SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/staging/vt6656/wmgr.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  *
  20  * File: wmgr.c
  21  *
  22  * Purpose: Handles the 802.11 management functions
  23  *
  24  * Author: Lyndon Chen
  25  *
  26  * Date: May 8, 2002
  27  *
  28  * Functions:
  29  *      nsMgrObjectInitial - Initialize Management Objet data structure
  30  *      vMgrObjectReset - Reset Management Objet data structure
  31  *      vMgrAssocBeginSta - Start associate function
  32  *      vMgrReAssocBeginSta - Start reassociate function
  33  *      vMgrDisassocBeginSta - Start disassociate function
  34  *      s_vMgrRxAssocRequest - Handle Rcv associate_request
  35  *      s_vMgrRxAssocResponse - Handle Rcv associate_response
  36  *      vMrgAuthenBeginSta - Start authentication function
  37  *      vMgrDeAuthenDeginSta - Start deauthentication function
  38  *      s_vMgrRxAuthentication - Handle Rcv authentication
  39  *      s_vMgrRxAuthenSequence_1 - Handle Rcv authentication sequence 1
  40  *      s_vMgrRxAuthenSequence_2 - Handle Rcv authentication sequence 2
  41  *      s_vMgrRxAuthenSequence_3 - Handle Rcv authentication sequence 3
  42  *      s_vMgrRxAuthenSequence_4 - Handle Rcv authentication sequence 4
  43  *      s_vMgrRxDisassociation - Handle Rcv disassociation
  44  *      s_vMgrRxBeacon - Handle Rcv Beacon
  45  *      vMgrCreateOwnIBSS - Create ad_hoc IBSS or AP BSS
  46  *      vMgrJoinBSSBegin - Join BSS function
  47  *      s_vMgrSynchBSS - Synch & adopt BSS parameters
  48  *      s_MgrMakeBeacon - Create Baecon frame
  49  *      s_MgrMakeProbeResponse - Create Probe Response frame
  50  *      s_MgrMakeAssocRequest - Create Associate Request frame
  51  *      s_MgrMakeReAssocRequest - Create ReAssociate Request frame
  52  *      s_vMgrRxProbeResponse - Handle Rcv probe_response
  53  *      s_vMrgRxProbeRequest - Handle Rcv probe_request
  54  *      bMgrPrepareBeaconToSend - Prepare Beacon frame
  55  *      s_vMgrLogStatus - Log 802.11 Status
  56  *      vMgrRxManagePacket - Rcv management frame dispatch function
  57  *      s_vMgrFormatTIM- Assember TIM field of beacon
  58  *      vMgrTimerInit- Initial 1-sec and command call back funtions
  59  *
  60  * Revision History:
  61  *
  62  */
  63
  64
  65 #if !defined(__TMACRO_H__)
  66 #include "tmacro.h"
  67 #endif
  68 #if !defined(__TBIT_H__)
  69 #include "tbit.h"
  70 #endif
  71 #if !defined(__DESC_H__)
  72 #include "desc.h"
  73 #endif
  74 #if !defined(__DEVICE_H__)
  75 #include "device.h"
  76 #endif
  77 #if !defined(__CARD_H__)
  78 #include "card.h"
  79 #endif
  80 #if !defined(__80211HDR_H__)
  81 #include "80211hdr.h"
  82 #endif
  83 #if !defined(__80211MGR_H__)
  84 #include "80211mgr.h"
  85 #endif
  86 #if !defined(__WMGR_H__)
  87 #include "wmgr.h"
  88 #endif
  89 #if !defined(__WCMD_H__)
  90 #include "wcmd.h"
  91 #endif
  92 #if !defined(__MAC_H__)
  93 #include "mac.h"
  94 #endif
  95 #if !defined(__BSSDB_H__)
  96 #include "bssdb.h"
  97 #endif
  98 #if !defined(__POWER_H__)
  99 #include "power.h"
 100 #endif
 101 #if !defined(__DATARATE_H__)
 102 #include "datarate.h"
 103 #endif
 104 #if !defined(__BASEBAND_H__)
 105 #include "baseband.h"
 106 #endif
 107 #if !defined(__RXTX_H__)
 108 #include "rxtx.h"
 109 #endif
 110 #if !defined(__WPA_H__)
 111 #include "wpa.h"
 112 #endif
 113 #if !defined(__RF_H__)
 114 #include "rf.h"
 115 #endif
 116 #if !defined(__UMEM_H__)
 117 #include "umem.h"
 118 #endif
 119 #if !defined(__IOWPA_H__)
 120 #include "iowpa.h"
 121 #endif
 122 #if !defined(__CONTROL_H__)
 123 #include "control.h"
 124 #endif
 125 #if !defined(__RNDIS_H__)
 126 #include "rndis.h"
 127 #endif
 128 /*---------------------  Static Definitions -------------------------*/
 129
 130
 131
 132 /*---------------------  Static Classes  ----------------------------*/
 133
 134 /*---------------------  Static Variables  --------------------------*/
 135 static int          msglevel                =MSG_LEVEL_INFO;
 136 //static int          msglevel                =MSG_LEVEL_DEBUG;
 137
 138 /*---------------------  Static Functions  --------------------------*/
 139 //2008-0730-01<Add>by MikeLiu
 140 static BOOL ChannelExceedZoneType(
 141     IN PSDevice pDevice,
 142     IN BYTE byCurrChannel
 143     );
 144
 145 // Association/diassociation functions
 146 static
 147 PSTxMgmtPacket
 148 s_MgrMakeAssocRequest(
 149     IN PSDevice pDevice,
 150     IN PSMgmtObject pMgmt,
 151     IN PBYTE pDAddr,
 152     IN WORD wCurrCapInfo,
 153     IN WORD wListenInterval,
 154     IN PWLAN_IE_SSID pCurrSSID,
 155     IN PWLAN_IE_SUPP_RATES pCurrRates,
 156     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 157     );
 158
 159 static
 160 VOID
 161 s_vMgrRxAssocRequest(
 162     IN PSDevice pDevice,
 163     IN PSMgmtObject pMgmt,
 164     IN PSRxMgmtPacket pRxPacket,
 165     IN UINT  uNodeIndex
 166     );
 167
 168 static
 169 PSTxMgmtPacket
 170 s_MgrMakeReAssocRequest(
 171     IN PSDevice pDevice,
 172     IN PSMgmtObject pMgmt,
 173     IN PBYTE pDAddr,
 174     IN WORD wCurrCapInfo,
 175     IN WORD wListenInterval,
 176     IN PWLAN_IE_SSID pCurrSSID,
 177     IN PWLAN_IE_SUPP_RATES pCurrRates,
 178     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 179     );
 180
 181 static
 182 VOID
 183 s_vMgrRxAssocResponse(
 184     IN PSDevice pDevice,
 185     IN PSMgmtObject pMgmt,
 186     IN PSRxMgmtPacket pRxPacket,
 187     IN BOOL bReAssocType
 188     );
 189
 190 static
 191 VOID
 192 s_vMgrRxDisassociation(
 193     IN PSDevice pDevice,
 194     IN PSMgmtObject pMgmt,
 195     IN PSRxMgmtPacket pRxPacket
 196     );
 197
 198 // Authentication/deauthen functions
 199 static
 200 VOID
 201 s_vMgrRxAuthenSequence_1(
 202     IN PSDevice pDevice,
 203     IN PSMgmtObject pMgmt,
 204     IN PWLAN_FR_AUTHEN pFrame
 205     );
 206
 207 static
 208 VOID
 209 s_vMgrRxAuthenSequence_2(
 210     IN PSDevice pDevice,
 211     IN PSMgmtObject pMgmt,
 212     IN PWLAN_FR_AUTHEN pFrame
 213     );
 214
 215 static
 216 VOID
 217 s_vMgrRxAuthenSequence_3(
 218     IN PSDevice pDevice,
 219     IN PSMgmtObject pMgmt,
 220     IN PWLAN_FR_AUTHEN pFrame
 221     );
 222
 223 static
 224 VOID
 225 s_vMgrRxAuthenSequence_4(
 226     IN PSDevice pDevice,
 227     IN PSMgmtObject pMgmt,
 228     IN PWLAN_FR_AUTHEN pFrame
 229     );
 230
 231 static
 232 VOID
 233 s_vMgrRxAuthentication(
 234     IN PSDevice pDevice,
 235     IN PSMgmtObject pMgmt,
 236     IN PSRxMgmtPacket pRxPacket
 237     );
 238
 239 static
 240 VOID
 241 s_vMgrRxDeauthentication(
 242     IN PSDevice pDevice,
 243     IN PSMgmtObject pMgmt,
 244     IN PSRxMgmtPacket pRxPacket
 245     );
 246
 247 // Scan functions
 248 // probe request/response functions
 249 static
 250 VOID
 251 s_vMgrRxProbeRequest(
 252     IN PSDevice pDevice,
 253     IN PSMgmtObject pMgmt,
 254     IN PSRxMgmtPacket pRxPacket
 255     );
 256
 257 static
 258 VOID
 259 s_vMgrRxProbeResponse(
 260     IN PSDevice pDevice,
 261     IN PSMgmtObject pMgmt,
 262     IN PSRxMgmtPacket pRxPacket
 263     );
 264
 265 // beacon functions
 266 static
 267 VOID
 268 s_vMgrRxBeacon(
 269     IN PSDevice pDevice,
 270     IN PSMgmtObject pMgmt,
 271     IN PSRxMgmtPacket pRxPacket,
 272     IN BOOL bInScan
 273     );
 274
 275 static
 276 VOID
 277 s_vMgrFormatTIM(
 278     IN PSMgmtObject pMgmt,
 279     IN PWLAN_IE_TIM pTIM
 280     );
 281
 282 static
 283 PSTxMgmtPacket
 284 s_MgrMakeBeacon(
 285     IN PSDevice pDevice,
 286     IN PSMgmtObject pMgmt,
 287     IN WORD wCurrCapInfo,
 288     IN WORD wCurrBeaconPeriod,
 289     IN UINT uCurrChannel,
 290     IN WORD wCurrATIMWinodw,
 291     IN PWLAN_IE_SSID pCurrSSID,
 292     IN PBYTE pCurrBSSID,
 293     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 294     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 295     );
 296
 297
 298 // Association response
 299 static
 300 PSTxMgmtPacket
 301 s_MgrMakeAssocResponse(
 302     IN PSDevice pDevice,
 303     IN PSMgmtObject pMgmt,
 304     IN WORD wCurrCapInfo,
 305     IN WORD wAssocStatus,
 306     IN WORD wAssocAID,
 307     IN PBYTE pDstAddr,
 308     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 309     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 310     );
 311
 312 // ReAssociation response
 313 static
 314 PSTxMgmtPacket
 315 s_MgrMakeReAssocResponse(
 316     IN PSDevice pDevice,
 317     IN PSMgmtObject pMgmt,
 318     IN WORD wCurrCapInfo,
 319     IN WORD wAssocStatus,
 320     IN WORD wAssocAID,
 321     IN PBYTE pDstAddr,
 322     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 323     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 324     );
 325
 326 // Probe response
 327 static
 328 PSTxMgmtPacket
 329 s_MgrMakeProbeResponse(
 330     IN PSDevice pDevice,
 331     IN PSMgmtObject pMgmt,
 332     IN WORD wCurrCapInfo,
 333     IN WORD wCurrBeaconPeriod,
 334     IN UINT uCurrChannel,
 335     IN WORD wCurrATIMWinodw,
 336     IN PBYTE pDstAddr,
 337     IN PWLAN_IE_SSID pCurrSSID,
 338     IN PBYTE pCurrBSSID,
 339     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 340     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
 341     IN BYTE byPHYType
 342     );
 343
 344 // received status
 345 static
 346 VOID
 347 s_vMgrLogStatus(
 348     IN PSMgmtObject pMgmt,
 349     IN WORD wStatus
 350     );
 351
 352
 353 static
 354 VOID
 355 s_vMgrSynchBSS (
 356     IN PSDevice      pDevice,
 357     IN UINT          uBSSMode,
 358     IN PKnownBSS     pCurr,
 359     OUT PCMD_STATUS  pStatus
 360     );
 361
 362
 363 static BOOL
 364 s_bCipherMatch (
 365     IN PKnownBSS                        pBSSNode,
 366     IN NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
 367     OUT PBYTE                           pbyCCSPK,
 368     OUT PBYTE                           pbyCCSGK
 369     );
 370
 371  static VOID  Encyption_Rebuild(
 372     IN PSDevice pDevice,
 373     IN PKnownBSS pCurr
 374  );
 375
 376
 377
 378 /*---------------------  Export Variables  --------------------------*/
 379
 380
 381 /*---------------------  Export Functions  --------------------------*/
 382
 383
 384 /*+
 385  *
 386  * Routine Description:
 387  *    Allocates and initializes the Management object.
 388  *
 389  * Return Value:
 390  *    Ndis_staus.
 391  *
 392 -*/
 393
 394 VOID
 395 vMgrObjectInit(
 396     IN  HANDLE hDeviceContext
 397     )
 398 {
 399     PSDevice     pDevice = (PSDevice)hDeviceContext;
 400     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
 401     int ii;
 402
 403
 404     pMgmt->pbyPSPacketPool = &pMgmt->byPSPacketPool[0];
 405     pMgmt->pbyMgmtPacketPool = &pMgmt->byMgmtPacketPool[0];
 406     pMgmt->uCurrChannel = pDevice->uChannel;
 407     for(ii=0;ii<WLAN_BSSID_LEN;ii++) {
 408         pMgmt->abyDesireBSSID[ii] = 0xFF;
 409     }
 410     pMgmt->sAssocInfo.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 411     //memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN +1);
 412     pMgmt->byCSSPK = KEY_CTL_NONE;
 413     pMgmt->byCSSGK = KEY_CTL_NONE;
 414     pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
 415     BSSvClearBSSList((HANDLE)pDevice, FALSE);
 416
 417     init_timer(&pMgmt->sTimerSecondCallback);
 418     pMgmt->sTimerSecondCallback.data = (ULONG)pDevice;
 419     pMgmt->sTimerSecondCallback.function = (TimerFunction)BSSvSecondCallBack;
 420     pMgmt->sTimerSecondCallback.expires = RUN_AT(HZ);
 421
 422     init_timer(&pDevice->sTimerCommand);
 423     pDevice->sTimerCommand.data = (ULONG)pDevice;
 424     pDevice->sTimerCommand.function = (TimerFunction)vRunCommand;
 425     pDevice->sTimerCommand.expires = RUN_AT(HZ);
 426
 427 //2007-0115-10<Add>by MikeLiu
 428    #ifdef TxInSleep
 429     init_timer(&pDevice->sTimerTxData);
 430     pDevice->sTimerTxData.data = (ULONG)pDevice;
 431     pDevice->sTimerTxData.function = (TimerFunction)BSSvSecondTxData;
 432     pDevice->sTimerTxData.expires = RUN_AT(10*HZ);      //10s callback
 433     pDevice->fTxDataInSleep = FALSE;
 434     pDevice->IsTxDataTrigger = FALSE;
 435     pDevice->nTxDataTimeCout = 0;
 436    #endif
 437
 438     pDevice->cbFreeCmdQueue = CMD_Q_SIZE;
 439     pDevice->uCmdDequeueIdx = 0;
 440     pDevice->uCmdEnqueueIdx = 0;
 441     pDevice->eCommandState = WLAN_CMD_IDLE;
 442     pDevice->bCmdRunning = FALSE;
 443     pDevice->bCmdClear = FALSE;
 444
 445     return;
 446 }
 447
 448
 449
 450 /*+
 451  *
 452  * Routine Description:
 453  *    Start the station association procedure.  Namely, send an
 454  *    association request frame to the AP.
 455  *
 456  * Return Value:
 457  *    None.
 458  *
 459 -*/
 460
 461
 462 VOID
 463 vMgrAssocBeginSta(
 464     IN  HANDLE hDeviceContext,
 465     IN  PSMgmtObject pMgmt,
 466     OUT PCMD_STATUS pStatus
 467     )
 468 {
 469     PSDevice             pDevice = (PSDevice)hDeviceContext;
 470     PSTxMgmtPacket          pTxPacket;
 471
 472
 473     pMgmt->wCurrCapInfo = 0;
 474     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 475     if (pDevice->bEncryptionEnable) {
 476         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 477     }
 478     // always allow receive short preamble
 479     //if (pDevice->byPreambleType == 1) {
 480     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 481     //}
 482     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 483     if (pMgmt->wListenInterval == 0)
 484         pMgmt->wListenInterval = 1;    // at least one.
 485
 486     // ERP Phy (802.11g) should support short preamble.
 487     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 488         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 489         if (pDevice->bShortSlotTime == TRUE)
 490             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 491
 492     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 493         if (pDevice->byPreambleType == 1) {
 494             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 495         }
 496     }
 497     if (pMgmt->b11hEnable == TRUE)
 498         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 499
 500     // build an assocreq frame and send it
 501     pTxPacket = s_MgrMakeAssocRequest
 502                 (
 503                   pDevice,
 504                   pMgmt,
 505                   pMgmt->abyCurrBSSID,
 506                   pMgmt->wCurrCapInfo,
 507                   pMgmt->wListenInterval,
 508                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 509                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 510                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 511                 );
 512
 513     if (pTxPacket != NULL ){
 514         // send the frame
 515         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 516         if (*pStatus == CMD_STATUS_PENDING) {
 517             pMgmt->eCurrState = WMAC_STATE_ASSOCPENDING;
 518             *pStatus = CMD_STATUS_SUCCESS;
 519         }
 520     }
 521     else
 522         *pStatus = CMD_STATUS_RESOURCES;
 523
 524     return ;
 525 }
 526
 527
 528 /*+
 529  *
 530  * Routine Description:
 531  *    Start the station re-association procedure.
 532  *
 533  * Return Value:
 534  *    None.
 535  *
 536 -*/
 537
 538 VOID
 539 vMgrReAssocBeginSta(
 540     IN  HANDLE hDeviceContext,
 541     IN  PSMgmtObject pMgmt,
 542     OUT PCMD_STATUS pStatus
 543     )
 544 {
 545     PSDevice             pDevice = (PSDevice)hDeviceContext;
 546     PSTxMgmtPacket          pTxPacket;
 547
 548
 549
 550     pMgmt->wCurrCapInfo = 0;
 551     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 552     if (pDevice->bEncryptionEnable) {
 553         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 554     }
 555
 556     //if (pDevice->byPreambleType == 1) {
 557     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 558     //}
 559     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 560
 561     if (pMgmt->wListenInterval == 0)
 562         pMgmt->wListenInterval = 1;    // at least one.
 563
 564
 565     // ERP Phy (802.11g) should support short preamble.
 566     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 567         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 568       if (pDevice->bShortSlotTime == TRUE)
 569           pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 570
 571     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 572         if (pDevice->byPreambleType == 1) {
 573             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 574         }
 575     }
 576     if (pMgmt->b11hEnable == TRUE)
 577         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 578
 579
 580     pTxPacket = s_MgrMakeReAssocRequest
 581                 (
 582                   pDevice,
 583                   pMgmt,
 584                   pMgmt->abyCurrBSSID,
 585                   pMgmt->wCurrCapInfo,
 586                   pMgmt->wListenInterval,
 587                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 588                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 589                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 590                 );
 591
 592     if (pTxPacket != NULL ){
 593         // send the frame
 594         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 595         if (*pStatus != CMD_STATUS_PENDING) {
 596             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx failed.\n");
 597         }
 598         else {
 599             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx sending.\n");
 600         }
 601     }
 602
 603
 604     return ;
 605 }
 606
 607 /*+
 608  *
 609  * Routine Description:
 610  *    Send an dis-association request frame to the AP.
 611  *
 612  * Return Value:
 613  *    None.
 614  *
 615 -*/
 616
 617 VOID
 618 vMgrDisassocBeginSta(
 619     IN  HANDLE hDeviceContext,
 620     IN  PSMgmtObject pMgmt,
 621     IN  PBYTE  abyDestAddress,
 622     IN  WORD    wReason,
 623     OUT PCMD_STATUS pStatus
 624     )
 625 {
 626     PSDevice            pDevice = (PSDevice)hDeviceContext;
 627     PSTxMgmtPacket      pTxPacket = NULL;
 628     WLAN_FR_DISASSOC    sFrame;
 629
 630     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
 631     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DISASSOC_FR_MAXLEN);
 632     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
 633
 634     // Setup the sFrame structure
 635     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
 636     sFrame.len = WLAN_DISASSOC_FR_MAXLEN;
 637
 638     // format fixed field frame structure
 639     vMgrEncodeDisassociation(&sFrame);
 640
 641     // Setup the header
 642     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
 643         (
 644         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
 645         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DISASSOC)
 646         ));
 647
 648     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
 649     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
 650     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
 651
 652     // Set reason code
 653     *(sFrame.pwReason) = cpu_to_le16(wReason);
 654     pTxPacket->cbMPDULen = sFrame.len;
 655     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
 656
 657     // send the frame
 658     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 659     if (*pStatus == CMD_STATUS_PENDING) {
 660         pMgmt->eCurrState = WMAC_STATE_IDLE;
 661         *pStatus = CMD_STATUS_SUCCESS;
 662     };
 663
 664     return;
 665 }
 666
 667
 668
 669 /*+
 670  *
 671  * Routine Description:(AP function)
 672  *    Handle incoming station association request frames.
