1824                 if (byCurrChannel > CB_MAX_CHANNEL_24G) {
1825                         // channel remapping to
1826                         byIEChannel = get_channel_mapping(pDevice, sFrame.pDSParms->byCurrChannel, PHY_TYPE_11A);
1827                 } else {
1828                         byIEChannel = sFrame.pDSParms->byCurrChannel;
1829                 }
1830                 if (byCurrChannel != byIEChannel) {
1831                         // adjust channel info. bcs we rcv adjacent channel packets
1832                         bChannelHit = false;
1833                         byCurrChannel = byIEChannel;
1834                 }
1835         } else {
1836                 // no DS channel info
1837                 bChannelHit = true;
1838         }
1839 //2008-0730-01<Add>by MikeLiu
1840         if (ChannelExceedZoneType(pDevice, byCurrChannel) == true)
1841                 return;
1842
1843         if (sFrame.pERP != NULL) {
1844                 sERP.byERP = sFrame.pERP->byContext;
1845                 sERP.bERPExist = true;
1846
1847         } else {
1848                 sERP.bERPExist = false;
1849                 sERP.byERP = 0;
1850         }
1851
1852         pBSSList = BSSpAddrIsInBSSList((void *)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
1853         if (pBSSList == NULL) {
1854                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Beacon/insert: RxChannel = : %d\n", byCurrChannel);
1855                 BSSbInsertToBSSList((void *)pDevice,
1856                                     sFrame.pHdr->sA3.abyAddr3,
1857                                     *sFrame.pqwTimestamp,
1858                                     *sFrame.pwBeaconInterval,
1859                                     *sFrame.pwCapInfo,
1860                                     byCurrChannel,
1861                                     sFrame.pSSID,
1862                                     sFrame.pSuppRates,
1863                                     sFrame.pExtSuppRates,
1864                                     &sERP,
1865                                     sFrame.pRSN,
1866                                     sFrame.pRSNWPA,
1867                                     sFrame.pIE_Country,
1868                                     sFrame.pIE_Quiet,
1869                                     sFrame.len - WLAN_HDR_ADDR3_LEN,
1870                                     sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
1871                                     (void *)pRxPacket
1872 );
1873         } else {
1874 //        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "update bcn: RxChannel = : %d\n", byCurrChannel);
1875                 BSSbUpdateToBSSList((void *)pDevice,
1876                                     *sFrame.pqwTimestamp,
1877                                     *sFrame.pwBeaconInterval,
1878                                     *sFrame.pwCapInfo,
1879                                     byCurrChannel,
1880                                     bChannelHit,
1881                                     sFrame.pSSID,
1882                                     sFrame.pSuppRates,
1883                                     sFrame.pExtSuppRates,
1884                                     &sERP,
1885                                     sFrame.pRSN,
1886                                     sFrame.pRSNWPA,
1887                                     sFrame.pIE_Country,
1888                                     sFrame.pIE_Quiet,
1889                                     pBSSList,
1890                                     sFrame.len - WLAN_HDR_ADDR3_LEN,
1891                                     sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
1892                                     (void *)pRxPacket
1893 );
1894
1895         }
1896
1897         if (bInScan) {
1898                 return;
1899         }
1900
1901         if (byCurrChannel == (unsigned char)pMgmt->uCurrChannel)
1902                 bIsChannelEqual = true;
1903
1904         if (bIsChannelEqual && (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)) {
1905                 // if rx beacon without ERP field
1906                 if (sERP.bERPExist) {
1907                         if (WLAN_GET_ERP_USE_PROTECTION(sERP.byERP)) {
1908                                 pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
1909                                 pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
1910                         }
1911                 } else {
1912                         pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
1913                         pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
1914                 }
1915
1916                 if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
1917                         if (!WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo))
1918                                 pDevice->byERPFlag |= WLAN_SET_ERP_BARKER_MODE(1);
1919                         if (!sERP.bERPExist)
1920                                 pDevice->byERPFlag |= WLAN_SET_ERP_NONERP_PRESENT(1);
1921                 }
1922
1923                 // set to MAC&BBP
1924                 if (WLAN_GET_ERP_USE_PROTECTION(pDevice->byERPFlag)) {
1925                         if (!pDevice->bProtectMode) {
1926                                 MACvEnableProtectMD(pDevice->PortOffset);
1927                                 pDevice->bProtectMode = true;
1928                         }
1929                 }
1930         }
1931
1932         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)
1933                 return;
1934
1935         // check if BSSID the same
1936         if (memcmp(sFrame.pHdr->sA3.abyAddr3,
1937                    pMgmt->abyCurrBSSID,
1938                    WLAN_BSSID_LEN) == 0) {
1939                 bIsBSSIDEqual = true;
1940
1941 // 2008-05-21 <add> by Richardtai
1942                 pDevice->uCurrRSSI = pRxPacket->uRSSI;
1943                 pDevice->byCurrSQ = pRxPacket->bySQ;
1944
1945                 if (pMgmt->sNodeDBTable[0].uInActiveCount != 0) {
1946                         pMgmt->sNodeDBTable[0].uInActiveCount = 0;
1947                         //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:Wake Count= [%d]\n", pMgmt->wCountToWakeUp);
1948                 }
1949         }
1950         // check if SSID the same
1951         if (sFrame.pSSID->len == ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) {
1952                 if (memcmp(sFrame.pSSID->abySSID,
1953                            ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
1954                            sFrame.pSSID->len
1955 ) == 0) {
1956                         bIsSSIDEqual = true;
1957                 }
1958         }
1959
1960         if ((WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo) == true) &&
1961             (bIsBSSIDEqual == true) &&
1962             (bIsSSIDEqual == true) &&
1963             (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
1964             (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
1965                 // add state check to prevent reconnect fail since we'll receive Beacon
1966
1967                 bIsAPBeacon = true;
1968
1969                 if (pBSSList != NULL) {
1970                         // Compare PHY parameter setting
1971                         if (pMgmt->wCurrCapInfo != pBSSList->wCapInfo) {
1972                                 bUpdatePhyParameter = true;
1973                                 pMgmt->wCurrCapInfo = pBSSList->wCapInfo;
1974                         }
1975                         if (sFrame.pERP != NULL) {
1976                                 if ((sFrame.pERP->byElementID == WLAN_EID_ERP) &&
1977                                     (pMgmt->byERPContext != sFrame.pERP->byContext)) {
1978                                         bUpdatePhyParameter = true;
1979                                         pMgmt->byERPContext = sFrame.pERP->byContext;
1980                                 }
1981                         }
1982                         //
1983                         // Basic Rate Set may change dynamically
1984                         //
1985                         if (pBSSList->eNetworkTypeInUse == PHY_TYPE_11B) {
1986                                 uRateLen = WLAN_RATES_MAXLEN_11B;
1987                         }
1988                         pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abySuppRates,
1989                                                                 (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
1990                                                                 uRateLen);
1991                         pMgmt->abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abyExtSuppRates,
1992                                                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
1993                                                                    uRateLen);
1994                         RATEvParseMaxRate((void *)pDevice,
1995                                           (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
1996                                           (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
1997                                           true,
1998                                           &(pMgmt->sNodeDBTable[0].wMaxBasicRate),
1999                                           &(pMgmt->sNodeDBTable[0].wMaxSuppRate),
2000                                           &(pMgmt->sNodeDBTable[0].wSuppRate),
2001                                           &(pMgmt->sNodeDBTable[0].byTopCCKBasicRate),
2002                                           &(pMgmt->sNodeDBTable[0].byTopOFDMBasicRate)
2003                                 );
2004                         if (bUpdatePhyParameter == true) {
2005                                 CARDbSetPhyParameter(pMgmt->pAdapter,
2006                                                      pMgmt->eCurrentPHYMode,
2007                                                      pMgmt->wCurrCapInfo,
2008                                                      pMgmt->byERPContext,
2009                                                      pMgmt->abyCurrSuppRates,
2010                                                      pMgmt->abyCurrExtSuppRates
2011                                         );
2012                         }
2013                         if (sFrame.pIE_PowerConstraint != NULL) {
2014                                 CARDvSetPowerConstraint(pMgmt->pAdapter,
2015                                                         (unsigned char) pBSSList->uChannel,
2016                                                         sFrame.pIE_PowerConstraint->byPower
2017 );
2018                         }
2019                         if (sFrame.pIE_CHSW != NULL) {
2020                                 CARDbChannelSwitch(pMgmt->pAdapter,
2021                                                    sFrame.pIE_CHSW->byMode,
2022                                                    get_channel_mapping(pMgmt->pAdapter, sFrame.pIE_CHSW->byMode, pMgmt->eCurrentPHYMode),
2023                                                    sFrame.pIE_CHSW->byCount
2024                                         );
2025
2026                         } else if (bIsChannelEqual == false) {
2027                                 set_channel(pMgmt->pAdapter, pBSSList->uChannel);
2028                         }
2029                 }
2030         }
2031
2032 //    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Beacon 2 \n");
2033         // check if CF field exists
2034         if (WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)) {
2035                 if (sFrame.pCFParms->wCFPDurRemaining > 0) {
2036                         // TODO: deal with CFP period to set NAV
2037                 }
2038         }
2039
2040         HIDWORD(qwTimestamp) = cpu_to_le32(HIDWORD(*sFrame.pqwTimestamp));
2041         LODWORD(qwTimestamp) = cpu_to_le32(LODWORD(*sFrame.pqwTimestamp));
2042         HIDWORD(qwLocalTSF) = HIDWORD(pRxPacket->qwLocalTSF);
2043         LODWORD(qwLocalTSF) = LODWORD(pRxPacket->qwLocalTSF);
2044
2045         // check if beacon TSF larger or small than our local TSF
2046         if (HIDWORD(qwTimestamp) == HIDWORD(qwLocalTSF)) {
2047                 if (LODWORD(qwTimestamp) >= LODWORD(qwLocalTSF)) {
2048                         bTSFOffsetPostive = true;
2049                 } else {
2050                         bTSFOffsetPostive = false;
2051                 }
2052         } else if (HIDWORD(qwTimestamp) > HIDWORD(qwLocalTSF)) {
2053                 bTSFOffsetPostive = true;
2054         } else if (HIDWORD(qwTimestamp) < HIDWORD(qwLocalTSF)) {
2055                 bTSFOffsetPostive = false;
2056         }
2057
2058         if (bTSFOffsetPostive) {
2059                 qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwTimestamp), (qwLocalTSF));
2060         } else {
2061                 qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwLocalTSF), (qwTimestamp));
2062         }
2063
2064         if (HIDWORD(qwTSFOffset) != 0 ||
2065             (LODWORD(qwTSFOffset) > TRIVIAL_SYNC_DIFFERENCE)) {
2066                 bTSFLargeDiff = true;
2067         }
2068
2069         // if infra mode
2070         if (bIsAPBeacon == true) {
2071                 // Infra mode: Local TSF always follow AP's TSF if Difference huge.
2072                 if (bTSFLargeDiff)
2073                         bUpdateTSF = true;
2074
2075                 if ((pDevice->bEnablePSMode == true) && (sFrame.pTIM != 0)) {
2076                         // deal with DTIM, analysis TIM
2077                         pMgmt->bMulticastTIM = WLAN_MGMT_IS_MULTICAST_TIM(sFrame.pTIM->byBitMapCtl) ? true : false;
2078                         pMgmt->byDTIMCount = sFrame.pTIM->byDTIMCount;
2079                         pMgmt->byDTIMPeriod = sFrame.pTIM->byDTIMPeriod;
2080                         wAIDNumber = pMgmt->wCurrAID & ~(BIT14|BIT15);
2081
2082                         // check if AID in TIM field bit on
2083                         // wStartIndex = N1
2084                         wStartIndex = WLAN_MGMT_GET_TIM_OFFSET(sFrame.pTIM->byBitMapCtl) << 1;
2085                         // AIDIndex = N2
2086                         wAIDIndex = (wAIDNumber >> 3);
2087                         if ((wAIDNumber > 0) && (wAIDIndex >= wStartIndex)) {
2088                                 uLocateByteIndex = wAIDIndex - wStartIndex;
2089                                 // len = byDTIMCount + byDTIMPeriod + byDTIMPeriod + byVirtBitMap[0~250]
2090                                 if (sFrame.pTIM->len >= (uLocateByteIndex + 4)) {
2091                                         byTIMBitOn  = (0x01) << ((wAIDNumber) % 8);
2092                                         pMgmt->bInTIM = sFrame.pTIM->byVirtBitMap[uLocateByteIndex] & byTIMBitOn ? true : false;
2093                                 } else {
2094                                         pMgmt->bInTIM = false;
2095                                 };
2096                         } else {
2097                                 pMgmt->bInTIM = false;
2098                         };
2099
2100                         if (pMgmt->bInTIM ||
2101                             (pMgmt->bMulticastTIM && (pMgmt->byDTIMCount == 0))) {
2102                                 pMgmt->bInTIMWake = true;
2103                                 // send out ps-poll packet
2104 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:In TIM\n");
2105                                 if (pMgmt->bInTIM) {
2106                                         PSvSendPSPOLL((PSDevice)pDevice);
2107 //                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:PS-POLL sent..\n");
2108                                 }
2109
2110                         } else {
2111                                 pMgmt->bInTIMWake = false;
2112                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Not In TIM..\n");
2113                                 if (pDevice->bPWBitOn == false) {
2114                                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Send Null Packet\n");
2115                                         if (PSbSendNullPacket(pDevice))
2116                                                 pDevice->bPWBitOn = true;
2117                                 }
2118                                 if (PSbConsiderPowerDown(pDevice, false, false)) {
2119                                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Power down now...\n");
2120                                 }
2121                         }
2122
2123                 }
2124
2125         }
2126         // if adhoc mode
2127         if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && !bIsAPBeacon && bIsChannelEqual) {
2128                 if (bIsBSSIDEqual) {
2129                         // Use sNodeDBTable[0].uInActiveCount as IBSS beacons received count.
2130                         if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
2131                                 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2132
2133                         // adhoc mode:TSF updated only when beacon larger than local TSF
2134                         if (bTSFLargeDiff && bTSFOffsetPostive &&
2135                             (pMgmt->eCurrState == WMAC_STATE_JOINTED))
2136                                 bUpdateTSF = true;
2137
2138                         // During dpc, already in spinlocked.
2139                         if (BSSDBbIsSTAInNodeDB(pMgmt, sFrame.pHdr->sA3.abyAddr2, &uNodeIndex)) {
2140                                 // Update the STA, (Technically the Beacons of all the IBSS nodes
2141                                 // should be identical, but that's not happening in practice.
