SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/staging/vt6656/wmgr.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  *
  20  * File: wmgr.c
  21  *
  22  * Purpose: Handles the 802.11 management functions
  23  *
  24  * Author: Lyndon Chen
  25  *
  26  * Date: May 8, 2002
  27  *
  28  * Functions:
  29  *      nsMgrObjectInitial - Initialize Management Objet data structure
  30  *      vMgrObjectReset - Reset Management Objet data structure
  31  *      vMgrAssocBeginSta - Start associate function
  32  *      vMgrReAssocBeginSta - Start reassociate function
  33  *      vMgrDisassocBeginSta - Start disassociate function
  34  *      s_vMgrRxAssocRequest - Handle Rcv associate_request
  35  *      s_vMgrRxAssocResponse - Handle Rcv associate_response
  36  *      vMrgAuthenBeginSta - Start authentication function
  37  *      vMgrDeAuthenDeginSta - Start deauthentication function
  38  *      s_vMgrRxAuthentication - Handle Rcv authentication
  39  *      s_vMgrRxAuthenSequence_1 - Handle Rcv authentication sequence 1
  40  *      s_vMgrRxAuthenSequence_2 - Handle Rcv authentication sequence 2
  41  *      s_vMgrRxAuthenSequence_3 - Handle Rcv authentication sequence 3
  42  *      s_vMgrRxAuthenSequence_4 - Handle Rcv authentication sequence 4
  43  *      s_vMgrRxDisassociation - Handle Rcv disassociation
  44  *      s_vMgrRxBeacon - Handle Rcv Beacon
  45  *      vMgrCreateOwnIBSS - Create ad_hoc IBSS or AP BSS
  46  *      vMgrJoinBSSBegin - Join BSS function
  47  *      s_vMgrSynchBSS - Synch & adopt BSS parameters
  48  *      s_MgrMakeBeacon - Create Baecon frame
  49  *      s_MgrMakeProbeResponse - Create Probe Response frame
  50  *      s_MgrMakeAssocRequest - Create Associate Request frame
  51  *      s_MgrMakeReAssocRequest - Create ReAssociate Request frame
  52  *      s_vMgrRxProbeResponse - Handle Rcv probe_response
  53  *      s_vMrgRxProbeRequest - Handle Rcv probe_request
  54  *      bMgrPrepareBeaconToSend - Prepare Beacon frame
  55  *      s_vMgrLogStatus - Log 802.11 Status
  56  *      vMgrRxManagePacket - Rcv management frame dispatch function
  57  *      s_vMgrFormatTIM- Assember TIM field of beacon
  58  *      vMgrTimerInit- Initial 1-sec and command call back funtions
  59  *
  60  * Revision History:
  61  *
  62  */
  63
  64
  65 #if !defined(__TMACRO_H__)
  66 #include "tmacro.h"
  67 #endif
  68 #if !defined(__TBIT_H__)
  69 #include "tbit.h"
  70 #endif
  71 #if !defined(__DESC_H__)
  72 #include "desc.h"
  73 #endif
  74 #if !defined(__DEVICE_H__)
  75 #include "device.h"
  76 #endif
  77 #if !defined(__CARD_H__)
  78 #include "card.h"
  79 #endif
  80 #if !defined(__80211HDR_H__)
  81 #include "80211hdr.h"
  82 #endif
  83 #if !defined(__80211MGR_H__)
  84 #include "80211mgr.h"
  85 #endif
  86 #if !defined(__WMGR_H__)
  87 #include "wmgr.h"
  88 #endif
  89 #if !defined(__WCMD_H__)
  90 #include "wcmd.h"
  91 #endif
  92 #if !defined(__MAC_H__)
  93 #include "mac.h"
  94 #endif
  95 #if !defined(__BSSDB_H__)
  96 #include "bssdb.h"
  97 #endif
  98 #if !defined(__POWER_H__)
  99 #include "power.h"
 100 #endif
 101 #if !defined(__DATARATE_H__)
 102 #include "datarate.h"
 103 #endif
 104 #if !defined(__BASEBAND_H__)
 105 #include "baseband.h"
 106 #endif
 107 #if !defined(__RXTX_H__)
 108 #include "rxtx.h"
 109 #endif
 110 #if !defined(__WPA_H__)
 111 #include "wpa.h"
 112 #endif
 113 #if !defined(__RF_H__)
 114 #include "rf.h"
 115 #endif
 116 #if !defined(__UMEM_H__)
 117 #include "umem.h"
 118 #endif
 119 #if !defined(__IOWPA_H__)
 120 #include "iowpa.h"
 121 #endif
 122 #if !defined(__CONTROL_H__)
 123 #include "control.h"
 124 #endif
 125 #if !defined(__RNDIS_H__)
 126 #include "rndis.h"
 127 #endif
 128 /*---------------------  Static Definitions -------------------------*/
 129
 130
 131
 132 /*---------------------  Static Classes  ----------------------------*/
 133
 134 /*---------------------  Static Variables  --------------------------*/
 135 static int          msglevel                =MSG_LEVEL_INFO;
 136 //static int          msglevel                =MSG_LEVEL_DEBUG;
 137
 138 /*---------------------  Static Functions  --------------------------*/
 139 //2008-0730-01<Add>by MikeLiu
 140 static BOOL ChannelExceedZoneType(
 141     IN PSDevice pDevice,
 142     IN BYTE byCurrChannel
 143     );
 144
 145 // Association/diassociation functions
 146 static
 147 PSTxMgmtPacket
 148 s_MgrMakeAssocRequest(
 149     IN PSDevice pDevice,
 150     IN PSMgmtObject pMgmt,
 151     IN PBYTE pDAddr,
 152     IN WORD wCurrCapInfo,
 153     IN WORD wListenInterval,
 154     IN PWLAN_IE_SSID pCurrSSID,
 155     IN PWLAN_IE_SUPP_RATES pCurrRates,
 156     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 157     );
 158
 159 static
 160 VOID
 161 s_vMgrRxAssocRequest(
 162     IN PSDevice pDevice,
 163     IN PSMgmtObject pMgmt,
 164     IN PSRxMgmtPacket pRxPacket,
 165     IN UINT  uNodeIndex
 166     );
 167
 168 static
 169 PSTxMgmtPacket
 170 s_MgrMakeReAssocRequest(
 171     IN PSDevice pDevice,
 172     IN PSMgmtObject pMgmt,
 173     IN PBYTE pDAddr,
 174     IN WORD wCurrCapInfo,
 175     IN WORD wListenInterval,
 176     IN PWLAN_IE_SSID pCurrSSID,
 177     IN PWLAN_IE_SUPP_RATES pCurrRates,
 178     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 179     );
 180
 181 static
 182 VOID
 183 s_vMgrRxAssocResponse(
 184     IN PSDevice pDevice,
 185     IN PSMgmtObject pMgmt,
 186     IN PSRxMgmtPacket pRxPacket,
 187     IN BOOL bReAssocType
 188     );
 189
 190 static
 191 VOID
 192 s_vMgrRxDisassociation(
 193     IN PSDevice pDevice,
 194     IN PSMgmtObject pMgmt,
 195     IN PSRxMgmtPacket pRxPacket
 196     );
 197
 198 // Authentication/deauthen functions
 199 static
 200 VOID
 201 s_vMgrRxAuthenSequence_1(
 202     IN PSDevice pDevice,
 203     IN PSMgmtObject pMgmt,
 204     IN PWLAN_FR_AUTHEN pFrame
 205     );
 206
 207 static
 208 VOID
 209 s_vMgrRxAuthenSequence_2(
 210     IN PSDevice pDevice,
 211     IN PSMgmtObject pMgmt,
 212     IN PWLAN_FR_AUTHEN pFrame
 213     );
 214
 215 static
 216 VOID
 217 s_vMgrRxAuthenSequence_3(
 218     IN PSDevice pDevice,
 219     IN PSMgmtObject pMgmt,
 220     IN PWLAN_FR_AUTHEN pFrame
 221     );
 222
 223 static
 224 VOID
 225 s_vMgrRxAuthenSequence_4(
 226     IN PSDevice pDevice,
 227     IN PSMgmtObject pMgmt,
 228     IN PWLAN_FR_AUTHEN pFrame
 229     );
 230
 231 static
 232 VOID
 233 s_vMgrRxAuthentication(
 234     IN PSDevice pDevice,
 235     IN PSMgmtObject pMgmt,
 236     IN PSRxMgmtPacket pRxPacket
 237     );
 238
 239 static
 240 VOID
 241 s_vMgrRxDeauthentication(
 242     IN PSDevice pDevice,
 243     IN PSMgmtObject pMgmt,
 244     IN PSRxMgmtPacket pRxPacket
 245     );
 246
 247 // Scan functions
 248 // probe request/response functions
 249 static
 250 VOID
 251 s_vMgrRxProbeRequest(
 252     IN PSDevice pDevice,
 253     IN PSMgmtObject pMgmt,
 254     IN PSRxMgmtPacket pRxPacket
 255     );
 256
 257 static
 258 VOID
 259 s_vMgrRxProbeResponse(
 260     IN PSDevice pDevice,
 261     IN PSMgmtObject pMgmt,
 262     IN PSRxMgmtPacket pRxPacket
 263     );
 264
 265 // beacon functions
 266 static
 267 VOID
 268 s_vMgrRxBeacon(
 269     IN PSDevice pDevice,
 270     IN PSMgmtObject pMgmt,
 271     IN PSRxMgmtPacket pRxPacket,
 272     IN BOOL bInScan
 273     );
 274
 275 static
 276 VOID
 277 s_vMgrFormatTIM(
 278     IN PSMgmtObject pMgmt,
 279     IN PWLAN_IE_TIM pTIM
 280     );
 281
 282 static
 283 PSTxMgmtPacket
 284 s_MgrMakeBeacon(
 285     IN PSDevice pDevice,
 286     IN PSMgmtObject pMgmt,
 287     IN WORD wCurrCapInfo,
 288     IN WORD wCurrBeaconPeriod,
 289     IN UINT uCurrChannel,
 290     IN WORD wCurrATIMWinodw,
 291     IN PWLAN_IE_SSID pCurrSSID,
 292     IN PBYTE pCurrBSSID,
 293     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 294     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 295     );
 296
 297
 298 // Association response
 299 static
 300 PSTxMgmtPacket
 301 s_MgrMakeAssocResponse(
 302     IN PSDevice pDevice,
 303     IN PSMgmtObject pMgmt,
 304     IN WORD wCurrCapInfo,