 673  *
 674  * Return Value:
 675  *    None.
 676  *
 677 -*/
 678
 679 static
 680 VOID
 681 s_vMgrRxAssocRequest(
 682     IN PSDevice pDevice,
 683     IN PSMgmtObject pMgmt,
 684     IN PSRxMgmtPacket pRxPacket,
 685     IN UINT uNodeIndex
 686     )
 687 {
 688     WLAN_FR_ASSOCREQ    sFrame;
 689     CMD_STATUS          Status;
 690     PSTxMgmtPacket      pTxPacket;
 691     WORD                wAssocStatus = 0;
 692     WORD                wAssocAID = 0;
 693     UINT                uRateLen = WLAN_RATES_MAXLEN;
 694     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 695     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 696
 697
 698     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 699         return;
 700     //  node index not found
 701     if (!uNodeIndex)
 702         return;
 703
 704     //check if node is authenticated
 705     //decode the frame
 706     memset(&sFrame, 0, sizeof(WLAN_FR_ASSOCREQ));
 707     memset(abyCurrSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 708     memset(abyCurrExtSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 709     sFrame.len = pRxPacket->cbMPDULen;
 710     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 711
 712     vMgrDecodeAssocRequest(&sFrame);
 713
 714     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 715         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 716         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 717         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 718         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 719                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 720         // Todo: check sta basic rate, if ap can't support, set status code
 721         if (pDevice->byBBType == BB_TYPE_11B) {
 722             uRateLen = WLAN_RATES_MAXLEN_11B;
 723         }
 724         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 725         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 726                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 727                                          uRateLen);
 728         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 729         if (pDevice->byBBType == BB_TYPE_11G) {
 730             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 731                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 732                                                 uRateLen);
 733         } else {
 734             abyCurrExtSuppRates[1] = 0;
 735         }
 736
 737
 738         RATEvParseMaxRate((PVOID)pDevice,
 739                            (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 740                            (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 741                            FALSE, // do not change our basic rate
 742                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 743                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 744                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 745                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 746                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 747                           );
 748
 749         // set max tx rate
 750         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 751                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 752         // Todo: check sta preamble, if ap can't support, set status code
 753         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 754                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 755         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 756                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 757         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 758         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 759         wAssocAID = (WORD)uNodeIndex;
 760         // check if ERP support
 761         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 762            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 763
 764         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 765             // B only STA join
 766             pDevice->bProtectMode = TRUE;
 767             pDevice->bNonERPPresent = TRUE;
 768         }
 769         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 770             pDevice->bBarkerPreambleMd = TRUE;
 771         }
 772
 773         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Associate AID= %d \n", wAssocAID);
 774         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 775                    sFrame.pHdr->sA3.abyAddr2[0],
 776                    sFrame.pHdr->sA3.abyAddr2[1],
 777                    sFrame.pHdr->sA3.abyAddr2[2],
 778                    sFrame.pHdr->sA3.abyAddr2[3],
 779                    sFrame.pHdr->sA3.abyAddr2[4],
 780                    sFrame.pHdr->sA3.abyAddr2[5]
 781                   ) ;
 782         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 783                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 784     }
 785
 786
 787     // assoc response reply..
 788     pTxPacket = s_MgrMakeAssocResponse
 789                 (
 790                   pDevice,
 791                   pMgmt,
 792                   pMgmt->wCurrCapInfo,
 793                   wAssocStatus,
 794                   wAssocAID,
 795                   sFrame.pHdr->sA3.abyAddr2,
 796                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 797                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 798                 );
 799     if (pTxPacket != NULL ){
 800
 801         if (pDevice->bEnableHostapd) {
 802             return;
 803         }
 804         /* send the frame */
 805         Status = csMgmt_xmit(pDevice, pTxPacket);
 806         if (Status != CMD_STATUS_PENDING) {
 807             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx failed\n");
 808         }
 809         else {
 810             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx sending..\n");
 811         }
 812
 813     }
 814
 815     return;
 816 }
 817
 818
 819 /*+
 820  *
 821  * Description:(AP function)
 822  *      Handle incoming station re-association request frames.
 823  *
 824  * Parameters:
 825  *  In:
 826  *      pMgmt           - Management Object structure
 827  *      pRxPacket       - Received Packet
 828  *  Out:
 829  *      none
 830  *
 831  * Return Value: None.
 832  *
 833 -*/
 834
 835 static
 836 VOID
 837 s_vMgrRxReAssocRequest(
 838     IN PSDevice pDevice,
 839     IN PSMgmtObject pMgmt,
 840     IN PSRxMgmtPacket pRxPacket,
 841     IN UINT uNodeIndex
 842     )
 843 {
 844     WLAN_FR_REASSOCREQ    sFrame;
 845     CMD_STATUS          Status;
 846     PSTxMgmtPacket      pTxPacket;
 847     WORD                wAssocStatus = 0;
 848     WORD                wAssocAID = 0;
 849     UINT                uRateLen = WLAN_RATES_MAXLEN;
 850     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 851     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 852
 853     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 854         return;
 855     //  node index not found
 856     if (!uNodeIndex)
 857         return;
 858     //check if node is authenticated
 859     //decode the frame
 860     memset(&sFrame, 0, sizeof(WLAN_FR_REASSOCREQ));
 861     sFrame.len = pRxPacket->cbMPDULen;
 862     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 863     vMgrDecodeReassocRequest(&sFrame);
 864
 865     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 866         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 867         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 868         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 869         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 870                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 871         // Todo: check sta basic rate, if ap can't support, set status code
 872
 873         if (pDevice->byBBType == BB_TYPE_11B) {
 874             uRateLen = WLAN_RATES_MAXLEN_11B;
 875         }
 876
 877         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 878         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 879                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 880                                          uRateLen);
 881         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 882         if (pDevice->byBBType == BB_TYPE_11G) {
 883             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 884                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 885                                                 uRateLen);
 886         } else {
 887             abyCurrExtSuppRates[1] = 0;
 888         }
 889
 890
 891         RATEvParseMaxRate((PVOID)pDevice,
 892                           (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 893                           (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 894                            FALSE, // do not change our basic rate
 895                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 896                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 897                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 898                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 899                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 900                           );
 901
 902         // set max tx rate
 903         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 904                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 905         // Todo: check sta preamble, if ap can't support, set status code
 906         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 907                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 908         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 909                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 910         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 911         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 912         wAssocAID = (WORD)uNodeIndex;
 913
 914         // if suppurt ERP
 915         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 916            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 917
 918         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 919             // B only STA join
 920             pDevice->bProtectMode = TRUE;
 921             pDevice->bNonERPPresent = TRUE;
 922         }
 923         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 924             pDevice->bBarkerPreambleMd = TRUE;
 925         }
 926
 927         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Rx ReAssociate AID= %d \n", wAssocAID);
 928         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 929                    sFrame.pHdr->sA3.abyAddr2[0],
 930                    sFrame.pHdr->sA3.abyAddr2[1],
 931                    sFrame.pHdr->sA3.abyAddr2[2],
 932                    sFrame.pHdr->sA3.abyAddr2[3],
 933                    sFrame.pHdr->sA3.abyAddr2[4],
 934                    sFrame.pHdr->sA3.abyAddr2[5]
 935                   ) ;
 936         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 937                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 938
 939     }
 940
 941
 942     // assoc response reply..
 943     pTxPacket = s_MgrMakeReAssocResponse
 944                 (
 945                   pDevice,
 946                   pMgmt,
 947                   pMgmt->wCurrCapInfo,
 948                   wAssocStatus,
 949                   wAssocAID,
 950                   sFrame.pHdr->sA3.abyAddr2,
 951                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 952                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 953                 );
 954
 955     if (pTxPacket != NULL ){
 956         /* send the frame */
 957         if (pDevice->bEnableHostapd) {
 958             return;
 959         }
 960         Status = csMgmt_xmit(pDevice, pTxPacket);
 961         if (Status != CMD_STATUS_PENDING) {
 962             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx failed\n");
 963         }
 964         else {
 965             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx sending..\n");
 966         }
 967     }
 968     return;
 969 }
 970
 971
 972 /*+
 973  *
 974  * Routine Description:
 975  *    Handle incoming association response frames.
 976  *
 977  * Return Value:
 978  *    None.
 979  *
 980 -*/
 981
 982 static
 983 VOID
 984 s_vMgrRxAssocResponse(
 985     IN PSDevice pDevice,
 986     IN PSMgmtObject pMgmt,
 987     IN PSRxMgmtPacket pRxPacket,
 988     IN BOOL bReAssocType
 989     )
 990 {
 991     WLAN_FR_ASSOCRESP   sFrame;
 992     PWLAN_IE_SSID   pItemSSID;
 993     PBYTE   pbyIEs;
 994     viawget_wpa_header *wpahdr;
 995
 996
 997
 998     if (pMgmt->eCurrState == WMAC_STATE_ASSOCPENDING ||
 999          pMgmt->eCurrState == WMAC_STATE_ASSOC) {
1000
1001         sFrame.len = pRxPacket->cbMPDULen;
1002         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1003         // decode the frame
1004         vMgrDecodeAssocResponse(&sFrame);
1005         if ((sFrame.pwCapInfo == 0) ||
1006             (sFrame.pwStatus == 0) ||
1007             (sFrame.pwAid == 0) ||
1008             (sFrame.pSuppRates == 0)){
1009             DBG_PORT80(0xCC);
1010             return;
1011         };
1012
1013         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.Capabilities = *(sFrame.pwCapInfo);
1014         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.StatusCode = *(sFrame.pwStatus);
1015         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.AssociationId = *(sFrame.pwAid);
1016         pMgmt->sAssocInfo.AssocInfo.AvailableResponseFixedIEs |= 0x07;
1017
1018         pMgmt->sAssocInfo.AssocInfo.ResponseIELength = sFrame.len - 24 - 6;
1019         pMgmt->sAssocInfo.AssocInfo.OffsetResponseIEs = pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs + pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1020         pbyIEs = pMgmt->sAssocInfo.abyIEs;
1021         pbyIEs += pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1022         memcpy(pbyIEs, (sFrame.pBuf + 24 +6), pMgmt->sAssocInfo.AssocInfo.ResponseIELength);
1023
1024         // save values and set current BSS state
1025         if (cpu_to_le16((*(sFrame.pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1026             // set AID
1027             pMgmt->wCurrAID = cpu_to_le16((*(sFrame.pwAid)));
1028             if ( (pMgmt->wCurrAID >> 14) != (BIT0 | BIT1) )
1029             {
1030                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "AID from AP, has two msb clear.\n");
1031             };
1032             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Association Successful, AID=%d.\n", pMgmt->wCurrAID & ~(BIT14|BIT15));
1033             pMgmt->eCurrState = WMAC_STATE_ASSOC;
1034             BSSvUpdateAPNode((HANDLE)pDevice, sFrame.pwCapInfo, sFrame.pSuppRates, sFrame.pExtSuppRates);
1035             pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
1036             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Link with AP(SSID): %s\n", pItemSSID->abySSID);
1037             pDevice->bLinkPass = TRUE;
1038             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
1039             if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1040                if(skb_tailroom(pDevice->skb) <(sizeof(viawget_wpa_header)+pMgmt->sAssocInfo.AssocInfo.ResponseIELength+
1041                                                                          pMgmt->sAssocInfo.AssocInfo.RequestIELength)) {    //data room not enough
1042                      dev_kfree_skb(pDevice->skb);
1043                    pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1044                 }
1045                 wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1046                 wpahdr->type = VIAWGET_ASSOC_MSG;
1047                 wpahdr->resp_ie_len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1048                 wpahdr->req_ie_len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1049                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header), pMgmt->sAssocInfo.abyIEs, wpahdr->req_ie_len);
1050                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header) + wpahdr->req_ie_len,
1051                        pbyIEs,
1052                        wpahdr->resp_ie_len
1053                        );
1054                 skb_put(pDevice->skb, sizeof(viawget_wpa_header) + wpahdr->resp_ie_len + wpahdr->req_ie_len);
1055                 pDevice->skb->dev = pDevice->wpadev;
1056 //2008-4-3 modify by Chester for wpa
1057 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
1058                 pDevice->skb->mac_header = pDevice->skb->data;
1059 #else
1060                 pDevice->skb->mac.raw = pDevice->skb->data;
1061 #endif
1062                 pDevice->skb->pkt_type = PACKET_HOST;
1063                 pDevice->skb->protocol = htons(ETH_P_802_2);
1064                 memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1065                 netif_rx(pDevice->skb);
1066                 pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1067             }
1068 //2008-0409-07, <Add> by Einsn Liu
1069 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1070         //if(pDevice->bWPASuppWextEnabled == TRUE)
1071            {
1072                 BYTE buf[512];
1073                 size_t len;
1074                 union iwreq_data  wrqu;
1075                 int we_event;
1076
1077                 memset(buf, 0, 512);
1078
1079                 len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1080                 if(len) {
1081                         memcpy(buf, pMgmt->sAssocInfo.abyIEs, len);
1082                         memset(&wrqu, 0, sizeof (wrqu));
1083                         wrqu.data.length = len;
1084                         we_event = IWEVASSOCREQIE;
1085                         PRINT_K("wireless_send_event--->IWEVASSOCREQIE\n");
1086                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1087                 }
1088
1089                 memset(buf, 0, 512);
1090                 len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1091
1092                 if(len) {
1093                         memcpy(buf, pbyIEs, len);
1094                         memset(&wrqu, 0, sizeof (wrqu));
1095                         wrqu.data.length = len;
1096                         we_event = IWEVASSOCRESPIE;
1097                         PRINT_K("wireless_send_event--->IWEVASSOCRESPIE\n");
1098                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1099                 }
1100
1101            memset(&wrqu, 0, sizeof (wrqu));
1102         memcpy(wrqu.ap_addr.sa_data, &pMgmt->abyCurrBSSID[0], ETH_ALEN);
1103         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1104            PRINT_K("wireless_send_event--->SIOCGIWAP(associated)\n");
1105         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1106
1107         }
1108 #endif //#ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1109 //End Add -- //2008-0409-07, <Add> by Einsn Liu
1110         }
1111         else {
1112             if (bReAssocType) {
1113                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1114             }
1115             else {
1116                 // jump back to the auth state and indicate the error
1117                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1118             }
1119             s_vMgrLogStatus(pMgmt,cpu_to_le16((*(sFrame.pwStatus))));
1120         }
1121
1122     }
1123
1124 #if 1
1125 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1126 //need clear flags related to Networkmanager
1127               pDevice->bwextstep0 = FALSE;
1128               pDevice->bwextstep1 = FALSE;
1129               pDevice->bwextstep2 = FALSE;
1130               pDevice->bwextstep3 = FALSE;
1131               pDevice->bWPASuppWextEnabled = FALSE;
1132 #endif
1133 #endif
1134
1135 if(pMgmt->eCurrState == WMAC_STATE_ASSOC)
1136       timer_expire(pDevice->sTimerCommand, 0);
1137
1138     return;
1139 }
1140
1141
1142
1143 /*+
1144  *
1145  * Routine Description:
1146  *    Start the station authentication procedure.  Namely, send an
1147  *    authentication frame to the AP.
1148  *
1149  * Return Value:
1150  *    None.
1151  *
1152 -*/
1153
1154 VOID
1155 vMgrAuthenBeginSta(
1156     IN  HANDLE hDeviceContext,
1157     IN  PSMgmtObject  pMgmt,
1158     OUT PCMD_STATUS pStatus
1159     )
1160 {
1161     PSDevice     pDevice = (PSDevice)hDeviceContext;
1162     WLAN_FR_AUTHEN  sFrame;
1163     PSTxMgmtPacket  pTxPacket = NULL;
1164
1165     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1166     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1167     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1168     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1169     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1170     vMgrEncodeAuthen(&sFrame);
1171     /* insert values */
1172     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1173         (
1174         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1175         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)
1176         ));
1177     memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
1178     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1179     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1180     if (pMgmt->bShareKeyAlgorithm)
1181         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_SHAREDKEY);
1182     else
1183         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_OPENSYSTEM);
1184
1185     *(sFrame.pwAuthSequence) = cpu_to_le16(1);
1186     /* Adjust the length fields */
1187     pTxPacket->cbMPDULen = sFrame.len;
1188     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1189
1190     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1191     if (*pStatus == CMD_STATUS_PENDING){
1192         pMgmt->eCurrState = WMAC_STATE_AUTHPENDING;
1193         *pStatus = CMD_STATUS_SUCCESS;
1194     }
1195
1196     return ;
1197 }
1198
1199
1200
1201 /*+
1202  *
1203  * Routine Description:
1204  *    Start the station(AP) deauthentication procedure.  Namely, send an
1205  *    deauthentication frame to the AP or Sta.
1206  *
1207  * Return Value:
1208  *    None.
1209  *
1210 -*/
1211
1212 VOID
1213 vMgrDeAuthenBeginSta(
1214     IN  HANDLE hDeviceContext,
1215     IN  PSMgmtObject  pMgmt,
1216     IN  PBYTE  abyDestAddress,
1217     IN  WORD    wReason,
1218     OUT PCMD_STATUS pStatus
1219     )
1220 {
1221     PSDevice            pDevice = (PSDevice)hDeviceContext;
1222     WLAN_FR_DEAUTHEN    sFrame;
1223     PSTxMgmtPacket      pTxPacket = NULL;
1224
1225
1226     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1227     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DEAUTHEN_FR_MAXLEN);
1228     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1229     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1230     sFrame.len = WLAN_DEAUTHEN_FR_MAXLEN;
1231     vMgrEncodeDeauthen(&sFrame);
1232     /* insert values */
1233     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1234         (
1235         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1236         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DEAUTHEN)
1237         ));
1238
1239     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
1240     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1241     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1242
1243     *(sFrame.pwReason) = cpu_to_le16(wReason);       // deauthen. bcs left BSS
1244     /* Adjust the length fields */
1245     pTxPacket->cbMPDULen = sFrame.len;
1246     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1247
1248     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1249     if (*pStatus == CMD_STATUS_PENDING){
1250         *pStatus = CMD_STATUS_SUCCESS;
1251     }
1252
1253
1254     return ;
1255 }
1256
1257
1258 /*+
1259  *
1260  * Routine Description:
1261  *    Handle incoming authentication frames.
1262  *
1263  * Return Value:
1264  *    None.
1265  *
1266 -*/
1267
1268 static
1269 VOID
1270 s_vMgrRxAuthentication(
1271     IN PSDevice pDevice,
1272     IN PSMgmtObject pMgmt,
1273     IN PSRxMgmtPacket pRxPacket
1274     )
1275 {
1276     WLAN_FR_AUTHEN  sFrame;
1277
1278     // we better be an AP or a STA in AUTHPENDING otherwise ignore
1279     if (!(pMgmt->eCurrMode == WMAC_MODE_ESS_AP ||
1280           pMgmt->eCurrState == WMAC_STATE_AUTHPENDING)) {
1281         return;
1282     }
1283
1284     // decode the frame
1285     sFrame.len = pRxPacket->cbMPDULen;
1286     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1287     vMgrDecodeAuthen(&sFrame);
1288     switch (cpu_to_le16((*(sFrame.pwAuthSequence )))){
1289         case 1:
1290             //AP funciton
1291             s_vMgrRxAuthenSequence_1(pDevice,pMgmt, &sFrame);
1292             break;
1293         case 2:
1294             s_vMgrRxAuthenSequence_2(pDevice, pMgmt, &sFrame);
1295             break;
1296         case 3:
1297             //AP funciton
1298             s_vMgrRxAuthenSequence_3(pDevice, pMgmt, &sFrame);
1299             break;
1300         case 4:
1301             s_vMgrRxAuthenSequence_4(pDevice, pMgmt, &sFrame);
1302             break;
1303         default:
1304             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Auth Sequence error, seq = %d\n",
1305                         cpu_to_le16((*(sFrame.pwAuthSequence))));
1306             break;
1307     }
1308     return;
1309 }
1310
1311
1312
1313 /*+
1314  *
1315  * Routine Description:
1316  *   Handles incoming authen frames with sequence 1.  Currently
1317  *   assumes we're an AP.  So far, no one appears to use authentication
1318  *   in Ad-Hoc mode.