2142                                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2143                                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2144                                                                         WLAN_RATES_MAXLEN_11B);
2145                                 RATEvParseMaxRate((void *)pDevice,
2146                                                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2147                                                   NULL,
2148                                                   true,
2149                                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2150                                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2151                                                   &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2152                                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2153                                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2154                                         );
2155                                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2156                                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2157                                 pMgmt->sNodeDBTable[uNodeIndex].uInActiveCount = 0;
2158                         } else {
2159                                 // Todo, initial Node content
2160                                 BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
2161
2162                                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2163                                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2164                                                                         WLAN_RATES_MAXLEN_11B);
2165                                 RATEvParseMaxRate((void *)pDevice,
2166                                                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2167                                                   NULL,
2168                                                   true,
2169                                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2170                                                   &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2171                                                   &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2172                                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2173                                                   &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2174                                         );
2175
2176                                 memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, sFrame.pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
2177                                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2178                                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate = pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
2179 #ifdef  PLICE_DEBUG
2180                                 {
2181                                         printk("s_vMgrRxBeacon:TxDataRate is %d,Index is %d\n", pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate, uNodeIndex);
2182                                 }
2183 #endif
2184 /*
2185   pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2186   if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
2187   pMgmt->sNodeDBTable[uNodeIndex].bERPExist = true;
2188 */
2189                         }
2190
2191                         // if other stations joined, indicate connection to upper layer..
2192                         if (pMgmt->eCurrState == WMAC_STATE_STARTED) {
2193                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Current IBSS State: [Started]........to: [Jointed] \n");
2194                                 pMgmt->eCurrState = WMAC_STATE_JOINTED;
2195                                 pDevice->bLinkPass = true;
2196                                 if (netif_queue_stopped(pDevice->dev)) {
2197                                         netif_wake_queue(pDevice->dev);
2198                                 }
2199                                 pMgmt->sNodeDBTable[0].bActive = true;
2200                                 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2201
2202                         }
2203                 } else if (bIsSSIDEqual) {
2204                         // See other adhoc sta with the same SSID but BSSID is different.
2205                         // adpot this vars only when TSF larger then us.
2206                         if (bTSFLargeDiff && bTSFOffsetPostive) {
2207                                 // we don't support ATIM under adhoc mode
2208                                 // if (sFrame.pIBSSParms->wATIMWindow == 0) {
2209                                 // adpot this vars
2210                                 // TODO: check sFrame cap if privacy on, and support rate syn
2211                                 memcpy(pMgmt->abyCurrBSSID, sFrame.pHdr->sA3.abyAddr3, WLAN_BSSID_LEN);
2212                                 memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
2213                                 pMgmt->wCurrATIMWindow = cpu_to_le16(sFrame.pIBSSParms->wATIMWindow);
2214                                 pMgmt->wCurrBeaconPeriod = cpu_to_le16(*sFrame.pwBeaconInterval);
2215                                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2216                                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2217                                                                         WLAN_RATES_MAXLEN_11B);
2218                                 // set HW beacon interval and re-synchronizing....
2219                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rejoining to Other Adhoc group with same SSID........\n");
2220                                 VNSvOutPortW(pDevice->PortOffset + MAC_REG_BI, pMgmt->wCurrBeaconPeriod);
2221                                 CARDbUpdateTSF(pDevice, pRxPacket->byRxRate, qwTimestamp, qwLocalTSF);
2222                                 CARDvUpdateNextTBTT(pDevice->PortOffset, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2223                                 // Turn off bssid filter to avoid filter others adhoc station which bssid is different.
2224                                 MACvWriteBSSIDAddress(pDevice->PortOffset, pMgmt->abyCurrBSSID);
2225
2226                                 CARDbSetPhyParameter(pMgmt->pAdapter,
2227                                                      pMgmt->eCurrentPHYMode,
2228                                                      pMgmt->wCurrCapInfo,
2229                                                      pMgmt->byERPContext,
2230                                                      pMgmt->abyCurrSuppRates,
2231                                                      pMgmt->abyCurrExtSuppRates);
2232
2233                                 // MACvRegBitsOff(pDevice->PortOffset, MAC_REG_RCR, RCR_BSSID);
2234                                 // set highest basic rate
2235                                 // s_vSetHighestBasicRate(pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates);
2236                                 // Prepare beacon frame
2237                                 bMgrPrepareBeaconToSend((void *)pDevice, pMgmt);
2238                                 //  }
2239                         }
2240                 }
2241         }
2242         // endian issue ???
2243         // Update TSF
2244 if (bUpdateTSF) {
2245                 CARDbGetCurrentTSF(pDevice->PortOffset, &qwCurrTSF);
2246                 CARDbUpdateTSF(pDevice, pRxPacket->byRxRate, qwTimestamp, pRxPacket->qwLocalTSF);
2247                 CARDbGetCurrentTSF(pDevice->PortOffset, &qwCurrTSF);
2248                 CARDvUpdateNextTBTT(pDevice->PortOffset, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2249         }
2250
2251         return;
2252 }
2253
2254 /*+
2255  *
2256  * Routine Description:
2257  *   Instructs the hw to create a bss using the supplied
2258  *   attributes. Note that this implementation only supports Ad-Hoc
2259  *   BSS creation.
2260  *
2261  *
2262  * Return Value:
2263  *    CMD_STATUS
2264  *
2265  -*/
2266 void
2267 vMgrCreateOwnIBSS(
2268         void *hDeviceContext,
2269         PCMD_STATUS pStatus
2270 )
2271 {
2272         PSDevice            pDevice = (PSDevice)hDeviceContext;
2273         PSMgmtObject        pMgmt = pDevice->pMgmt;
2274         unsigned short wMaxBasicRate;
2275         unsigned short wMaxSuppRate;
2276         unsigned char byTopCCKBasicRate;
2277         unsigned char byTopOFDMBasicRate;
2278         QWORD               qwCurrTSF;
2279         unsigned int ii;
2280         unsigned char abyRATE[] = {0x82, 0x84, 0x8B, 0x96, 0x24, 0x30, 0x48, 0x6C, 0x0C, 0x12, 0x18, 0x60};
2281         unsigned char abyCCK_RATE[] = {0x82, 0x84, 0x8B, 0x96};
2282         unsigned char abyOFDM_RATE[] = {0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2283         unsigned short wSuppRate;
2284
2285         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Create Basic Service Set .......\n");
2286
2287         if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2288                 if ((pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) &&
2289                     (pDevice->eEncryptionStatus != Ndis802_11Encryption2Enabled) &&
2290                     (pDevice->eEncryptionStatus != Ndis802_11Encryption3Enabled)) {
2291                         // encryption mode error
2292                         *pStatus = CMD_STATUS_FAILURE;
2293                         return;
2294                 }
2295         }
2296
2297         pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2298         pMgmt->abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
2299
2300         if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2301                 pMgmt->eCurrentPHYMode = pMgmt->byAPBBType;
2302         } else {
2303                 if (pDevice->byBBType == BB_TYPE_11G)
2304                         pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
2305                 if (pDevice->byBBType == BB_TYPE_11B)
2306                         pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
2307                 if (pDevice->byBBType == BB_TYPE_11A)
2308                         pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
2309         }
2310
2311         if (pMgmt->eCurrentPHYMode != PHY_TYPE_11A) {
2312                 pMgmt->abyCurrSuppRates[1] = WLAN_RATES_MAXLEN_11B;
2313                 pMgmt->abyCurrExtSuppRates[1] = 0;
2314                 for (ii = 0; ii < 4; ii++)
2315                         pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2316         } else {
2317                 pMgmt->abyCurrSuppRates[1] = 8;
2318                 pMgmt->abyCurrExtSuppRates[1] = 0;
2319                 for (ii = 0; ii < 8; ii++)
2320                         pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2321         }
2322
2323         if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
2324                 pMgmt->abyCurrSuppRates[1] = 8;
2325                 pMgmt->abyCurrExtSuppRates[1] = 4;
2326                 for (ii = 0; ii < 4; ii++)
2327                         pMgmt->abyCurrSuppRates[2+ii] =  abyCCK_RATE[ii];
2328                 for (ii = 4; ii < 8; ii++)
2329                         pMgmt->abyCurrSuppRates[2+ii] =  abyOFDM_RATE[ii-4];
2330                 for (ii = 0; ii < 4; ii++)
2331                         pMgmt->abyCurrExtSuppRates[2+ii] =  abyOFDM_RATE[ii+4];
2332         }
2333
2334         // Disable Protect Mode
2335         pDevice->bProtectMode = 0;
2336         MACvDisableProtectMD(pDevice->PortOffset);
2337
2338         pDevice->bBarkerPreambleMd = 0;
2339         MACvDisableBarkerPreambleMd(pDevice->PortOffset);
2340
2341         // Kyle Test 2003.11.04
2342
2343         // set HW beacon interval
2344         if (pMgmt->wIBSSBeaconPeriod == 0)
2345                 pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
2346
2347         CARDbGetCurrentTSF(pDevice->PortOffset, &qwCurrTSF);
2348         // clear TSF counter
2349         VNSvOutPortB(pDevice->PortOffset + MAC_REG_TFTCTL, TFTCTL_TSFCNTRST);
2350         // enable TSF counter
2351         VNSvOutPortB(pDevice->PortOffset + MAC_REG_TFTCTL, TFTCTL_TSFCNTREN);
2352
2353         // set Next TBTT
2354         CARDvSetFirstNextTBTT(pDevice->PortOffset, pMgmt->wIBSSBeaconPeriod);
2355
2356         pMgmt->uIBSSChannel = pDevice->uChannel;
2357
2358         if (pMgmt->uIBSSChannel == 0)
2359                 pMgmt->uIBSSChannel = DEFAULT_IBSS_CHANNEL;
2360
2361         // set basic rate
2362
2363         RATEvParseMaxRate((void *)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2364                           (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates, true,
2365                           &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2366                           &byTopCCKBasicRate, &byTopOFDMBasicRate);
2367
2368         if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2369                 pMgmt->eCurrMode = WMAC_MODE_ESS_AP;
2370         }
2371
2372         if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2373                 memcpy(pMgmt->abyIBSSDFSOwner, pDevice->abyCurrentNetAddr, 6);
2374                 pMgmt->byIBSSDFSRecovery = 10;
2375                 pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2376         }
2377
2378         // Adopt pre-configured IBSS vars to current vars
2379         pMgmt->eCurrState = WMAC_STATE_STARTED;
2380         pMgmt->wCurrBeaconPeriod = pMgmt->wIBSSBeaconPeriod;
2381         pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2382         pMgmt->wCurrATIMWindow = pMgmt->wIBSSATIMWindow;
2383         MACvWriteATIMW(pDevice->PortOffset, pMgmt->wCurrATIMWindow);
2384         pDevice->uCurrRSSI = 0;
2385         pDevice->byCurrSQ = 0;
2386         //memcpy(pMgmt->abyDesireSSID,pMgmt->abyAdHocSSID,
2387         // ((PWLAN_IE_SSID)pMgmt->abyAdHocSSID)->len + WLAN_IEHDR_LEN);
2388         memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2389         memcpy(pMgmt->abyCurrSSID,
2390                pMgmt->abyDesireSSID,
2391                ((PWLAN_IE_SSID)pMgmt->abyDesireSSID)->len + WLAN_IEHDR_LEN
2392 );
2393
2394         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2395                 // AP mode BSSID = MAC addr
2396                 memcpy(pMgmt->abyCurrBSSID, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
2397                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "AP beacon created BSSID:%pM\n",
2398                         pMgmt->abyCurrBSSID);
2399         }
2400
2401         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2402                 // BSSID selected must be randomized as spec 11.1.3
2403                 pMgmt->abyCurrBSSID[5] = (unsigned char) (LODWORD(qwCurrTSF) & 0x000000ff);
2404                 pMgmt->abyCurrBSSID[4] = (unsigned char)((LODWORD(qwCurrTSF) & 0x0000ff00) >> 8);
2405                 pMgmt->abyCurrBSSID[3] = (unsigned char)((LODWORD(qwCurrTSF) & 0x00ff0000) >> 16);
2406                 pMgmt->abyCurrBSSID[2] = (unsigned char)((LODWORD(qwCurrTSF) & 0x00000ff0) >> 4);
2407                 pMgmt->abyCurrBSSID[1] = (unsigned char)((LODWORD(qwCurrTSF) & 0x000ff000) >> 12);
2408                 pMgmt->abyCurrBSSID[0] = (unsigned char)((LODWORD(qwCurrTSF) & 0x0ff00000) >> 20);
2409                 pMgmt->abyCurrBSSID[5] ^= pMgmt->abyMACAddr[0];
2410                 pMgmt->abyCurrBSSID[4] ^= pMgmt->abyMACAddr[1];
2411                 pMgmt->abyCurrBSSID[3] ^= pMgmt->abyMACAddr[2];
2412                 pMgmt->abyCurrBSSID[2] ^= pMgmt->abyMACAddr[3];
2413                 pMgmt->abyCurrBSSID[1] ^= pMgmt->abyMACAddr[4];
2414                 pMgmt->abyCurrBSSID[0] ^= pMgmt->abyMACAddr[5];
2415                 pMgmt->abyCurrBSSID[0] &= ~IEEE_ADDR_GROUP;
2416                 pMgmt->abyCurrBSSID[0] |= IEEE_ADDR_UNIVERSAL;
2417
2418                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Adhoc beacon created bssid:%pM\n",
2419                         pMgmt->abyCurrBSSID);
2420         }
2421
2422         // Set Capability Info
2423         pMgmt->wCurrCapInfo = 0;
2424
2425         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2426                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
2427                 pMgmt->byDTIMPeriod = DEFAULT_DTIM_PERIOD;
2428                 pMgmt->byDTIMCount = pMgmt->byDTIMPeriod - 1;
2429         }
2430
2431         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2432                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_IBSS(1);
2433         }
2434
2435         if (pDevice->bEncryptionEnable) {
2436                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
2437                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2438                         if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2439                                 pMgmt->byCSSPK = KEY_CTL_CCMP;
2440                                 pMgmt->byCSSGK = KEY_CTL_CCMP;
2441                         } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2442                                 pMgmt->byCSSPK = KEY_CTL_TKIP;
2443                                 pMgmt->byCSSGK = KEY_CTL_TKIP;
2444                         } else {
2445                                 pMgmt->byCSSPK = KEY_CTL_NONE;
2446                                 pMgmt->byCSSGK = KEY_CTL_WEP;
2447                         }
2448                 } else {
2449                         pMgmt->byCSSPK = KEY_CTL_WEP;
2450                         pMgmt->byCSSGK = KEY_CTL_WEP;
2451                 }
2452         }
2453
2454         pMgmt->byERPContext = 0;
2455
2456 //    memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
2457
2458         if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2459                 CARDbSetBSSID(pMgmt->pAdapter, pMgmt->abyCurrBSSID, OP_MODE_AP);
2460         } else {
2461                 CARDbSetBSSID(pMgmt->pAdapter, pMgmt->abyCurrBSSID, OP_MODE_ADHOC);
2462         }
2463
2464         CARDbSetPhyParameter(pMgmt->pAdapter,
2465                              pMgmt->eCurrentPHYMode,
2466                              pMgmt->wCurrCapInfo,
2467                              pMgmt->byERPContext,
2468                              pMgmt->abyCurrSuppRates,
2469                              pMgmt->abyCurrExtSuppRates
2470                 );
2471
2472         CARDbSetBeaconPeriod(pMgmt->pAdapter, pMgmt->wIBSSBeaconPeriod);
2473         // set channel and clear NAV
2474         set_channel(pMgmt->pAdapter, pMgmt->uIBSSChannel);
2475         pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2476
2477         if (CARDbIsShortPreamble(pMgmt->pAdapter)) {
2478                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
2479         } else {
2480                 pMgmt->wCurrCapInfo &= (~WLAN_SET_CAP_INFO_SHORTPREAMBLE(1));
2481         }
2482
2483         if ((pMgmt->b11hEnable == true) &&
2484             (pMgmt->eCurrentPHYMode == PHY_TYPE_11A)) {
2485                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
2486         } else {
2487                 pMgmt->wCurrCapInfo &= (~WLAN_SET_CAP_INFO_SPECTRUMMNG(1));
2488         }
2489
2490         pMgmt->eCurrState = WMAC_STATE_STARTED;
2491         // Prepare beacon to send
2492         if (bMgrPrepareBeaconToSend((void *)pDevice, pMgmt)) {
2493                 *pStatus = CMD_STATUS_SUCCESS;
2494         }
2495
2496         return;
2497 }
2498
2499 /*+
2500  *
2501  * Routine Description:
2502  *   Instructs wmac to join a bss using the supplied attributes.