 305     IN WORD wAssocStatus,
 306     IN WORD wAssocAID,
 307     IN PBYTE pDstAddr,
 308     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 309     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 310     );
 311
 312 // ReAssociation response
 313 static
 314 PSTxMgmtPacket
 315 s_MgrMakeReAssocResponse(
 316     IN PSDevice pDevice,
 317     IN PSMgmtObject pMgmt,
 318     IN WORD wCurrCapInfo,
 319     IN WORD wAssocStatus,
 320     IN WORD wAssocAID,
 321     IN PBYTE pDstAddr,
 322     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 323     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 324     );
 325
 326 // Probe response
 327 static
 328 PSTxMgmtPacket
 329 s_MgrMakeProbeResponse(
 330     IN PSDevice pDevice,
 331     IN PSMgmtObject pMgmt,
 332     IN WORD wCurrCapInfo,
 333     IN WORD wCurrBeaconPeriod,
 334     IN UINT uCurrChannel,
 335     IN WORD wCurrATIMWinodw,
 336     IN PBYTE pDstAddr,
 337     IN PWLAN_IE_SSID pCurrSSID,
 338     IN PBYTE pCurrBSSID,
 339     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 340     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
 341     IN BYTE byPHYType
 342     );
 343
 344 // received status
 345 static
 346 VOID
 347 s_vMgrLogStatus(
 348     IN PSMgmtObject pMgmt,
 349     IN WORD wStatus
 350     );
 351
 352
 353 static
 354 VOID
 355 s_vMgrSynchBSS (
 356     IN PSDevice      pDevice,
 357     IN UINT          uBSSMode,
 358     IN PKnownBSS     pCurr,
 359     OUT PCMD_STATUS  pStatus
 360     );
 361
 362
 363 static BOOL
 364 s_bCipherMatch (
 365     IN PKnownBSS                        pBSSNode,
 366     IN NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
 367     OUT PBYTE                           pbyCCSPK,
 368     OUT PBYTE                           pbyCCSGK
 369     );
 370
 371  static VOID  Encyption_Rebuild(
 372     IN PSDevice pDevice,
 373     IN PKnownBSS pCurr
 374  );
 375
 376
 377
 378 /*---------------------  Export Variables  --------------------------*/
 379
 380
 381 /*---------------------  Export Functions  --------------------------*/
 382
 383
 384 /*+
 385  *
 386  * Routine Description:
 387  *    Allocates and initializes the Management object.
 388  *
 389  * Return Value:
 390  *    Ndis_staus.
 391  *
 392 -*/
 393
 394 VOID
 395 vMgrObjectInit(
 396     IN  HANDLE hDeviceContext
 397     )
 398 {
 399     PSDevice     pDevice = (PSDevice)hDeviceContext;
 400     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
 401     int ii;
 402
 403
 404     pMgmt->pbyPSPacketPool = &pMgmt->byPSPacketPool[0];
 405     pMgmt->pbyMgmtPacketPool = &pMgmt->byMgmtPacketPool[0];
 406     pMgmt->uCurrChannel = pDevice->uChannel;
 407     for(ii=0;ii<WLAN_BSSID_LEN;ii++) {
 408         pMgmt->abyDesireBSSID[ii] = 0xFF;
 409     }
 410     pMgmt->sAssocInfo.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 411     //memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN +1);
 412     pMgmt->byCSSPK = KEY_CTL_NONE;
 413     pMgmt->byCSSGK = KEY_CTL_NONE;
 414     pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
 415     BSSvClearBSSList((HANDLE)pDevice, FALSE);
 416
 417     init_timer(&pMgmt->sTimerSecondCallback);
 418     pMgmt->sTimerSecondCallback.data = (ULONG)pDevice;
 419     pMgmt->sTimerSecondCallback.function = (TimerFunction)BSSvSecondCallBack;
 420     pMgmt->sTimerSecondCallback.expires = RUN_AT(HZ);
 421
 422     init_timer(&pDevice->sTimerCommand);
 423     pDevice->sTimerCommand.data = (ULONG)pDevice;
 424     pDevice->sTimerCommand.function = (TimerFunction)vRunCommand;
 425     pDevice->sTimerCommand.expires = RUN_AT(HZ);
 426
 427 //2007-0115-10<Add>by MikeLiu
 428    #ifdef TxInSleep
 429     init_timer(&pDevice->sTimerTxData);
 430     pDevice->sTimerTxData.data = (ULONG)pDevice;
 431     pDevice->sTimerTxData.function = (TimerFunction)BSSvSecondTxData;
 432     pDevice->sTimerTxData.expires = RUN_AT(10*HZ);      //10s callback
 433     pDevice->fTxDataInSleep = FALSE;
 434     pDevice->IsTxDataTrigger = FALSE;
 435     pDevice->nTxDataTimeCout = 0;
 436    #endif
 437
 438     pDevice->cbFreeCmdQueue = CMD_Q_SIZE;
 439     pDevice->uCmdDequeueIdx = 0;
 440     pDevice->uCmdEnqueueIdx = 0;
 441     pDevice->eCommandState = WLAN_CMD_IDLE;
 442     pDevice->bCmdRunning = FALSE;
 443     pDevice->bCmdClear = FALSE;
 444
 445     return;
 446 }
 447
 448
 449
 450 /*+
 451  *
 452  * Routine Description:
 453  *    Start the station association procedure.  Namely, send an
 454  *    association request frame to the AP.
 455  *
 456  * Return Value:
 457  *    None.
 458  *
 459 -*/
 460
 461
 462 VOID
 463 vMgrAssocBeginSta(
 464     IN  HANDLE hDeviceContext,
 465     IN  PSMgmtObject pMgmt,
 466     OUT PCMD_STATUS pStatus
 467     )
 468 {
 469     PSDevice             pDevice = (PSDevice)hDeviceContext;
 470     PSTxMgmtPacket          pTxPacket;
 471
 472
 473     pMgmt->wCurrCapInfo = 0;
 474     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 475     if (pDevice->bEncryptionEnable) {
 476         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 477     }
 478     // always allow receive short preamble
 479     //if (pDevice->byPreambleType == 1) {
 480     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 481     //}
 482     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 483     if (pMgmt->wListenInterval == 0)
 484         pMgmt->wListenInterval = 1;    // at least one.
 485
 486     // ERP Phy (802.11g) should support short preamble.
 487     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 488         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 489         if (pDevice->bShortSlotTime == TRUE)
 490             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 491
 492     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 493         if (pDevice->byPreambleType == 1) {
 494             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 495         }
 496     }
 497     if (pMgmt->b11hEnable == TRUE)
 498         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 499
 500     // build an assocreq frame and send it
 501     pTxPacket = s_MgrMakeAssocRequest
 502                 (
 503                   pDevice,
 504                   pMgmt,
 505                   pMgmt->abyCurrBSSID,
 506                   pMgmt->wCurrCapInfo,
 507                   pMgmt->wListenInterval,
 508                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 509                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 510                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 511                 );
 512
 513     if (pTxPacket != NULL ){
 514         // send the frame
 515         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 516         if (*pStatus == CMD_STATUS_PENDING) {
 517             pMgmt->eCurrState = WMAC_STATE_ASSOCPENDING;
 518             *pStatus = CMD_STATUS_SUCCESS;
 519         }
 520     }
 521     else
 522         *pStatus = CMD_STATUS_RESOURCES;
 523
 524     return ;
 525 }
 526
 527
 528 /*+
 529  *
 530  * Routine Description:
 531  *    Start the station re-association procedure.
 532  *
 533  * Return Value:
 534  *    None.
 535  *
 536 -*/
 537
 538 VOID
 539 vMgrReAssocBeginSta(
 540     IN  HANDLE hDeviceContext,
 541     IN  PSMgmtObject pMgmt,
 542     OUT PCMD_STATUS pStatus
 543     )
 544 {
 545     PSDevice             pDevice = (PSDevice)hDeviceContext;
 546     PSTxMgmtPacket          pTxPacket;
 547
 548
 549
 550     pMgmt->wCurrCapInfo = 0;
 551     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 552     if (pDevice->bEncryptionEnable) {
 553         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 554     }
 555
 556     //if (pDevice->byPreambleType == 1) {
 557     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 558     //}
 559     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 560
 561     if (pMgmt->wListenInterval == 0)
 562         pMgmt->wListenInterval = 1;    // at least one.
 563
 564
 565     // ERP Phy (802.11g) should support short preamble.