1319  *
1320  * Return Value:
1321  *    None.
1322  *
1323 -*/
1324
1325
1326 static
1327 VOID
1328 s_vMgrRxAuthenSequence_1(
1329     IN PSDevice pDevice,
1330     IN PSMgmtObject pMgmt,
1331     IN PWLAN_FR_AUTHEN pFrame
1332      )
1333 {
1334     PSTxMgmtPacket      pTxPacket = NULL;
1335     UINT                uNodeIndex;
1336     WLAN_FR_AUTHEN      sFrame;
1337     PSKeyItem           pTransmitKey;
1338
1339     // Insert a Node entry
1340     if (!BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1341         BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
1342         memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, pFrame->pHdr->sA3.abyAddr2,
1343                WLAN_ADDR_LEN);
1344     }
1345
1346     if (pMgmt->bShareKeyAlgorithm) {
1347         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_KNOWN;
1348         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 1;
1349     }
1350     else {
1351         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1352     }
1353
1354     // send auth reply
1355     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1356     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1357     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1358     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1359     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1360     // format buffer structure
1361     vMgrEncodeAuthen(&sFrame);
1362     // insert values
1363     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1364          (
1365          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1366          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1367          WLAN_SET_FC_ISWEP(0)
1368          ));
1369     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1370     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1371     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1372     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1373     *(sFrame.pwAuthSequence) = cpu_to_le16(2);
1374
1375     if (cpu_to_le16(*(pFrame->pwAuthAlgorithm)) == WLAN_AUTH_ALG_SHAREDKEY) {
1376         if (pMgmt->bShareKeyAlgorithm)
1377             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1378         else
1379             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1380     }
1381     else {
1382         if (pMgmt->bShareKeyAlgorithm)
1383             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1384         else
1385             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1386     }
1387
1388     if (pMgmt->bShareKeyAlgorithm &&
1389         (cpu_to_le16(*(sFrame.pwStatus)) == WLAN_MGMT_STATUS_SUCCESS)) {
1390
1391         sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1392         sFrame.len += WLAN_CHALLENGE_IE_LEN;
1393         sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1394         sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1395         memset(pMgmt->abyChallenge, 0, WLAN_CHALLENGE_LEN);
1396         // get group key
1397         if(KeybGetTransmitKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, GROUP_KEY, &pTransmitKey) == TRUE) {
1398             rc4_init(&pDevice->SBox, pDevice->abyPRNG, pTransmitKey->uKeyLength+3);
1399             rc4_encrypt(&pDevice->SBox, pMgmt->abyChallenge, pMgmt->abyChallenge, WLAN_CHALLENGE_LEN);
1400         }
1401         memcpy(sFrame.pChallenge->abyChallenge, pMgmt->abyChallenge , WLAN_CHALLENGE_LEN);
1402     }
1403
1404     /* Adjust the length fields */
1405     pTxPacket->cbMPDULen = sFrame.len;
1406     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1407     // send the frame
1408     if (pDevice->bEnableHostapd) {
1409         return;
1410     }
1411     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx.. \n");
1412     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1413         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx failed.\n");
1414     }
1415     return;
1416 }
1417
1418
1419
1420 /*+
1421  *
1422  * Routine Description:
1423  *   Handles incoming auth frames with sequence number 2.  Currently
1424  *   assumes we're a station.
1425  *
1426  *
1427  * Return Value:
1428  *    None.
1429  *
1430 -*/
1431
1432 static
1433 VOID
1434 s_vMgrRxAuthenSequence_2(
1435     IN PSDevice pDevice,
1436     IN PSMgmtObject pMgmt,
1437     IN PWLAN_FR_AUTHEN pFrame
1438     )
1439 {
1440     WLAN_FR_AUTHEN      sFrame;
1441     PSTxMgmtPacket      pTxPacket = NULL;
1442
1443
1444     switch (cpu_to_le16((*(pFrame->pwAuthAlgorithm))))
1445     {
1446         case WLAN_AUTH_ALG_OPENSYSTEM:
1447             if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1448                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Successful.\n");
1449                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1450                timer_expire(pDevice->sTimerCommand, 0);
1451             }
1452             else {
1453                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Failed.\n");
1454                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1455                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1456             }
1457             if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1458 //                spin_unlock_irq(&pDevice->lock);
1459 //                vCommandTimerWait((HANDLE)pDevice, 0);
1460 //                spin_lock_irq(&pDevice->lock);
1461             }
1462
1463             break;
1464
1465         case WLAN_AUTH_ALG_SHAREDKEY:
1466
1467             if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1468                 pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1469                 memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1470                 pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1471                 sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1472                 sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1473                 // format buffer structure
1474                 vMgrEncodeAuthen(&sFrame);
1475                 // insert values
1476                 sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1477                      (
1478                      WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1479                      WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1480                      WLAN_SET_FC_ISWEP(1)
1481                      ));
1482                 memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1483                 memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1484                 memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1485                 *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1486                 *(sFrame.pwAuthSequence) = cpu_to_le16(3);
1487                 *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1488                 sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1489                 sFrame.len += WLAN_CHALLENGE_IE_LEN;
1490                 sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1491                 sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1492                 memcpy( sFrame.pChallenge->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN);
1493                 // Adjust the length fields
1494                 pTxPacket->cbMPDULen = sFrame.len;
1495                 pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1496                 // send the frame
1497                 if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1498                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx failed.\n");
1499                 }
1500                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx ...\n");
1501             }
1502             else {
1503                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:rx Auth_reply sequence_2 status error ...\n");
1504                 if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1505 //                    spin_unlock_irq(&pDevice->lock);
1506 //                    vCommandTimerWait((HANDLE)pDevice, 0);
1507 //                    spin_lock_irq(&pDevice->lock);
1508                 }
1509                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1510             }
1511             break;
1512         default:
1513             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt: rx auth.seq = 2 unknown AuthAlgorithm=%d\n", cpu_to_le16((*(pFrame->pwAuthAlgorithm))));
1514             break;
1515     }
1516     return;
1517 }
1518
1519
1520
1521 /*+
1522  *
1523  * Routine Description:
1524  *   Handles incoming authen frames with sequence 3.  Currently
1525  *   assumes we're an AP.  This function assumes the frame has
1526  *   already been successfully decrypted.
1527  *
1528  *
1529  * Return Value:
1530  *    None.
1531  *
1532 -*/
1533
1534 static
1535 VOID
1536 s_vMgrRxAuthenSequence_3(
1537     IN PSDevice pDevice,
1538     IN PSMgmtObject pMgmt,
1539     IN PWLAN_FR_AUTHEN pFrame
1540     )
1541 {
1542     PSTxMgmtPacket      pTxPacket = NULL;
1543     UINT                uStatusCode = 0 ;
1544     UINT                uNodeIndex = 0;
1545     WLAN_FR_AUTHEN      sFrame;
1546
1547     if (!WLAN_GET_FC_ISWEP(pFrame->pHdr->sA3.wFrameCtl)) {
1548         uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1549         goto reply;
1550     }
1551     if (BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1552          if (pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence != 1) {
1553             uStatusCode = WLAN_MGMT_STATUS_RX_AUTH_NOSEQ;
1554             goto reply;
1555          }
1556          if (memcmp(pMgmt->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN) != 0) {
1557             uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1558             goto reply;
1559          }
1560     }
1561     else {
1562         uStatusCode = WLAN_MGMT_STATUS_UNSPEC_FAILURE;
1563         goto reply;
1564     }
1565
1566     if (uNodeIndex) {
1567         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1568         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 0;
1569     }
1570     uStatusCode = WLAN_MGMT_STATUS_SUCCESS;
1571     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Challenge text check ok..\n");
1572
1573 reply:
1574     // send auth reply
1575     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1576     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1577     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1578     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1579     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1580     // format buffer structure
1581     vMgrEncodeAuthen(&sFrame);
1582     /* insert values */
1583     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1584          (
1585          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1586          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1587          WLAN_SET_FC_ISWEP(0)
1588          ));
1589     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1590     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1591     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1592     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1593     *(sFrame.pwAuthSequence) = cpu_to_le16(4);
1594     *(sFrame.pwStatus) = cpu_to_le16(uStatusCode);
1595
1596     /* Adjust the length fields */
1597     pTxPacket->cbMPDULen = sFrame.len;
1598     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1599     // send the frame
1600     if (pDevice->bEnableHostapd) {
1601         return;
1602     }
1603     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1604         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_4 tx failed.\n");
1605     }
1606     return;
1607
1608 }
1609
1610
1611
1612 /*+
1613  *
1614  * Routine Description:
1615  *   Handles incoming authen frames with sequence 4
1616  *
1617  *
1618  * Return Value:
1619  *    None.
1620  *
1621 -*/
1622 static
1623 VOID
1624 s_vMgrRxAuthenSequence_4(
1625     IN PSDevice pDevice,
1626     IN PSMgmtObject pMgmt,
1627     IN PWLAN_FR_AUTHEN pFrame
1628     )
1629 {
1630
1631     if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1632         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Successful.\n");
1633         pMgmt->eCurrState = WMAC_STATE_AUTH;
1634         timer_expire(pDevice->sTimerCommand, 0);
1635     }
1636     else{
1637         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Failed.\n");
1638         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))) );
1639         pMgmt->eCurrState = WMAC_STATE_IDLE;
1640     }
1641
1642     if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1643 //        spin_unlock_irq(&pDevice->lock);
1644 //        vCommandTimerWait((HANDLE)pDevice, 0);
1645 //        spin_lock_irq(&pDevice->lock);
1646     }
1647
1648 }
1649
1650 /*+
1651  *
1652  * Routine Description:
1653  *   Handles incoming disassociation frames
1654  *
1655  *
1656  * Return Value:
1657  *    None.
1658  *
1659 -*/
1660
1661 static
1662 VOID
1663 s_vMgrRxDisassociation(
1664     IN PSDevice pDevice,
1665     IN PSMgmtObject pMgmt,
1666     IN PSRxMgmtPacket pRxPacket
1667     )
1668 {
1669     WLAN_FR_DISASSOC    sFrame;
1670     UINT        uNodeIndex = 0;
1671     CMD_STATUS          CmdStatus;
1672     viawget_wpa_header *wpahdr;
1673
1674     if ( pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1675         // if is acting an AP..
1676         // a STA is leaving this BSS..
1677         sFrame.len = pRxPacket->cbMPDULen;
1678         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1679         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1680             BSSvRemoveOneNode(pDevice, uNodeIndex);
1681         }
1682         else {
1683             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx disassoc, sta not found\n");
1684         }
1685     }
1686     else if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ){
1687         sFrame.len = pRxPacket->cbMPDULen;
1688         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1689         vMgrDecodeDisassociation(&sFrame);
1690         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP disassociated me, reason=%d.\n", cpu_to_le16(*(sFrame.pwReason)));
1691
1692           pDevice->fWPA_Authened = FALSE;
1693         if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1694              wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1695              wpahdr->type = VIAWGET_DISASSOC_MSG;
1696              wpahdr->resp_ie_len = 0;
1697              wpahdr->req_ie_len = 0;
1698              skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1699              pDevice->skb->dev = pDevice->wpadev;
1700 //2008-4-3 modify by Chester for wpa
1701 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
1702              pDevice->skb->mac_header = pDevice->skb->data;
1703 #else
1704             pDevice->skb->mac.raw = pDevice->skb->data;
1705 #endif
1706              pDevice->skb->pkt_type = PACKET_HOST;
1707              pDevice->skb->protocol = htons(ETH_P_802_2);
1708              memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1709              netif_rx(pDevice->skb);
1710              pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1711          };
1712
1713         //TODO: do something let upper layer know or
1714         //try to send associate packet again because of inactivity timeout
1715         if (pMgmt->eCurrState == WMAC_STATE_ASSOC) {
1716                 pDevice->bLinkPass = FALSE;
1717                 pMgmt->sNodeDBTable[0].bActive = FALSE;
1718                pDevice->byReAssocCount = 0;
1719                 pMgmt->eCurrState = WMAC_STATE_AUTH;  // jump back to the auth state!
1720                 pDevice->eCommandState = WLAN_ASSOCIATE_WAIT;
1721             vMgrReAssocBeginSta((PSDevice)pDevice, pMgmt, &CmdStatus);
1722               if(CmdStatus == CMD_STATUS_PENDING) {
1723                   pDevice->byReAssocCount ++;
1724                   return;       //mike add: you'll retry for many times, so it cann't be regarded as disconnected!
1725               }
1726         };
1727
1728    #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1729   // if(pDevice->bWPASuppWextEnabled == TRUE)
1730       {
1731         union iwreq_data  wrqu;
1732         memset(&wrqu, 0, sizeof (wrqu));
1733         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1734         PRINT_K("wireless_send_event--->SIOCGIWAP(disassociated)\n");
1735         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1736      }
1737   #endif
1738     }
1739     /* else, ignore it */
1740
1741     return;
1742 }
1743
1744
1745 /*+
1746  *
1747  * Routine Description:
1748  *   Handles incoming deauthentication frames
1749  *
1750  *
1751  * Return Value:
1752  *    None.
1753  *
1754 -*/
1755
1756 static
1757 VOID
1758 s_vMgrRxDeauthentication(
1759     IN PSDevice pDevice,
1760     IN PSMgmtObject pMgmt,
1761     IN PSRxMgmtPacket pRxPacket
1762     )
1763 {
1764     WLAN_FR_DEAUTHEN    sFrame;
1765     UINT        uNodeIndex = 0;
1766     viawget_wpa_header *wpahdr;
1767
1768
1769     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1770         //Todo:
1771         // if is acting an AP..
1772         // a STA is leaving this BSS..
1773         sFrame.len = pRxPacket->cbMPDULen;
1774         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1775         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1776             BSSvRemoveOneNode(pDevice, uNodeIndex);
1777         }
1778         else {
1779             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Rx deauth, sta not found\n");
1780         }
1781     }
1782     else {
1783         if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ) {
1784             sFrame.len = pRxPacket->cbMPDULen;
1785             sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1786             vMgrDecodeDeauthen(&sFrame);
1787            pDevice->fWPA_Authened = FALSE;
1788             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO  "AP deauthed me, reason=%d.\n", cpu_to_le16((*(sFrame.pwReason))));
1789             // TODO: update BSS list for specific BSSID if pre-authentication case
1790             if (IS_ETH_ADDRESS_EQUAL(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID)) {
1791                 if (pMgmt->eCurrState >= WMAC_STATE_AUTHPENDING) {
1792                     pMgmt->sNodeDBTable[0].bActive = FALSE;
1793                     pMgmt->eCurrMode = WMAC_MODE_STANDBY;
1794                     pMgmt->eCurrState = WMAC_STATE_IDLE;
1795                     netif_stop_queue(pDevice->dev);
1796                     pDevice->bLinkPass = FALSE;
1797                     ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_SLOW);
1798                 }
1799             };
1800
1801             if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1802                  wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1803                  wpahdr->type = VIAWGET_DISASSOC_MSG;
1804                  wpahdr->resp_ie_len = 0;
1805                  wpahdr->req_ie_len = 0;
1806                  skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1807                  pDevice->skb->dev = pDevice->wpadev;
1808 //2008-4-3 modify by Chester for wpa
1809 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
1810                  pDevice->skb->mac_header = pDevice->skb->data;
1811 #else
1812                  pDevice->skb->mac.raw = pDevice->skb->data;
1813 #endif
1814                  pDevice->skb->pkt_type = PACKET_HOST;
1815                  pDevice->skb->protocol = htons(ETH_P_802_2);
1816                  memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1817                  netif_rx(pDevice->skb);
1818                  pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1819            };
1820
1821    #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1822   // if(pDevice->bWPASuppWextEnabled == TRUE)
1823       {
1824         union iwreq_data  wrqu;
1825         memset(&wrqu, 0, sizeof (wrqu));
1826         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1827         PRINT_K("wireless_send_event--->SIOCGIWAP(disauthen)\n");
1828         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1829      }
1830   #endif
1831
1832         }
1833         /* else, ignore it.  TODO: IBSS authentication service
1834             would be implemented here */
1835     };
1836     return;
1837 }
1838
1839 //2008-0730-01<Add>by MikeLiu
1840 /*+
1841  *
1842  * Routine Description:
1843  * check if current channel is match ZoneType.
1844  *for USA:1~11;
1845  *      Japan:1~13;
1846  *      Europe:1~13
1847  * Return Value:
1848  *               True:exceed;
1849  *                False:normal case
1850 -*/
1851 static BOOL
1852 ChannelExceedZoneType(
1853     IN PSDevice pDevice,
1854     IN BYTE byCurrChannel
1855     )
1856 {
1857   BOOL exceed=FALSE;
1858
1859   switch(pDevice->byZoneType) {
1860         case 0x00:                  //USA:1~11
1861                      if((byCurrChannel<1) ||(byCurrChannel>11))
1862                         exceed = TRUE;
1863                  break;
1864         case 0x01:                  //Japan:1~13
1865         case 0x02:                  //Europe:1~13
1866                      if((byCurrChannel<1) ||(byCurrChannel>13))
1867                         exceed = TRUE;
1868                  break;
1869         default:                    //reserve for other zonetype
1870                 break;
1871   }
1872
1873   return exceed;
1874 }
1875
1876 /*+
1877  *
1878  * Routine Description:
1879  *   Handles and analysis incoming beacon frames.
1880  *
1881  *
1882  * Return Value:
1883  *    None.