2503  *   The arguments may the BSSID or SSID and the rest of the
2504  *   attributes are obtained from the scan result of known bss list.
2505  *
2506  *
2507  * Return Value:
2508  *    None.
2509  *
2510  -*/
2511
2512 void
2513 vMgrJoinBSSBegin(
2514         void *hDeviceContext,
2515         PCMD_STATUS pStatus
2516 )
2517 {
2518         PSDevice     pDevice = (PSDevice)hDeviceContext;
2519         PSMgmtObject    pMgmt = pDevice->pMgmt;
2520         PKnownBSS       pCurr = NULL;
2521         unsigned int ii, uu;
2522         PWLAN_IE_SUPP_RATES pItemRates = NULL;
2523         PWLAN_IE_SUPP_RATES pItemExtRates = NULL;
2524         PWLAN_IE_SSID   pItemSSID;
2525         unsigned int uRateLen = WLAN_RATES_MAXLEN;
2526         unsigned short wMaxBasicRate = RATE_1M;
2527         unsigned short wMaxSuppRate = RATE_1M;
2528         unsigned short wSuppRate;
2529         unsigned char byTopCCKBasicRate = RATE_1M;
2530         unsigned char byTopOFDMBasicRate = RATE_1M;
2531
2532         for (ii = 0; ii < MAX_BSS_NUM; ii++) {
2533                 if (pMgmt->sBSSList[ii].bActive == true)
2534                         break;
2535         }
2536
2537         if (ii == MAX_BSS_NUM) {
2538                 *pStatus = CMD_STATUS_RESOURCES;
2539                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "BSS finding:BSS list is empty.\n");
2540                 return;
2541         }
2542
2543         // memset(pMgmt->abyDesireBSSID, 0,  WLAN_BSSID_LEN);
2544         // Search known BSS list for prefer BSSID or SSID
2545
2546         pCurr = BSSpSearchBSSList(pDevice,
2547                                   pMgmt->abyDesireBSSID,
2548                                   pMgmt->abyDesireSSID,
2549                                   pMgmt->eConfigPHYMode
2550 );
2551
2552         if (pCurr == NULL) {
2553                 *pStatus = CMD_STATUS_RESOURCES;
2554                 pItemSSID = (PWLAN_IE_SSID)pMgmt->abyDesireSSID;
2555                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Scanning [%s] not found, disconnected !\n", pItemSSID->abySSID);
2556                 return;
2557         }
2558
2559         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP(BSS) finding:Found a AP(BSS)..\n");
2560         if (WLAN_GET_CAP_INFO_ESS(cpu_to_le16(pCurr->wCapInfo))) {
2561                 if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA) || (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK)) {
2562                         // patch for CISCO migration mode
2563 /*
2564   if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2565   if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == false) {
2566   DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2567   // encryption mode error
2568   pMgmt->eCurrState = WMAC_STATE_IDLE;
2569   return;
2570   }
2571   } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2572   if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == false) {
2573   DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2574   // encryption mode error
2575   pMgmt->eCurrState = WMAC_STATE_IDLE;
2576   return;
2577   }
2578   }
2579 */
2580                 }
2581
2582 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
2583                 Encyption_Rebuild(pDevice, pCurr);
2584 #endif
2585                 // Infrastructure BSS
2586                 s_vMgrSynchBSS(pDevice,
2587                                WMAC_MODE_ESS_STA,
2588                                pCurr,
2589                                pStatus
2590 );
2591
2592                 if (*pStatus == CMD_STATUS_SUCCESS) {
2593                         // Adopt this BSS state vars in Mgmt Object
2594                         pMgmt->uCurrChannel = pCurr->uChannel;
2595
2596                         memset(pMgmt->abyCurrSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2597                         memset(pMgmt->abyCurrExtSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2598
2599                         if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2600                                 uRateLen = WLAN_RATES_MAXLEN_11B;
2601                         }
2602
2603                         pItemRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates;
2604                         pItemExtRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates;
2605
2606                         // Parse Support Rate IE
2607                         pItemRates->byElementID = WLAN_EID_SUPP_RATES;
2608                         pItemRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2609                                                      pItemRates,
2610                                                      uRateLen);
2611
2612                         // Parse Extension Support Rate IE
2613                         pItemExtRates->byElementID = WLAN_EID_EXTSUPP_RATES;
2614                         pItemExtRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abyExtSuppRates,
2615                                                         pItemExtRates,
2616                                                         uRateLen);
2617                         // Stuffing Rate IE
2618                         if ((pItemExtRates->len > 0) && (pItemRates->len < 8)) {
2619                                 for (ii = 0; ii < (unsigned int)(8 - pItemRates->len);) {
2620                                         pItemRates->abyRates[pItemRates->len + ii] = pItemExtRates->abyRates[ii];
2621                                         ii++;
2622                                         if (pItemExtRates->len <= ii)
2623                                                 break;
2624                                 }
2625                                 pItemRates->len += (unsigned char)ii;
2626                                 if (pItemExtRates->len - ii > 0) {
2627                                         pItemExtRates->len -= (unsigned char)ii;
2628                                         for (uu = 0; uu < pItemExtRates->len; uu++) {
2629                                                 pItemExtRates->abyRates[uu] = pItemExtRates->abyRates[uu + ii];
2630                                         }
2631                                 } else {
2632                                         pItemExtRates->len = 0;
2633                                 }
2634                         }
2635
2636                         RATEvParseMaxRate((void *)pDevice, pItemRates, pItemExtRates, true,
2637                                           &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2638                                           &byTopCCKBasicRate, &byTopOFDMBasicRate);
2639
2640                         // TODO: deal with if wCapInfo the privacy is on, but station WEP is off
2641                         // TODO: deal with if wCapInfo the PS-Pollable is on.
2642                         pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2643                         memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2644                         memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2645                         memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2646
2647                         pMgmt->eCurrMode = WMAC_MODE_ESS_STA;
2648
2649                         pMgmt->eCurrState = WMAC_STATE_JOINTED;
2650                         // Adopt BSS state in Adapter Device Object
2651                         //pDevice->byOpMode = OP_MODE_INFRASTRUCTURE;
2652 //            memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2653
2654                         // Add current BSS to Candidate list
2655                         // This should only works for WPA2 BSS, and WPA2 BSS check must be done before.
2656                         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
2657                                 bool bResult = bAdd_PMKID_Candidate((void *)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2658                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "bAdd_PMKID_Candidate: 1(%d)\n", bResult);
2659                                 if (bResult == false) {
2660                                         vFlush_PMKID_Candidate((void *)pDevice);
2661                                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "vFlush_PMKID_Candidate: 4\n");
2662                                         bAdd_PMKID_Candidate((void *)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2663                                 }
2664                         }
2665
2666                         // Preamble type auto-switch: if AP can receive short-preamble cap,
2667                         // we can turn on too.
2668
2669                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Join ESS\n");
2670
2671                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "End of Join AP -- A/B/G Action\n");
2672                 } else {
2673                         pMgmt->eCurrState = WMAC_STATE_IDLE;
2674                 };
2675
2676         } else {
2677                 // ad-hoc mode BSS
2678                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2679                         if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2680                                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == false) {
2681                                         // encryption mode error
2682                                         pMgmt->eCurrState = WMAC_STATE_IDLE;
2683                                         return;
2684                                 }
2685                         } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2686                                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == false) {
2687                                         // encryption mode error
2688                                         pMgmt->eCurrState = WMAC_STATE_IDLE;
2689                                         return;
2690                                 }
2691                         } else {
2692                                 // encryption mode error
2693                                 pMgmt->eCurrState = WMAC_STATE_IDLE;
2694                                 return;
2695                         }
2696                 }
2697
2698                 s_vMgrSynchBSS(pDevice,
2699                                WMAC_MODE_IBSS_STA,
2700                                pCurr,
2701                                pStatus
2702 );
2703
2704                 if (*pStatus == CMD_STATUS_SUCCESS) {
2705                         // Adopt this BSS state vars in Mgmt Object
2706                         // TODO: check if CapInfo privacy on, but we don't..
2707                         pMgmt->uCurrChannel = pCurr->uChannel;
2708
2709                         // Parse Support Rate IE
2710                         pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2711                         pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2712                                                                 (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2713                                                                 WLAN_RATES_MAXLEN_11B);
2714                         // set basic rate
2715                         RATEvParseMaxRate((void *)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2716                                           NULL, true, &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2717                                           &byTopCCKBasicRate, &byTopOFDMBasicRate);
2718
2719                         pMgmt->wCurrCapInfo = pCurr->wCapInfo;
2720                         pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2721                         memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2722                         memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2723                         memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2724 //          pMgmt->wCurrATIMWindow = pCurr->wATIMWindow;
2725                         MACvWriteATIMW(pDevice->PortOffset, pMgmt->wCurrATIMWindow);
2726                         pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2727
2728                         pMgmt->eCurrState = WMAC_STATE_STARTED;
2729                         // Adopt BSS state in Adapter Device Object
2730                         //pDevice->byOpMode = OP_MODE_ADHOC;
2731 //            pDevice->bLinkPass = true;
2732 //            memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2733
2734                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Join IBSS ok:%pM\n",
2735                                 pMgmt->abyCurrBSSID);
2736                         // Preamble type auto-switch: if AP can receive short-preamble cap,
2737                         // and if registry setting is short preamble we can turn on too.
2738
2739                         // Prepare beacon
2740                         bMgrPrepareBeaconToSend((void *)pDevice, pMgmt);
2741                 } else {
2742                         pMgmt->eCurrState = WMAC_STATE_IDLE;
2743                 };
2744         };
2745         return;
2746 }
2747
2748 /*+
2749  *
2750  * Routine Description:
2751  * Set HW to synchronize a specific BSS from known BSS list.
2752  *
2753  *
2754  * Return Value:
2755  *    PCM_STATUS
2756  *
2757  -*/
2758 static
2759 void
2760 s_vMgrSynchBSS(
2761         PSDevice      pDevice,
2762         unsigned int uBSSMode,
2763         PKnownBSS     pCurr,
2764         PCMD_STATUS  pStatus
2765 )
2766 {
2767         CARD_PHY_TYPE   ePhyType = PHY_TYPE_11B;
2768         PSMgmtObject  pMgmt = pDevice->pMgmt;
2769 //    int     ii;
2770         //1M,   2M,   5M,   11M,  18M,  24M,  36M,  54M
2771         unsigned char abyCurrSuppRatesG[] = {WLAN_EID_SUPP_RATES, 8, 0x02, 0x04, 0x0B, 0x16, 0x24, 0x30, 0x48, 0x6C};
2772         unsigned char abyCurrExtSuppRatesG[] = {WLAN_EID_EXTSUPP_RATES, 4, 0x0C, 0x12, 0x18, 0x60};
2773         //6M,   9M,   12M,  48M
2774         unsigned char abyCurrSuppRatesA[] = {WLAN_EID_SUPP_RATES, 8, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2775         unsigned char abyCurrSuppRatesB[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
2776
2777         *pStatus = CMD_STATUS_FAILURE;
2778
2779         if (s_bCipherMatch(pCurr,
2780                            pDevice->eEncryptionStatus,
2781                            &(pMgmt->byCSSPK),
2782                            &(pMgmt->byCSSGK)) == false) {
2783                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "s_bCipherMatch Fail .......\n");
2784                 return;
2785         }
2786
2787         pMgmt->pCurrBSS = pCurr;
2788
2789         // if previous mode is IBSS.