 566     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 567         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 568       if (pDevice->bShortSlotTime == TRUE)
 569           pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 570
 571     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 572         if (pDevice->byPreambleType == 1) {
 573             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 574         }
 575     }
 576     if (pMgmt->b11hEnable == TRUE)
 577         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 578
 579
 580     pTxPacket = s_MgrMakeReAssocRequest
 581                 (
 582                   pDevice,
 583                   pMgmt,
 584                   pMgmt->abyCurrBSSID,
 585                   pMgmt->wCurrCapInfo,
 586                   pMgmt->wListenInterval,
 587                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 588                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 589                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 590                 );
 591
 592     if (pTxPacket != NULL ){
 593         // send the frame
 594         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 595         if (*pStatus != CMD_STATUS_PENDING) {
 596             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx failed.\n");
 597         }
 598         else {
 599             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx sending.\n");
 600         }
 601     }
 602
 603
 604     return ;
 605 }
 606
 607 /*+
 608  *
 609  * Routine Description:
 610  *    Send an dis-association request frame to the AP.
 611  *
 612  * Return Value:
 613  *    None.
 614  *
 615 -*/
 616
 617 VOID
 618 vMgrDisassocBeginSta(
 619     IN  HANDLE hDeviceContext,
 620     IN  PSMgmtObject pMgmt,
 621     IN  PBYTE  abyDestAddress,
 622     IN  WORD    wReason,
 623     OUT PCMD_STATUS pStatus
 624     )
 625 {
 626     PSDevice            pDevice = (PSDevice)hDeviceContext;
 627     PSTxMgmtPacket      pTxPacket = NULL;
 628     WLAN_FR_DISASSOC    sFrame;
 629
 630     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
 631     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DISASSOC_FR_MAXLEN);
 632     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
 633
 634     // Setup the sFrame structure
 635     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
 636     sFrame.len = WLAN_DISASSOC_FR_MAXLEN;
 637
 638     // format fixed field frame structure
 639     vMgrEncodeDisassociation(&sFrame);
 640
 641     // Setup the header
 642     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
 643         (
 644         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
 645         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DISASSOC)
 646         ));
 647
 648     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
 649     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
 650     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
 651
 652     // Set reason code
 653     *(sFrame.pwReason) = cpu_to_le16(wReason);
 654     pTxPacket->cbMPDULen = sFrame.len;
 655     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
 656
 657     // send the frame
 658     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 659     if (*pStatus == CMD_STATUS_PENDING) {
 660         pMgmt->eCurrState = WMAC_STATE_IDLE;
 661         *pStatus = CMD_STATUS_SUCCESS;
 662     };
 663
 664     return;
 665 }
 666
 667
 668
 669 /*+
 670  *
 671  * Routine Description:(AP function)
 672  *    Handle incoming station association request frames.
 673  *
 674  * Return Value:
 675  *    None.
 676  *
 677 -*/
 678
 679 static
 680 VOID
 681 s_vMgrRxAssocRequest(
 682     IN PSDevice pDevice,
 683     IN PSMgmtObject pMgmt,
 684     IN PSRxMgmtPacket pRxPacket,
 685     IN UINT uNodeIndex
 686     )
 687 {
 688     WLAN_FR_ASSOCREQ    sFrame;
 689     CMD_STATUS          Status;
 690     PSTxMgmtPacket      pTxPacket;
 691     WORD                wAssocStatus = 0;
 692     WORD                wAssocAID = 0;
 693     UINT                uRateLen = WLAN_RATES_MAXLEN;
 694     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 695     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 696
 697
 698     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 699         return;
 700     //  node index not found
 701     if (!uNodeIndex)
 702         return;
 703
 704     //check if node is authenticated
 705     //decode the frame
 706     memset(&sFrame, 0, sizeof(WLAN_FR_ASSOCREQ));
 707     memset(abyCurrSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 708     memset(abyCurrExtSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 709     sFrame.len = pRxPacket->cbMPDULen;
 710     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 711
 712     vMgrDecodeAssocRequest(&sFrame);
 713
 714     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 715         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 716         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 717         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 718         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 719                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 720         // Todo: check sta basic rate, if ap can't support, set status code
 721         if (pDevice->byBBType == BB_TYPE_11B) {
 722             uRateLen = WLAN_RATES_MAXLEN_11B;
 723         }
 724         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 725         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 726                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 727                                          uRateLen);
 728         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 729         if (pDevice->byBBType == BB_TYPE_11G) {
 730             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 731                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 732                                                 uRateLen);
 733         } else {
 734             abyCurrExtSuppRates[1] = 0;
 735         }
 736
 737
 738         RATEvParseMaxRate((PVOID)pDevice,
 739                            (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 740                            (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 741                            FALSE, // do not change our basic rate
 742                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 743                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 744                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 745                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 746                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 747                           );
 748
 749         // set max tx rate
 750         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 751                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 752         // Todo: check sta preamble, if ap can't support, set status code
 753         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 754                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 755         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 756                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 757         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 758         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 759         wAssocAID = (WORD)uNodeIndex;
 760         // check if ERP support
 761         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 762            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 763
 764         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 765             // B only STA join
 766             pDevice->bProtectMode = TRUE;
 767             pDevice->bNonERPPresent = TRUE;
 768         }
 769         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 770             pDevice->bBarkerPreambleMd = TRUE;
 771         }
 772
 773         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Associate AID= %d \n", wAssocAID);
 774         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 775                    sFrame.pHdr->sA3.abyAddr2[0],
 776                    sFrame.pHdr->sA3.abyAddr2[1],
 777                    sFrame.pHdr->sA3.abyAddr2[2],
 778                    sFrame.pHdr->sA3.abyAddr2[3],
 779                    sFrame.pHdr->sA3.abyAddr2[4],
 780                    sFrame.pHdr->sA3.abyAddr2[5]
 781                   ) ;
 782         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 783                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 784     }
 785
 786
 787     // assoc response reply..
 788     pTxPacket = s_MgrMakeAssocResponse
 789                 (
 790                   pDevice,
 791                   pMgmt,
 792                   pMgmt->wCurrCapInfo,
 793                   wAssocStatus,
 794                   wAssocAID,
 795                   sFrame.pHdr->sA3.abyAddr2,
 796                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 797                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 798                 );
 799     if (pTxPacket != NULL ){
 800
 801         if (pDevice->bEnableHostapd) {
 802             return;
 803         }
 804         /* send the frame */
 805         Status = csMgmt_xmit(pDevice, pTxPacket);
 806         if (Status != CMD_STATUS_PENDING) {
 807             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx failed\n");
 808         }
 809         else {
 810             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx sending..\n");
 811         }
 812
 813     }
 814
 815     return;
 816 }
 817
 818
 819 /*+
 820  *
 821  * Description:(AP function)
 822  *      Handle incoming station re-association request frames.
 823  *
 824  * Parameters:
 825  *  In:
 826  *      pMgmt           - Management Object structure
 827  *      pRxPacket       - Received Packet
 828  *  Out:
 829  *      none
 830  *
 831  * Return Value: None.
 832  *
 833 -*/
 834
 835 static
 836 VOID
 837 s_vMgrRxReAssocRequest(
 838     IN PSDevice pDevice,
 839     IN PSMgmtObject pMgmt,
 840     IN PSRxMgmtPacket pRxPacket,
 841     IN UINT uNodeIndex
 842     )
 843 {
 844     WLAN_FR_REASSOCREQ    sFrame;
 845     CMD_STATUS          Status;
 846     PSTxMgmtPacket      pTxPacket;
 847     WORD                wAssocStatus = 0;
 848     WORD                wAssocAID = 0;
 849     UINT                uRateLen = WLAN_RATES_MAXLEN;
 850     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 851     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 852
 853     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 854         return;
 855     //  node index not found
 856     if (!uNodeIndex)
 857         return;
 858     //check if node is authenticated
 859     //decode the frame
 860     memset(&sFrame, 0, sizeof(WLAN_FR_REASSOCREQ));
 861     sFrame.len = pRxPacket->cbMPDULen;
 862     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 863     vMgrDecodeReassocRequest(&sFrame);
 864
 865     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 866         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 867         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 868         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 869         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 870                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 871         // Todo: check sta basic rate, if ap can't support, set status code
 872
 873         if (pDevice->byBBType == BB_TYPE_11B) {
 874             uRateLen = WLAN_RATES_MAXLEN_11B;
 875         }
 876
 877         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 878         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 879                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 880                                          uRateLen);
 881         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 882         if (pDevice->byBBType == BB_TYPE_11G) {
 883             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 884                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 885                                                 uRateLen);
 886         } else {
 887             abyCurrExtSuppRates[1] = 0;
 888         }
 889
 890
 891         RATEvParseMaxRate((PVOID)pDevice,
 892                           (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 893                           (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 894                            FALSE, // do not change our basic rate
 895                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 896                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 897                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 898                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 899                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 900                           );
 901
 902         // set max tx rate
 903         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 904                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 905         // Todo: check sta preamble, if ap can't support, set status code
 906         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 907                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 908         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 909                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 910         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 911         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 912         wAssocAID = (WORD)uNodeIndex;
 913
 914         // if suppurt ERP
 915         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 916            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 917
 918         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 919             // B only STA join
 920             pDevice->bProtectMode = TRUE;
 921             pDevice->bNonERPPresent = TRUE;
 922         }
 923         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 924             pDevice->bBarkerPreambleMd = TRUE;
 925         }
 926
 927         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Rx ReAssociate AID= %d \n", wAssocAID);
 928         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 929                    sFrame.pHdr->sA3.abyAddr2[0],
 930                    sFrame.pHdr->sA3.abyAddr2[1],
 931                    sFrame.pHdr->sA3.abyAddr2[2],
 932                    sFrame.pHdr->sA3.abyAddr2[3],
 933                    sFrame.pHdr->sA3.abyAddr2[4],
 934                    sFrame.pHdr->sA3.abyAddr2[5]
 935                   ) ;
 936         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 937                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 938
 939     }
 940
 941
 942     // assoc response reply..