1884  *
1885 -*/
1886
1887 static
1888 VOID
1889 s_vMgrRxBeacon(
1890     IN PSDevice pDevice,
1891     IN PSMgmtObject pMgmt,
1892     IN PSRxMgmtPacket pRxPacket,
1893     IN BOOL bInScan
1894     )
1895 {
1896
1897     PKnownBSS           pBSSList;
1898     WLAN_FR_BEACON      sFrame;
1899     QWORD               qwTSFOffset;
1900     BOOL                bIsBSSIDEqual = FALSE;
1901     BOOL                bIsSSIDEqual = FALSE;
1902     BOOL                bTSFLargeDiff = FALSE;
1903     BOOL                bTSFOffsetPostive = FALSE;
1904     BOOL                bUpdateTSF = FALSE;
1905     BOOL                bIsAPBeacon = FALSE;
1906     BOOL                bIsChannelEqual = FALSE;
1907     UINT                uLocateByteIndex;
1908     BYTE                byTIMBitOn = 0;
1909     WORD                wAIDNumber = 0;
1910     UINT                uNodeIndex;
1911     QWORD               qwTimestamp, qwLocalTSF;
1912     QWORD               qwCurrTSF;
1913     WORD                wStartIndex = 0;
1914     WORD                wAIDIndex = 0;
1915     BYTE                byCurrChannel = pRxPacket->byRxChannel;
1916     ERPObject           sERP;
1917     UINT                uRateLen = WLAN_RATES_MAXLEN;
1918     BOOL                bChannelHit = FALSE;
1919     BYTE                byOldPreambleType;
1920
1921
1922
1923      if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)
1924         return;
1925
1926     memset(&sFrame, 0, sizeof(WLAN_FR_BEACON));
1927     sFrame.len = pRxPacket->cbMPDULen;
1928     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1929
1930     // decode the beacon frame
1931     vMgrDecodeBeacon(&sFrame);
1932
1933     if ((sFrame.pwBeaconInterval == 0) ||
1934         (sFrame.pwCapInfo == 0) ||
1935         (sFrame.pSSID == 0) ||
1936         (sFrame.pSuppRates == 0) ) {
1937         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx beacon frame error\n");
1938         return;
1939     };
1940
1941
1942     if( byCurrChannel > CB_MAX_CHANNEL_24G )
1943     {
1944         if (sFrame.pDSParms != NULL) {
1945             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
1946                 bChannelHit = TRUE;
1947             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
1948         } else {
1949             bChannelHit = TRUE;
1950         }
1951
1952     } else {
1953         if (sFrame.pDSParms != NULL) {
1954             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
1955                 bChannelHit = TRUE;
1956             byCurrChannel = sFrame.pDSParms->byCurrChannel;
1957         } else {
1958             bChannelHit = TRUE;
1959         }
1960     }
1961
1962 //2008-0730-01<Add>by MikeLiu
1963 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
1964       return;
1965
1966     if (sFrame.pERP != NULL) {
1967         sERP.byERP = sFrame.pERP->byContext;
1968         sERP.bERPExist = TRUE;
1969
1970     } else {
1971         sERP.bERPExist = FALSE;
1972         sERP.byERP = 0;
1973     }
1974
1975     pBSSList = BSSpAddrIsInBSSList((HANDLE)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
1976     if (pBSSList == NULL) {
1977         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon/insert: RxChannel = : %d\n", byCurrChannel);
1978         BSSbInsertToBSSList((HANDLE)pDevice,
1979                             sFrame.pHdr->sA3.abyAddr3,
1980                             *sFrame.pqwTimestamp,
1981                             *sFrame.pwBeaconInterval,
1982                             *sFrame.pwCapInfo,
1983                             byCurrChannel,
1984                             sFrame.pSSID,
1985                             sFrame.pSuppRates,
1986                             sFrame.pExtSuppRates,
1987                             &sERP,
1988                             sFrame.pRSN,
1989                             sFrame.pRSNWPA,
1990                             sFrame.pIE_Country,
1991                             sFrame.pIE_Quiet,
1992                             sFrame.len - WLAN_HDR_ADDR3_LEN,
1993                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
1994                             (HANDLE)pRxPacket
1995                            );
1996     }
1997     else {
1998 //        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"update bcn: RxChannel = : %d\n", byCurrChannel);
1999         BSSbUpdateToBSSList((HANDLE)pDevice,
2000                             *sFrame.pqwTimestamp,
2001                             *sFrame.pwBeaconInterval,
2002                             *sFrame.pwCapInfo,
2003                             byCurrChannel,
2004                             bChannelHit,
2005                             sFrame.pSSID,
2006                             sFrame.pSuppRates,
2007                             sFrame.pExtSuppRates,
2008                             &sERP,
2009                             sFrame.pRSN,
2010                             sFrame.pRSNWPA,
2011                             sFrame.pIE_Country,
2012                             sFrame.pIE_Quiet,
2013                             pBSSList,
2014                             sFrame.len - WLAN_HDR_ADDR3_LEN,
2015                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
2016                             (HANDLE)pRxPacket
2017                            );
2018
2019     }
2020
2021     if (bInScan) {
2022         return;
2023     }
2024
2025     if(byCurrChannel == (BYTE)pMgmt->uCurrChannel)
2026        bIsChannelEqual = TRUE;
2027
2028     if (bIsChannelEqual && (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)) {
2029
2030         // if rx beacon without ERP field
2031         if (sERP.bERPExist) {
2032             if (WLAN_GET_ERP_USE_PROTECTION(sERP.byERP)){
2033                 pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
2034                 pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
2035             }
2036         }
2037         else {
2038             pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
2039             pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
2040         }
2041
2042         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2043             if(!WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo))
2044                 pDevice->byERPFlag |= WLAN_SET_ERP_BARKER_MODE(1);
2045             if(!sERP.bERPExist)
2046                 pDevice->byERPFlag |= WLAN_SET_ERP_NONERP_PRESENT(1);
2047         }
2048     }
2049
2050     // check if BSSID the same
2051     if (memcmp(sFrame.pHdr->sA3.abyAddr3,
2052                pMgmt->abyCurrBSSID,
2053                WLAN_BSSID_LEN) == 0) {
2054
2055         bIsBSSIDEqual = TRUE;
2056         pDevice->uCurrRSSI = pRxPacket->uRSSI;
2057         pDevice->byCurrSQ = pRxPacket->bySQ;
2058         if (pMgmt->sNodeDBTable[0].uInActiveCount != 0) {
2059             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2060             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"BCN:Wake Count= [%d]\n", pMgmt->wCountToWakeUp);
2061         }
2062     }
2063     // check if SSID the same
2064     if (sFrame.pSSID->len == ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) {
2065         if (memcmp(sFrame.pSSID->abySSID,
2066                    ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
2067                    sFrame.pSSID->len
2068                    ) == 0) {
2069             bIsSSIDEqual = TRUE;
2070         };
2071     }
2072
2073     if ((WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)== TRUE) &&
2074         (bIsBSSIDEqual == TRUE) &&
2075         (bIsSSIDEqual == TRUE) &&
2076         (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
2077         (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
2078         // add state check to prevent reconnect fail since we'll receive Beacon
2079
2080         bIsAPBeacon = TRUE;
2081         if (pBSSList != NULL) {
2082
2083                 // Sync ERP field
2084                 if ((pBSSList->sERP.bERPExist == TRUE) && (pDevice->byBBType == BB_TYPE_11G)) {
2085                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2086                         pDevice->bProtectMode = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2087                         if (pDevice->bProtectMode) {
2088                             MACvEnableProtectMD(pDevice);
2089                         } else {
2090                             MACvDisableProtectMD(pDevice);
2091                         }
2092                         vUpdateIFS(pDevice);
2093                     }
2094                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2095                         pDevice->bNonERPPresent = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2096                     }
2097                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2098                         pDevice->bBarkerPreambleMd = (pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2099                         //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2100                         if (pDevice->bBarkerPreambleMd) {
2101                             MACvEnableBarkerPreambleMd(pDevice);
2102                         } else {
2103                             MACvDisableBarkerPreambleMd(pDevice);
2104                         }
2105                     }
2106                 }
2107                 // Sync Short Slot Time
2108                 if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo) != pDevice->bShortSlotTime) {
2109                     BOOL    bShortSlotTime;
2110
2111                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo);
2112                     //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2113                     //Kyle check if it is OK to set G.
2114                     if (pDevice->byBBType == BB_TYPE_11A) {
2115                         bShortSlotTime = TRUE;
2116                     }
2117                     else if (pDevice->byBBType == BB_TYPE_11B) {
2118                         bShortSlotTime = FALSE;
2119                     }
2120                     if (bShortSlotTime != pDevice->bShortSlotTime) {
2121                         pDevice->bShortSlotTime = bShortSlotTime;
2122                         BBvSetShortSlotTime(pDevice);
2123                         vUpdateIFS(pDevice);
2124                     }
2125                 }
2126
2127                 //
2128                 // Preamble may change dynamiclly
2129                 //
2130                 byOldPreambleType = pDevice->byPreambleType;
2131                 if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pBSSList->wCapInfo)) {
2132                     pDevice->byPreambleType = pDevice->byShortPreamble;
2133                 }
2134                 else {
2135                     pDevice->byPreambleType = 0;
2136                 }
2137                 if (pDevice->byPreambleType != byOldPreambleType)
2138                     CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2139             //
2140             // Basic Rate Set may change dynamiclly
2141             //
2142             if (pBSSList->eNetworkTypeInUse == PHY_TYPE_11B) {
2143                 uRateLen = WLAN_RATES_MAXLEN_11B;
2144             }
2145             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abySuppRates,
2146                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2147                                                     uRateLen);
2148             pMgmt->abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abyExtSuppRates,
2149                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
2150                                                     uRateLen);
2151             RATEvParseMaxRate( (PVOID)pDevice,
2152                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2153                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
2154                                TRUE,
2155                                &(pMgmt->sNodeDBTable[0].wMaxBasicRate),
2156                                &(pMgmt->sNodeDBTable[0].wMaxSuppRate),
2157                                &(pMgmt->sNodeDBTable[0].wSuppRate),
2158                                &(pMgmt->sNodeDBTable[0].byTopCCKBasicRate),
2159                                &(pMgmt->sNodeDBTable[0].byTopOFDMBasicRate)
2160                               );
2161
2162         }
2163     }
2164
2165 //    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon 2 \n");
2166     // check if CF field exisit
2167     if (WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)) {
2168         if (sFrame.pCFParms->wCFPDurRemaining > 0) {
2169             // TODO: deal with CFP period to set NAV
2170         };
2171     };
2172
2173     HIDWORD(qwTimestamp) = cpu_to_le32(HIDWORD(*sFrame.pqwTimestamp));
2174     LODWORD(qwTimestamp) = cpu_to_le32(LODWORD(*sFrame.pqwTimestamp));
2175     HIDWORD(qwLocalTSF) = HIDWORD(pRxPacket->qwLocalTSF);
2176     LODWORD(qwLocalTSF) = LODWORD(pRxPacket->qwLocalTSF);
2177
2178     // check if beacon TSF larger or small than our local TSF
2179     if (HIDWORD(qwTimestamp) == HIDWORD(qwLocalTSF)) {
2180         if (LODWORD(qwTimestamp) >= LODWORD(qwLocalTSF)) {
2181             bTSFOffsetPostive = TRUE;
2182         }
2183         else {
2184             bTSFOffsetPostive = FALSE;
2185         }
2186     }
2187     else if (HIDWORD(qwTimestamp) > HIDWORD(qwLocalTSF)) {
2188         bTSFOffsetPostive = TRUE;
2189     }
2190     else if (HIDWORD(qwTimestamp) < HIDWORD(qwLocalTSF)) {
2191         bTSFOffsetPostive = FALSE;
2192     };
2193
2194     if (bTSFOffsetPostive) {
2195         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwTimestamp), (qwLocalTSF));
2196     }
2197     else {
2198         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwLocalTSF), (qwTimestamp));
2199     }
2200
2201     if (HIDWORD(qwTSFOffset) != 0 ||
2202         (LODWORD(qwTSFOffset) > TRIVIAL_SYNC_DIFFERENCE )) {
2203          bTSFLargeDiff = TRUE;
2204     }
2205
2206
2207     // if infra mode
2208     if (bIsAPBeacon == TRUE) {
2209
2210         // Infra mode: Local TSF always follow AP's TSF if Difference huge.
2211         if (bTSFLargeDiff)
2212             bUpdateTSF = TRUE;
2213
2214         if ((pDevice->bEnablePSMode == TRUE) &&(sFrame.pTIM != 0)) {
2215
2216             // deal with DTIM, analysis TIM
2217             pMgmt->bMulticastTIM = WLAN_MGMT_IS_MULTICAST_TIM(sFrame.pTIM->byBitMapCtl) ? TRUE : FALSE ;
2218             pMgmt->byDTIMCount = sFrame.pTIM->byDTIMCount;
2219             pMgmt->byDTIMPeriod = sFrame.pTIM->byDTIMPeriod;
2220             wAIDNumber = pMgmt->wCurrAID & ~(BIT14|BIT15);
2221
2222             // check if AID in TIM field bit on
2223             // wStartIndex = N1
2224             wStartIndex = WLAN_MGMT_GET_TIM_OFFSET(sFrame.pTIM->byBitMapCtl) << 1;
2225             // AIDIndex = N2
2226             wAIDIndex = (wAIDNumber >> 3);
2227             if ((wAIDNumber > 0) && (wAIDIndex >= wStartIndex)) {
2228                 uLocateByteIndex = wAIDIndex - wStartIndex;
2229                 // len = byDTIMCount + byDTIMPeriod + byDTIMPeriod + byVirtBitMap[0~250]
2230                 if (sFrame.pTIM->len >= (uLocateByteIndex + 4)) {
2231                     byTIMBitOn  = (0x01) << ((wAIDNumber) % 8);
2232                     pMgmt->bInTIM = sFrame.pTIM->byVirtBitMap[uLocateByteIndex] & byTIMBitOn ? TRUE : FALSE;
2233                 }
2234                 else {
2235                     pMgmt->bInTIM = FALSE;
2236                 };
2237             }
2238             else {
2239                 pMgmt->bInTIM = FALSE;
2240             };
2241
2242             if (pMgmt->bInTIM ||
2243                 (pMgmt->bMulticastTIM && (pMgmt->byDTIMCount == 0))) {
2244                 pMgmt->bInTIMWake = TRUE;
2245                 // send out ps-poll packet
2246 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:In TIM\n");
2247                 if (pMgmt->bInTIM) {
2248                     PSvSendPSPOLL((PSDevice)pDevice);
2249 //                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:PS-POLL sent..\n");
2250                 };
2251
2252             }
2253             else {
2254                 pMgmt->bInTIMWake = FALSE;
2255                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Not In TIM..\n");
2256                 if (pDevice->bPWBitOn == FALSE) {
2257                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Send Null Packet\n");
2258                     if (PSbSendNullPacket(pDevice))
2259                         pDevice->bPWBitOn = TRUE;
2260                 }
2261                 if(PSbConsiderPowerDown(pDevice, FALSE, FALSE)) {
2262                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Power down now...\n");
2263                 };
2264             }
2265
2266         }
2267
2268     }
2269     // if adhoc mode
2270     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && !bIsAPBeacon && bIsChannelEqual) {
2271         if (bIsBSSIDEqual) {
2272             // Use sNodeDBTable[0].uInActiveCount as IBSS beacons received count.
2273                     if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
2274                             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2275
2276             // adhoc mode:TSF updated only when beacon larger then local TSF
2277             if (bTSFLargeDiff && bTSFOffsetPostive &&
2278                 (pMgmt->eCurrState == WMAC_STATE_JOINTED))
2279                 bUpdateTSF = TRUE;
2280
2281             // During dpc, already in spinlocked.
2282             if (BSSbIsSTAInNodeDB(pDevice, sFrame.pHdr->sA3.abyAddr2, &uNodeIndex)) {
2283
2284                 // Update the STA, (Techically the Beacons of all the IBSS nodes
2285                         // should be identical, but that's not happening in practice.
2286                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2287                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2288                                                         WLAN_RATES_MAXLEN_11B);
2289                 RATEvParseMaxRate( (PVOID)pDevice,
2290                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2291                                    NULL,
2292                                    TRUE,
2293                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2294                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2295                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2296                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2297                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2298                                   );
2299                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2300                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2301                 pMgmt->sNodeDBTable[uNodeIndex].uInActiveCount = 0;
2302             }
2303             else {
2304                 // Todo, initial Node content
2305                 BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
2306
2307                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2308                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2309                                                         WLAN_RATES_MAXLEN_11B);
2310                 RATEvParseMaxRate( (PVOID)pDevice,
2311                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2312                                    NULL,
2313                                    TRUE,
2314                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2315                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2316                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2317                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2318                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2319                                  );
2320
2321                 memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, sFrame.pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
2322                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2323                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate = pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
2324 /*
2325                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2326                 if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
2327                        pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
2328 */
2329             }
2330
2331             // if other stations jointed, indicate connect to upper layer..
2332             if (pMgmt->eCurrState == WMAC_STATE_STARTED) {
2333                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Current IBSS State: [Started]........to: [Jointed] \n");
2334                 pMgmt->eCurrState = WMAC_STATE_JOINTED;
2335                 pDevice->bLinkPass = TRUE;
2336                 ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2337                 if (netif_queue_stopped(pDevice->dev)){
2338                     netif_wake_queue(pDevice->dev);
2339                 }
2340                 pMgmt->sNodeDBTable[0].bActive = TRUE;
2341                 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2342
2343             };
2344         }
2345         else if (bIsSSIDEqual) {
2346
2347             // See other adhoc sta with the same SSID but BSSID is different.
2348             // adpot this vars only when TSF larger then us.
2349             if (bTSFLargeDiff && bTSFOffsetPostive) {
2350                  // we don't support ATIM under adhoc mode
2351                // if ( sFrame.pIBSSParms->wATIMWindow == 0) {
2352                      // adpot this vars
2353                      // TODO: check sFrame cap if privacy on, and support rate syn
2354                      memcpy(pMgmt->abyCurrBSSID, sFrame.pHdr->sA3.abyAddr3, WLAN_BSSID_LEN);
2355                      memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
2356                      pMgmt->wCurrATIMWindow = cpu_to_le16(sFrame.pIBSSParms->wATIMWindow);
2357                      pMgmt->wCurrBeaconPeriod = cpu_to_le16(*sFrame.pwBeaconInterval);
2358                      pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2359                                                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2360                                                       WLAN_RATES_MAXLEN_11B);
2361                      // set HW beacon interval and re-synchronizing....
2362                      DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rejoining to Other Adhoc group with same SSID........\n");
2363
2364                      MACvWriteBeaconInterval(pDevice, pMgmt->wCurrBeaconPeriod);
2365                      CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp, pRxPacket->qwLocalTSF);
2366                      CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2367
2368                      // Turn off bssid filter to avoid filter others adhoc station which bssid is different.
2369                      MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2370
2371                     byOldPreambleType = pDevice->byPreambleType;
2372                     if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo)) {
2373                         pDevice->byPreambleType = pDevice->byShortPreamble;
2374                     }
2375                     else {
2376                         pDevice->byPreambleType = 0;
2377                     }
2378                     if (pDevice->byPreambleType != byOldPreambleType)
2379                         CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2380
2381
2382                      // MACvRegBitsOff(pDevice->PortOffset, MAC_REG_RCR, RCR_BSSID);
2383                      // set highest basic rate
2384                      // s_vSetHighestBasicRate(pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates);
2385                      // Prepare beacon frame
2386                      bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt);
2387               //  }
2388             };
2389         }
2390     };
2391     // endian issue ???
2392     // Update TSF
2393     if (bUpdateTSF) {
2394         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2395         CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp , pRxPacket->qwLocalTSF);
2396         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2397         CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2398     }
2399
2400     return;
2401 }
2402
2403
2404
2405 /*+
2406  *
2407  * Routine Description:
2408  *   Instructs the hw to create a bss using the supplied
2409  *   attributes. Note that this implementation only supports Ad-Hoc
2410  *   BSS creation.
2411  *
2412  *
2413  * Return Value:
2414  *    CMD_STATUS
2415  *
2416 -*/
2417 VOID
2418 vMgrCreateOwnIBSS(
2419     IN  HANDLE hDeviceContext,
2420     OUT PCMD_STATUS pStatus
2421     )
2422 {
2423     PSDevice            pDevice = (PSDevice)hDeviceContext;
2424     PSMgmtObject        pMgmt = &(pDevice->sMgmtObj);
2425     WORD                wMaxBasicRate;
2426     WORD                wMaxSuppRate;
2427     BYTE                byTopCCKBasicRate;
2428     BYTE                byTopOFDMBasicRate;
2429     QWORD               qwCurrTSF;
2430     UINT                ii;
2431     BYTE    abyRATE[] = {0x82, 0x84, 0x8B, 0x96, 0x24, 0x30, 0x48, 0x6C, 0x0C, 0x12, 0x18, 0x60};
2432     BYTE    abyCCK_RATE[] = {0x82, 0x84, 0x8B, 0x96};
2433     BYTE    abyOFDM_RATE[] = {0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2434     WORD                wSuppRate;
2435
2436
2437
2438     HIDWORD(qwCurrTSF) = 0;
2439     LODWORD(qwCurrTSF) = 0;
2440
2441     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Create Basic Service Set .......\n");
2442
2443     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2444         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) &&
2445             (pDevice->eEncryptionStatus != Ndis802_11Encryption2Enabled) &&
2446             (pDevice->eEncryptionStatus != Ndis802_11Encryption3Enabled)) {
2447             // encryption mode error
2448             *pStatus = CMD_STATUS_FAILURE;
2449             return;
2450         }
2451     }
2452
2453     pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2454     pMgmt->abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
2455
2456     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2457         pMgmt->eCurrentPHYMode = pMgmt->byAPBBType;
2458     } else {
2459         if (pDevice->byBBType == BB_TYPE_11G)
2460             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
2461         if (pDevice->byBBType == BB_TYPE_11B)
2462             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
2463         if (pDevice->byBBType == BB_TYPE_11A)
2464             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
2465     }
2466
2467     if (pMgmt->eCurrentPHYMode != PHY_TYPE_11A) {
2468         pMgmt->abyCurrSuppRates[1] = WLAN_RATES_MAXLEN_11B;
2469         pMgmt->abyCurrExtSuppRates[1] = 0;
2470         for (ii = 0; ii < 4; ii++)
2471             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2472     } else {
2473         pMgmt->abyCurrSuppRates[1] = 8;
2474         pMgmt->abyCurrExtSuppRates[1] = 0;
2475         for (ii = 0; ii < 8; ii++)
2476             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2477     }
2478
2479
2480     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
2481         pMgmt->abyCurrSuppRates[1] = 8;
2482         pMgmt->abyCurrExtSuppRates[1] = 4;
2483         for (ii = 0; ii < 4; ii++)
2484             pMgmt->abyCurrSuppRates[2+ii] =  abyCCK_RATE[ii];
2485         for (ii = 4; ii < 8; ii++)
2486             pMgmt->abyCurrSuppRates[2+ii] =  abyOFDM_RATE[ii-4];
2487         for (ii = 0; ii < 4; ii++)
2488             pMgmt->abyCurrExtSuppRates[2+ii] =  abyOFDM_RATE[ii+4];
2489     }
2490
2491
2492     // Disable Protect Mode
2493     pDevice->bProtectMode = 0;
2494     MACvDisableProtectMD(pDevice);
2495
2496     pDevice->bBarkerPreambleMd = 0;
2497     MACvDisableBarkerPreambleMd(pDevice);
2498
2499     // Kyle Test 2003.11.04
2500
2501     // set HW beacon interval
2502     if (pMgmt->wIBSSBeaconPeriod == 0)
2503         pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
2504     MACvWriteBeaconInterval(pDevice, pMgmt->wIBSSBeaconPeriod);
2505
2506     CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2507     // clear TSF counter
2508     CARDbClearCurrentTSF(pDevice);
2509
2510     // enable TSF counter
2511     MACvRegBitsOn(pDevice,MAC_REG_TFTCTL,TFTCTL_TSFCNTREN);
2512     // set Next TBTT
2513     CARDvSetFirstNextTBTT(pDevice, pMgmt->wIBSSBeaconPeriod);
2514
2515     pMgmt->uIBSSChannel = pDevice->uChannel;
2516
2517     if (pMgmt->uIBSSChannel == 0)
2518         pMgmt->uIBSSChannel = DEFAULT_IBSS_CHANNEL;
2519
2520     // set channel and clear NAV
2521     CARDbSetMediaChannel(pDevice, pMgmt->uIBSSChannel);
2522     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2523
2524     pDevice->byPreambleType = pDevice->byShortPreamble;
2525
2526     // set basic rate
2527
2528     RATEvParseMaxRate((PVOID)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2529                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates, TRUE,
2530                       &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2531                       &byTopCCKBasicRate, &byTopOFDMBasicRate);
2532
2533
2534
2535     if (pDevice->byBBType == BB_TYPE_11A) {
2536         pDevice->bShortSlotTime = TRUE;
2537     } else {
2538         pDevice->bShortSlotTime = FALSE;
2539     }
2540     BBvSetShortSlotTime(pDevice);
2541     // vUpdateIFS() use pDevice->bShortSlotTime as parameter so it must be called
2542     // after setting ShortSlotTime.