2790         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2791                 MACvRegBitsOff(pDevice->PortOffset, MAC_REG_BCNDMACTL, BEACON_READY);
2792                 MACvRegBitsOff(pDevice->PortOffset, MAC_REG_TCR, TCR_AUTOBCNTX);
2793         }
2794
2795         // Init the BSS informations
2796         pDevice->bCCK = true;
2797         pDevice->bProtectMode = false;
2798         MACvDisableProtectMD(pDevice->PortOffset);
2799         pDevice->bBarkerPreambleMd = false;
2800         MACvDisableBarkerPreambleMd(pDevice->PortOffset);
2801         pDevice->bNonERPPresent = false;
2802         pDevice->byPreambleType = 0;
2803         pDevice->wBasicRate = 0;
2804         // Set Basic Rate
2805         CARDbAddBasicRate((void *)pDevice, RATE_1M);
2806         // calculate TSF offset
2807         // TSF Offset = Received Timestamp TSF - Marked Local's TSF
2808         CARDbUpdateTSF(pDevice, pCurr->byRxRate, pCurr->qwBSSTimestamp, pCurr->qwLocalTSF);
2809
2810         CARDbSetBeaconPeriod(pDevice, pCurr->wBeaconInterval);
2811
2812         // set Next TBTT
2813         // Next TBTT = ((local_current_TSF / beacon_interval) + 1) * beacon_interval
2814         CARDvSetFirstNextTBTT(pDevice->PortOffset, pCurr->wBeaconInterval);
2815
2816         // set BSSID
2817         MACvWriteBSSIDAddress(pDevice->PortOffset, pCurr->abyBSSID);
2818
2819         MACvReadBSSIDAddress(pDevice->PortOffset, pMgmt->abyCurrBSSID);
2820
2821         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = "
2822                 "%pM\n", pMgmt->abyCurrBSSID);
2823
2824         if (pCurr->eNetworkTypeInUse == PHY_TYPE_11A) {
2825                 if ((pMgmt->eConfigPHYMode == PHY_TYPE_11A) ||
2826                     (pMgmt->eConfigPHYMode == PHY_TYPE_AUTO)) {
2827                         ePhyType = PHY_TYPE_11A;
2828                 } else {
2829                         return;
2830                 }
2831         } else if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2832                 if ((pMgmt->eConfigPHYMode == PHY_TYPE_11B) ||
2833                     (pMgmt->eConfigPHYMode == PHY_TYPE_11G) ||
2834                     (pMgmt->eConfigPHYMode == PHY_TYPE_AUTO)) {
2835                         ePhyType = PHY_TYPE_11B;
2836                 } else {
2837                         return;
2838                 }
2839         } else {
2840                 if ((pMgmt->eConfigPHYMode == PHY_TYPE_11G) ||
2841                     (pMgmt->eConfigPHYMode == PHY_TYPE_AUTO)) {
2842                         ePhyType = PHY_TYPE_11G;
2843                 } else if (pMgmt->eConfigPHYMode == PHY_TYPE_11B) {
2844                         ePhyType = PHY_TYPE_11B;
2845                 } else {
2846                         return;
2847                 }
2848         }
2849
2850         if (ePhyType == PHY_TYPE_11A) {
2851                 memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesA[0], sizeof(abyCurrSuppRatesA));
2852                 pMgmt->abyCurrExtSuppRates[1] = 0;
2853         } else if (ePhyType == PHY_TYPE_11B) {
2854                 memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesB[0], sizeof(abyCurrSuppRatesB));
2855                 pMgmt->abyCurrExtSuppRates[1] = 0;
2856         } else {
2857                 memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesG[0], sizeof(abyCurrSuppRatesG));
2858                 memcpy(pMgmt->abyCurrExtSuppRates, &abyCurrExtSuppRatesG[0], sizeof(abyCurrExtSuppRatesG));
2859         }
2860
2861         if (WLAN_GET_CAP_INFO_ESS(pCurr->wCapInfo)) {
2862                 CARDbSetBSSID(pMgmt->pAdapter, pCurr->abyBSSID, OP_MODE_INFRASTRUCTURE);
2863                 // Add current BSS to Candidate list
2864                 // This should only works for WPA2 BSS, and WPA2 BSS check must be done before.
2865                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
2866                         CARDbAdd_PMKID_Candidate(pMgmt->pAdapter, pMgmt->abyCurrBSSID, pCurr->sRSNCapObj.bRSNCapExist, pCurr->sRSNCapObj.wRSNCap);
2867                 }
2868         } else {
2869                 CARDbSetBSSID(pMgmt->pAdapter, pCurr->abyBSSID, OP_MODE_ADHOC);
2870         }
2871
2872         if (CARDbSetPhyParameter(pMgmt->pAdapter,
2873                                  ePhyType,
2874                                  pCurr->wCapInfo,
2875                                  pCurr->sERP.byERP,
2876                                  pMgmt->abyCurrSuppRates,
2877                                  pMgmt->abyCurrExtSuppRates
2878                     ) != true) {
2879                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "<----s_bSynchBSS Set Phy Mode Fail [%d]\n", ePhyType);
2880                 return;
2881         }
2882         // set channel and clear NAV
2883         if (set_channel(pMgmt->pAdapter, pCurr->uChannel) == false) {
2884                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "<----s_bSynchBSS Set Channel [%d]\n", pCurr->uChannel);
2885                 return;
2886         }
2887
2888 /*
2889   for (ii=0; ii<BB_VGA_LEVEL; ii++) {
2890   if (pCurr->ldBmMAX< pDevice->ldBmThreshold[ii]) {
2891   pDevice->byBBVGANew = pDevice->abyBBVGA[ii];
2892   break;
2893   }
2894   }
2895
2896   if (pDevice->byBBVGANew != pDevice->byBBVGACurrent) {
2897   DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "RSSI[%d] NewGain[%d] OldGain[%d] \n",
2898   (int)pCurr->ldBmMAX, pDevice->byBBVGANew, pDevice->byBBVGACurrent);
2899   printk("RSSI[%d] NewGain[%d] OldGain[%d] \n",
2900   (int)pCurr->ldBmMAX, pDevice->byBBVGANew, pDevice->byBBVGACurrent);
2901   BBvSetVGAGainOffset(pDevice, pDevice->byBBVGANew);
2902   }
2903   printk("ldBmMAX[%d] NewGain[%d] OldGain[%d] \n",
2904   (int)pCurr->ldBmMAX, pDevice->byBBVGANew, pDevice->byBBVGACurrent);
2905 */
2906         pMgmt->uCurrChannel = pCurr->uChannel;
2907         pMgmt->eCurrentPHYMode = ePhyType;
2908         pMgmt->byERPContext = pCurr->sERP.byERP;
2909         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:Set to channel = [%d]\n", (int)pCurr->uChannel);
2910
2911         *pStatus = CMD_STATUS_SUCCESS;
2912
2913         return;
2914 };
2915
2916 //mike add: fix NetworkManager 0.7.0 hidden ssid mode in WPA encryption
2917 //                   ,need reset eAuthenMode and eEncryptionStatus
2918 static void  Encyption_Rebuild(
2919         PSDevice pDevice,
2920         PKnownBSS pCurr
2921 )
2922 {
2923         PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
2924
2925         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||           //networkmanager 0.7.0 does not give the pairwise-key selection,
2926             (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {         // so we need re-select it according to real pairwise-key info.
2927                 if (pCurr->bWPAValid == true)  {   //WPA-PSK
2928                         pMgmt->eAuthenMode = WMAC_AUTH_WPAPSK;
2929                         if (pCurr->abyPKType[0] == WPA_TKIP) {
2930                                 pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;    //TKIP
2931                                 PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-TKIP]\n");
2932                         } else if (pCurr->abyPKType[0] == WPA_AESCCMP) {
2933                                 pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
2934                                 PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-AES]\n");
2935                         }
2936                 } else if (pCurr->bWPA2Valid == true) {  //WPA2-PSK
2937                         pMgmt->eAuthenMode = WMAC_AUTH_WPA2PSK;
2938                         if (pCurr->abyCSSPK[0] == WLAN_11i_CSS_TKIP) {
2939                                 pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;     //TKIP
2940                                 PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-TKIP]\n");
2941                         } else if (pCurr->abyCSSPK[0] == WLAN_11i_CSS_CCMP) {
2942                                 pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
2943                                 PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-AES]\n");
2944                         }
2945                 }
2946         }
2947         //  }
2948         return;
2949 }
2950
2951 /*+
2952  *
2953  * Routine Description:
2954  *  Format TIM field
2955  *
2956  *
2957  * Return Value:
2958  *    void
2959  *
2960  -*/
2961
2962 static
2963 void
2964 s_vMgrFormatTIM(
2965         PSMgmtObject pMgmt,
2966         PWLAN_IE_TIM pTIM
2967 )
2968 {
2969         unsigned char byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
2970         unsigned char byMap;
2971         unsigned int ii, jj;
2972         bool bStartFound = false;
2973         bool bMulticast = false;
2974         unsigned short wStartIndex = 0;
2975         unsigned short wEndIndex = 0;
2976
2977         // Find size of partial virtual bitmap
2978         for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
2979                 byMap = pMgmt->abyPSTxMap[ii];
2980                 if (!ii) {
2981                         // Mask out the broadcast bit which is indicated separately.
2982                         bMulticast = (byMap & byMask[0]) != 0;
2983                         if (bMulticast) {
2984                                 pMgmt->sNodeDBTable[0].bRxPSPoll = true;
2985                         }
2986                         byMap = 0;
2987                 }
2988                 if (byMap) {
2989                         if (!bStartFound) {
2990                                 bStartFound = true;
2991                                 wStartIndex = ii;
2992                         }
2993                         wEndIndex = ii;
2994                 }
2995         }
2996
2997         // Round start index down to nearest even number
2998         wStartIndex &=  ~BIT0;
2999
3000         // Round end index up to nearest even number
3001         wEndIndex = ((wEndIndex + 1) & ~BIT0);
3002
3003         // Size of element payload
3004
3005         pTIM->len =  3 + (wEndIndex - wStartIndex) + 1;
3006
3007         // Fill in the Fixed parts of the TIM
3008         pTIM->byDTIMCount = pMgmt->byDTIMCount;
3009         pTIM->byDTIMPeriod = pMgmt->byDTIMPeriod;
3010         pTIM->byBitMapCtl = (bMulticast ? TIM_MULTICAST_MASK : 0) |
3011                 (((wStartIndex >> 1) << 1) & TIM_BITMAPOFFSET_MASK);
3012
3013         // Append variable part of TIM
3014
3015         for (ii = wStartIndex, jj = 0; ii <= wEndIndex; ii++, jj++) {
3016                 pTIM->byVirtBitMap[jj] = pMgmt->abyPSTxMap[ii];
3017         }
3018
3019         // Aid = 0 don't used.
3020         pTIM->byVirtBitMap[0]  &= ~BIT0;
3021 }
3022
3023 /*+
3024  *
3025  * Routine Description:
3026  *  Constructs an Beacon frame(Ad-hoc mode)
3027  *
3028  *
3029  * Return Value:
3030  *    PTR to frame; or NULL on allocation failure
3031  *
3032  -*/
3033
3034 static
3035 PSTxMgmtPacket
3036 s_MgrMakeBeacon(
3037         PSDevice pDevice,
3038         PSMgmtObject pMgmt,
3039         unsigned short wCurrCapInfo,
3040         unsigned short wCurrBeaconPeriod,
3041         unsigned int uCurrChannel,
3042         unsigned short wCurrATIMWinodw,
3043         PWLAN_IE_SSID pCurrSSID,
3044         unsigned char *pCurrBSSID,
3045         PWLAN_IE_SUPP_RATES pCurrSuppRates,
3046         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3047 )
3048 {
3049         PSTxMgmtPacket      pTxPacket = NULL;
3050         WLAN_FR_BEACON      sFrame;
3051         unsigned char abyBroadcastAddr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
3052         unsigned char *pbyBuffer;
3053         unsigned int uLength = 0;
3054         PWLAN_IE_IBSS_DFS   pIBSSDFS = NULL;
3055         unsigned int ii;
3056
3057         // prepare beacon frame
3058         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3059         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_BEACON_FR_MAXLEN);
3060         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
3061         // Setup the sFrame structure.