 943     pTxPacket = s_MgrMakeReAssocResponse
 944                 (
 945                   pDevice,
 946                   pMgmt,
 947                   pMgmt->wCurrCapInfo,
 948                   wAssocStatus,
 949                   wAssocAID,
 950                   sFrame.pHdr->sA3.abyAddr2,
 951                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 952                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 953                 );
 954
 955     if (pTxPacket != NULL ){
 956         /* send the frame */
 957         if (pDevice->bEnableHostapd) {
 958             return;
 959         }
 960         Status = csMgmt_xmit(pDevice, pTxPacket);
 961         if (Status != CMD_STATUS_PENDING) {
 962             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx failed\n");
 963         }
 964         else {
 965             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx sending..\n");
 966         }
 967     }
 968     return;
 969 }
 970
 971
 972 /*+
 973  *
 974  * Routine Description:
 975  *    Handle incoming association response frames.
 976  *
 977  * Return Value:
 978  *    None.
 979  *
 980 -*/
 981
 982 static
 983 VOID
 984 s_vMgrRxAssocResponse(
 985     IN PSDevice pDevice,
 986     IN PSMgmtObject pMgmt,
 987     IN PSRxMgmtPacket pRxPacket,
 988     IN BOOL bReAssocType
 989     )
 990 {
 991     WLAN_FR_ASSOCRESP   sFrame;
 992     PWLAN_IE_SSID   pItemSSID;
 993     PBYTE   pbyIEs;
 994     viawget_wpa_header *wpahdr;
 995
 996
 997
 998     if (pMgmt->eCurrState == WMAC_STATE_ASSOCPENDING ||
 999          pMgmt->eCurrState == WMAC_STATE_ASSOC) {
1000
1001         sFrame.len = pRxPacket->cbMPDULen;
1002         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1003         // decode the frame
1004         vMgrDecodeAssocResponse(&sFrame);
1005         if ((sFrame.pwCapInfo == 0) ||
1006             (sFrame.pwStatus == 0) ||
1007             (sFrame.pwAid == 0) ||
1008             (sFrame.pSuppRates == 0)){
1009             DBG_PORT80(0xCC);
1010             return;
1011         };
1012
1013         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.Capabilities = *(sFrame.pwCapInfo);
1014         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.StatusCode = *(sFrame.pwStatus);
1015         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.AssociationId = *(sFrame.pwAid);
1016         pMgmt->sAssocInfo.AssocInfo.AvailableResponseFixedIEs |= 0x07;
1017
1018         pMgmt->sAssocInfo.AssocInfo.ResponseIELength = sFrame.len - 24 - 6;
1019         pMgmt->sAssocInfo.AssocInfo.OffsetResponseIEs = pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs + pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1020         pbyIEs = pMgmt->sAssocInfo.abyIEs;
1021         pbyIEs += pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1022         memcpy(pbyIEs, (sFrame.pBuf + 24 +6), pMgmt->sAssocInfo.AssocInfo.ResponseIELength);
1023
1024         // save values and set current BSS state
1025         if (cpu_to_le16((*(sFrame.pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1026             // set AID
1027             pMgmt->wCurrAID = cpu_to_le16((*(sFrame.pwAid)));
1028             if ( (pMgmt->wCurrAID >> 14) != (BIT0 | BIT1) )
1029             {
1030                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "AID from AP, has two msb clear.\n");
1031             };
1032             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Association Successful, AID=%d.\n", pMgmt->wCurrAID & ~(BIT14|BIT15));
1033             pMgmt->eCurrState = WMAC_STATE_ASSOC;
1034             BSSvUpdateAPNode((HANDLE)pDevice, sFrame.pwCapInfo, sFrame.pSuppRates, sFrame.pExtSuppRates);
1035             pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
1036             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Link with AP(SSID): %s\n", pItemSSID->abySSID);
1037             pDevice->bLinkPass = TRUE;
1038             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
1039             if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1040                if(skb_tailroom(pDevice->skb) <(sizeof(viawget_wpa_header)+pMgmt->sAssocInfo.AssocInfo.ResponseIELength+
1041                                                                          pMgmt->sAssocInfo.AssocInfo.RequestIELength)) {    //data room not enough
1042                      dev_kfree_skb(pDevice->skb);
1043                    pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1044                 }
1045                 wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1046                 wpahdr->type = VIAWGET_ASSOC_MSG;
1047                 wpahdr->resp_ie_len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1048                 wpahdr->req_ie_len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1049                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header), pMgmt->sAssocInfo.abyIEs, wpahdr->req_ie_len);
1050                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header) + wpahdr->req_ie_len,
1051                        pbyIEs,
1052                        wpahdr->resp_ie_len
1053                        );
1054                 skb_put(pDevice->skb, sizeof(viawget_wpa_header) + wpahdr->resp_ie_len + wpahdr->req_ie_len);
1055                 pDevice->skb->dev = pDevice->wpadev;
1056                 skb_reset_mac_header(pDevice->skb);
1057                 pDevice->skb->pkt_type = PACKET_HOST;
1058                 pDevice->skb->protocol = htons(ETH_P_802_2);
1059                 memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1060                 netif_rx(pDevice->skb);
1061                 pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1062             }
1063 //2008-0409-07, <Add> by Einsn Liu
1064 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1065         //if(pDevice->bWPASuppWextEnabled == TRUE)
1066            {
1067                 BYTE buf[512];
1068                 size_t len;
1069                 union iwreq_data  wrqu;
1070                 int we_event;
1071
1072                 memset(buf, 0, 512);
1073
1074                 len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1075                 if(len) {
1076                         memcpy(buf, pMgmt->sAssocInfo.abyIEs, len);
1077                         memset(&wrqu, 0, sizeof (wrqu));
1078                         wrqu.data.length = len;
1079                         we_event = IWEVASSOCREQIE;
1080                         PRINT_K("wireless_send_event--->IWEVASSOCREQIE\n");
1081                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1082                 }
1083
1084                 memset(buf, 0, 512);
1085                 len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1086
1087                 if(len) {
1088                         memcpy(buf, pbyIEs, len);
1089                         memset(&wrqu, 0, sizeof (wrqu));
1090                         wrqu.data.length = len;
1091                         we_event = IWEVASSOCRESPIE;
1092                         PRINT_K("wireless_send_event--->IWEVASSOCRESPIE\n");
1093                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1094                 }
1095
1096            memset(&wrqu, 0, sizeof (wrqu));
1097         memcpy(wrqu.ap_addr.sa_data, &pMgmt->abyCurrBSSID[0], ETH_ALEN);
1098         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1099            PRINT_K("wireless_send_event--->SIOCGIWAP(associated)\n");
1100         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1101
1102         }
1103 #endif //#ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1104 //End Add -- //2008-0409-07, <Add> by Einsn Liu
1105         }
1106         else {
1107             if (bReAssocType) {
1108                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1109             }
1110             else {
1111                 // jump back to the auth state and indicate the error
1112                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1113             }
1114             s_vMgrLogStatus(pMgmt,cpu_to_le16((*(sFrame.pwStatus))));
1115         }
1116
1117     }
1118
1119 #if 1
1120 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1121 //need clear flags related to Networkmanager
1122               pDevice->bwextstep0 = FALSE;
1123               pDevice->bwextstep1 = FALSE;
1124               pDevice->bwextstep2 = FALSE;
1125               pDevice->bwextstep3 = FALSE;
1126               pDevice->bWPASuppWextEnabled = FALSE;
1127 #endif
1128 #endif
1129
1130 if(pMgmt->eCurrState == WMAC_STATE_ASSOC)
1131       timer_expire(pDevice->sTimerCommand, 0);
1132
1133     return;
1134 }
1135
1136
1137
1138 /*+
1139  *
1140  * Routine Description:
1141  *    Start the station authentication procedure.  Namely, send an
1142  *    authentication frame to the AP.
1143  *
1144  * Return Value:
1145  *    None.
1146  *
1147 -*/
1148
1149 VOID
1150 vMgrAuthenBeginSta(
1151     IN  HANDLE hDeviceContext,
1152     IN  PSMgmtObject  pMgmt,
1153     OUT PCMD_STATUS pStatus
1154     )
1155 {
1156     PSDevice     pDevice = (PSDevice)hDeviceContext;
1157     WLAN_FR_AUTHEN  sFrame;
1158     PSTxMgmtPacket  pTxPacket = NULL;
1159
1160     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1161     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1162     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1163     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1164     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1165     vMgrEncodeAuthen(&sFrame);
1166     /* insert values */
1167     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1168         (
1169         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1170         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)
1171         ));
1172     memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
1173     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1174     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1175     if (pMgmt->bShareKeyAlgorithm)
1176         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_SHAREDKEY);
1177     else
1178         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_OPENSYSTEM);
1179
1180     *(sFrame.pwAuthSequence) = cpu_to_le16(1);
1181     /* Adjust the length fields */
1182     pTxPacket->cbMPDULen = sFrame.len;
1183     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1184
1185     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1186     if (*pStatus == CMD_STATUS_PENDING){
1187         pMgmt->eCurrState = WMAC_STATE_AUTHPENDING;
1188         *pStatus = CMD_STATUS_SUCCESS;
1189     }
1190
1191     return ;
1192 }
1193
1194
1195
1196 /*+
1197  *
1198  * Routine Description:
1199  *    Start the station(AP) deauthentication procedure.  Namely, send an
1200  *    deauthentication frame to the AP or Sta.