2543     // CARDvSetBSSMode call vUpdateIFS()
2544     CARDvSetBSSMode(pDevice);
2545
2546     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2547         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_AP);
2548         pMgmt->eCurrMode = WMAC_MODE_ESS_AP;
2549     }
2550
2551     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2552         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
2553         pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2554     }
2555
2556     // Adopt pre-configured IBSS vars to current vars
2557     pMgmt->eCurrState = WMAC_STATE_STARTED;
2558     pMgmt->wCurrBeaconPeriod = pMgmt->wIBSSBeaconPeriod;
2559     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2560     pMgmt->wCurrATIMWindow = pMgmt->wIBSSATIMWindow;
2561     pDevice->uCurrRSSI = 0;
2562     pDevice->byCurrSQ = 0;
2563
2564 //20080131-04,<Add> by Mike Liu
2565 #ifdef Adhoc_STA
2566     memcpy(pMgmt->abyDesireSSID,pMgmt->abyAdHocSSID,
2567                       ((PWLAN_IE_SSID)pMgmt->abyAdHocSSID)->len + WLAN_IEHDR_LEN);
2568 #endif
2569
2570     memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2571     memcpy(pMgmt->abyCurrSSID,
2572            pMgmt->abyDesireSSID,
2573            ((PWLAN_IE_SSID)pMgmt->abyDesireSSID)->len + WLAN_IEHDR_LEN
2574           );
2575
2576     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2577         // AP mode BSSID = MAC addr
2578         memcpy(pMgmt->abyCurrBSSID, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
2579         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"AP beacon created BSSID:%02x-%02x-%02x-%02x-%02x-%02x \n",
2580                       pMgmt->abyCurrBSSID[0],
2581                       pMgmt->abyCurrBSSID[1],
2582                       pMgmt->abyCurrBSSID[2],
2583                       pMgmt->abyCurrBSSID[3],
2584                       pMgmt->abyCurrBSSID[4],
2585                       pMgmt->abyCurrBSSID[5]
2586                     );
2587     }
2588
2589     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2590
2591         // BSSID selected must be randomized as spec 11.1.3
2592         pMgmt->abyCurrBSSID[5] = (BYTE) (LODWORD(qwCurrTSF)& 0x000000ff);
2593         pMgmt->abyCurrBSSID[4] = (BYTE)((LODWORD(qwCurrTSF)& 0x0000ff00) >> 8);
2594         pMgmt->abyCurrBSSID[3] = (BYTE)((LODWORD(qwCurrTSF)& 0x00ff0000) >> 16);
2595         pMgmt->abyCurrBSSID[2] = (BYTE)((LODWORD(qwCurrTSF)& 0x00000ff0) >> 4);
2596         pMgmt->abyCurrBSSID[1] = (BYTE)((LODWORD(qwCurrTSF)& 0x000ff000) >> 12);
2597         pMgmt->abyCurrBSSID[0] = (BYTE)((LODWORD(qwCurrTSF)& 0x0ff00000) >> 20);
2598         pMgmt->abyCurrBSSID[5] ^= pMgmt->abyMACAddr[0];
2599         pMgmt->abyCurrBSSID[4] ^= pMgmt->abyMACAddr[1];
2600         pMgmt->abyCurrBSSID[3] ^= pMgmt->abyMACAddr[2];
2601         pMgmt->abyCurrBSSID[2] ^= pMgmt->abyMACAddr[3];
2602         pMgmt->abyCurrBSSID[1] ^= pMgmt->abyMACAddr[4];
2603         pMgmt->abyCurrBSSID[0] ^= pMgmt->abyMACAddr[5];
2604         pMgmt->abyCurrBSSID[0] &= ~IEEE_ADDR_GROUP;
2605         pMgmt->abyCurrBSSID[0] |= IEEE_ADDR_UNIVERSAL;
2606
2607
2608         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"Adhoc beacon created bssid:%02x-%02x-%02x-%02x-%02x-%02x \n",
2609                       pMgmt->abyCurrBSSID[0],
2610                       pMgmt->abyCurrBSSID[1],
2611                       pMgmt->abyCurrBSSID[2],
2612                       pMgmt->abyCurrBSSID[3],
2613                       pMgmt->abyCurrBSSID[4],
2614                       pMgmt->abyCurrBSSID[5]
2615                     );
2616     }
2617
2618     // set BSSID filter
2619     MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2620     memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
2621
2622     MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
2623     pDevice->byRxMode |= RCR_BSSID;
2624     pMgmt->bCurrBSSIDFilterOn = TRUE;
2625
2626     // Set Capability Info
2627     pMgmt->wCurrCapInfo = 0;
2628
2629     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2630         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
2631         pMgmt->byDTIMPeriod = DEFAULT_DTIM_PERIOD;
2632         pMgmt->byDTIMCount = pMgmt->byDTIMPeriod - 1;
2633         pDevice->eOPMode = OP_MODE_AP;
2634     }
2635
2636     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2637         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_IBSS(1);
2638         pDevice->eOPMode = OP_MODE_ADHOC;
2639     }
2640
2641     if (pDevice->bEncryptionEnable) {
2642         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
2643         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2644             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2645                 pMgmt->byCSSPK = KEY_CTL_CCMP;
2646                 pMgmt->byCSSGK = KEY_CTL_CCMP;
2647             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2648                 pMgmt->byCSSPK = KEY_CTL_TKIP;
2649                 pMgmt->byCSSGK = KEY_CTL_TKIP;
2650             } else {
2651                 pMgmt->byCSSPK = KEY_CTL_NONE;
2652                 pMgmt->byCSSGK = KEY_CTL_WEP;
2653             }
2654         } else {
2655             pMgmt->byCSSPK = KEY_CTL_WEP;
2656             pMgmt->byCSSGK = KEY_CTL_WEP;
2657         }
2658     };
2659
2660     pMgmt->byERPContext = 0;
2661
2662     if (pDevice->byPreambleType == 1) {
2663         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
2664     } else {
2665         pMgmt->wCurrCapInfo &= (~WLAN_SET_CAP_INFO_SHORTPREAMBLE(1));
2666     }
2667
2668     pMgmt->eCurrState = WMAC_STATE_STARTED;
2669     // Prepare beacon to send
2670     if (bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt)) {
2671         *pStatus = CMD_STATUS_SUCCESS;
2672     }
2673     return ;
2674 }
2675
2676
2677
2678 /*+
2679  *
2680  * Routine Description:
2681  *   Instructs wmac to join a bss using the supplied attributes.
2682  *   The arguments may the BSSID or SSID and the rest of the
2683  *   attributes are obtained from the scan result of known bss list.
2684  *
2685  *
2686  * Return Value:
2687  *    None.
2688  *
2689 -*/
2690
2691 VOID
2692 vMgrJoinBSSBegin(
2693     IN  HANDLE hDeviceContext,
2694     OUT PCMD_STATUS pStatus
2695     )
2696 {
2697
2698     PSDevice     pDevice = (PSDevice)hDeviceContext;
2699     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
2700     PKnownBSS       pCurr = NULL;
2701     UINT            ii, uu;
2702     PWLAN_IE_SUPP_RATES pItemRates = NULL;
2703     PWLAN_IE_SUPP_RATES pItemExtRates = NULL;
2704     PWLAN_IE_SSID   pItemSSID;
2705     UINT            uRateLen = WLAN_RATES_MAXLEN;
2706     WORD            wMaxBasicRate = RATE_1M;
2707     WORD            wMaxSuppRate = RATE_1M;
2708     WORD            wSuppRate;
2709     BYTE            byTopCCKBasicRate = RATE_1M;
2710     BYTE            byTopOFDMBasicRate = RATE_1M;
2711     BOOL            bShortSlotTime = FALSE;
2712
2713
2714     for (ii = 0; ii < MAX_BSS_NUM; ii++) {
2715         if (pMgmt->sBSSList[ii].bActive == TRUE)
2716             break;
2717     }
2718
2719     if (ii == MAX_BSS_NUM) {
2720        *pStatus = CMD_STATUS_RESOURCES;
2721         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "BSS finding:BSS list is empty.\n");
2722        return;
2723     };
2724
2725     // memset(pMgmt->abyDesireBSSID, 0,  WLAN_BSSID_LEN);
2726     // Search known BSS list for prefer BSSID or SSID
2727
2728     pCurr = BSSpSearchBSSList(pDevice,
2729                               pMgmt->abyDesireBSSID,
2730                               pMgmt->abyDesireSSID,
2731                               pDevice->eConfigPHYMode
2732                               );
2733
2734     if (pCurr == NULL){
2735        *pStatus = CMD_STATUS_RESOURCES;
2736        pItemSSID = (PWLAN_IE_SSID)pMgmt->abyDesireSSID;
2737        DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Scanning [%s] not found, disconnected !\n", pItemSSID->abySSID);
2738        return;
2739     };
2740
2741     DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP(BSS) finding:Found a AP(BSS)..\n");
2742
2743     if (WLAN_GET_CAP_INFO_ESS(cpu_to_le16(pCurr->wCapInfo))){
2744
2745         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA)||(pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK)) {
2746 /*
2747             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2748                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2749                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2750                     // encryption mode error
2751                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2752                     return;
2753                 }
2754             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2755                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2756                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2757                     // encryption mode error
2758                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2759                     return;
2760                 }
2761             }
2762 */
2763         }
2764
2765 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
2766         //if(pDevice->bWPASuppWextEnabled == TRUE)
2767             Encyption_Rebuild(pDevice, pCurr);
2768 #endif
2769
2770         // Infrastructure BSS
2771         s_vMgrSynchBSS(pDevice,
2772                        WMAC_MODE_ESS_STA,
2773                        pCurr,
2774                        pStatus
2775                        );
2776
2777         if (*pStatus == CMD_STATUS_SUCCESS){
2778
2779             // Adopt this BSS state vars in Mgmt Object
2780             pMgmt->uCurrChannel = pCurr->uChannel;
2781
2782             memset(pMgmt->abyCurrSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2783             memset(pMgmt->abyCurrExtSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2784
2785             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2786                 uRateLen = WLAN_RATES_MAXLEN_11B;
2787             }
2788
2789             pItemRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates;
2790             pItemExtRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates;
2791
2792             // Parse Support Rate IE
2793             pItemRates->byElementID = WLAN_EID_SUPP_RATES;
2794             pItemRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2795                                          pItemRates,
2796                                          uRateLen);
2797
2798             // Parse Extension Support Rate IE
2799             pItemExtRates->byElementID = WLAN_EID_EXTSUPP_RATES;
2800             pItemExtRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abyExtSuppRates,
2801                                             pItemExtRates,
2802                                             uRateLen);
2803             // Stuffing Rate IE
2804             if ((pItemExtRates->len > 0) && (pItemRates->len < 8)) {
2805                 for (ii = 0; ii < (UINT)(8 - pItemRates->len); ) {
2806                     pItemRates->abyRates[pItemRates->len + ii] = pItemExtRates->abyRates[ii];
2807                     ii ++;
2808                     if (pItemExtRates->len <= ii)
2809                         break;
2810                 }
2811                 pItemRates->len += (BYTE)ii;
2812                 if (pItemExtRates->len - ii > 0) {
2813                     pItemExtRates->len -= (BYTE)ii;
2814                     for (uu = 0; uu < pItemExtRates->len; uu ++) {
2815                         pItemExtRates->abyRates[uu] = pItemExtRates->abyRates[uu + ii];
2816                     }
2817                 } else {
2818                     pItemExtRates->len = 0;
2819                 }
2820             }
2821
2822             RATEvParseMaxRate((PVOID)pDevice, pItemRates, pItemExtRates, TRUE,
2823                               &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2824                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2825             vUpdateIFS(pDevice);
2826             // TODO: deal with if wCapInfo the privacy is on, but station WEP is off
2827             // TODO: deal with if wCapInfo the PS-Pollable is on.
2828             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2829             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2830             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2831             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2832
2833             pMgmt->eCurrMode = WMAC_MODE_ESS_STA;
2834
2835             pMgmt->eCurrState = WMAC_STATE_JOINTED;
2836             // Adopt BSS state in Adapter Device Object
2837             pDevice->eOPMode = OP_MODE_INFRASTRUCTURE;
2838             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2839
2840             // Add current BSS to Candidate list
2841             // This should only works for WPA2 BSS, and WPA2 BSS check must be done before.
2842             if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
2843                 BOOL bResult = bAdd_PMKID_Candidate((HANDLE)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2844                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate: 1(%d)\n", bResult);
2845                 if (bResult == FALSE) {
2846                     vFlush_PMKID_Candidate((HANDLE)pDevice);
2847                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFlush_PMKID_Candidate: 4\n");
2848                     bAdd_PMKID_Candidate((HANDLE)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2849                 }
2850             }
2851
2852             // Preamble type auto-switch: if AP can receive short-preamble cap,
2853             // we can turn on too.
2854             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2855                 pDevice->byPreambleType = pDevice->byShortPreamble;
2856             }
2857             else {
2858                 pDevice->byPreambleType = 0;
2859             }
2860             // Change PreambleType must set RSPINF again
2861             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2862
2863             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join ESS\n");
2864
2865             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11G) {
2866
2867                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2868                     pDevice->bProtectMode = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2869                     if (pDevice->bProtectMode) {
2870                         MACvEnableProtectMD(pDevice);
2871                     } else {
2872                         MACvDisableProtectMD(pDevice);
2873                     }
2874                     vUpdateIFS(pDevice);
2875                 }
2876                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2877                     pDevice->bNonERPPresent = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2878                 }
2879                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2880                     pDevice->bBarkerPreambleMd = (pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2881                     //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2882                     if (pDevice->bBarkerPreambleMd) {
2883                         MACvEnableBarkerPreambleMd(pDevice);
2884                     } else {
2885                         MACvDisableBarkerPreambleMd(pDevice);
2886                     }
2887                 }
2888             }
2889             //DBG_PRN_WLAN05(("wCapInfo: %X\n", pCurr->wCapInfo));
2890             if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo) != pDevice->bShortSlotTime) {
2891                 if (pDevice->byBBType == BB_TYPE_11A) {
2892                     bShortSlotTime = TRUE;
2893                 }
2894                 else if (pDevice->byBBType == BB_TYPE_11B) {
2895                     bShortSlotTime = FALSE;
2896                 }
2897                 else {
2898                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo);
2899                 }
2900                 //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2901                 if (bShortSlotTime != pDevice->bShortSlotTime) {
2902                     pDevice->bShortSlotTime = bShortSlotTime;
2903                     BBvSetShortSlotTime(pDevice);
2904                     vUpdateIFS(pDevice);
2905                 }
2906             }
2907
2908             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"End of Join AP -- A/B/G Action\n");
2909         }
2910         else {
2911             pMgmt->eCurrState = WMAC_STATE_IDLE;
2912         };
2913
2914
2915      }
2916      else {
2917         // ad-hoc mode BSS
2918         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2919
2920             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2921 /*
2922                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2923                     // encryption mode error
2924                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2925                     return;
2926                 }
2927 */
2928             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2929 /*
2930                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2931                     // encryption mode error
2932                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2933                     return;
2934                 }
2935 */
2936             } else {
2937                 // encryption mode error
2938                 pMgmt->eCurrState = WMAC_STATE_IDLE;
2939                 return;
2940             }
2941         }
2942
2943         s_vMgrSynchBSS(pDevice,
2944                        WMAC_MODE_IBSS_STA,
2945                        pCurr,
2946                        pStatus
2947                        );
2948
2949         if (*pStatus == CMD_STATUS_SUCCESS){
2950             // Adopt this BSS state vars in Mgmt Object
2951             // TODO: check if CapInfo privacy on, but we don't..
2952             pMgmt->uCurrChannel = pCurr->uChannel;
2953
2954
2955             // Parse Support Rate IE
2956             pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2957             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2958                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2959                                                     WLAN_RATES_MAXLEN_11B);
2960             // set basic rate
2961             RATEvParseMaxRate((PVOID)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2962                               NULL, TRUE, &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2963                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2964             vUpdateIFS(pDevice);
2965             pMgmt->wCurrCapInfo = pCurr->wCapInfo;
2966             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2967             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2968             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2969             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2970 //          pMgmt->wCurrATIMWindow = pCurr->wATIMWindow;
2971             pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2972             pMgmt->eCurrState = WMAC_STATE_STARTED;
2973             // Adopt BSS state in Adapter Device Object
2974             pDevice->eOPMode = OP_MODE_ADHOC;
2975             pDevice->bLinkPass = TRUE;
2976             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2977             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2978
2979             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join IBSS ok:%02x-%02x-%02x-%02x-%02x-%02x \n",
2980                   pMgmt->abyCurrBSSID[0],
2981                   pMgmt->abyCurrBSSID[1],
2982                   pMgmt->abyCurrBSSID[2],
2983                   pMgmt->abyCurrBSSID[3],
2984                   pMgmt->abyCurrBSSID[4],
2985                   pMgmt->abyCurrBSSID[5]
2986                 );
2987             // Preamble type auto-switch: if AP can receive short-preamble cap,
2988             // and if registry setting is short preamble we can turn on too.
2989
2990             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2991                 pDevice->byPreambleType = pDevice->byShortPreamble;
2992             }
2993             else {
2994                 pDevice->byPreambleType = 0;
2995             }
2996             // Change PreambleType must set RSPINF again
2997             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2998
2999             // Prepare beacon
3000             bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt);
3001         }
3002         else {
3003             pMgmt->eCurrState = WMAC_STATE_IDLE;
3004         };
3005      };
3006     return;
3007 }
3008
3009
3010
3011 /*+
3012  *
3013  * Routine Description:
3014  * Set HW to synchronize a specific BSS from known BSS list.
3015  *
3016  *
3017  * Return Value:
3018  *    PCM_STATUS
3019  *
3020 -*/
3021 static
3022 VOID
3023 s_vMgrSynchBSS (
3024     IN PSDevice      pDevice,
3025     IN UINT          uBSSMode,
3026     IN PKnownBSS     pCurr,
3027     OUT PCMD_STATUS  pStatus
3028     )
3029 {
3030     PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
3031                                                      //1M,   2M,   5M,   11M,  18M,  24M,  36M,  54M
3032     BYTE abyCurrSuppRatesG[] = {WLAN_EID_SUPP_RATES, 8, 0x02, 0x04, 0x0B, 0x16, 0x24, 0x30, 0x48, 0x6C};
3033     BYTE abyCurrExtSuppRatesG[] = {WLAN_EID_EXTSUPP_RATES, 4, 0x0C, 0x12, 0x18, 0x60};
3034                                                            //6M,   9M,   12M,  48M
3035     BYTE abyCurrSuppRatesA[] = {WLAN_EID_SUPP_RATES, 8, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
3036     BYTE abyCurrSuppRatesB[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
3037
3038
3039     *pStatus = CMD_STATUS_FAILURE;
3040
3041     if (s_bCipherMatch(pCurr,
3042                        pDevice->eEncryptionStatus,
3043                        &(pMgmt->byCSSPK),
3044                        &(pMgmt->byCSSGK)) == FALSE) {
3045         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "s_bCipherMatch Fail .......\n");
3046         return;
3047     }
3048
3049     pMgmt->pCurrBSS = pCurr;
3050
3051     // if previous mode is IBSS.