3062         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
3063         sFrame.len = WLAN_BEACON_FR_MAXLEN;
3064         vMgrEncodeBeacon(&sFrame);
3065         // Setup the header
3066         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3067                 (
3068                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3069                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_BEACON)
3070 ));
3071
3072         if (pDevice->bEnablePSMode) {
3073                 sFrame.pHdr->sA3.wFrameCtl |= cpu_to_le16((unsigned short)WLAN_SET_FC_PWRMGT(1));
3074         }
3075
3076         memcpy(sFrame.pHdr->sA3.abyAddr1, abyBroadcastAddr, WLAN_ADDR_LEN);
3077         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3078         memcpy(sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3079         *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3080         *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3081         // Copy SSID
3082         sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3083         sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3084         memcpy(sFrame.pSSID,
3085                pCurrSSID,
3086                ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3087 );
3088         // Copy the rate set
3089         sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3090         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3091         memcpy(sFrame.pSuppRates,
3092                pCurrSuppRates,
3093                ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3094 );
3095         // DS parameter
3096         if (pDevice->eCurrentPHYType != PHY_TYPE_11A) {
3097                 sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3098                 sFrame.len += (1) + WLAN_IEHDR_LEN;
3099                 sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3100                 sFrame.pDSParms->len = 1;
3101                 sFrame.pDSParms->byCurrChannel = (unsigned char)uCurrChannel;
3102         }
3103         // TIM field
3104         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
3105                 sFrame.pTIM = (PWLAN_IE_TIM)(sFrame.pBuf + sFrame.len);
3106                 sFrame.pTIM->byElementID = WLAN_EID_TIM;
3107                 s_vMgrFormatTIM(pMgmt, sFrame.pTIM);
3108                 sFrame.len += (WLAN_IEHDR_LEN + sFrame.pTIM->len);
3109         }
3110
3111         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3112                 // IBSS parameter
3113                 sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3114                 sFrame.len += (2) + WLAN_IEHDR_LEN;
3115                 sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3116                 sFrame.pIBSSParms->len = 2;
3117                 sFrame.pIBSSParms->wATIMWindow = wCurrATIMWinodw;
3118                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3119                         /* RSN parameter */
3120                         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3121                         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3122                         sFrame.pRSNWPA->len = 12;
3123                         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3124                         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3125                         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3126                         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3127                         sFrame.pRSNWPA->wVersion = 1;
3128                         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3129                         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3130                         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3131                         if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled)
3132                                 sFrame.pRSNWPA->abyMulticast[3] = 0x04;//AES
3133                         else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled)
3134                                 sFrame.pRSNWPA->abyMulticast[3] = 0x02;//TKIP
3135                         else if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled)
3136                                 sFrame.pRSNWPA->abyMulticast[3] = 0x01;//WEP40
3137                         else
3138                                 sFrame.pRSNWPA->abyMulticast[3] = 0x00;//NONE
3139
3140                         // Pairwise Key Cipher Suite
3141                         sFrame.pRSNWPA->wPKCount = 0;
3142                         // Auth Key Management Suite
3143                         *((unsigned short *)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len)) = 0;
3144                         sFrame.pRSNWPA->len += 2;
3145
3146                         // RSN Capabilities
3147                         *((unsigned short *)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len)) = 0;
3148                         sFrame.pRSNWPA->len += 2;
3149                         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3150                 }
3151         }
3152
3153         if ((pMgmt->b11hEnable == true) &&
3154             (pMgmt->eCurrentPHYMode == PHY_TYPE_11A)) {
3155                 // Country IE
3156                 pbyBuffer = (unsigned char *)(sFrame.pBuf + sFrame.len);
3157                 set_country_IE(pMgmt->pAdapter, pbyBuffer);
3158                 set_country_info(pMgmt->pAdapter, PHY_TYPE_11A, pbyBuffer);
3159                 uLength += ((PWLAN_IE_COUNTRY) pbyBuffer)->len + WLAN_IEHDR_LEN;
3160                 pbyBuffer += (((PWLAN_IE_COUNTRY) pbyBuffer)->len + WLAN_IEHDR_LEN);
3161                 // Power Constrain IE
3162                 ((PWLAN_IE_PW_CONST) pbyBuffer)->byElementID = WLAN_EID_PWR_CONSTRAINT;
3163                 ((PWLAN_IE_PW_CONST) pbyBuffer)->len = 1;
3164                 ((PWLAN_IE_PW_CONST) pbyBuffer)->byPower = 0;
3165                 pbyBuffer += (1) + WLAN_IEHDR_LEN;
3166                 uLength += (1) + WLAN_IEHDR_LEN;
3167                 if (pMgmt->bSwitchChannel == true) {
3168                         // Channel Switch IE
3169                         ((PWLAN_IE_CH_SW) pbyBuffer)->byElementID = WLAN_EID_CH_SWITCH;
3170                         ((PWLAN_IE_CH_SW) pbyBuffer)->len = 3;
3171                         ((PWLAN_IE_CH_SW) pbyBuffer)->byMode = 1;
3172                         ((PWLAN_IE_CH_SW) pbyBuffer)->byChannel = get_channel_number(pMgmt->pAdapter, pMgmt->byNewChannel);
3173                         ((PWLAN_IE_CH_SW) pbyBuffer)->byCount = 0;
3174                         pbyBuffer += (3) + WLAN_IEHDR_LEN;
3175                         uLength += (3) + WLAN_IEHDR_LEN;
3176                 }
3177                 // TPC report
3178                 ((PWLAN_IE_TPC_REP) pbyBuffer)->byElementID = WLAN_EID_TPC_REP;
3179                 ((PWLAN_IE_TPC_REP) pbyBuffer)->len = 2;
3180                 ((PWLAN_IE_TPC_REP) pbyBuffer)->byTxPower = CARDbyGetTransmitPower(pMgmt->pAdapter);
3181                 ((PWLAN_IE_TPC_REP) pbyBuffer)->byLinkMargin = 0;
3182                 pbyBuffer += (2) + WLAN_IEHDR_LEN;
3183                 uLength += (2) + WLAN_IEHDR_LEN;
3184                 // IBSS DFS
3185                 if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3186                         pIBSSDFS = (PWLAN_IE_IBSS_DFS) pbyBuffer;
3187                         pIBSSDFS->byElementID = WLAN_EID_IBSS_DFS;
3188                         pIBSSDFS->len = 7;
3189                         memcpy(pIBSSDFS->abyDFSOwner,
3190                                pMgmt->abyIBSSDFSOwner,
3191                                6);
3192                         pIBSSDFS->byDFSRecovery = pMgmt->byIBSSDFSRecovery;
3193                         pbyBuffer += (7) + WLAN_IEHDR_LEN;
3194                         uLength += (7) + WLAN_IEHDR_LEN;
3195                         for (ii = CB_MAX_CHANNEL_24G+1; ii <= CB_MAX_CHANNEL; ii++) {
3196                                 if (get_channel_map_info(pMgmt->pAdapter, ii, pbyBuffer, pbyBuffer+1) == true) {
3197                                         pbyBuffer += 2;
3198                                         uLength += 2;
3199                                         pIBSSDFS->len += 2;
3200                                 }
3201                         }
3202                 }
3203                 sFrame.len += uLength;
3204         }
3205
3206         if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
3207                 sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3208                 sFrame.len += 1 + WLAN_IEHDR_LEN;
3209                 sFrame.pERP->byElementID = WLAN_EID_ERP;
3210                 sFrame.pERP->len = 1;
3211                 sFrame.pERP->byContext = 0;
3212                 if (pDevice->bProtectMode == true)
3213                         sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3214                 if (pDevice->bNonERPPresent == true)
3215                         sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3216                 if (pDevice->bBarkerPreambleMd == true)
3217                         sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3218         }
3219         if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3220                 sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3221                 sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3222                 memcpy(sFrame.pExtSuppRates,
3223                        pCurrExtSuppRates,
3224                        ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3225 );
3226         }
3227         // hostapd wpa/wpa2 IE
3228         if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == true)) {
3229                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3230                         if (pMgmt->wWPAIELen != 0) {
3231                                 sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3232                                 memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3233                                 sFrame.len += pMgmt->wWPAIELen;
3234                         }
3235                 }
3236         }
3237
3238         /* Adjust the length fields */
3239         pTxPacket->cbMPDULen = sFrame.len;
3240         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3241
3242         return pTxPacket;
3243 }
3244
3245 /*+
3246  *
3247  * Routine Description:
3248  *  Constructs an Prob-response frame
3249  *
3250  *
3251  * Return Value:
3252  *    PTR to frame; or NULL on allocation failure
3253  *
3254  -*/
3255
3256 PSTxMgmtPacket
3257 s_MgrMakeProbeResponse(
3258         PSDevice pDevice,
3259         PSMgmtObject pMgmt,
3260         unsigned short wCurrCapInfo,
3261         unsigned short wCurrBeaconPeriod,
3262         unsigned int uCurrChannel,
3263         unsigned short wCurrATIMWinodw,
3264         unsigned char *pDstAddr,
3265         PWLAN_IE_SSID pCurrSSID,
3266         unsigned char *pCurrBSSID,
3267         PWLAN_IE_SUPP_RATES pCurrSuppRates,
3268         PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
3269         unsigned char byPHYType
3270 )
3271 {
3272         PSTxMgmtPacket      pTxPacket = NULL;
3273         WLAN_FR_PROBERESP   sFrame;
3274         unsigned char *pbyBuffer;
3275         unsigned int uLength = 0;
3276         PWLAN_IE_IBSS_DFS   pIBSSDFS = NULL;
3277         unsigned int ii;
3278
3279         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3280         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_PROBERESP_FR_MAXLEN);
3281         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
3282         // Setup the sFrame structure.
3283         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
3284         sFrame.len = WLAN_PROBERESP_FR_MAXLEN;
3285         vMgrEncodeProbeResponse(&sFrame);
3286         // Setup the header
3287         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3288                 (
3289                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3290                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_PROBERESP)
3291 ));
3292         memcpy(sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3293         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3294         memcpy(sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3295         *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3296         *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3297
3298         if (byPHYType == BB_TYPE_11B) {
3299                 *sFrame.pwCapInfo &= cpu_to_le16((unsigned short)~(WLAN_SET_CAP_INFO_SHORTSLOTTIME(1)));
3300         }
3301
3302         // Copy SSID
3303         sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3304         sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3305         memcpy(sFrame.pSSID,
3306                pCurrSSID,
3307                ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3308 );
3309         // Copy the rate set
3310         sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3311
3312         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3313         memcpy(sFrame.pSuppRates,
3314                pCurrSuppRates,
3315                ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3316 );
3317
3318         // DS parameter
3319         if (pDevice->eCurrentPHYType != PHY_TYPE_11A) {
3320                 sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3321                 sFrame.len += (1) + WLAN_IEHDR_LEN;
3322                 sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3323                 sFrame.pDSParms->len = 1;
3324                 sFrame.pDSParms->byCurrChannel = (unsigned char)uCurrChannel;
3325         }
3326
3327         if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3328                 // IBSS parameter
3329                 sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3330                 sFrame.len += (2) + WLAN_IEHDR_LEN;
3331                 sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3332                 sFrame.pIBSSParms->len = 2;
3333                 sFrame.pIBSSParms->wATIMWindow = 0;
3334         }
3335         if (pDevice->eCurrentPHYType == PHY_TYPE_11G) {
3336                 sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3337                 sFrame.len += 1 + WLAN_IEHDR_LEN;
3338                 sFrame.pERP->byElementID = WLAN_EID_ERP;
3339                 sFrame.pERP->len = 1;
3340                 sFrame.pERP->byContext = 0;
3341                 if (pDevice->bProtectMode == true)
3342                         sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3343                 if (pDevice->bNonERPPresent == true)
3344                         sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3345                 if (pDevice->bBarkerPreambleMd == true)
3346                         sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3347         }
3348
3349         if ((pMgmt->b11hEnable == true) &&
3350             (pMgmt->eCurrentPHYMode == PHY_TYPE_11A)) {
3351                 // Country IE
3352                 pbyBuffer = (unsigned char *)(sFrame.pBuf + sFrame.len);
3353                 set_country_IE(pMgmt->pAdapter, pbyBuffer);
3354                 set_country_info(pMgmt->pAdapter, PHY_TYPE_11A, pbyBuffer);
3355                 uLength += ((PWLAN_IE_COUNTRY) pbyBuffer)->len + WLAN_IEHDR_LEN;
3356                 pbyBuffer += (((PWLAN_IE_COUNTRY) pbyBuffer)->len + WLAN_IEHDR_LEN);
3357                 // Power Constrain IE
3358                 ((PWLAN_IE_PW_CONST) pbyBuffer)->byElementID = WLAN_EID_PWR_CONSTRAINT;
3359                 ((PWLAN_IE_PW_CONST) pbyBuffer)->len = 1;
3360                 ((PWLAN_IE_PW_CONST) pbyBuffer)->byPower = 0;
3361                 pbyBuffer += (1) + WLAN_IEHDR_LEN;
3362                 uLength += (1) + WLAN_IEHDR_LEN;
3363                 if (pMgmt->bSwitchChannel == true) {
3364                         // Channel Switch IE
3365                         ((PWLAN_IE_CH_SW) pbyBuffer)->byElementID = WLAN_EID_CH_SWITCH;
3366                         ((PWLAN_IE_CH_SW) pbyBuffer)->len = 3;
3367                         ((PWLAN_IE_CH_SW) pbyBuffer)->byMode = 1;
3368                         ((PWLAN_IE_CH_SW) pbyBuffer)->byChannel = get_channel_number(pMgmt->pAdapter, pMgmt->byNewChannel);
3369                         ((PWLAN_IE_CH_SW) pbyBuffer)->byCount = 0;
3370                         pbyBuffer += (3) + WLAN_IEHDR_LEN;
3371                         uLength += (3) + WLAN_IEHDR_LEN;
3372                 }
3373                 // TPC report
3374                 ((PWLAN_IE_TPC_REP) pbyBuffer)->byElementID = WLAN_EID_TPC_REP;
3375                 ((PWLAN_IE_TPC_REP) pbyBuffer)->len = 2;
3376                 ((PWLAN_IE_TPC_REP) pbyBuffer)->byTxPower = CARDbyGetTransmitPower(pMgmt->pAdapter);
3377                 ((PWLAN_IE_TPC_REP) pbyBuffer)->byLinkMargin = 0;
3378                 pbyBuffer += (2) + WLAN_IEHDR_LEN;
3379                 uLength += (2) + WLAN_IEHDR_LEN;
3380                 // IBSS DFS
3381                 if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3382                         pIBSSDFS = (PWLAN_IE_IBSS_DFS) pbyBuffer;
3383                         pIBSSDFS->byElementID = WLAN_EID_IBSS_DFS;
3384                         pIBSSDFS->len = 7;
3385                         memcpy(pIBSSDFS->abyDFSOwner,
3386                                pMgmt->abyIBSSDFSOwner,
3387                                6);
3388                         pIBSSDFS->byDFSRecovery = pMgmt->byIBSSDFSRecovery;
3389                         pbyBuffer += (7) + WLAN_IEHDR_LEN;
3390                         uLength += (7) + WLAN_IEHDR_LEN;
3391                         for (ii = CB_MAX_CHANNEL_24G + 1; ii <= CB_MAX_CHANNEL; ii++) {
3392                                 if (get_channel_map_info(pMgmt->pAdapter, ii, pbyBuffer, pbyBuffer+1) == true) {
3393                                         pbyBuffer += 2;
3394                                         uLength += 2;
3395                                         pIBSSDFS->len += 2;
3396                                 }
3397                         }
3398                 }
3399                 sFrame.len += uLength;
3400         }
3401
3402         if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3403                 sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3404                 sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3405                 memcpy(sFrame.pExtSuppRates,
3406                        pCurrExtSuppRates,
3407                        ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3408 );
3409         }
3410
3411         // hostapd wpa/wpa2 IE
3412         if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == true)) {
3413                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3414                         if (pMgmt->wWPAIELen != 0) {
3415                                 sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3416                                 memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3417                                 sFrame.len += pMgmt->wWPAIELen;
3418                         }
3419                 }
3420         }
3421
3422         // Adjust the length fields
3423         pTxPacket->cbMPDULen = sFrame.len;
3424         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3425
3426         return pTxPacket;
3427 }
3428
3429 /*+
3430  *
3431  * Routine Description:
3432  *  Constructs an association request frame
3433  *
3434  *
3435  * Return Value:
3436  *    A ptr to frame or NULL on allocation failure
3437  *
3438  -*/
3439
3440 PSTxMgmtPacket
3441 s_MgrMakeAssocRequest(
3442         PSDevice pDevice,
3443         PSMgmtObject pMgmt,
3444         unsigned char *pDAddr,
3445         unsigned short wCurrCapInfo,
3446         unsigned short wListenInterval,
3447         PWLAN_IE_SSID pCurrSSID,
3448         PWLAN_IE_SUPP_RATES pCurrRates,
3449         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3450 )
3451 {
3452         PSTxMgmtPacket      pTxPacket = NULL;
3453         WLAN_FR_ASSOCREQ    sFrame;
3454         unsigned char *pbyIEs;
3455         unsigned char *pbyRSN;
3456
3457         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3458         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3459         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
3460         // Setup the sFrame structure.