1201  *
1202  * Return Value:
1203  *    None.
1204  *
1205 -*/
1206
1207 VOID
1208 vMgrDeAuthenBeginSta(
1209     IN  HANDLE hDeviceContext,
1210     IN  PSMgmtObject  pMgmt,
1211     IN  PBYTE  abyDestAddress,
1212     IN  WORD    wReason,
1213     OUT PCMD_STATUS pStatus
1214     )
1215 {
1216     PSDevice            pDevice = (PSDevice)hDeviceContext;
1217     WLAN_FR_DEAUTHEN    sFrame;
1218     PSTxMgmtPacket      pTxPacket = NULL;
1219
1220
1221     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1222     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DEAUTHEN_FR_MAXLEN);
1223     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1224     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1225     sFrame.len = WLAN_DEAUTHEN_FR_MAXLEN;
1226     vMgrEncodeDeauthen(&sFrame);
1227     /* insert values */
1228     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1229         (
1230         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1231         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DEAUTHEN)
1232         ));
1233
1234     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
1235     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1236     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1237
1238     *(sFrame.pwReason) = cpu_to_le16(wReason);       // deauthen. bcs left BSS
1239     /* Adjust the length fields */
1240     pTxPacket->cbMPDULen = sFrame.len;
1241     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1242
1243     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1244     if (*pStatus == CMD_STATUS_PENDING){
1245         *pStatus = CMD_STATUS_SUCCESS;
1246     }
1247
1248
1249     return ;
1250 }
1251
1252
1253 /*+
1254  *
1255  * Routine Description:
1256  *    Handle incoming authentication frames.
1257  *
1258  * Return Value:
1259  *    None.
1260  *
1261 -*/
1262
1263 static
1264 VOID
1265 s_vMgrRxAuthentication(
1266     IN PSDevice pDevice,
1267     IN PSMgmtObject pMgmt,
1268     IN PSRxMgmtPacket pRxPacket
1269     )
1270 {
1271     WLAN_FR_AUTHEN  sFrame;
1272
1273     // we better be an AP or a STA in AUTHPENDING otherwise ignore
1274     if (!(pMgmt->eCurrMode == WMAC_MODE_ESS_AP ||
1275           pMgmt->eCurrState == WMAC_STATE_AUTHPENDING)) {
1276         return;
1277     }
1278
1279     // decode the frame
1280     sFrame.len = pRxPacket->cbMPDULen;
1281     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1282     vMgrDecodeAuthen(&sFrame);
1283     switch (cpu_to_le16((*(sFrame.pwAuthSequence )))){
1284         case 1:
1285             //AP funciton
1286             s_vMgrRxAuthenSequence_1(pDevice,pMgmt, &sFrame);
1287             break;
1288         case 2:
1289             s_vMgrRxAuthenSequence_2(pDevice, pMgmt, &sFrame);
1290             break;
1291         case 3:
1292             //AP funciton
1293             s_vMgrRxAuthenSequence_3(pDevice, pMgmt, &sFrame);
1294             break;
1295         case 4:
1296             s_vMgrRxAuthenSequence_4(pDevice, pMgmt, &sFrame);
1297             break;
1298         default:
1299             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Auth Sequence error, seq = %d\n",
1300                         cpu_to_le16((*(sFrame.pwAuthSequence))));
1301             break;
1302     }
1303     return;
1304 }
1305
1306
1307
1308 /*+
1309  *
1310  * Routine Description:
1311  *   Handles incoming authen frames with sequence 1.  Currently
1312  *   assumes we're an AP.  So far, no one appears to use authentication
1313  *   in Ad-Hoc mode.
1314  *
1315  * Return Value:
1316  *    None.
1317  *
1318 -*/
1319
1320
1321 static
1322 VOID
1323 s_vMgrRxAuthenSequence_1(
1324     IN PSDevice pDevice,
1325     IN PSMgmtObject pMgmt,
1326     IN PWLAN_FR_AUTHEN pFrame
1327      )
1328 {
1329     PSTxMgmtPacket      pTxPacket = NULL;
1330     UINT                uNodeIndex;
1331     WLAN_FR_AUTHEN      sFrame;
1332     PSKeyItem           pTransmitKey;
1333
1334     // Insert a Node entry
1335     if (!BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1336         BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
1337         memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, pFrame->pHdr->sA3.abyAddr2,
1338                WLAN_ADDR_LEN);
1339     }
1340
1341     if (pMgmt->bShareKeyAlgorithm) {
1342         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_KNOWN;
1343         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 1;
1344     }
1345     else {
1346         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1347     }
1348
1349     // send auth reply
1350     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1351     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1352     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1353     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1354     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1355     // format buffer structure
1356     vMgrEncodeAuthen(&sFrame);
1357     // insert values
1358     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1359          (
1360          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1361          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1362          WLAN_SET_FC_ISWEP(0)
1363          ));
1364     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1365     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1366     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1367     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1368     *(sFrame.pwAuthSequence) = cpu_to_le16(2);
1369
1370     if (cpu_to_le16(*(pFrame->pwAuthAlgorithm)) == WLAN_AUTH_ALG_SHAREDKEY) {
1371         if (pMgmt->bShareKeyAlgorithm)
1372             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1373         else
1374             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1375     }
1376     else {
1377         if (pMgmt->bShareKeyAlgorithm)
1378             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1379         else
1380             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1381     }
1382
1383     if (pMgmt->bShareKeyAlgorithm &&
1384         (cpu_to_le16(*(sFrame.pwStatus)) == WLAN_MGMT_STATUS_SUCCESS)) {
1385
1386         sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1387         sFrame.len += WLAN_CHALLENGE_IE_LEN;
1388         sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1389         sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1390         memset(pMgmt->abyChallenge, 0, WLAN_CHALLENGE_LEN);
1391         // get group key
1392         if(KeybGetTransmitKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, GROUP_KEY, &pTransmitKey) == TRUE) {
1393             rc4_init(&pDevice->SBox, pDevice->abyPRNG, pTransmitKey->uKeyLength+3);
1394             rc4_encrypt(&pDevice->SBox, pMgmt->abyChallenge, pMgmt->abyChallenge, WLAN_CHALLENGE_LEN);
1395         }
1396         memcpy(sFrame.pChallenge->abyChallenge, pMgmt->abyChallenge , WLAN_CHALLENGE_LEN);
1397     }
1398
1399     /* Adjust the length fields */
1400     pTxPacket->cbMPDULen = sFrame.len;
1401     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1402     // send the frame
1403     if (pDevice->bEnableHostapd) {
1404         return;
1405     }
1406     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx.. \n");
1407     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1408         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx failed.\n");
1409     }
1410     return;
1411 }
1412
1413
1414
1415 /*+
1416  *
1417  * Routine Description:
1418  *   Handles incoming auth frames with sequence number 2.  Currently
1419  *   assumes we're a station.
1420  *
1421  *
1422  * Return Value:
1423  *    None.
1424  *
1425 -*/
1426
1427 static
1428 VOID
1429 s_vMgrRxAuthenSequence_2(
1430     IN PSDevice pDevice,
1431     IN PSMgmtObject pMgmt,
1432     IN PWLAN_FR_AUTHEN pFrame
1433     )
1434 {
1435     WLAN_FR_AUTHEN      sFrame;
1436     PSTxMgmtPacket      pTxPacket = NULL;
1437
1438
1439     switch (cpu_to_le16((*(pFrame->pwAuthAlgorithm))))
1440     {
1441         case WLAN_AUTH_ALG_OPENSYSTEM:
1442             if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1443                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Successful.\n");
1444                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1445                timer_expire(pDevice->sTimerCommand, 0);
1446             }
1447             else {
1448                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Failed.\n");
1449                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1450                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1451             }
1452             if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1453 //                spin_unlock_irq(&pDevice->lock);
1454 //                vCommandTimerWait((HANDLE)pDevice, 0);
1455 //                spin_lock_irq(&pDevice->lock);
1456             }
1457
1458             break;
1459
1460         case WLAN_AUTH_ALG_SHAREDKEY:
1461
1462             if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1463                 pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1464                 memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1465                 pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1466                 sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1467                 sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1468                 // format buffer structure
1469                 vMgrEncodeAuthen(&sFrame);
1470                 // insert values
1471                 sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1472                      (
1473                      WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1474                      WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1475                      WLAN_SET_FC_ISWEP(1)
1476                      ));
1477                 memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1478                 memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1479                 memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1480                 *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1481                 *(sFrame.pwAuthSequence) = cpu_to_le16(3);
1482                 *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1483                 sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1484                 sFrame.len += WLAN_CHALLENGE_IE_LEN;
1485                 sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1486                 sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1487                 memcpy( sFrame.pChallenge->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN);
1488                 // Adjust the length fields
1489                 pTxPacket->cbMPDULen = sFrame.len;
1490                 pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1491                 // send the frame
1492                 if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1493                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx failed.\n");
1494                 }
1495                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx ...\n");
1496             }
1497             else {
1498                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:rx Auth_reply sequence_2 status error ...\n");
1499                 if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1500 //                    spin_unlock_irq(&pDevice->lock);
1501 //                    vCommandTimerWait((HANDLE)pDevice, 0);
1502 //                    spin_lock_irq(&pDevice->lock);
1503                 }
1504                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1505             }
1506             break;
1507         default:
1508             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt: rx auth.seq = 2 unknown AuthAlgorithm=%d\n", cpu_to_le16((*(pFrame->pwAuthAlgorithm))));
1509             break;
1510     }
1511     return;
1512 }
1513
1514
1515
1516 /*+
1517  *
1518  * Routine Description:
1519  *   Handles incoming authen frames with sequence 3.  Currently
1520  *   assumes we're an AP.  This function assumes the frame has
1521  *   already been successfully decrypted.