3052     if(pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3053         MACvRegBitsOff(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
3054     }
3055
3056     // Init the BSS informations
3057     pDevice->bCCK = TRUE;
3058     pDevice->bProtectMode = FALSE;
3059     MACvDisableProtectMD(pDevice);
3060     pDevice->bBarkerPreambleMd = FALSE;
3061     MACvDisableBarkerPreambleMd(pDevice);
3062     pDevice->bNonERPPresent = FALSE;
3063     pDevice->byPreambleType = 0;
3064     pDevice->wBasicRate = 0;
3065     // Set Basic Rate
3066     CARDbAddBasicRate((PVOID)pDevice, RATE_1M);
3067
3068     // calculate TSF offset
3069     // TSF Offset = Received Timestamp TSF - Marked Local's TSF
3070     CARDvAdjustTSF(pDevice, pCurr->byRxRate, pCurr->qwBSSTimestamp, pCurr->qwLocalTSF);
3071
3072     // set HW beacon interval
3073     MACvWriteBeaconInterval(pDevice, pCurr->wBeaconInterval);
3074
3075     // set Next TBTT
3076     // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
3077     CARDvSetFirstNextTBTT(pDevice, pCurr->wBeaconInterval);
3078
3079     // set BSSID
3080     MACvWriteBSSIDAddress(pDevice, pCurr->abyBSSID);
3081
3082     MEMvCopy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, 6);
3083
3084     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = %02x-%02x-%02x=%02x-%02x-%02x\n",
3085         pMgmt->abyCurrBSSID[0],
3086         pMgmt->abyCurrBSSID[1],
3087         pMgmt->abyCurrBSSID[2],
3088         pMgmt->abyCurrBSSID[3],
3089         pMgmt->abyCurrBSSID[4],
3090         pMgmt->abyCurrBSSID[5]);
3091
3092     if (pCurr->eNetworkTypeInUse == PHY_TYPE_11A) {
3093         if ((pDevice->eConfigPHYMode == PHY_TYPE_11A) ||
3094             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3095             pDevice->byBBType = BB_TYPE_11A;
3096             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
3097             pDevice->bShortSlotTime = TRUE;
3098             BBvSetShortSlotTime(pDevice);
3099             CARDvSetBSSMode(pDevice);
3100         } else {
3101             return;
3102         }
3103     } else if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
3104         if ((pDevice->eConfigPHYMode == PHY_TYPE_11B) ||
3105             (pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
3106             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3107             pDevice->byBBType = BB_TYPE_11B;
3108             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
3109             pDevice->bShortSlotTime = FALSE;
3110             BBvSetShortSlotTime(pDevice);
3111             CARDvSetBSSMode(pDevice);
3112         } else {
3113             return;
3114         }
3115     } else {
3116         if ((pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
3117             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3118             pDevice->byBBType = BB_TYPE_11G;
3119             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
3120             pDevice->bShortSlotTime = TRUE;
3121             BBvSetShortSlotTime(pDevice);
3122             CARDvSetBSSMode(pDevice);
3123         } else if (pDevice->eConfigPHYMode == PHY_TYPE_11B) {
3124             pDevice->byBBType = BB_TYPE_11B;
3125             pDevice->bShortSlotTime = FALSE;
3126             BBvSetShortSlotTime(pDevice);
3127             CARDvSetBSSMode(pDevice);
3128         } else {
3129             return;
3130         }
3131     }
3132
3133     if (uBSSMode == WMAC_MODE_ESS_STA) {
3134         MACvRegBitsOff(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
3135         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
3136         pDevice->byRxMode |= RCR_BSSID;
3137         pMgmt->bCurrBSSIDFilterOn = TRUE;
3138     }
3139
3140     // set channel and clear NAV
3141     CARDbSetMediaChannel(pDevice, pCurr->uChannel);
3142     pMgmt->uCurrChannel = pCurr->uChannel;
3143     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "<----s_bSynchBSS Set Channel [%d]\n", pCurr->uChannel);
3144
3145     if ((pDevice->bUpdateBBVGA) &&
3146         (pDevice->byBBVGACurrent != pDevice->abyBBVGA[0])) {
3147         pDevice->byBBVGACurrent = pDevice->abyBBVGA[0];
3148         BBvSetVGAGainOffset(pDevice, pDevice->byBBVGACurrent);
3149         BBvSetShortSlotTime(pDevice);
3150     }
3151     //
3152     // Notes:
3153     // 1. In Ad-hoc mode : check if received others beacon as jointed indication,
3154     //    otherwise we will start own IBSS.
3155     // 2. In Infra mode : Supposed we already synchronized with AP right now.
3156
3157     if (uBSSMode == WMAC_MODE_IBSS_STA) {
3158         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
3159         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
3160         pDevice->byRxMode |= RCR_BSSID;
3161         pMgmt->bCurrBSSIDFilterOn = TRUE;
3162     };
3163
3164     if (pDevice->byBBType == BB_TYPE_11A) {
3165         MEMvCopy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesA[0], sizeof(abyCurrSuppRatesA));
3166         pMgmt->abyCurrExtSuppRates[1] = 0;
3167     } else if (pDevice->byBBType == BB_TYPE_11B) {
3168         MEMvCopy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesB[0], sizeof(abyCurrSuppRatesB));
3169         pMgmt->abyCurrExtSuppRates[1] = 0;
3170     } else {
3171         MEMvCopy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesG[0], sizeof(abyCurrSuppRatesG));
3172         MEMvCopy(pMgmt->abyCurrExtSuppRates, &abyCurrExtSuppRatesG[0], sizeof(abyCurrExtSuppRatesG));
3173     }
3174     pMgmt->byERPContext = pCurr->sERP.byERP;
3175
3176     *pStatus = CMD_STATUS_SUCCESS;
3177
3178     return;
3179 };
3180
3181
3182 //mike add: fix NetworkManager 0.7.0 hidden ssid mode in WPA encryption
3183 //                   ,need reset eAuthenMode and eEncryptionStatus
3184  static VOID  Encyption_Rebuild(
3185     IN PSDevice pDevice,
3186     IN PKnownBSS pCurr
3187  )
3188  {
3189   PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
3190  // UINT            ii , uSameBssidNum=0;
3191
3192         //  for (ii = 0; ii < MAX_BSS_NUM; ii++) {
3193           //   if (pMgmt->sBSSList[ii].bActive &&
3194             //      IS_ETH_ADDRESS_EQUAL(pMgmt->sBSSList[ii].abyBSSID, pCurr->abyBSSID)) {
3195              //       uSameBssidNum++;
3196                //   }
3197            // }
3198   //   if( uSameBssidNum>=2) {   //we only check AP in hidden sssid  mode
3199         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||           //networkmanager 0.7.0 does not give the pairwise-key selsection,
3200              (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {         // so we need re-selsect it according to real pairwise-key info.
3201                if(pCurr->bWPAValid == TRUE)  {   //WPA-PSK
3202                           pMgmt->eAuthenMode = WMAC_AUTH_WPAPSK;
3203                     if(pCurr->abyPKType[0] == WPA_TKIP) {
3204                         pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;    //TKIP
3205                         PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-TKIP]\n");
3206                       }
3207                    else if(pCurr->abyPKType[0] == WPA_AESCCMP) {
3208                         pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3209                           PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-AES]\n");
3210                      }
3211                 }
3212                else if(pCurr->bWPA2Valid == TRUE) {  //WPA2-PSK
3213                          pMgmt->eAuthenMode = WMAC_AUTH_WPA2PSK;
3214                        if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_TKIP) {
3215                            pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;     //TKIP
3216                              PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-TKIP]\n");
3217                         }
3218                        else if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_CCMP) {
3219                            pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3220                             PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-AES]\n");
3221                         }
3222                 }
3223               }
3224         //  }
3225       return;
3226  }
3227
3228
3229 /*+
3230  *
3231  * Routine Description:
3232  *  Format TIM field
3233  *
3234  *
3235  * Return Value:
3236  *    VOID
3237  *
3238 -*/
3239
3240 static
3241 VOID
3242 s_vMgrFormatTIM(
3243     IN PSMgmtObject pMgmt,
3244     IN PWLAN_IE_TIM pTIM
3245     )
3246 {
3247     BYTE        byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
3248     BYTE        byMap;
3249     UINT        ii, jj;
3250     BOOL        bStartFound = FALSE;
3251     BOOL        bMulticast = FALSE;
3252     WORD        wStartIndex = 0;
3253     WORD        wEndIndex = 0;
3254
3255
3256     // Find size of partial virtual bitmap
3257     for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
3258         byMap = pMgmt->abyPSTxMap[ii];
3259         if (!ii) {
3260             // Mask out the broadcast bit which is indicated separately.
3261             bMulticast = (byMap & byMask[0]) != 0;
3262             if(bMulticast) {
3263                pMgmt->sNodeDBTable[0].bRxPSPoll = TRUE;
3264             }
3265             byMap = 0;
3266         }
3267         if (byMap) {
3268             if (!bStartFound) {
3269                 bStartFound = TRUE;
3270                 wStartIndex = (WORD)ii;
3271             }
3272             wEndIndex = (WORD)ii;
3273         }
3274     };
3275
3276
3277     // Round start index down to nearest even number
3278     wStartIndex &=  ~BIT0;
3279
3280     // Round end index up to nearest even number
3281     wEndIndex = ((wEndIndex + 1) & ~BIT0);
3282
3283     // Size of element payload
3284
3285     pTIM->len =  3 + (wEndIndex - wStartIndex) + 1;
3286
3287     // Fill in the Fixed parts of the TIM
3288     pTIM->byDTIMCount = pMgmt->byDTIMCount;
3289     pTIM->byDTIMPeriod = pMgmt->byDTIMPeriod;
3290     pTIM->byBitMapCtl = (bMulticast ? TIM_MULTICAST_MASK : 0) |
3291         (((wStartIndex >> 1) << 1) & TIM_BITMAPOFFSET_MASK);
3292
3293     // Append variable part of TIM
3294
3295     for (ii = wStartIndex, jj =0 ; ii <= wEndIndex; ii++, jj++) {
3296          pTIM->byVirtBitMap[jj] = pMgmt->abyPSTxMap[ii];
3297     }
3298
3299     // Aid = 0 don't used.
3300     pTIM->byVirtBitMap[0]  &= ~BIT0;
3301 }
3302
3303
3304 /*+
3305  *
3306  * Routine Description:
3307  *  Constructs an Beacon frame( Ad-hoc mode)
3308  *
3309  *
3310  * Return Value:
3311  *    PTR to frame; or NULL on allocation failue
3312  *
3313 -*/
3314
3315 static
3316 PSTxMgmtPacket
3317 s_MgrMakeBeacon(
3318     IN PSDevice pDevice,
3319     IN PSMgmtObject pMgmt,
3320     IN WORD wCurrCapInfo,
3321     IN WORD wCurrBeaconPeriod,
3322     IN UINT uCurrChannel,
3323     IN WORD wCurrATIMWinodw,
3324     IN PWLAN_IE_SSID pCurrSSID,
3325     IN PBYTE pCurrBSSID,
3326     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
3327     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3328     )
3329 {
3330     PSTxMgmtPacket      pTxPacket = NULL;
3331     WLAN_FR_BEACON      sFrame;
3332     BYTE                abyBroadcastAddr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
3333
3334
3335     // prepare beacon frame
3336     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3337     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_BEACON_FR_MAXLEN);
3338     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3339     // Setup the sFrame structure.
3340     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3341     sFrame.len = WLAN_BEACON_FR_MAXLEN;
3342     vMgrEncodeBeacon(&sFrame);
3343     // Setup the header
3344     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3345         (
3346         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3347         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_BEACON)
3348         ));
3349
3350     if (pDevice->bEnablePSMode) {
3351         sFrame.pHdr->sA3.wFrameCtl |= cpu_to_le16((WORD)WLAN_SET_FC_PWRMGT(1));
3352     }
3353
3354     memcpy( sFrame.pHdr->sA3.abyAddr1, abyBroadcastAddr, WLAN_ADDR_LEN);
3355     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3356     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3357     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3358     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3359     // Copy SSID
3360     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3361     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3362     memcpy(sFrame.pSSID,
3363              pCurrSSID,
3364              ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3365             );
3366     // Copy the rate set
3367     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3368     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3369     memcpy(sFrame.pSuppRates,
3370            pCurrSuppRates,
3371            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3372           );
3373     // DS parameter
3374     if (pDevice->byBBType != BB_TYPE_11A) {
3375         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3376         sFrame.len += (1) + WLAN_IEHDR_LEN;
3377         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3378         sFrame.pDSParms->len = 1;
3379         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3380     }
3381     // TIM field
3382     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
3383         sFrame.pTIM = (PWLAN_IE_TIM)(sFrame.pBuf + sFrame.len);
3384         sFrame.pTIM->byElementID = WLAN_EID_TIM;
3385         s_vMgrFormatTIM(pMgmt, sFrame.pTIM);
3386         sFrame.len += (WLAN_IEHDR_LEN + sFrame.pTIM->len);
3387     }
3388
3389     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3390
3391         // IBSS parameter
3392         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3393         sFrame.len += (2) + WLAN_IEHDR_LEN;
3394         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3395         sFrame.pIBSSParms->len = 2;
3396         sFrame.pIBSSParms->wATIMWindow = wCurrATIMWinodw;
3397         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3398             /* RSN parameter */
3399             sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3400             sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3401             sFrame.pRSNWPA->len = 12;
3402             sFrame.pRSNWPA->abyOUI[0] = 0x00;
3403             sFrame.pRSNWPA->abyOUI[1] = 0x50;
3404             sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3405             sFrame.pRSNWPA->abyOUI[3] = 0x01;
3406             sFrame.pRSNWPA->wVersion = 1;
3407             sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3408             sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3409             sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3410             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled)
3411                 sFrame.pRSNWPA->abyMulticast[3] = 0x04;//AES
3412             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled)
3413                 sFrame.pRSNWPA->abyMulticast[3] = 0x02;//TKIP
3414             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled)
3415                 sFrame.pRSNWPA->abyMulticast[3] = 0x01;//WEP40
3416             else
3417                 sFrame.pRSNWPA->abyMulticast[3] = 0x00;//NONE
3418
3419             // Pairwise Key Cipher Suite
3420             sFrame.pRSNWPA->wPKCount = 0;
3421             // Auth Key Management Suite
3422             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3423             sFrame.pRSNWPA->len +=2;
3424
3425             // RSN Capabilites
3426             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3427             sFrame.pRSNWPA->len +=2;
3428             sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3429         }
3430     }
3431
3432
3433     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
3434         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3435         sFrame.len += 1 + WLAN_IEHDR_LEN;
3436         sFrame.pERP->byElementID = WLAN_EID_ERP;
3437         sFrame.pERP->len = 1;
3438         sFrame.pERP->byContext = 0;
3439         if (pDevice->bProtectMode == TRUE)
3440             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3441         if (pDevice->bNonERPPresent == TRUE)
3442             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3443         if (pDevice->bBarkerPreambleMd == TRUE)
3444             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3445     }
3446     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3447         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3448         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3449         MEMvCopy(sFrame.pExtSuppRates,
3450              pCurrExtSuppRates,
3451              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3452              );
3453     }
3454     // hostapd wpa/wpa2 IE
3455     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3456          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3457              if (pMgmt->wWPAIELen != 0) {
3458                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3459                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3460                  sFrame.len += pMgmt->wWPAIELen;
3461              }
3462          }
3463     }
3464
3465     /* Adjust the length fields */
3466     pTxPacket->cbMPDULen = sFrame.len;
3467     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3468
3469     return pTxPacket;
3470 }
3471
3472
3473
3474
3475
3476 /*+
3477  *
3478  * Routine Description:
3479  *  Constructs an Prob-response frame
3480  *
3481  *
3482  * Return Value:
3483  *    PTR to frame; or NULL on allocation failue
3484  *
3485 -*/
3486
3487
3488
3489
3490 PSTxMgmtPacket
3491 s_MgrMakeProbeResponse(
3492     IN PSDevice pDevice,
3493     IN PSMgmtObject pMgmt,
3494     IN WORD wCurrCapInfo,
3495     IN WORD wCurrBeaconPeriod,
3496     IN UINT uCurrChannel,
3497     IN WORD wCurrATIMWinodw,
3498     IN PBYTE pDstAddr,
3499     IN PWLAN_IE_SSID pCurrSSID,
3500     IN PBYTE pCurrBSSID,
3501     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
3502     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
3503     IN BYTE byPHYType
3504     )
3505 {
3506     PSTxMgmtPacket      pTxPacket = NULL;
3507     WLAN_FR_PROBERESP   sFrame;
3508
3509
3510
3511     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3512     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_PROBERESP_FR_MAXLEN);
3513     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3514     // Setup the sFrame structure.
3515     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3516     sFrame.len = WLAN_PROBERESP_FR_MAXLEN;
3517     vMgrEncodeProbeResponse(&sFrame);
3518     // Setup the header
3519     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3520         (
3521         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3522         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_PROBERESP)
3523         ));
3524     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3525     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3526     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3527     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3528     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3529
3530     if (byPHYType == BB_TYPE_11B) {
3531         *sFrame.pwCapInfo &= cpu_to_le16((WORD)~(WLAN_SET_CAP_INFO_SHORTSLOTTIME(1)));
3532     }
3533
3534     // Copy SSID
3535     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3536     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3537     memcpy(sFrame.pSSID,
3538            pCurrSSID,
3539            ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3540            );
3541     // Copy the rate set
3542     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3543
3544     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3545     memcpy(sFrame.pSuppRates,
3546            pCurrSuppRates,
3547            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3548           );
3549
3550     // DS parameter
3551     if (pDevice->byBBType != BB_TYPE_11A) {
3552         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3553         sFrame.len += (1) + WLAN_IEHDR_LEN;
3554         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3555         sFrame.pDSParms->len = 1;
3556         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3557     }
3558
3559     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3560         // IBSS parameter
3561         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3562         sFrame.len += (2) + WLAN_IEHDR_LEN;
3563         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3564         sFrame.pIBSSParms->len = 2;
3565         sFrame.pIBSSParms->wATIMWindow = 0;
3566     }
3567     if (pDevice->byBBType == BB_TYPE_11G) {
3568         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3569         sFrame.len += 1 + WLAN_IEHDR_LEN;
3570         sFrame.pERP->byElementID = WLAN_EID_ERP;
3571         sFrame.pERP->len = 1;
3572         sFrame.pERP->byContext = 0;
3573         if (pDevice->bProtectMode == TRUE)
3574             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3575         if (pDevice->bNonERPPresent == TRUE)
3576             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3577         if (pDevice->bBarkerPreambleMd == TRUE)
3578             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3579     }
3580
3581     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3582         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3583         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3584         MEMvCopy(sFrame.pExtSuppRates,
3585              pCurrExtSuppRates,
3586              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3587              );
3588     }
3589
3590     // hostapd wpa/wpa2 IE
3591     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3592          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3593              if (pMgmt->wWPAIELen != 0) {
3594                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3595                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3596                  sFrame.len += pMgmt->wWPAIELen;
3597              }
3598          }
3599     }
3600
3601     // Adjust the length fields
3602     pTxPacket->cbMPDULen = sFrame.len;
3603     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3604
3605     return pTxPacket;
3606 }
3607
3608
3609
3610 /*+
3611  *
3612  * Routine Description:
3613  *  Constructs an association request frame
3614  *
3615  *
3616  * Return Value:
3617  *    A ptr to frame or NULL on allocation failue
3618  *
3619 -*/
3620
3621
3622 PSTxMgmtPacket
3623 s_MgrMakeAssocRequest(
3624     IN PSDevice pDevice,
3625     IN PSMgmtObject pMgmt,
3626     IN PBYTE pDAddr,
3627     IN WORD wCurrCapInfo,
3628     IN WORD wListenInterval,
3629     IN PWLAN_IE_SSID pCurrSSID,
3630     IN PWLAN_IE_SUPP_RATES pCurrRates,
3631     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3632     )
3633 {
3634     PSTxMgmtPacket      pTxPacket = NULL;
3635     WLAN_FR_ASSOCREQ    sFrame;
3636     PBYTE               pbyIEs;
3637     PBYTE               pbyRSN;
3638
3639
3640     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3641     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3642     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3643     // Setup the sFrame structure.