3461         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
3462         sFrame.len = WLAN_ASSOCREQ_FR_MAXLEN;
3463         // format fixed field frame structure
3464         vMgrEncodeAssocRequest(&sFrame);
3465         // Setup the header
3466         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3467                 (
3468                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3469                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCREQ)
3470 ));
3471         memcpy(sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3472         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3473         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3474
3475         // Set the capability and listen interval
3476         *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3477         *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3478
3479         // sFrame.len point to end of fixed field
3480         sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3481         sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3482         memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3483
3484         pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3485         pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3486         pbyIEs = pMgmt->sAssocInfo.abyIEs;
3487         memcpy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3488         pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3489
3490         // Copy the rate set
3491         sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3492         if ((pDevice->eCurrentPHYType == PHY_TYPE_11B) && (pCurrRates->len > 4))
3493                 sFrame.len += 4 + WLAN_IEHDR_LEN;
3494         else
3495                 sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3496         memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3497
3498         // Copy the extension rate set
3499         if ((pDevice->eCurrentPHYType == PHY_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3500                 sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3501                 sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3502                 memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3503         }
3504
3505         pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3506         memcpy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3507         pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3508
3509         // for 802.11h
3510         if (pMgmt->b11hEnable == true) {
3511                 if (sFrame.pCurrPowerCap == NULL) {
3512                         sFrame.pCurrPowerCap = (PWLAN_IE_PW_CAP)(sFrame.pBuf + sFrame.len);
3513                         sFrame.len += (2 + WLAN_IEHDR_LEN);
3514                         sFrame.pCurrPowerCap->byElementID = WLAN_EID_PWR_CAPABILITY;
3515                         sFrame.pCurrPowerCap->len = 2;
3516                         CARDvGetPowerCapability(pMgmt->pAdapter,
3517                                                 &(sFrame.pCurrPowerCap->byMinPower),
3518                                                 &(sFrame.pCurrPowerCap->byMaxPower)
3519 );
3520                 }
3521                 if (sFrame.pCurrSuppCh == NULL) {
3522                         sFrame.pCurrSuppCh = (PWLAN_IE_SUPP_CH)(sFrame.pBuf + sFrame.len);
3523                         sFrame.len += set_support_channels(pMgmt->pAdapter, (unsigned char *)sFrame.pCurrSuppCh);
3524                 }
3525         }
3526
3527         if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3528              (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3529              (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3530             (pMgmt->pCurrBSS != NULL)) {
3531                 /* WPA IE */
3532                 sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3533                 sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3534                 sFrame.pRSNWPA->len = 16;
3535                 sFrame.pRSNWPA->abyOUI[0] = 0x00;
3536                 sFrame.pRSNWPA->abyOUI[1] = 0x50;
3537                 sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3538                 sFrame.pRSNWPA->abyOUI[3] = 0x01;
3539                 sFrame.pRSNWPA->wVersion = 1;
3540                 //Group Key Cipher Suite
3541                 sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3542                 sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3543                 sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3544                 if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3545                         sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3546                 } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3547                         sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3548                 } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3549                         sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3550                 } else {
3551                         sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3552                 }
3553                 // Pairwise Key Cipher Suite
3554                 sFrame.pRSNWPA->wPKCount = 1;
3555                 sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3556                 sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3557                 sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3558                 if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3559                         sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3560                 } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3561                         sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3562                 } else {
3563                         sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3564                 }
3565                 // Auth Key Management Suite
3566                 pbyRSN = (unsigned char *)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3567                 *pbyRSN++ = 0x01;
3568                 *pbyRSN++ = 0x00;
3569                 *pbyRSN++ = 0x00;
3570
3571                 *pbyRSN++ = 0x50;
3572                 *pbyRSN++ = 0xf2;
3573                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3574                         *pbyRSN++ = WPA_AUTH_PSK;
3575                 } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3576                         *pbyRSN++ = WPA_AUTH_IEEE802_1X;
3577                 } else {
3578                         *pbyRSN++ = WPA_NONE;
3579                 }
3580
3581                 sFrame.pRSNWPA->len += 6;
3582
3583                 // RSN Capabilities
3584
3585                 *pbyRSN++ = 0x00;
3586                 *pbyRSN++ = 0x00;
3587                 sFrame.pRSNWPA->len += 2;
3588
3589                 sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3590                 // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3591                 pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3592                 memcpy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3593                 pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3594
3595         } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3596                     (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3597                    (pMgmt->pCurrBSS != NULL)) {
3598                 unsigned int ii;
3599                 unsigned short *pwPMKID;
3600
3601                 // WPA IE
3602                 sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3603                 sFrame.pRSN->byElementID = WLAN_EID_RSN;
3604                 sFrame.pRSN->len = 6; //Version(2)+GK(4)
3605                 sFrame.pRSN->wVersion = 1;
3606                 //Group Key Cipher Suite
3607                 sFrame.pRSN->abyRSN[0] = 0x00;
3608                 sFrame.pRSN->abyRSN[1] = 0x0F;
3609                 sFrame.pRSN->abyRSN[2] = 0xAC;
3610                 if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3611                         sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3612                 } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3613                         sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3614                 } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3615                         sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3616                 } else {
3617                         sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3618                 }
3619
3620                 // Pairwise Key Cipher Suite
3621                 sFrame.pRSN->abyRSN[4] = 1;
3622                 sFrame.pRSN->abyRSN[5] = 0;
3623                 sFrame.pRSN->abyRSN[6] = 0x00;
3624                 sFrame.pRSN->abyRSN[7] = 0x0F;
3625                 sFrame.pRSN->abyRSN[8] = 0xAC;
3626                 if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3627                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3628                 } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3629                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3630                 } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3631                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3632                 } else {
3633                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3634                 }
3635                 sFrame.pRSN->len += 6;
3636
3637                 // Auth Key Management Suite
3638                 sFrame.pRSN->abyRSN[10] = 1;
3639                 sFrame.pRSN->abyRSN[11] = 0;
3640                 sFrame.pRSN->abyRSN[12] = 0x00;
3641                 sFrame.pRSN->abyRSN[13] = 0x0F;
3642                 sFrame.pRSN->abyRSN[14] = 0xAC;
3643                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3644                         sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3645                 } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3646                         sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3647                 } else {
3648                         sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3649                 }
3650                 sFrame.pRSN->len += 6;
3651
3652                 // RSN Capabilities
3653                 if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == true) {
3654                         memcpy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3655                 } else {
3656                         sFrame.pRSN->abyRSN[16] = 0;
3657                         sFrame.pRSN->abyRSN[17] = 0;
3658                 }
3659                 sFrame.pRSN->len += 2;
3660
3661                 if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == true) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3662                         // RSN PMKID
3663                         pbyRSN = &sFrame.pRSN->abyRSN[18];
3664                         pwPMKID = (unsigned short *)pbyRSN; // Point to PMKID count
3665                         *pwPMKID = 0;            // Initialize PMKID count
3666                         pbyRSN += 2;             // Point to PMKID list
3667                         for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3668                                 if (!memcmp(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, ETH_ALEN)) {
3669                                         (*pwPMKID)++;
3670                                         memcpy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
3671                                         pbyRSN += 16;
3672                                 }
3673                         }
3674                         if (*pwPMKID != 0) {
3675                                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
3676                         }
3677                 }
3678
3679                 sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3680                 // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3681                 pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3682                 memcpy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3683                 pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3684         }
3685
3686         // Adjust the length fields
3687         pTxPacket->cbMPDULen = sFrame.len;
3688         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3689         return pTxPacket;
3690 }
3691
3692 /*+
3693  *
3694  * Routine Description:
3695  *  Constructs an re-association request frame
3696  *
3697  *
3698  * Return Value:
3699  *    A ptr to frame or NULL on allocation failure
3700  *
3701  -*/
3702
3703 PSTxMgmtPacket
3704 s_MgrMakeReAssocRequest(
3705         PSDevice pDevice,
3706         PSMgmtObject pMgmt,
3707         unsigned char *pDAddr,
3708         unsigned short wCurrCapInfo,
3709         unsigned short wListenInterval,
3710         PWLAN_IE_SSID pCurrSSID,
3711         PWLAN_IE_SUPP_RATES pCurrRates,
3712         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3713 )
3714 {
3715         PSTxMgmtPacket      pTxPacket = NULL;
3716         WLAN_FR_REASSOCREQ  sFrame;
3717         unsigned char *pbyIEs;
3718         unsigned char *pbyRSN;
3719
3720         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3721         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_REASSOCREQ_FR_MAXLEN);
3722         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
3723         /* Setup the sFrame structure. */
3724         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
3725         sFrame.len = WLAN_REASSOCREQ_FR_MAXLEN;
3726
3727         // format fixed field frame structure
3728         vMgrEncodeReassocRequest(&sFrame);
3729
3730         /* Setup the header */
3731         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3732                 (
3733                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3734                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCREQ)
3735 ));
3736         memcpy(sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3737         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3738         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3739
3740         /* Set the capability and listen interval */
3741         *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3742         *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3743
3744         memcpy(sFrame.pAddrCurrAP, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3745         /* Copy the SSID */
3746         /* sFrame.len point to end of fixed field */
3747         sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3748         sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3749         memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3750
3751         pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3752         pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3753         pbyIEs = pMgmt->sAssocInfo.abyIEs;
3754         memcpy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3755         pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3756
3757         /* Copy the rate set */
3758         /* sFrame.len point to end of SSID */
3759         sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3760         sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3761         memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3762
3763         // Copy the extension rate set
3764         if ((pMgmt->eCurrentPHYMode == PHY_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3765                 sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3766                 sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3767                 memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3768         }
3769
3770         pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3771         memcpy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3772         pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3773
3774         if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3775              (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3776              (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3777             (pMgmt->pCurrBSS != NULL)) {
3778                 /* WPA IE */
3779                 sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3780                 sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3781                 sFrame.pRSNWPA->len = 16;
3782                 sFrame.pRSNWPA->abyOUI[0] = 0x00;
3783                 sFrame.pRSNWPA->abyOUI[1] = 0x50;
3784                 sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3785                 sFrame.pRSNWPA->abyOUI[3] = 0x01;
3786                 sFrame.pRSNWPA->wVersion = 1;
3787                 //Group Key Cipher Suite
3788                 sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3789                 sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3790                 sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3791                 if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3792                         sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3793                 } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3794                         sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3795                 } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3796                         sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3797                 } else {
3798                         sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3799                 }
3800                 // Pairwise Key Cipher Suite
3801                 sFrame.pRSNWPA->wPKCount = 1;
3802                 sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3803                 sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3804                 sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3805                 if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3806                         sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3807                 } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3808                         sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3809                 } else {
3810                         sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3811                 }
3812                 // Auth Key Management Suite
3813                 pbyRSN = (unsigned char *)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3814                 *pbyRSN++ = 0x01;
3815                 *pbyRSN++ = 0x00;
3816                 *pbyRSN++ = 0x00;
3817
3818                 *pbyRSN++ = 0x50;
3819                 *pbyRSN++ = 0xf2;
3820                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3821                         *pbyRSN++ = WPA_AUTH_PSK;
3822                 } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3823                         *pbyRSN++ = WPA_AUTH_IEEE802_1X;
3824                 } else {
3825                         *pbyRSN++ = WPA_NONE;
3826                 }
3827
3828                 sFrame.pRSNWPA->len += 6;
3829
3830                 // RSN Capabilities
3831                 *pbyRSN++ = 0x00;
3832                 *pbyRSN++ = 0x00;
3833                 sFrame.pRSNWPA->len += 2;
3834
3835                 sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3836                 // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3837                 pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3838                 memcpy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3839                 pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3840
3841         } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3842                     (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3843                    (pMgmt->pCurrBSS != NULL)) {
3844                 unsigned int ii;
3845                 unsigned short *pwPMKID;
3846
3847                 /* WPA IE */
3848                 sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3849                 sFrame.pRSN->byElementID = WLAN_EID_RSN;
3850                 sFrame.pRSN->len = 6; //Version(2)+GK(4)
3851                 sFrame.pRSN->wVersion = 1;
3852                 //Group Key Cipher Suite
3853                 sFrame.pRSN->abyRSN[0] = 0x00;
3854                 sFrame.pRSN->abyRSN[1] = 0x0F;
3855                 sFrame.pRSN->abyRSN[2] = 0xAC;
3856                 if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3857                         sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3858                 } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3859                         sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3860                 } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3861                         sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3862                 } else {
3863                         sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3864                 }
3865
3866                 // Pairwise Key Cipher Suite
3867                 sFrame.pRSN->abyRSN[4] = 1;
3868                 sFrame.pRSN->abyRSN[5] = 0;
3869                 sFrame.pRSN->abyRSN[6] = 0x00;
3870                 sFrame.pRSN->abyRSN[7] = 0x0F;
3871                 sFrame.pRSN->abyRSN[8] = 0xAC;
3872                 if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3873                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3874                 } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3875                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3876                 } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3877                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3878                 } else {
3879                         sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3880                 }
3881                 sFrame.pRSN->len += 6;
3882
3883                 // Auth Key Management Suite
3884                 sFrame.pRSN->abyRSN[10] = 1;
3885                 sFrame.pRSN->abyRSN[11] = 0;
3886                 sFrame.pRSN->abyRSN[12] = 0x00;
3887                 sFrame.pRSN->abyRSN[13] = 0x0F;
3888                 sFrame.pRSN->abyRSN[14] = 0xAC;
3889                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3890                         sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3891                 } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3892                         sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3893                 } else {
3894                         sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3895                 }
3896                 sFrame.pRSN->len += 6;
3897
3898                 // RSN Capabilities
3899                 if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == true) {
3900                         memcpy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3901                 } else {
3902                         sFrame.pRSN->abyRSN[16] = 0;
3903                         sFrame.pRSN->abyRSN[17] = 0;
3904                 }
3905                 sFrame.pRSN->len += 2;
3906
3907                 if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == true) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3908                         // RSN PMKID
3909                         pbyRSN = &sFrame.pRSN->abyRSN[18];
3910                         pwPMKID = (unsigned short *)pbyRSN; // Point to PMKID count
3911                         *pwPMKID = 0;            // Initialize PMKID count
3912                         pbyRSN += 2;             // Point to PMKID list
3913                         for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3914                                 if (!memcmp(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, ETH_ALEN)) {
3915                                         (*pwPMKID)++;
3916                                         memcpy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
3917                                         pbyRSN += 16;
3918                                 }
3919                         }
3920                         if (*pwPMKID != 0) {
3921                                 sFrame.pRSN->len += (2 + (*pwPMKID) * 16);
3922                         }
3923                 }
3924
3925                 sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3926                 // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3927                 pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3928                 memcpy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3929                 pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3930         }
3931
3932         /* Adjust the length fields */
3933         pTxPacket->cbMPDULen = sFrame.len;
3934         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3935
3936         return pTxPacket;
3937 }
3938
3939 /*+
3940  *
3941  * Routine Description:
3942  *  Constructs an assoc-response frame
3943  *
3944  *
3945  * Return Value:
3946  *    PTR to frame; or NULL on allocation failure
3947  *
3948  -*/
3949
3950 PSTxMgmtPacket
3951 s_MgrMakeAssocResponse(
3952         PSDevice pDevice,
3953         PSMgmtObject pMgmt,
3954         unsigned short wCurrCapInfo,
3955         unsigned short wAssocStatus,
3956         unsigned short wAssocAID,
3957         unsigned char *pDstAddr,
3958         PWLAN_IE_SUPP_RATES pCurrSuppRates,
3959         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3960 )
3961 {
3962         PSTxMgmtPacket      pTxPacket = NULL;
3963         WLAN_FR_ASSOCRESP   sFrame;
3964
3965         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3966         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3967         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
3968         // Setup the sFrame structure
3969         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
3970         sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
3971         vMgrEncodeAssocResponse(&sFrame);
3972         // Setup the header
3973         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3974                 (
3975                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3976                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCRESP)
3977 ));
3978         memcpy(sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3979         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3980         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3981
3982         *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3983         *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
3984         *sFrame.pwAid = cpu_to_le16((unsigned short)(wAssocAID | BIT14 | BIT15));
3985
3986         // Copy the rate set
3987         sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3988         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3989         memcpy(sFrame.pSuppRates,
3990                pCurrSuppRates,
3991                ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3992 );
3993
3994         if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3995                 sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3996                 sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3997                 memcpy(sFrame.pExtSuppRates,
3998                        pCurrExtSuppRates,
3999                        ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4000 );
4001         }
4002
4003         // Adjust the length fields
4004         pTxPacket->cbMPDULen = sFrame.len;
4005         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4006
4007         return pTxPacket;
4008 }
4009
4010 /*+
4011  *
4012  * Routine Description:
4013  *  Constructs an reassoc-response frame
4014  *
4015  *
4016  * Return Value:
4017  *    PTR to frame; or NULL on allocation failure
4018  *
4019  -*/
4020
4021 PSTxMgmtPacket
4022 s_MgrMakeReAssocResponse(
4023         PSDevice pDevice,
4024         PSMgmtObject pMgmt,
4025         unsigned short wCurrCapInfo,
4026         unsigned short wAssocStatus,
4027         unsigned short wAssocAID,
4028         unsigned char *pDstAddr,
4029         PWLAN_IE_SUPP_RATES pCurrSuppRates,
4030         PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4031 )
4032 {
4033         PSTxMgmtPacket      pTxPacket = NULL;
4034         WLAN_FR_REASSOCRESP   sFrame;
4035
4036         pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4037         memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4038         pTxPacket->p80211Header = (PUWLAN_80211HDR)((unsigned char *)pTxPacket + sizeof(STxMgmtPacket));
4039         // Setup the sFrame structure
4040         sFrame.pBuf = (unsigned char *)pTxPacket->p80211Header;
4041         sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4042         vMgrEncodeReassocResponse(&sFrame);
4043         // Setup the header
4044         sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4045                 (
4046                         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4047                         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCRESP)
4048 ));
4049         memcpy(sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4050         memcpy(sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4051         memcpy(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4052
4053         *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4054         *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4055         *sFrame.pwAid = cpu_to_le16((unsigned short)(wAssocAID | BIT14 | BIT15));
4056
4057         // Copy the rate set
4058         sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4059         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4060         memcpy(sFrame.pSuppRates,
4061                pCurrSuppRates,
4062                ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4063 );
4064
4065         if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4066                 sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4067                 sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4068                 memcpy(sFrame.pExtSuppRates,
4069                        pCurrExtSuppRates,
4070                        ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4071 );
4072         }
4073
4074         // Adjust the length fields
4075         pTxPacket->cbMPDULen = sFrame.len;
4076         pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4077
4078         return pTxPacket;
4079 }
4080
4081 /*+
4082  *
4083  * Routine Description:
4084  *  Handles probe response management frames.