1522  *
1523  *
1524  * Return Value:
1525  *    None.
1526  *
1527 -*/
1528
1529 static
1530 VOID
1531 s_vMgrRxAuthenSequence_3(
1532     IN PSDevice pDevice,
1533     IN PSMgmtObject pMgmt,
1534     IN PWLAN_FR_AUTHEN pFrame
1535     )
1536 {
1537     PSTxMgmtPacket      pTxPacket = NULL;
1538     UINT                uStatusCode = 0 ;
1539     UINT                uNodeIndex = 0;
1540     WLAN_FR_AUTHEN      sFrame;
1541
1542     if (!WLAN_GET_FC_ISWEP(pFrame->pHdr->sA3.wFrameCtl)) {
1543         uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1544         goto reply;
1545     }
1546     if (BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1547          if (pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence != 1) {
1548             uStatusCode = WLAN_MGMT_STATUS_RX_AUTH_NOSEQ;
1549             goto reply;
1550          }
1551          if (memcmp(pMgmt->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN) != 0) {
1552             uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1553             goto reply;
1554          }
1555     }
1556     else {
1557         uStatusCode = WLAN_MGMT_STATUS_UNSPEC_FAILURE;
1558         goto reply;
1559     }
1560
1561     if (uNodeIndex) {
1562         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1563         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 0;
1564     }
1565     uStatusCode = WLAN_MGMT_STATUS_SUCCESS;
1566     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Challenge text check ok..\n");
1567
1568 reply:
1569     // send auth reply
1570     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1571     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1572     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1573     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1574     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1575     // format buffer structure
1576     vMgrEncodeAuthen(&sFrame);
1577     /* insert values */
1578     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1579          (
1580          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1581          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1582          WLAN_SET_FC_ISWEP(0)
1583          ));
1584     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1585     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1586     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1587     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1588     *(sFrame.pwAuthSequence) = cpu_to_le16(4);
1589     *(sFrame.pwStatus) = cpu_to_le16(uStatusCode);
1590
1591     /* Adjust the length fields */
1592     pTxPacket->cbMPDULen = sFrame.len;
1593     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1594     // send the frame
1595     if (pDevice->bEnableHostapd) {
1596         return;
1597     }
1598     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1599         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_4 tx failed.\n");
1600     }
1601     return;
1602
1603 }
1604
1605
1606
1607 /*+
1608  *
1609  * Routine Description:
1610  *   Handles incoming authen frames with sequence 4
1611  *
1612  *
1613  * Return Value:
1614  *    None.
1615  *
1616 -*/
1617 static
1618 VOID
1619 s_vMgrRxAuthenSequence_4(
1620     IN PSDevice pDevice,
1621     IN PSMgmtObject pMgmt,
1622     IN PWLAN_FR_AUTHEN pFrame
1623     )
1624 {
1625
1626     if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1627         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Successful.\n");
1628         pMgmt->eCurrState = WMAC_STATE_AUTH;
1629         timer_expire(pDevice->sTimerCommand, 0);
1630     }
1631     else{
1632         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Failed.\n");
1633         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))) );
1634         pMgmt->eCurrState = WMAC_STATE_IDLE;
1635     }
1636
1637     if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1638 //        spin_unlock_irq(&pDevice->lock);
1639 //        vCommandTimerWait((HANDLE)pDevice, 0);
1640 //        spin_lock_irq(&pDevice->lock);
1641     }
1642
1643 }
1644
1645 /*+
1646  *
1647  * Routine Description:
1648  *   Handles incoming disassociation frames
1649  *
1650  *
1651  * Return Value:
1652  *    None.
1653  *
1654 -*/
1655
1656 static
1657 VOID
1658 s_vMgrRxDisassociation(
1659     IN PSDevice pDevice,
1660     IN PSMgmtObject pMgmt,
1661     IN PSRxMgmtPacket pRxPacket
1662     )
1663 {
1664     WLAN_FR_DISASSOC    sFrame;
1665     UINT        uNodeIndex = 0;
1666     CMD_STATUS          CmdStatus;
1667     viawget_wpa_header *wpahdr;
1668
1669     if ( pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1670         // if is acting an AP..
1671         // a STA is leaving this BSS..
1672         sFrame.len = pRxPacket->cbMPDULen;
1673         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1674         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1675             BSSvRemoveOneNode(pDevice, uNodeIndex);
1676         }
1677         else {
1678             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx disassoc, sta not found\n");
1679         }
1680     }
1681     else if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ){
1682         sFrame.len = pRxPacket->cbMPDULen;
1683         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1684         vMgrDecodeDisassociation(&sFrame);
1685         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP disassociated me, reason=%d.\n", cpu_to_le16(*(sFrame.pwReason)));
1686
1687           pDevice->fWPA_Authened = FALSE;
1688         if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1689              wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1690              wpahdr->type = VIAWGET_DISASSOC_MSG;
1691              wpahdr->resp_ie_len = 0;
1692              wpahdr->req_ie_len = 0;
1693              skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1694              pDevice->skb->dev = pDevice->wpadev;
1695              skb_reset_mac_header(pDevice->skb);
1696              pDevice->skb->pkt_type = PACKET_HOST;
1697              pDevice->skb->protocol = htons(ETH_P_802_2);
1698              memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1699              netif_rx(pDevice->skb);
1700              pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1701          };
1702
1703         //TODO: do something let upper layer know or
1704         //try to send associate packet again because of inactivity timeout
1705         if (pMgmt->eCurrState == WMAC_STATE_ASSOC) {
1706                 pDevice->bLinkPass = FALSE;
1707                 pMgmt->sNodeDBTable[0].bActive = FALSE;
1708                pDevice->byReAssocCount = 0;
1709                 pMgmt->eCurrState = WMAC_STATE_AUTH;  // jump back to the auth state!
1710                 pDevice->eCommandState = WLAN_ASSOCIATE_WAIT;
1711             vMgrReAssocBeginSta((PSDevice)pDevice, pMgmt, &CmdStatus);
1712               if(CmdStatus == CMD_STATUS_PENDING) {
1713                   pDevice->byReAssocCount ++;
1714                   return;       //mike add: you'll retry for many times, so it cann't be regarded as disconnected!
1715               }
1716         };
1717
1718    #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1719   // if(pDevice->bWPASuppWextEnabled == TRUE)
1720       {
1721         union iwreq_data  wrqu;
1722         memset(&wrqu, 0, sizeof (wrqu));
1723         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1724         PRINT_K("wireless_send_event--->SIOCGIWAP(disassociated)\n");
1725         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1726      }
1727   #endif
1728     }
1729     /* else, ignore it */
1730
1731     return;
1732 }
1733
1734
1735 /*+
1736  *
1737  * Routine Description:
1738  *   Handles incoming deauthentication frames
1739  *
1740  *
1741  * Return Value:
1742  *    None.
1743  *
1744 -*/
1745
1746 static
1747 VOID
1748 s_vMgrRxDeauthentication(
1749     IN PSDevice pDevice,
1750     IN PSMgmtObject pMgmt,
1751     IN PSRxMgmtPacket pRxPacket
1752     )
1753 {
1754     WLAN_FR_DEAUTHEN    sFrame;
1755     UINT        uNodeIndex = 0;
1756     viawget_wpa_header *wpahdr;
1757
1758
1759     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1760         //Todo:
1761         // if is acting an AP..
1762         // a STA is leaving this BSS..
1763         sFrame.len = pRxPacket->cbMPDULen;
1764         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1765         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1766             BSSvRemoveOneNode(pDevice, uNodeIndex);
1767         }
1768         else {
1769             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Rx deauth, sta not found\n");
1770         }
1771     }
1772     else {
1773         if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ) {
1774             sFrame.len = pRxPacket->cbMPDULen;
1775             sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1776             vMgrDecodeDeauthen(&sFrame);
1777            pDevice->fWPA_Authened = FALSE;
1778             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO  "AP deauthed me, reason=%d.\n", cpu_to_le16((*(sFrame.pwReason))));
1779             // TODO: update BSS list for specific BSSID if pre-authentication case
1780             if (IS_ETH_ADDRESS_EQUAL(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID)) {
1781                 if (pMgmt->eCurrState >= WMAC_STATE_AUTHPENDING) {
1782                     pMgmt->sNodeDBTable[0].bActive = FALSE;
1783                     pMgmt->eCurrMode = WMAC_MODE_STANDBY;
1784                     pMgmt->eCurrState = WMAC_STATE_IDLE;
1785                     netif_stop_queue(pDevice->dev);
1786                     pDevice->bLinkPass = FALSE;
1787                     ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_SLOW);
1788                 }
1789             };
1790
1791             if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1792                  wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1793                  wpahdr->type = VIAWGET_DISASSOC_MSG;
1794                  wpahdr->resp_ie_len = 0;
1795                  wpahdr->req_ie_len = 0;
1796                  skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1797                  pDevice->skb->dev = pDevice->wpadev;
1798                  skb_reset_mac_header(pDevice->skb);
1799                  pDevice->skb->pkt_type = PACKET_HOST;
1800                  pDevice->skb->protocol = htons(ETH_P_802_2);
1801                  memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1802                  netif_rx(pDevice->skb);
1803                  pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1804            };
1805
1806    #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1807   // if(pDevice->bWPASuppWextEnabled == TRUE)
1808       {
1809         union iwreq_data  wrqu;
1810         memset(&wrqu, 0, sizeof (wrqu));
1811         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1812         PRINT_K("wireless_send_event--->SIOCGIWAP(disauthen)\n");
1813         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1814      }
1815   #endif
1816
1817         }
1818         /* else, ignore it.  TODO: IBSS authentication service
1819             would be implemented here */
1820     };
1821     return;
1822 }
1823
1824 //2008-0730-01<Add>by MikeLiu
1825 /*+
1826  *
1827  * Routine Description:
1828  * check if current channel is match ZoneType.