3644     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3645     sFrame.len = WLAN_ASSOCREQ_FR_MAXLEN;
3646     // format fixed field frame structure
3647     vMgrEncodeAssocRequest(&sFrame);
3648     // Setup the header
3649     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3650         (
3651         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3652         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCREQ)
3653         ));
3654     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3655     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3656     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3657
3658     // Set the capibility and listen interval
3659     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3660     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3661
3662     // sFrame.len point to end of fixed field
3663     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3664     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3665     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3666
3667     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3668     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3669     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3670     MEMvCopy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3671     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3672
3673     // Copy the rate set
3674     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3675     if ((pDevice->byBBType == BB_TYPE_11B) && (pCurrRates->len > 4))
3676         sFrame.len += 4 + WLAN_IEHDR_LEN;
3677     else
3678         sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3679     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3680
3681     // Copy the extension rate set
3682     if ((pDevice->byBBType == BB_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3683         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3684         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3685         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3686     }
3687
3688     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3689     MEMvCopy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3690     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3691
3692
3693     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3694          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3695          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3696         (pMgmt->pCurrBSS != NULL)) {
3697         /* WPA IE */
3698         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3699         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3700         sFrame.pRSNWPA->len = 16;
3701         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3702         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3703         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3704         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3705         sFrame.pRSNWPA->wVersion = 1;
3706         //Group Key Cipher Suite
3707         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3708         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3709         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3710         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3711             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3712         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3713             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3714         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3715             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3716         } else {
3717             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3718         }
3719         // Pairwise Key Cipher Suite
3720         sFrame.pRSNWPA->wPKCount = 1;
3721         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3722         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3723         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3724         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3725             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3726         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3727             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3728         } else {
3729             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3730         }
3731         // Auth Key Management Suite
3732         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3733         *pbyRSN++=0x01;
3734         *pbyRSN++=0x00;
3735         *pbyRSN++=0x00;
3736
3737         *pbyRSN++=0x50;
3738         *pbyRSN++=0xf2;
3739         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3740             *pbyRSN++=WPA_AUTH_PSK;
3741         }
3742         else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3743             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3744         }
3745         else {
3746             *pbyRSN++=WPA_NONE;
3747         }
3748
3749         sFrame.pRSNWPA->len +=6;
3750
3751         // RSN Capabilites
3752
3753         *pbyRSN++=0x00;
3754         *pbyRSN++=0x00;
3755         sFrame.pRSNWPA->len +=2;
3756
3757         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3758         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3759         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3760         MEMvCopy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3761         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3762
3763     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3764                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3765                (pMgmt->pCurrBSS != NULL)) {
3766         UINT                ii;
3767         PWORD               pwPMKID;
3768
3769         // WPA IE
3770         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3771         sFrame.pRSN->byElementID = WLAN_EID_RSN;
3772         sFrame.pRSN->len = 6; //Version(2)+GK(4)
3773         sFrame.pRSN->wVersion = 1;
3774         //Group Key Cipher Suite
3775         sFrame.pRSN->abyRSN[0] = 0x00;
3776         sFrame.pRSN->abyRSN[1] = 0x0F;
3777         sFrame.pRSN->abyRSN[2] = 0xAC;
3778         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3779             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3780         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3781             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3782         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3783             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3784         } else {
3785             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3786         }
3787
3788         // Pairwise Key Cipher Suite
3789         sFrame.pRSN->abyRSN[4] = 1;
3790         sFrame.pRSN->abyRSN[5] = 0;
3791         sFrame.pRSN->abyRSN[6] = 0x00;
3792         sFrame.pRSN->abyRSN[7] = 0x0F;
3793         sFrame.pRSN->abyRSN[8] = 0xAC;
3794         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3795             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3796         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3797             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3798         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3799             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3800         } else {
3801             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3802         }
3803         sFrame.pRSN->len += 6;
3804
3805         // Auth Key Management Suite
3806         sFrame.pRSN->abyRSN[10] = 1;
3807         sFrame.pRSN->abyRSN[11] = 0;
3808         sFrame.pRSN->abyRSN[12] = 0x00;
3809         sFrame.pRSN->abyRSN[13] = 0x0F;
3810         sFrame.pRSN->abyRSN[14] = 0xAC;
3811         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3812             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3813         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3814             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3815         } else {
3816             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3817         }
3818         sFrame.pRSN->len +=6;
3819
3820         // RSN Capabilites
3821         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
3822             MEMvCopy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3823         } else {
3824             sFrame.pRSN->abyRSN[16] = 0;
3825             sFrame.pRSN->abyRSN[17] = 0;
3826         }
3827         sFrame.pRSN->len +=2;
3828
3829         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3830             // RSN PMKID
3831             pbyRSN = &sFrame.pRSN->abyRSN[18];
3832             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
3833             *pwPMKID = 0;            // Initialize PMKID count
3834             pbyRSN += 2;             // Point to PMKID list
3835             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3836                 if (MEMEqualMemory(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, U_ETHER_ADDR_LEN)) {
3837                     (*pwPMKID) ++;
3838                     MEMvCopy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
3839                     pbyRSN += 16;
3840                 }
3841             }
3842             if (*pwPMKID != 0) {
3843                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
3844             }
3845         }
3846
3847         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3848         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3849         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3850         MEMvCopy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3851         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3852     }
3853
3854
3855     // Adjust the length fields
3856     pTxPacket->cbMPDULen = sFrame.len;
3857     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3858     return pTxPacket;
3859 }
3860
3861
3862
3863
3864
3865
3866
3867
3868 /*+
3869  *
3870  * Routine Description:
3871  *  Constructs an re-association request frame
3872  *
3873  *
3874  * Return Value:
3875  *    A ptr to frame or NULL on allocation failue
3876  *
3877 -*/
3878
3879
3880 PSTxMgmtPacket
3881 s_MgrMakeReAssocRequest(
3882     IN PSDevice pDevice,
3883     IN PSMgmtObject pMgmt,
3884     IN PBYTE pDAddr,
3885     IN WORD wCurrCapInfo,
3886     IN WORD wListenInterval,
3887     IN PWLAN_IE_SSID pCurrSSID,
3888     IN PWLAN_IE_SUPP_RATES pCurrRates,
3889     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3890     )
3891 {
3892     PSTxMgmtPacket      pTxPacket = NULL;
3893     WLAN_FR_REASSOCREQ  sFrame;
3894     PBYTE               pbyIEs;
3895     PBYTE               pbyRSN;
3896
3897
3898     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3899     memset( pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_REASSOCREQ_FR_MAXLEN);
3900     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3901     /* Setup the sFrame structure. */
3902     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3903     sFrame.len = WLAN_REASSOCREQ_FR_MAXLEN;
3904
3905     // format fixed field frame structure
3906     vMgrEncodeReassocRequest(&sFrame);
3907
3908     /* Setup the header */
3909     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3910         (
3911         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3912         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCREQ)
3913         ));
3914     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3915     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3916     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3917
3918     /* Set the capibility and listen interval */
3919     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3920     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3921
3922     memcpy(sFrame.pAddrCurrAP, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3923     /* Copy the SSID */
3924     /* sFrame.len point to end of fixed field */
3925     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3926     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3927     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3928
3929     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3930     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3931     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3932     MEMvCopy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3933     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3934
3935     /* Copy the rate set */
3936     /* sFrame.len point to end of SSID */
3937     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3938     sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3939     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3940
3941     // Copy the extension rate set
3942     if ((pMgmt->eCurrentPHYMode == PHY_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3943         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3944         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3945         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3946     }
3947
3948     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3949     MEMvCopy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3950     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3951
3952     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3953          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3954          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3955         (pMgmt->pCurrBSS != NULL)) {
3956         /* WPA IE */
3957         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3958         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3959         sFrame.pRSNWPA->len = 16;
3960         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3961         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3962         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3963         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3964         sFrame.pRSNWPA->wVersion = 1;
3965         //Group Key Cipher Suite
3966         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3967         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3968         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3969         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3970             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3971         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3972             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3973         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3974             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3975         } else {
3976             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3977         }
3978         // Pairwise Key Cipher Suite
3979         sFrame.pRSNWPA->wPKCount = 1;
3980         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3981         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3982         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3983         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3984             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3985         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3986             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3987         } else {
3988             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3989         }
3990         // Auth Key Management Suite
3991         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3992         *pbyRSN++=0x01;
3993         *pbyRSN++=0x00;
3994         *pbyRSN++=0x00;
3995
3996         *pbyRSN++=0x50;
3997         *pbyRSN++=0xf2;
3998         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3999             *pbyRSN++=WPA_AUTH_PSK;
4000         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
4001             *pbyRSN++=WPA_AUTH_IEEE802_1X;
4002         } else {
4003             *pbyRSN++=WPA_NONE;
4004         }
4005
4006         sFrame.pRSNWPA->len +=6;
4007
4008         // RSN Capabilites
4009         *pbyRSN++=0x00;
4010         *pbyRSN++=0x00;
4011         sFrame.pRSNWPA->len +=2;
4012
4013         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
4014         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
4015         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
4016         MEMvCopy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
4017         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
4018
4019     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
4020                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
4021                (pMgmt->pCurrBSS != NULL)) {
4022         UINT                ii;
4023         PWORD               pwPMKID;
4024
4025         /* WPA IE */
4026         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
4027         sFrame.pRSN->byElementID = WLAN_EID_RSN;
4028         sFrame.pRSN->len = 6; //Version(2)+GK(4)
4029         sFrame.pRSN->wVersion = 1;
4030         //Group Key Cipher Suite
4031         sFrame.pRSN->abyRSN[0] = 0x00;
4032         sFrame.pRSN->abyRSN[1] = 0x0F;
4033         sFrame.pRSN->abyRSN[2] = 0xAC;
4034         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
4035             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
4036         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
4037             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
4038         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
4039             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
4040         } else {
4041             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
4042         }
4043
4044         // Pairwise Key Cipher Suite
4045         sFrame.pRSN->abyRSN[4] = 1;
4046         sFrame.pRSN->abyRSN[5] = 0;
4047         sFrame.pRSN->abyRSN[6] = 0x00;
4048         sFrame.pRSN->abyRSN[7] = 0x0F;
4049         sFrame.pRSN->abyRSN[8] = 0xAC;
4050         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
4051             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
4052         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
4053             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
4054         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
4055             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
4056         } else {
4057             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
4058         }
4059         sFrame.pRSN->len += 6;
4060
4061         // Auth Key Management Suite
4062         sFrame.pRSN->abyRSN[10] = 1;
4063         sFrame.pRSN->abyRSN[11] = 0;
4064         sFrame.pRSN->abyRSN[12] = 0x00;
4065         sFrame.pRSN->abyRSN[13] = 0x0F;
4066         sFrame.pRSN->abyRSN[14] = 0xAC;
4067         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
4068             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
4069         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
4070             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
4071         } else {
4072             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
4073         }
4074         sFrame.pRSN->len +=6;
4075
4076         // RSN Capabilites
4077         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
4078             MEMvCopy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
4079         } else {
4080             sFrame.pRSN->abyRSN[16] = 0;
4081             sFrame.pRSN->abyRSN[17] = 0;
4082         }
4083         sFrame.pRSN->len +=2;
4084
4085         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
4086             // RSN PMKID
4087             pbyRSN = &sFrame.pRSN->abyRSN[18];
4088             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
4089             *pwPMKID = 0;            // Initialize PMKID count
4090             pbyRSN += 2;             // Point to PMKID list
4091             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
4092                 if (MEMEqualMemory(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, U_ETHER_ADDR_LEN)) {
4093                     (*pwPMKID) ++;
4094                     MEMvCopy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
4095                     pbyRSN += 16;
4096                 }
4097             }
4098             if (*pwPMKID != 0) {
4099                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
4100             }
4101         }
4102
4103         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4104         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
4105         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4106         MEMvCopy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
4107         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4108     }
4109
4110
4111
4112     /* Adjust the length fields */
4113     pTxPacket->cbMPDULen = sFrame.len;
4114     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4115
4116     return pTxPacket;
4117 }
4118
4119
4120
4121 /*+
4122  *
4123  * Routine Description:
4124  *  Constructs an assoc-response frame
4125  *
4126  *
4127  * Return Value:
4128  *    PTR to frame; or NULL on allocation failue
4129  *
4130 -*/
4131
4132
4133 PSTxMgmtPacket
4134 s_MgrMakeAssocResponse(
4135     IN PSDevice pDevice,
4136     IN PSMgmtObject pMgmt,
4137     IN WORD wCurrCapInfo,
4138     IN WORD wAssocStatus,
4139     IN WORD wAssocAID,
4140     IN PBYTE pDstAddr,
4141     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
4142     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4143     )
4144 {
4145     PSTxMgmtPacket      pTxPacket = NULL;
4146     WLAN_FR_ASSOCRESP   sFrame;
4147
4148
4149     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4150     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4151     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4152     // Setup the sFrame structure
4153     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4154     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4155     vMgrEncodeAssocResponse(&sFrame);
4156     // Setup the header
4157     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4158         (
4159         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4160         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCRESP)
4161         ));
4162     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4163     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4164     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4165
4166     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4167     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4168     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4169
4170     // Copy the rate set
4171     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4172     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4173     memcpy(sFrame.pSuppRates,
4174            pCurrSuppRates,
4175            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4176           );
4177
4178     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4179         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4180         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4181         MEMvCopy(sFrame.pExtSuppRates,
4182              pCurrExtSuppRates,
4183              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4184              );
4185     }
4186
4187     // Adjust the length fields
4188     pTxPacket->cbMPDULen = sFrame.len;
4189     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4190
4191     return pTxPacket;
4192 }
4193
4194
4195 /*+
4196  *
4197  * Routine Description:
4198  *  Constructs an reassoc-response frame
4199  *
4200  *
4201  * Return Value:
4202  *    PTR to frame; or NULL on allocation failue
4203  *
4204 -*/
4205
4206
4207 PSTxMgmtPacket
4208 s_MgrMakeReAssocResponse(
4209     IN PSDevice pDevice,
4210     IN PSMgmtObject pMgmt,
4211     IN WORD wCurrCapInfo,
4212     IN WORD wAssocStatus,
4213     IN WORD wAssocAID,
4214     IN PBYTE pDstAddr,
4215     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
4216     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4217     )
4218 {
4219     PSTxMgmtPacket      pTxPacket = NULL;
4220     WLAN_FR_REASSOCRESP   sFrame;
4221
4222
4223     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4224     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4225     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4226     // Setup the sFrame structure
4227     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4228     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4229     vMgrEncodeReassocResponse(&sFrame);
4230     // Setup the header
4231     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4232         (
4233         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4234         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCRESP)
4235         ));
4236     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4237     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4238     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4239
4240     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4241     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4242     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4243
4244     // Copy the rate set
4245     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4246     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4247     memcpy(sFrame.pSuppRates,
4248              pCurrSuppRates,
4249              ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4250              );
4251
4252     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4253         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4254         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4255         MEMvCopy(sFrame.pExtSuppRates,
4256              pCurrExtSuppRates,
4257              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4258              );
4259     }
4260
4261     // Adjust the length fields
4262     pTxPacket->cbMPDULen = sFrame.len;
4263     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4264
4265     return pTxPacket;
4266 }
4267
4268
4269 /*+
4270  *
4271  * Routine Description:
4272  *  Handles probe response management frames.
4273  *
4274  *
4275  * Return Value:
4276  *    none.
4277  *
4278 -*/
4279
4280 static
4281 VOID
4282 s_vMgrRxProbeResponse(
4283     IN PSDevice pDevice,
4284     IN PSMgmtObject pMgmt,
4285     IN PSRxMgmtPacket pRxPacket
4286     )
4287 {
4288     PKnownBSS           pBSSList = NULL;
4289     WLAN_FR_PROBERESP   sFrame;
4290     BYTE                byCurrChannel = pRxPacket->byRxChannel;
4291     ERPObject           sERP;
4292     BOOL                bChannelHit = TRUE;
4293
4294
4295     memset(&sFrame, 0, sizeof(WLAN_FR_PROBERESP));
4296     // decode the frame
4297     sFrame.len = pRxPacket->cbMPDULen;
4298     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4299     vMgrDecodeProbeResponse(&sFrame);
4300
4301     if ((sFrame.pqwTimestamp == 0) ||
4302         (sFrame.pwBeaconInterval == 0) ||
4303         (sFrame.pwCapInfo == 0) ||
4304         (sFrame.pSSID == 0) ||
4305         (sFrame.pSuppRates == 0)) {
4306         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe resp:Fail addr:[%p] \n", pRxPacket->p80211Header);
4307         DBG_PORT80(0xCC);
4308         return;
4309     };
4310
4311     if(sFrame.pSSID->len == 0)
4312        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx Probe resp: SSID len = 0 \n");
4313
4314
4315     //{{ RobertYu:20050201, 11a  byCurrChannel != sFrame.pDSParms->byCurrChannel mapping
4316     if( byCurrChannel > CB_MAX_CHANNEL_24G )
4317     {
4318         if (sFrame.pDSParms != 0) {
4319             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
4320                 bChannelHit = TRUE;
4321             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
4322         } else {
4323             bChannelHit = TRUE;
4324         }
4325
4326     } else {
4327         if (sFrame.pDSParms != 0) {
4328             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
4329                 bChannelHit = TRUE;
4330             byCurrChannel = sFrame.pDSParms->byCurrChannel;
4331         } else {
4332             bChannelHit = TRUE;
4333         }
4334     }
4335     //RobertYu:20050201
4336
4337 //2008-0730-01<Add>by MikeLiu
4338 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
4339       return;
4340
4341     if (sFrame.pERP != NULL) {
4342         sERP.byERP = sFrame.pERP->byContext;
4343         sERP.bERPExist = TRUE;
4344     } else {
4345         sERP.bERPExist = FALSE;
4346         sERP.byERP = 0;
4347     }
4348
4349
4350     // update or insert the bss
4351     pBSSList = BSSpAddrIsInBSSList((HANDLE)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
4352     if (pBSSList) {
4353         BSSbUpdateToBSSList((HANDLE)pDevice,
4354                             *sFrame.pqwTimestamp,
4355                             *sFrame.pwBeaconInterval,
4356                             *sFrame.pwCapInfo,
4357                             byCurrChannel,
4358                             bChannelHit,
4359                             sFrame.pSSID,
4360                             sFrame.pSuppRates,
4361                             sFrame.pExtSuppRates,
4362                             &sERP,
4363                             sFrame.pRSN,
4364                             sFrame.pRSNWPA,
4365                             sFrame.pIE_Country,
4366                             sFrame.pIE_Quiet,
4367                             pBSSList,
4368                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4369                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
4370                             (HANDLE)pRxPacket
4371                            );
4372     }
4373     else {
4374         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Probe resp/insert: RxChannel = : %d\n", byCurrChannel);
4375         BSSbInsertToBSSList((HANDLE)pDevice,
4376                             sFrame.pHdr->sA3.abyAddr3,
4377                             *sFrame.pqwTimestamp,
4378                             *sFrame.pwBeaconInterval,
4379                             *sFrame.pwCapInfo,
4380                             byCurrChannel,
4381                             sFrame.pSSID,
4382                             sFrame.pSuppRates,
4383                             sFrame.pExtSuppRates,
4384                             &sERP,
4385                             sFrame.pRSN,
4386                             sFrame.pRSNWPA,
4387                             sFrame.pIE_Country,
4388                             sFrame.pIE_Quiet,
4389                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4390                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
4391                             (HANDLE)pRxPacket
4392                            );
4393     }
4394     return;
4395
4396 }
4397
4398 /*+
4399  *
4400  * Routine Description:(AP)or(Ad-hoc STA)
4401  *  Handles probe request management frames.
4402  *
4403  *
4404  * Return Value:
4405  *    none.
4406  *
4407 -*/
4408
4409
4410 static
4411 VOID
4412 s_vMgrRxProbeRequest(
4413     IN PSDevice pDevice,
4414     IN PSMgmtObject pMgmt,
4415     IN PSRxMgmtPacket pRxPacket
4416     )
4417 {
4418     WLAN_FR_PROBEREQ    sFrame;
4419     CMD_STATUS          Status;
4420     PSTxMgmtPacket      pTxPacket;
4421     BYTE                byPHYType = BB_TYPE_11B;
4422
4423     // STA in Ad-hoc mode: when latest TBTT beacon transmit success,
4424     // STA have to response this request.