4085  *
4086  *
4087  * Return Value:
4088  *    none.
4089  *
4090  -*/
4091
4092 static
4093 void
4094 s_vMgrRxProbeResponse(
4095         PSDevice pDevice,
4096         PSMgmtObject pMgmt,
4097         PSRxMgmtPacket pRxPacket
4098 )
4099 {
4100         PKnownBSS           pBSSList = NULL;
4101         WLAN_FR_PROBERESP   sFrame;
4102         unsigned char byCurrChannel = pRxPacket->byRxChannel;
4103         ERPObject           sERP;
4104         unsigned char byIEChannel = 0;
4105         bool bChannelHit = true;
4106
4107         memset(&sFrame, 0, sizeof(WLAN_FR_PROBERESP));
4108         // decode the frame
4109         sFrame.len = pRxPacket->cbMPDULen;
4110         sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
4111         vMgrDecodeProbeResponse(&sFrame);
4112
4113         if ((sFrame.pqwTimestamp == 0) ||
4114             (sFrame.pwBeaconInterval == 0) ||
4115             (sFrame.pwCapInfo == 0) ||
4116             (sFrame.pSSID == 0) ||
4117             (sFrame.pSuppRates == 0)) {
4118                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe resp:Fail addr:[%p] \n", pRxPacket->p80211Header);
4119                 DBG_PORT80(0xCC);
4120                 return;
4121         }
4122
4123         if (sFrame.pSSID->len == 0)
4124                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx Probe resp: SSID len = 0 \n");
4125
4126         if (sFrame.pDSParms != 0) {
4127                 if (byCurrChannel > CB_MAX_CHANNEL_24G) {
4128                         // channel remapping to
4129                         byIEChannel = get_channel_mapping(pMgmt->pAdapter, sFrame.pDSParms->byCurrChannel, PHY_TYPE_11A);
4130                 } else {
4131                         byIEChannel = sFrame.pDSParms->byCurrChannel;
4132                 }
4133                 if (byCurrChannel != byIEChannel) {
4134                         // adjust channel info. bcs we rcv adjacent channel packets
4135                         bChannelHit = false;
4136                         byCurrChannel = byIEChannel;
4137                 }
4138         } else {
4139                 // no DS channel info
4140                 bChannelHit = true;
4141         }
4142
4143 //2008-0730-01<Add>by MikeLiu
4144         if (ChannelExceedZoneType(pDevice, byCurrChannel) == true)
4145                 return;
4146
4147         if (sFrame.pERP != NULL) {
4148                 sERP.byERP = sFrame.pERP->byContext;
4149                 sERP.bERPExist = true;
4150         } else {
4151                 sERP.bERPExist = false;
4152                 sERP.byERP = 0;
4153         }
4154
4155         // update or insert the bss
4156         pBSSList = BSSpAddrIsInBSSList((void *)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
4157         if (pBSSList) {
4158                 BSSbUpdateToBSSList((void *)pDevice,
4159                                     *sFrame.pqwTimestamp,
4160                                     *sFrame.pwBeaconInterval,
4161                                     *sFrame.pwCapInfo,
4162                                     byCurrChannel,
4163                                     bChannelHit,
4164                                     sFrame.pSSID,
4165                                     sFrame.pSuppRates,
4166                                     sFrame.pExtSuppRates,
4167                                     &sERP,
4168                                     sFrame.pRSN,
4169                                     sFrame.pRSNWPA,
4170                                     sFrame.pIE_Country,
4171                                     sFrame.pIE_Quiet,
4172                                     pBSSList,
4173                                     sFrame.len - WLAN_HDR_ADDR3_LEN,
4174                                     sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
4175                                     (void *)pRxPacket
4176 );
4177         } else {
4178                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe resp/insert: RxChannel = : %d\n", byCurrChannel);
4179                 BSSbInsertToBSSList((void *)pDevice,
4180                                     sFrame.pHdr->sA3.abyAddr3,
4181                                     *sFrame.pqwTimestamp,
4182                                     *sFrame.pwBeaconInterval,
4183                                     *sFrame.pwCapInfo,
4184                                     byCurrChannel,
4185                                     sFrame.pSSID,
4186                                     sFrame.pSuppRates,
4187                                     sFrame.pExtSuppRates,
4188                                     &sERP,
4189                                     sFrame.pRSN,
4190                                     sFrame.pRSNWPA,
4191                                     sFrame.pIE_Country,
4192                                     sFrame.pIE_Quiet,
4193                                     sFrame.len - WLAN_HDR_ADDR3_LEN,
4194                                     sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
4195                                     (void *)pRxPacket
4196 );
4197         }
4198         return;
4199 }
4200
4201 /*+
4202  *
4203  * Routine Description:(AP)or(Ad-hoc STA)
4204  *  Handles probe request management frames.
4205  *
4206  *
4207  * Return Value:
4208  *    none.
4209  *
4210  -*/
4211
4212 static
4213 void
4214 s_vMgrRxProbeRequest(
4215         PSDevice pDevice,
4216         PSMgmtObject pMgmt,
4217         PSRxMgmtPacket pRxPacket
4218 )
4219 {
4220         WLAN_FR_PROBEREQ    sFrame;
4221         CMD_STATUS          Status;
4222         PSTxMgmtPacket      pTxPacket;
4223         unsigned char byPHYType = BB_TYPE_11B;
4224
4225         // STA in Ad-hoc mode: when latest TBTT beacon transmit success,
4226         // STA have to response this request.
4227         if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
4228             ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && pDevice->bBeaconSent)) {
4229                 memset(&sFrame, 0, sizeof(WLAN_FR_PROBEREQ));
4230                 // decode the frame
4231                 sFrame.len = pRxPacket->cbMPDULen;
4232                 sFrame.pBuf = (unsigned char *)pRxPacket->p80211Header;
4233                 vMgrDecodeProbeRequest(&sFrame);
4234 /*
4235   DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%pM\n",
4236   sFrame.pHdr->sA3.abyAddr2);
4237 */
4238                 if (sFrame.pSSID->len != 0) {
4239                         if (sFrame.pSSID->len != ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len)
4240                                 return;
4241                         if (memcmp(sFrame.pSSID->abySSID,
4242                                    ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
4243                                    ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) != 0) {
4244                                 return;
4245                         }
4246                 }
4247
4248                 if ((sFrame.pSuppRates->len > 4) || (sFrame.pExtSuppRates != NULL)) {
4249                         byPHYType = BB_TYPE_11G;
4250                 }
4251
4252                 // Probe response reply..
4253                 pTxPacket = s_MgrMakeProbeResponse
4254                         (
4255                                 pDevice,
4256                                 pMgmt,
4257                                 pMgmt->wCurrCapInfo,
4258                                 pMgmt->wCurrBeaconPeriod,
4259                                 pMgmt->uCurrChannel,
4260                                 0,
4261                                 sFrame.pHdr->sA3.abyAddr2,
4262                                 (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4263                                 (unsigned char *)pMgmt->abyCurrBSSID,
4264                                 (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4265                                 (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
4266                                 byPHYType
4267 );
4268                 if (pTxPacket != NULL) {
4269                         /* send the frame */
4270                         Status = csMgmt_xmit(pDevice, pTxPacket);
4271                         if (Status != CMD_STATUS_PENDING) {
4272                                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx failed\n");
4273                         } else {
4274 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx sending..\n");
4275                         }
4276                 }
4277         }
4278
4279         return;
4280 }
4281
4282 /*+
4283  *
4284  * Routine Description:
4285  *
4286  *  Entry point for the reception and handling of 802.11 management
4287  *  frames. Makes a determination of the frame type and then calls
4288  *  the appropriate function.
4289  *
4290  *
4291  * Return Value:
4292  *    none.
4293  *
4294  -*/
4295
4296 void
4297 vMgrRxManagePacket(
4298         void *hDeviceContext,
4299         PSMgmtObject pMgmt,
4300         PSRxMgmtPacket pRxPacket
4301 )
4302 {
4303         PSDevice    pDevice = (PSDevice)hDeviceContext;
4304         bool bInScan = false;
4305         unsigned int uNodeIndex = 0;
4306         NODE_STATE  eNodeState = 0;
4307         CMD_STATUS  Status;
4308
4309         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
4310                 if (BSSDBbIsSTAInNodeDB(pMgmt, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex))
4311                         eNodeState = pMgmt->sNodeDBTable[uNodeIndex].eNodeState;
4312         }
4313
4314         switch (WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl))) {
4315         case WLAN_FSTYPE_ASSOCREQ:
4316                 // Frame Clase = 2
4317                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocreq\n");
4318                 if (eNodeState < NODE_AUTH) {
4319                         // send deauth notification
4320                         // reason = (6) class 2 received from nonauth sta
4321                         vMgrDeAuthenBeginSta(pDevice,
4322                                              pMgmt,
4323                                              pRxPacket->p80211Header->sA3.abyAddr2,
4324                                              (6),
4325                                              &Status
4326 );
4327                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 1\n");
4328                 } else {
4329                         s_vMgrRxAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4330                 }
4331                 break;
4332
4333         case WLAN_FSTYPE_ASSOCRESP:
4334                 // Frame Clase = 2
4335                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp1\n");
4336                 s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, false);
4337                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp2\n");
4338                 break;
4339
4340         case WLAN_FSTYPE_REASSOCREQ:
4341                 // Frame Clase = 2
4342                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocreq\n");
4343                 // Todo: reassoc
4344                 if (eNodeState < NODE_AUTH) {
4345                         // send deauth notification
4346                         // reason = (6) class 2 received from nonauth sta
4347                         vMgrDeAuthenBeginSta(pDevice,
4348                                              pMgmt,
4349                                              pRxPacket->p80211Header->sA3.abyAddr2,
4350                                              (6),
4351                                              &Status
4352 );
4353                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 2\n");
4354
4355                 }
4356                 s_vMgrRxReAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4357                 break;
4358
4359         case WLAN_FSTYPE_REASSOCRESP:
4360                 // Frame Clase = 2
4361                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocresp\n");
4362                 s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, true);
4363                 break;
4364
4365         case WLAN_FSTYPE_PROBEREQ:
4366                 // Frame Clase = 0
4367                 //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx probereq\n");
4368                 s_vMgrRxProbeRequest(pDevice, pMgmt, pRxPacket);
4369                 break;
4370
4371         case WLAN_FSTYPE_PROBERESP:
4372                 // Frame Clase = 0
4373                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx proberesp\n");
4374
4375                 s_vMgrRxProbeResponse(pDevice, pMgmt, pRxPacket);
4376                 break;
4377
4378         case WLAN_FSTYPE_BEACON:
4379                 // Frame Clase = 0
4380                 //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx beacon\n");
4381                 if (pMgmt->eScanState != WMAC_NO_SCANNING) {
4382                         bInScan = true;
4383                 }
4384                 s_vMgrRxBeacon(pDevice, pMgmt, pRxPacket, bInScan);
4385                 break;
4386
4387         case WLAN_FSTYPE_ATIM:
4388                 // Frame Clase = 1
4389                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx atim\n");
4390                 break;
4391
4392         case WLAN_FSTYPE_DISASSOC:
4393                 // Frame Clase = 2
4394                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx disassoc\n");
4395                 if (eNodeState < NODE_AUTH) {
4396                         // send deauth notification
4397                         // reason = (6) class 2 received from nonauth sta
4398                         vMgrDeAuthenBeginSta(pDevice,
4399                                              pMgmt,
4400                                              pRxPacket->p80211Header->sA3.abyAddr2,
4401                                              (6),
4402                                              &Status
4403 );
4404                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 3\n");
4405                 }
4406                 s_vMgrRxDisassociation(pDevice, pMgmt, pRxPacket);
4407                 break;
4408
4409         case WLAN_FSTYPE_AUTHEN:
4410                 // Frame Clase = 1
4411                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO  "rx authen\n");
4412                 s_vMgrRxAuthentication(pDevice, pMgmt, pRxPacket);
4413                 break;
4414
4415         case WLAN_FSTYPE_DEAUTHEN:
4416                 // Frame Clase = 1
4417                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx deauthen\n");
4418                 s_vMgrRxDeauthentication(pDevice, pMgmt, pRxPacket);
4419                 break;
4420
4421         default:
4422                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx unknown mgmt\n");
4423         }
4424
4425         return;
4426 }
4427
4428 /*+
4429  *
4430  * Routine Description:
4431  *
4432  *
4433  *  Prepare beacon to send
4434  *
4435  * Return Value:
4436  *    true if success; false if failed.