1829  *for USA:1~11;
1830  *      Japan:1~13;
1831  *      Europe:1~13
1832  * Return Value:
1833  *               True:exceed;
1834  *                False:normal case
1835 -*/
1836 static BOOL
1837 ChannelExceedZoneType(
1838     IN PSDevice pDevice,
1839     IN BYTE byCurrChannel
1840     )
1841 {
1842   BOOL exceed=FALSE;
1843
1844   switch(pDevice->byZoneType) {
1845         case 0x00:                  //USA:1~11
1846                      if((byCurrChannel<1) ||(byCurrChannel>11))
1847                         exceed = TRUE;
1848                  break;
1849         case 0x01:                  //Japan:1~13
1850         case 0x02:                  //Europe:1~13
1851                      if((byCurrChannel<1) ||(byCurrChannel>13))
1852                         exceed = TRUE;
1853                  break;
1854         default:                    //reserve for other zonetype
1855                 break;
1856   }
1857
1858   return exceed;
1859 }
1860
1861 /*+
1862  *
1863  * Routine Description:
1864  *   Handles and analysis incoming beacon frames.
1865  *
1866  *
1867  * Return Value:
1868  *    None.
1869  *
1870 -*/
1871
1872 static
1873 VOID
1874 s_vMgrRxBeacon(
1875     IN PSDevice pDevice,
1876     IN PSMgmtObject pMgmt,
1877     IN PSRxMgmtPacket pRxPacket,
1878     IN BOOL bInScan
1879     )
1880 {
1881
1882     PKnownBSS           pBSSList;
1883     WLAN_FR_BEACON      sFrame;
1884     QWORD               qwTSFOffset;
1885     BOOL                bIsBSSIDEqual = FALSE;
1886     BOOL                bIsSSIDEqual = FALSE;
1887     BOOL                bTSFLargeDiff = FALSE;
1888     BOOL                bTSFOffsetPostive = FALSE;
1889     BOOL                bUpdateTSF = FALSE;
1890     BOOL                bIsAPBeacon = FALSE;
1891     BOOL                bIsChannelEqual = FALSE;
1892     UINT                uLocateByteIndex;
1893     BYTE                byTIMBitOn = 0;
1894     WORD                wAIDNumber = 0;
1895     UINT                uNodeIndex;
1896     QWORD               qwTimestamp, qwLocalTSF;
1897     QWORD               qwCurrTSF;
1898     WORD                wStartIndex = 0;
1899     WORD                wAIDIndex = 0;
1900     BYTE                byCurrChannel = pRxPacket->byRxChannel;
1901     ERPObject           sERP;
1902     UINT                uRateLen = WLAN_RATES_MAXLEN;
1903     BOOL                bChannelHit = FALSE;
1904     BYTE                byOldPreambleType;
1905
1906
1907
1908      if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)
1909         return;
1910
1911     memset(&sFrame, 0, sizeof(WLAN_FR_BEACON));
1912     sFrame.len = pRxPacket->cbMPDULen;
1913     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1914
1915     // decode the beacon frame
1916     vMgrDecodeBeacon(&sFrame);
1917
1918     if ((sFrame.pwBeaconInterval == 0) ||
1919         (sFrame.pwCapInfo == 0) ||
1920         (sFrame.pSSID == 0) ||
1921         (sFrame.pSuppRates == 0) ) {
1922         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx beacon frame error\n");
1923         return;
1924     };
1925
1926
1927     if( byCurrChannel > CB_MAX_CHANNEL_24G )
1928     {
1929         if (sFrame.pDSParms != NULL) {
1930             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
1931                 bChannelHit = TRUE;
1932             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
1933         } else {
1934             bChannelHit = TRUE;
1935         }
1936
1937     } else {
1938         if (sFrame.pDSParms != NULL) {
1939             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
1940                 bChannelHit = TRUE;
1941             byCurrChannel = sFrame.pDSParms->byCurrChannel;
1942         } else {
1943             bChannelHit = TRUE;
1944         }
1945     }
1946
1947 //2008-0730-01<Add>by MikeLiu
1948 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
1949       return;
1950
1951     if (sFrame.pERP != NULL) {
1952         sERP.byERP = sFrame.pERP->byContext;
1953         sERP.bERPExist = TRUE;
1954
1955     } else {
1956         sERP.bERPExist = FALSE;
1957         sERP.byERP = 0;
1958     }
1959
1960     pBSSList = BSSpAddrIsInBSSList((HANDLE)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
1961     if (pBSSList == NULL) {
1962         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon/insert: RxChannel = : %d\n", byCurrChannel);
1963         BSSbInsertToBSSList((HANDLE)pDevice,
1964                             sFrame.pHdr->sA3.abyAddr3,
1965                             *sFrame.pqwTimestamp,
1966                             *sFrame.pwBeaconInterval,
1967                             *sFrame.pwCapInfo,
1968                             byCurrChannel,
1969                             sFrame.pSSID,
1970                             sFrame.pSuppRates,
1971                             sFrame.pExtSuppRates,
1972                             &sERP,
1973                             sFrame.pRSN,
1974                             sFrame.pRSNWPA,
1975                             sFrame.pIE_Country,
1976                             sFrame.pIE_Quiet,
1977                             sFrame.len - WLAN_HDR_ADDR3_LEN,
1978                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
1979                             (HANDLE)pRxPacket
1980                            );
1981     }
1982     else {
1983 //        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"update bcn: RxChannel = : %d\n", byCurrChannel);
1984         BSSbUpdateToBSSList((HANDLE)pDevice,
1985                             *sFrame.pqwTimestamp,
1986                             *sFrame.pwBeaconInterval,
1987                             *sFrame.pwCapInfo,
1988                             byCurrChannel,
1989                             bChannelHit,
1990                             sFrame.pSSID,
1991                             sFrame.pSuppRates,
1992                             sFrame.pExtSuppRates,
1993                             &sERP,
1994                             sFrame.pRSN,
1995                             sFrame.pRSNWPA,
1996                             sFrame.pIE_Country,
1997                             sFrame.pIE_Quiet,
1998                             pBSSList,
1999                             sFrame.len - WLAN_HDR_ADDR3_LEN,
2000                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
2001                             (HANDLE)pRxPacket
2002                            );
2003
2004     }
2005
2006     if (bInScan) {
2007         return;
2008     }
2009
2010     if(byCurrChannel == (BYTE)pMgmt->uCurrChannel)
2011        bIsChannelEqual = TRUE;
2012
2013     if (bIsChannelEqual && (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)) {
2014
2015         // if rx beacon without ERP field
2016         if (sERP.bERPExist) {
2017             if (WLAN_GET_ERP_USE_PROTECTION(sERP.byERP)){
2018                 pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
2019                 pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
2020             }
2021         }
2022         else {
2023             pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
2024             pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
2025         }
2026
2027         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2028             if(!WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo))
2029                 pDevice->byERPFlag |= WLAN_SET_ERP_BARKER_MODE(1);
2030             if(!sERP.bERPExist)
2031                 pDevice->byERPFlag |= WLAN_SET_ERP_NONERP_PRESENT(1);
2032         }
2033     }
2034
2035     // check if BSSID the same
2036     if (memcmp(sFrame.pHdr->sA3.abyAddr3,
2037                pMgmt->abyCurrBSSID,
2038                WLAN_BSSID_LEN) == 0) {
2039
2040         bIsBSSIDEqual = TRUE;
2041         pDevice->uCurrRSSI = pRxPacket->uRSSI;
2042         pDevice->byCurrSQ = pRxPacket->bySQ;
2043         if (pMgmt->sNodeDBTable[0].uInActiveCount != 0) {
2044             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2045             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"BCN:Wake Count= [%d]\n", pMgmt->wCountToWakeUp);
2046         }
2047     }
2048     // check if SSID the same
2049     if (sFrame.pSSID->len == ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) {
2050         if (memcmp(sFrame.pSSID->abySSID,
2051                    ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
2052                    sFrame.pSSID->len
2053                    ) == 0) {
2054             bIsSSIDEqual = TRUE;
2055         };
2056     }
2057
2058     if ((WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)== TRUE) &&
2059         (bIsBSSIDEqual == TRUE) &&
2060         (bIsSSIDEqual == TRUE) &&
2061         (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
2062         (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
2063         // add state check to prevent reconnect fail since we'll receive Beacon
2064
2065         bIsAPBeacon = TRUE;
2066         if (pBSSList != NULL) {
2067
2068                 // Sync ERP field
2069                 if ((pBSSList->sERP.bERPExist == TRUE) && (pDevice->byBBType == BB_TYPE_11G)) {
2070                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2071                         pDevice->bProtectMode = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2072                         if (pDevice->bProtectMode) {
2073                             MACvEnableProtectMD(pDevice);
2074                         } else {
2075                             MACvDisableProtectMD(pDevice);
2076                         }
2077                         vUpdateIFS(pDevice);
2078                     }
2079                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2080                         pDevice->bNonERPPresent = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2081                     }
2082                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2083                         pDevice->bBarkerPreambleMd = (pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2084                         //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2085                         if (pDevice->bBarkerPreambleMd) {
2086                             MACvEnableBarkerPreambleMd(pDevice);
2087                         } else {
2088                             MACvDisableBarkerPreambleMd(pDevice);
2089                         }
2090                     }
2091                 }
2092                 // Sync Short Slot Time
2093                 if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo) != pDevice->bShortSlotTime) {
2094                     BOOL    bShortSlotTime;
2095
2096                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo);
2097                     //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2098                     //Kyle check if it is OK to set G.