4425     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
4426         ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && pDevice->bBeaconSent)) {
4427
4428         memset(&sFrame, 0, sizeof(WLAN_FR_PROBEREQ));
4429         // decode the frame
4430         sFrame.len = pRxPacket->cbMPDULen;
4431         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4432         vMgrDecodeProbeRequest(&sFrame);
4433 /*
4434         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%02x-%02x-%02x=%02x-%02x-%02x \n",
4435                   sFrame.pHdr->sA3.abyAddr2[0],
4436                   sFrame.pHdr->sA3.abyAddr2[1],
4437                   sFrame.pHdr->sA3.abyAddr2[2],
4438                   sFrame.pHdr->sA3.abyAddr2[3],
4439                   sFrame.pHdr->sA3.abyAddr2[4],
4440                   sFrame.pHdr->sA3.abyAddr2[5]
4441                 );
4442 */
4443         if (sFrame.pSSID->len != 0) {
4444             if (sFrame.pSSID->len != ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len)
4445                 return;
4446             if (memcmp(sFrame.pSSID->abySSID,
4447                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
4448                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) != 0) {
4449                        return;
4450             }
4451         }
4452
4453         if ((sFrame.pSuppRates->len > 4) || (sFrame.pExtSuppRates != NULL)) {
4454             byPHYType = BB_TYPE_11G;
4455         }
4456
4457         // Probe response reply..
4458         pTxPacket = s_MgrMakeProbeResponse
4459                     (
4460                       pDevice,
4461                       pMgmt,
4462                       pMgmt->wCurrCapInfo,
4463                       pMgmt->wCurrBeaconPeriod,
4464                       pMgmt->uCurrChannel,
4465                       0,
4466                       sFrame.pHdr->sA3.abyAddr2,
4467                       (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4468                       (PBYTE)pMgmt->abyCurrBSSID,
4469                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4470                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
4471                        byPHYType
4472                     );
4473         if (pTxPacket != NULL ){
4474             /* send the frame */
4475             Status = csMgmt_xmit(pDevice, pTxPacket);
4476             if (Status != CMD_STATUS_PENDING) {
4477                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx failed\n");
4478             }
4479             else {
4480 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx sending..\n");
4481             }
4482         }
4483     }
4484
4485     return;
4486 }
4487
4488
4489
4490
4491
4492 /*+
4493  *
4494  * Routine Description:
4495  *
4496  *  Entry point for the reception and handling of 802.11 management
4497  *  frames. Makes a determination of the frame type and then calls
4498  *  the appropriate function.
4499  *
4500  *
4501  * Return Value:
4502  *    none.
4503  *
4504 -*/
4505
4506
4507 VOID
4508 vMgrRxManagePacket(
4509     IN  HANDLE hDeviceContext,
4510     IN PSMgmtObject pMgmt,
4511     IN PSRxMgmtPacket pRxPacket
4512      )
4513 {
4514     PSDevice    pDevice = (PSDevice)hDeviceContext;
4515     BOOL        bInScan = FALSE;
4516     UINT        uNodeIndex = 0;
4517     NODE_STATE  eNodeState = 0;
4518     CMD_STATUS  Status;
4519
4520
4521     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
4522         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex))
4523             eNodeState = pMgmt->sNodeDBTable[uNodeIndex].eNodeState;
4524     }
4525
4526     switch( WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) ){
4527
4528         case WLAN_FSTYPE_ASSOCREQ:
4529             // Frame Clase = 2
4530             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocreq\n");
4531             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4532                 (eNodeState < NODE_AUTH)) {
4533                 // send deauth notification
4534                 // reason = (6) class 2 received from nonauth sta
4535                 vMgrDeAuthenBeginSta(pDevice,
4536                                      pMgmt,
4537                                      pRxPacket->p80211Header->sA3.abyAddr2,
4538                                      (6),
4539                                      &Status
4540                                      );
4541                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 1\n");
4542             }
4543             else {
4544                 s_vMgrRxAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4545             }
4546             break;
4547
4548         case WLAN_FSTYPE_ASSOCRESP:
4549             // Frame Clase = 2
4550             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp1\n");
4551             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, FALSE);
4552             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp2\n");
4553             break;
4554
4555         case WLAN_FSTYPE_REASSOCREQ:
4556             // Frame Clase = 2
4557             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocreq\n");
4558             // Todo: reassoc
4559             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4560                (eNodeState < NODE_AUTH)) {
4561                 // send deauth notification
4562                 // reason = (6) class 2 received from nonauth sta
4563                 vMgrDeAuthenBeginSta(pDevice,
4564                                      pMgmt,
4565                                      pRxPacket->p80211Header->sA3.abyAddr2,
4566                                      (6),
4567                                      &Status
4568                                      );
4569                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 2\n");
4570
4571             }
4572             s_vMgrRxReAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4573             break;
4574
4575         case WLAN_FSTYPE_REASSOCRESP:
4576             // Frame Clase = 2
4577             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocresp\n");
4578             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, TRUE);
4579             break;
4580
4581         case WLAN_FSTYPE_PROBEREQ:
4582             // Frame Clase = 0
4583             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx probereq\n");
4584             s_vMgrRxProbeRequest(pDevice, pMgmt, pRxPacket);
4585             break;
4586
4587         case WLAN_FSTYPE_PROBERESP:
4588             // Frame Clase = 0
4589             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx proberesp\n");
4590
4591             s_vMgrRxProbeResponse(pDevice, pMgmt, pRxPacket);
4592             break;
4593
4594         case WLAN_FSTYPE_BEACON:
4595             // Frame Clase = 0
4596             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx beacon\n");
4597             if (pMgmt->eScanState != WMAC_NO_SCANNING) {
4598                 bInScan = TRUE;
4599             };
4600             s_vMgrRxBeacon(pDevice, pMgmt, pRxPacket, bInScan);
4601             break;
4602
4603         case WLAN_FSTYPE_ATIM:
4604             // Frame Clase = 1
4605             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx atim\n");
4606             break;
4607
4608         case WLAN_FSTYPE_DISASSOC:
4609             // Frame Clase = 2
4610             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx disassoc\n");
4611             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4612                 (eNodeState < NODE_AUTH)) {
4613                 // send deauth notification
4614                 // reason = (6) class 2 received from nonauth sta
4615                 vMgrDeAuthenBeginSta(pDevice,
4616                                      pMgmt,
4617                                      pRxPacket->p80211Header->sA3.abyAddr2,
4618                                      (6),
4619                                      &Status
4620                                      );
4621                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 3\n");
4622             }
4623             s_vMgrRxDisassociation(pDevice, pMgmt, pRxPacket);
4624             break;
4625
4626         case WLAN_FSTYPE_AUTHEN:
4627             // Frame Clase = 1
4628             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO  "rx authen\n");
4629             s_vMgrRxAuthentication(pDevice, pMgmt, pRxPacket);
4630             break;
4631
4632         case WLAN_FSTYPE_DEAUTHEN:
4633             // Frame Clase = 1
4634             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx deauthen\n");
4635             s_vMgrRxDeauthentication(pDevice, pMgmt, pRxPacket);
4636             break;
4637
4638         default:
4639             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx unknown mgmt\n");
4640     }
4641
4642     return;
4643 }
4644
4645
4646
4647
4648 /*+
4649  *
4650  * Routine Description:
4651  *
4652  *
4653  *  Prepare beacon to send
4654  *
4655  * Return Value:
4656  *    TRUE if success; FALSE if failed.
4657  *
4658 -*/
4659 BOOL
4660 bMgrPrepareBeaconToSend(
4661     IN HANDLE hDeviceContext,
4662     IN PSMgmtObject pMgmt
4663     )
4664 {
4665     PSDevice            pDevice = (PSDevice)hDeviceContext;
4666     PSTxMgmtPacket      pTxPacket;
4667
4668 //    pDevice->bBeaconBufReady = FALSE;
4669     if (pDevice->bEncryptionEnable || pDevice->bEnable8021x){
4670         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
4671     }
4672     else {
4673         pMgmt->wCurrCapInfo &= ~WLAN_SET_CAP_INFO_PRIVACY(1);
4674     }
4675     pTxPacket = s_MgrMakeBeacon
4676                 (
4677                   pDevice,
4678                   pMgmt,
4679                   pMgmt->wCurrCapInfo,
4680                   pMgmt->wCurrBeaconPeriod,
4681                   pMgmt->uCurrChannel,
4682                   pMgmt->wCurrATIMWindow, //0,
4683                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4684                   (PBYTE)pMgmt->abyCurrBSSID,
4685                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4686                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
4687                 );
4688
4689     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) &&
4690         (pMgmt->abyCurrBSSID[0] == 0))
4691         return FALSE;
4692
4693     csBeacon_xmit(pDevice, pTxPacket);
4694     MACvRegBitsOn(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
4695
4696     return TRUE;
4697 }
4698
4699
4700
4701
4702 /*+
4703  *
4704  * Routine Description:
4705  *
4706  *  Log a warning message based on the contents of the Status
4707  *  Code field of an 802.11 management frame.  Defines are
4708  *  derived from 802.11-1997 SPEC.
4709  *
4710  * Return Value:
4711  *    none.
4712  *
4713 -*/
4714 static
4715 VOID
4716 s_vMgrLogStatus(
4717     IN PSMgmtObject pMgmt,
4718     IN WORD  wStatus
4719     )
4720 {
4721     switch( wStatus ){
4722         case WLAN_MGMT_STATUS_UNSPEC_FAILURE:
4723             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Unspecified error.\n");
4724             break;
4725         case WLAN_MGMT_STATUS_CAPS_UNSUPPORTED:
4726             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Can't support all requested capabilities.\n");
4727             break;
4728         case WLAN_MGMT_STATUS_REASSOC_NO_ASSOC:
4729             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Reassoc denied, can't confirm original Association.\n");
4730             break;
4731         case WLAN_MGMT_STATUS_ASSOC_DENIED_UNSPEC:
4732             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, undefine in spec\n");
4733             break;
4734         case WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG:
4735             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Peer doesn't support authen algorithm.\n");
4736             break;
4737         case WLAN_MGMT_STATUS_RX_AUTH_NOSEQ:
4738             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen frame received out of sequence.\n");
4739             break;
4740         case WLAN_MGMT_STATUS_CHALLENGE_FAIL:
4741             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, challenge  failure.\n");
4742             break;
4743         case WLAN_MGMT_STATUS_AUTH_TIMEOUT:
4744             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, timeout waiting for next frame.\n");
4745             break;
4746         case WLAN_MGMT_STATUS_ASSOC_DENIED_BUSY:
4747             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, AP too busy.\n");
4748             break;
4749         case WLAN_MGMT_STATUS_ASSOC_DENIED_RATES:
4750             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we haven't enough basic rates.\n");
4751             break;
4752         case WLAN_MGMT_STATUS_ASSOC_DENIED_SHORTPREAMBLE:
4753             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support short preamble.\n");
4754             break;
4755         case WLAN_MGMT_STATUS_ASSOC_DENIED_PBCC:
4756             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support PBCC.\n");
4757             break;
4758         case WLAN_MGMT_STATUS_ASSOC_DENIED_AGILITY:
4759             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support channel agility.\n");
4760             break;
4761         default:
4762             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Unknown status code %d.\n", wStatus);
4763             break;
4764     }
4765 }
4766
4767
4768 /*
4769  *
4770  * Description:
4771  *    Add BSSID in PMKID Candidate list.
4772  *
4773  * Parameters:
4774  *  In:
4775  *      hDeviceContext - device structure point
4776  *      pbyBSSID - BSSID address for adding
4777  *      wRSNCap - BSS's RSN capability
4778  *  Out:
4779  *      none
4780  *
4781  * Return Value: none.
4782  *
4783 -*/
4784 BOOL
4785 bAdd_PMKID_Candidate (
4786     IN HANDLE    hDeviceContext,
4787     IN PBYTE          pbyBSSID,
4788     IN PSRSNCapObject psRSNCapObj
4789     )
4790 {
4791     PSDevice         pDevice = (PSDevice)hDeviceContext;
4792     PPMKID_CANDIDATE pCandidateList;
4793     UINT             ii = 0;
4794
4795     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate START: (%d)\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4796
4797     if ((pDevice == NULL) || (pbyBSSID == NULL) || (psRSNCapObj == NULL))
4798         return FALSE;
4799
4800     if (pDevice->gsPMKIDCandidate.NumCandidates >= MAX_PMKIDLIST)
4801         return FALSE;
4802
4803
4804
4805     // Update Old Candidate
4806     for (ii = 0; ii < pDevice->gsPMKIDCandidate.NumCandidates; ii++) {
4807         pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[ii];
4808         if (MEMEqualMemory(pCandidateList->BSSID, pbyBSSID, U_ETHER_ADDR_LEN)) {
4809             if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4810                 pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4811             } else {
4812                 pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4813             }
4814             return TRUE;
4815         }
4816     }
4817
4818     // New Candidate
4819     pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[pDevice->gsPMKIDCandidate.NumCandidates];
4820     if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4821         pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4822     } else {
4823         pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4824     }
4825     MEMvCopy(pCandidateList->BSSID, pbyBSSID, U_ETHER_ADDR_LEN);
4826     pDevice->gsPMKIDCandidate.NumCandidates++;
4827     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"NumCandidates:%d\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4828     return TRUE;
4829 }
4830
4831 /*
4832  *
4833  * Description:
4834  *    Flush PMKID Candidate list.
4835  *
4836  * Parameters:
4837  *  In:
4838  *      hDeviceContext - device structure point
4839  *  Out:
4840  *      none
4841  *
4842  * Return Value: none.
4843  *
4844 -*/
4845 VOID
4846 vFlush_PMKID_Candidate (
4847     IN HANDLE hDeviceContext
4848     )
4849 {
4850     PSDevice        pDevice = (PSDevice)hDeviceContext;
4851
4852     if (pDevice == NULL)
4853         return;
4854
4855     ZERO_MEMORY(&pDevice->gsPMKIDCandidate, sizeof(SPMKIDCandidateEvent));
4856 }
4857
4858 static BOOL
4859 s_bCipherMatch (
4860     IN PKnownBSS                        pBSSNode,
4861     IN NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
4862     OUT PBYTE                           pbyCCSPK,
4863     OUT PBYTE                           pbyCCSGK
4864     )
4865 {
4866     BYTE byMulticastCipher = KEY_CTL_INVALID;
4867     BYTE byCipherMask = 0x00;
4868     int i;
4869
4870     if (pBSSNode == NULL)
4871         return FALSE;
4872
4873     // check cap. of BSS
4874     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4875          (EncStatus == Ndis802_11Encryption1Enabled)) {
4876         // default is WEP only
4877         byMulticastCipher = KEY_CTL_WEP;
4878     }
4879
4880     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4881         (pBSSNode->bWPA2Valid == TRUE) &&
4882           //20080123-01,<Add> by Einsn Liu
4883         ((EncStatus == Ndis802_11Encryption3Enabled)||(EncStatus == Ndis802_11Encryption2Enabled))) {
4884         //WPA2
4885         // check Group Key Cipher
4886         if ((pBSSNode->byCSSGK == WLAN_11i_CSS_WEP40) ||
4887             (pBSSNode->byCSSGK == WLAN_11i_CSS_WEP104)) {
4888             byMulticastCipher = KEY_CTL_WEP;
4889         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_TKIP) {
4890             byMulticastCipher = KEY_CTL_TKIP;
4891         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_CCMP) {
4892             byMulticastCipher = KEY_CTL_CCMP;
4893         } else {
4894             byMulticastCipher = KEY_CTL_INVALID;
4895         }
4896
4897         // check Pairwise Key Cipher
4898         for(i=0;i<pBSSNode->wCSSPKCount;i++) {
4899             if ((pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP40) ||
4900                 (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP104)) {
4901                 // this should not happen as defined 802.11i
4902                 byCipherMask |= 0x01;
4903             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_TKIP) {
4904                 byCipherMask |= 0x02;
4905             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_CCMP) {
4906                 byCipherMask |= 0x04;
4907             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_USE_GROUP) {
4908                 // use group key only ignore all others
4909                 byCipherMask = 0;
4910                 i = pBSSNode->wCSSPKCount;
4911             }
4912         }
4913
4914     } else if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4915                 (pBSSNode->bWPAValid == TRUE) &&
4916                 ((EncStatus == Ndis802_11Encryption2Enabled) || (EncStatus == Ndis802_11Encryption3Enabled))) {
4917         //WPA
4918         // check Group Key Cipher
4919         if ((pBSSNode->byGKType == WPA_WEP40) ||
4920             (pBSSNode->byGKType == WPA_WEP104)) {
4921             byMulticastCipher = KEY_CTL_WEP;
4922         } else if (pBSSNode->byGKType == WPA_TKIP) {
4923             byMulticastCipher = KEY_CTL_TKIP;
4924         } else if (pBSSNode->byGKType == WPA_AESCCMP) {
4925             byMulticastCipher = KEY_CTL_CCMP;
4926         } else {
4927             byMulticastCipher = KEY_CTL_INVALID;
4928         }
4929
4930         // check Pairwise Key Cipher
4931         for(i=0;i<pBSSNode->wPKCount;i++) {
4932             if (pBSSNode->abyPKType[i] == WPA_TKIP) {
4933                 byCipherMask |= 0x02;
4934             } else if (pBSSNode->abyPKType[i] == WPA_AESCCMP) {
4935                 byCipherMask |= 0x04;
4936             } else if (pBSSNode->abyPKType[i] == WPA_NONE) {
4937                 // use group key only ignore all others
4938                 byCipherMask = 0;
4939                 i = pBSSNode->wPKCount;
4940             }
4941         }
4942     }
4943
4944     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"%d, %d, %d, %d, EncStatus:%d\n",
4945         byMulticastCipher, byCipherMask, pBSSNode->bWPAValid, pBSSNode->bWPA2Valid, EncStatus);
4946
4947     // mask our cap. with BSS
4948     if (EncStatus == Ndis802_11Encryption1Enabled) {
4949
4950         // For supporting Cisco migration mode, don't care pairwise key cipher
4951         //if ((byMulticastCipher == KEY_CTL_WEP) &&
4952         //    (byCipherMask == 0)) {
4953         if ((byMulticastCipher == KEY_CTL_WEP) &&
4954             (byCipherMask == 0)) {
4955             *pbyCCSGK = KEY_CTL_WEP;
4956             *pbyCCSPK = KEY_CTL_NONE;
4957             return TRUE;
4958         } else {
4959             return FALSE;
4960         }
4961
4962     } else if (EncStatus == Ndis802_11Encryption2Enabled) {
4963         if ((byMulticastCipher == KEY_CTL_TKIP) &&
4964             (byCipherMask == 0)) {
4965             *pbyCCSGK = KEY_CTL_TKIP;
4966             *pbyCCSPK = KEY_CTL_NONE;
4967             return TRUE;
4968         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4969                    ((byCipherMask & 0x02) != 0)) {
4970             *pbyCCSGK = KEY_CTL_WEP;
4971             *pbyCCSPK = KEY_CTL_TKIP;
4972             return TRUE;
4973         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4974                    ((byCipherMask & 0x02) != 0)) {
4975             *pbyCCSGK = KEY_CTL_TKIP;
4976             *pbyCCSPK = KEY_CTL_TKIP;
4977             return TRUE;
4978         } else {
4979             return FALSE;
4980         }
4981     } else if (EncStatus == Ndis802_11Encryption3Enabled) {
4982         if ((byMulticastCipher == KEY_CTL_CCMP) &&
4983             (byCipherMask == 0)) {
4984             // When CCMP is enable, "Use group cipher suite" shall not be a valid option.
4985             return FALSE;
4986         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4987                    ((byCipherMask & 0x04) != 0)) {
4988             *pbyCCSGK = KEY_CTL_WEP;
4989             *pbyCCSPK = KEY_CTL_CCMP;
4990             return TRUE;
4991         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4992                    ((byCipherMask & 0x04) != 0)) {
4993             *pbyCCSGK = KEY_CTL_TKIP;
4994             *pbyCCSPK = KEY_CTL_CCMP;
4995             return TRUE;
4996         } else if ((byMulticastCipher == KEY_CTL_CCMP) &&
4997                    ((byCipherMask & 0x04) != 0)) {
4998             *pbyCCSGK = KEY_CTL_CCMP;
4999             *pbyCCSPK = KEY_CTL_CCMP;
5000             return TRUE;
5001         } else {
5002             return FALSE;
5003         }
5004     }
5005     return TRUE;
5006 }
5007
5008