4437  *
4438  -*/
4439 bool
4440 bMgrPrepareBeaconToSend(
4441         void *hDeviceContext,
4442         PSMgmtObject pMgmt
4443 )
4444 {
4445         PSDevice            pDevice = (PSDevice)hDeviceContext;
4446         PSTxMgmtPacket      pTxPacket;
4447
4448 //    pDevice->bBeaconBufReady = false;
4449         if (pDevice->bEncryptionEnable || pDevice->bEnable8021x) {
4450                 pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
4451         } else {
4452                 pMgmt->wCurrCapInfo &= ~WLAN_SET_CAP_INFO_PRIVACY(1);
4453         }
4454         pTxPacket = s_MgrMakeBeacon
4455                 (
4456                         pDevice,
4457                         pMgmt,
4458                         pMgmt->wCurrCapInfo,
4459                         pMgmt->wCurrBeaconPeriod,
4460                         pMgmt->uCurrChannel,
4461                         pMgmt->wCurrATIMWindow, //0,
4462                         (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4463                         (unsigned char *)pMgmt->abyCurrBSSID,
4464                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4465                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
4466 );
4467
4468         if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) &&
4469             (pMgmt->abyCurrBSSID[0] == 0))
4470                 return false;
4471
4472         csBeacon_xmit(pDevice, pTxPacket);
4473
4474         return true;
4475 }
4476
4477 /*+
4478  *
4479  * Routine Description:
4480  *
4481  *  Log a warning message based on the contents of the Status
4482  *  Code field of an 802.11 management frame.  Defines are
4483  *  derived from 802.11-1997 SPEC.
4484  *
4485  * Return Value:
4486  *    none.
4487  *
4488  -*/
4489 static
4490 void
4491 s_vMgrLogStatus(
4492         PSMgmtObject pMgmt,
4493         unsigned short wStatus
4494 )
4495 {
4496         switch (wStatus) {
4497         case WLAN_MGMT_STATUS_UNSPEC_FAILURE:
4498                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Unspecified error.\n");
4499                 break;
4500         case WLAN_MGMT_STATUS_CAPS_UNSUPPORTED:
4501                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Can't support all requested capabilities.\n");
4502                 break;
4503         case WLAN_MGMT_STATUS_REASSOC_NO_ASSOC:
4504                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Reassoc denied, can't confirm original Association.\n");
4505                 break;
4506         case WLAN_MGMT_STATUS_ASSOC_DENIED_UNSPEC:
4507                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, undefine in spec\n");
4508                 break;
4509         case WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG:
4510                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Peer doesn't support authen algorithm.\n");
4511                 break;
4512         case WLAN_MGMT_STATUS_RX_AUTH_NOSEQ:
4513                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen frame received out of sequence.\n");
4514                 break;
4515         case WLAN_MGMT_STATUS_CHALLENGE_FAIL:
4516                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, challenge  failure.\n");
4517                 break;
4518         case WLAN_MGMT_STATUS_AUTH_TIMEOUT:
4519                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, timeout waiting for next frame.\n");
4520                 break;
4521         case WLAN_MGMT_STATUS_ASSOC_DENIED_BUSY:
4522                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, AP too busy.\n");
4523                 break;
4524         case WLAN_MGMT_STATUS_ASSOC_DENIED_RATES:
4525                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we haven't enough basic rates.\n");
4526                 break;
4527         case WLAN_MGMT_STATUS_ASSOC_DENIED_SHORTPREAMBLE:
4528                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support short preamble.\n");
4529                 break;
4530         case WLAN_MGMT_STATUS_ASSOC_DENIED_PBCC:
4531                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support PBCC.\n");
4532                 break;
4533         case WLAN_MGMT_STATUS_ASSOC_DENIED_AGILITY:
4534                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support channel agility.\n");
4535                 break;
4536         default:
4537                 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Unknown status code %d.\n", wStatus);
4538                 break;
4539         }
4540 }
4541
4542 /*
4543  *
4544  * Description:
4545  *    Add BSSID in PMKID Candidate list.
4546  *
4547  * Parameters:
4548  *  In:
4549  *      hDeviceContext - device structure point
4550  *      pbyBSSID - BSSID address for adding
4551  *      wRSNCap - BSS's RSN capability
4552  *  Out:
4553  *      none
4554  *
4555  * Return Value: none.
4556  *
4557  -*/
4558 bool
4559 bAdd_PMKID_Candidate(
4560         void *hDeviceContext,
4561         unsigned char *pbyBSSID,
4562         PSRSNCapObject psRSNCapObj
4563 )
4564 {
4565         PSDevice         pDevice = (PSDevice)hDeviceContext;
4566         PPMKID_CANDIDATE pCandidateList;
4567         unsigned int ii = 0;
4568
4569         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "bAdd_PMKID_Candidate START: (%d)\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4570
4571         if ((pDevice == NULL) || (pbyBSSID == NULL) || (psRSNCapObj == NULL))
4572                 return false;
4573
4574         if (pDevice->gsPMKIDCandidate.NumCandidates >= MAX_PMKIDLIST)
4575                 return false;
4576
4577         // Update Old Candidate
4578         for (ii = 0; ii < pDevice->gsPMKIDCandidate.NumCandidates; ii++) {
4579                 pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[ii];
4580                 if (!memcmp(pCandidateList->BSSID, pbyBSSID, ETH_ALEN)) {
4581                         if ((psRSNCapObj->bRSNCapExist == true) && (psRSNCapObj->wRSNCap & BIT0)) {
4582                                 pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4583                         } else {
4584                                 pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4585                         }
4586                         return true;
4587                 }
4588         }
4589
4590         // New Candidate
4591         pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[pDevice->gsPMKIDCandidate.NumCandidates];
4592         if ((psRSNCapObj->bRSNCapExist == true) && (psRSNCapObj->wRSNCap & BIT0)) {
4593                 pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4594         } else {
4595                 pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4596         }
4597         memcpy(pCandidateList->BSSID, pbyBSSID, ETH_ALEN);
4598         pDevice->gsPMKIDCandidate.NumCandidates++;
4599         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "NumCandidates:%d\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4600         return true;
4601 }
4602
4603 /*
4604  *
4605  * Description:
4606  *    Flush PMKID Candidate list.
4607  *
4608  * Parameters:
4609  *  In:
4610  *      hDeviceContext - device structure point
4611  *  Out:
4612  *      none
4613  *
4614  * Return Value: none.
4615  *
4616  -*/
4617 void
4618 vFlush_PMKID_Candidate(
4619         void *hDeviceContext
4620 )
4621 {
4622         PSDevice        pDevice = (PSDevice)hDeviceContext;
4623
4624         if (pDevice == NULL)
4625                 return;
4626
4627         memset(&pDevice->gsPMKIDCandidate, 0, sizeof(SPMKIDCandidateEvent));
4628 }
4629
4630 static bool
4631 s_bCipherMatch(
4632         PKnownBSS                        pBSSNode,
4633         NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
4634         unsigned char *pbyCCSPK,
4635         unsigned char *pbyCCSGK
4636 )
4637 {
4638         unsigned char byMulticastCipher = KEY_CTL_INVALID;
4639         unsigned char byCipherMask = 0x00;
4640         int i;
4641
4642         if (pBSSNode == NULL)
4643                 return false;
4644
4645         // check cap. of BSS
4646         if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4647             (EncStatus == Ndis802_11Encryption1Enabled)) {
4648                 // default is WEP only
4649                 byMulticastCipher = KEY_CTL_WEP;
4650         }
4651
4652         if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4653             (pBSSNode->bWPA2Valid == true) &&
4654             //20080123-01,<Add> by Einsn Liu
4655             ((EncStatus == Ndis802_11Encryption3Enabled) || (EncStatus == Ndis802_11Encryption2Enabled))) {
4656                 //WPA2
4657                 // check Group Key Cipher
4658                 if ((pBSSNode->byCSSGK == WLAN_11i_CSS_WEP40) ||
4659                     (pBSSNode->byCSSGK == WLAN_11i_CSS_WEP104)) {
4660                         byMulticastCipher = KEY_CTL_WEP;
4661                 } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_TKIP) {
4662                         byMulticastCipher = KEY_CTL_TKIP;
4663                 } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_CCMP) {
4664                         byMulticastCipher = KEY_CTL_CCMP;
4665                 } else {
4666                         byMulticastCipher = KEY_CTL_INVALID;
4667                 }
4668
4669                 // check Pairwise Key Cipher
4670                 for (i = 0; i < pBSSNode->wCSSPKCount; i++) {
4671                         if ((pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP40) ||
4672                             (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP104)) {
4673                                 // this should not happen as defined 802.11i
4674                                 byCipherMask |= 0x01;
4675                         } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_TKIP) {
4676                                 byCipherMask |= 0x02;
4677                         } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_CCMP) {
4678                                 byCipherMask |= 0x04;
4679                         } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_USE_GROUP) {
4680                                 // use group key only ignore all others
4681                                 byCipherMask = 0;
4682                                 i = pBSSNode->wCSSPKCount;
4683                         }
4684                 }
4685
4686         } else if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4687                    (pBSSNode->bWPAValid == true) &&
4688                    ((EncStatus == Ndis802_11Encryption3Enabled) || (EncStatus == Ndis802_11Encryption2Enabled))) {
4689                 //WPA
4690                 // check Group Key Cipher
4691                 if ((pBSSNode->byGKType == WPA_WEP40) ||
4692                     (pBSSNode->byGKType == WPA_WEP104)) {
4693                         byMulticastCipher = KEY_CTL_WEP;
4694                 } else if (pBSSNode->byGKType == WPA_TKIP) {
4695                         byMulticastCipher = KEY_CTL_TKIP;
4696                 } else if (pBSSNode->byGKType == WPA_AESCCMP) {
4697                         byMulticastCipher = KEY_CTL_CCMP;
4698                 } else {
4699                         byMulticastCipher = KEY_CTL_INVALID;
4700                 }
4701
4702                 // check Pairwise Key Cipher
4703                 for (i = 0; i < pBSSNode->wPKCount; i++) {
4704                         if (pBSSNode->abyPKType[i] == WPA_TKIP) {
4705                                 byCipherMask |= 0x02;
4706                         } else if (pBSSNode->abyPKType[i] == WPA_AESCCMP) {
4707                                 byCipherMask |= 0x04;
4708                         } else if (pBSSNode->abyPKType[i] == WPA_NONE) {
4709                                 // use group key only ignore all others
4710                                 byCipherMask = 0;
4711                                 i = pBSSNode->wPKCount;
4712                         }
4713                 }
4714         }
4715
4716         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%d, %d, %d, %d, EncStatus:%d\n",
4717                 byMulticastCipher, byCipherMask, pBSSNode->bWPAValid, pBSSNode->bWPA2Valid, EncStatus);
4718
4719         // mask our cap. with BSS
4720         if (EncStatus == Ndis802_11Encryption1Enabled) {
4721                 // For supporting Cisco migration mode, don't care pairwise key cipher
4722                 if ((byMulticastCipher == KEY_CTL_WEP) &&
4723                     (byCipherMask == 0)) {
4724                         *pbyCCSGK = KEY_CTL_WEP;
4725                         *pbyCCSPK = KEY_CTL_NONE;
4726                         return true;
4727                 } else {
4728                         return false;
4729                 }
4730
4731         } else if (EncStatus == Ndis802_11Encryption2Enabled) {
4732                 if ((byMulticastCipher == KEY_CTL_TKIP) &&
4733                     (byCipherMask == 0)) {
4734                         *pbyCCSGK = KEY_CTL_TKIP;
4735                         *pbyCCSPK = KEY_CTL_NONE;
4736                         return true;
4737                 } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4738                            ((byCipherMask & 0x02) != 0)) {
4739                         *pbyCCSGK = KEY_CTL_WEP;
4740                         *pbyCCSPK = KEY_CTL_TKIP;
4741                         return true;
4742                 } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4743                            ((byCipherMask & 0x02) != 0)) {
4744                         *pbyCCSGK = KEY_CTL_TKIP;
4745                         *pbyCCSPK = KEY_CTL_TKIP;
4746                         return true;
4747                 } else {
4748                         return false;
4749                 }
4750         } else if (EncStatus == Ndis802_11Encryption3Enabled) {
4751                 if ((byMulticastCipher == KEY_CTL_CCMP) &&
4752                     (byCipherMask == 0)) {
4753                         // When CCMP is enable, "Use group cipher suite" shall not be a valid option.
4754                         return false;
4755                 } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4756                            ((byCipherMask & 0x04) != 0)) {
4757                         *pbyCCSGK = KEY_CTL_WEP;
4758                         *pbyCCSPK = KEY_CTL_CCMP;
4759                         return true;
4760                 } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4761                            ((byCipherMask & 0x04) != 0)) {
4762                         *pbyCCSGK = KEY_CTL_TKIP;
4763                         *pbyCCSPK = KEY_CTL_CCMP;
4764                         return true;
4765                 } else if ((byMulticastCipher == KEY_CTL_CCMP) &&
4766                            ((byCipherMask & 0x04) != 0)) {
4767                         *pbyCCSGK = KEY_CTL_CCMP;
4768                         *pbyCCSPK = KEY_CTL_CCMP;
4769                         return true;
4770                 } else {
4771                         return false;
4772                 }
4773         }
4774         return true;
4775 }