2099                     if (pDevice->byBBType == BB_TYPE_11A) {
2100                         bShortSlotTime = TRUE;
2101                     }
2102                     else if (pDevice->byBBType == BB_TYPE_11B) {
2103                         bShortSlotTime = FALSE;
2104                     }
2105                     if (bShortSlotTime != pDevice->bShortSlotTime) {
2106                         pDevice->bShortSlotTime = bShortSlotTime;
2107                         BBvSetShortSlotTime(pDevice);
2108                         vUpdateIFS(pDevice);
2109                     }
2110                 }
2111
2112                 //
2113                 // Preamble may change dynamiclly
2114                 //
2115                 byOldPreambleType = pDevice->byPreambleType;
2116                 if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pBSSList->wCapInfo)) {
2117                     pDevice->byPreambleType = pDevice->byShortPreamble;
2118                 }
2119                 else {
2120                     pDevice->byPreambleType = 0;
2121                 }
2122                 if (pDevice->byPreambleType != byOldPreambleType)
2123                     CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2124             //
2125             // Basic Rate Set may change dynamiclly
2126             //
2127             if (pBSSList->eNetworkTypeInUse == PHY_TYPE_11B) {
2128                 uRateLen = WLAN_RATES_MAXLEN_11B;
2129             }
2130             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abySuppRates,
2131                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2132                                                     uRateLen);
2133             pMgmt->abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abyExtSuppRates,
2134                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
2135                                                     uRateLen);
2136             RATEvParseMaxRate( (PVOID)pDevice,
2137                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2138                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
2139                                TRUE,
2140                                &(pMgmt->sNodeDBTable[0].wMaxBasicRate),
2141                                &(pMgmt->sNodeDBTable[0].wMaxSuppRate),
2142                                &(pMgmt->sNodeDBTable[0].wSuppRate),
2143                                &(pMgmt->sNodeDBTable[0].byTopCCKBasicRate),
2144                                &(pMgmt->sNodeDBTable[0].byTopOFDMBasicRate)
2145                               );
2146
2147         }
2148     }
2149
2150 //    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon 2 \n");
2151     // check if CF field exisit
2152     if (WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)) {
2153         if (sFrame.pCFParms->wCFPDurRemaining > 0) {
2154             // TODO: deal with CFP period to set NAV
2155         };
2156     };
2157
2158     HIDWORD(qwTimestamp) = cpu_to_le32(HIDWORD(*sFrame.pqwTimestamp));
2159     LODWORD(qwTimestamp) = cpu_to_le32(LODWORD(*sFrame.pqwTimestamp));
2160     HIDWORD(qwLocalTSF) = HIDWORD(pRxPacket->qwLocalTSF);
2161     LODWORD(qwLocalTSF) = LODWORD(pRxPacket->qwLocalTSF);
2162
2163     // check if beacon TSF larger or small than our local TSF
2164     if (HIDWORD(qwTimestamp) == HIDWORD(qwLocalTSF)) {
2165         if (LODWORD(qwTimestamp) >= LODWORD(qwLocalTSF)) {
2166             bTSFOffsetPostive = TRUE;
2167         }
2168         else {
2169             bTSFOffsetPostive = FALSE;
2170         }
2171     }
2172     else if (HIDWORD(qwTimestamp) > HIDWORD(qwLocalTSF)) {
2173         bTSFOffsetPostive = TRUE;
2174     }
2175     else if (HIDWORD(qwTimestamp) < HIDWORD(qwLocalTSF)) {
2176         bTSFOffsetPostive = FALSE;
2177     };
2178
2179     if (bTSFOffsetPostive) {
2180         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwTimestamp), (qwLocalTSF));
2181     }
2182     else {
2183         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwLocalTSF), (qwTimestamp));
2184     }
2185
2186     if (HIDWORD(qwTSFOffset) != 0 ||
2187         (LODWORD(qwTSFOffset) > TRIVIAL_SYNC_DIFFERENCE )) {
2188          bTSFLargeDiff = TRUE;
2189     }
2190
2191
2192     // if infra mode
2193     if (bIsAPBeacon == TRUE) {
2194
2195         // Infra mode: Local TSF always follow AP's TSF if Difference huge.
2196         if (bTSFLargeDiff)
2197             bUpdateTSF = TRUE;
2198
2199         if ((pDevice->bEnablePSMode == TRUE) &&(sFrame.pTIM != 0)) {
2200
2201             // deal with DTIM, analysis TIM
2202             pMgmt->bMulticastTIM = WLAN_MGMT_IS_MULTICAST_TIM(sFrame.pTIM->byBitMapCtl) ? TRUE : FALSE ;
2203             pMgmt->byDTIMCount = sFrame.pTIM->byDTIMCount;
2204             pMgmt->byDTIMPeriod = sFrame.pTIM->byDTIMPeriod;
2205             wAIDNumber = pMgmt->wCurrAID & ~(BIT14|BIT15);
2206
2207             // check if AID in TIM field bit on
2208             // wStartIndex = N1
2209             wStartIndex = WLAN_MGMT_GET_TIM_OFFSET(sFrame.pTIM->byBitMapCtl) << 1;
2210             // AIDIndex = N2
2211             wAIDIndex = (wAIDNumber >> 3);
2212             if ((wAIDNumber > 0) && (wAIDIndex >= wStartIndex)) {
2213                 uLocateByteIndex = wAIDIndex - wStartIndex;
2214                 // len = byDTIMCount + byDTIMPeriod + byDTIMPeriod + byVirtBitMap[0~250]
2215                 if (sFrame.pTIM->len >= (uLocateByteIndex + 4)) {
2216                     byTIMBitOn  = (0x01) << ((wAIDNumber) % 8);
2217                     pMgmt->bInTIM = sFrame.pTIM->byVirtBitMap[uLocateByteIndex] & byTIMBitOn ? TRUE : FALSE;
2218                 }
2219                 else {
2220                     pMgmt->bInTIM = FALSE;
2221                 };
2222             }
2223             else {
2224                 pMgmt->bInTIM = FALSE;
2225             };
2226
2227             if (pMgmt->bInTIM ||
2228                 (pMgmt->bMulticastTIM && (pMgmt->byDTIMCount == 0))) {
2229                 pMgmt->bInTIMWake = TRUE;
2230                 // send out ps-poll packet
2231 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:In TIM\n");
2232                 if (pMgmt->bInTIM) {
2233                     PSvSendPSPOLL((PSDevice)pDevice);
2234 //                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:PS-POLL sent..\n");
2235                 };
2236
2237             }
2238             else {
2239                 pMgmt->bInTIMWake = FALSE;
2240                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Not In TIM..\n");
2241                 if (pDevice->bPWBitOn == FALSE) {
2242                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Send Null Packet\n");
2243                     if (PSbSendNullPacket(pDevice))
2244                         pDevice->bPWBitOn = TRUE;
2245                 }
2246                 if(PSbConsiderPowerDown(pDevice, FALSE, FALSE)) {
2247                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Power down now...\n");
2248                 };
2249             }
2250
2251         }
2252
2253     }
2254     // if adhoc mode
2255     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && !bIsAPBeacon && bIsChannelEqual) {
2256         if (bIsBSSIDEqual) {
2257             // Use sNodeDBTable[0].uInActiveCount as IBSS beacons received count.
2258                     if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
2259                             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2260
2261             // adhoc mode:TSF updated only when beacon larger then local TSF
2262             if (bTSFLargeDiff && bTSFOffsetPostive &&
2263                 (pMgmt->eCurrState == WMAC_STATE_JOINTED))
2264                 bUpdateTSF = TRUE;
2265
2266             // During dpc, already in spinlocked.
2267             if (BSSbIsSTAInNodeDB(pDevice, sFrame.pHdr->sA3.abyAddr2, &uNodeIndex)) {
2268
2269                 // Update the STA, (Techically the Beacons of all the IBSS nodes
2270                         // should be identical, but that's not happening in practice.
2271                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2272                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2273                                                         WLAN_RATES_MAXLEN_11B);
2274                 RATEvParseMaxRate( (PVOID)pDevice,
2275                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2276                                    NULL,
2277                                    TRUE,
2278                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2279                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2280                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2281                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2282                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2283                                   );
2284                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2285                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2286                 pMgmt->sNodeDBTable[uNodeIndex].uInActiveCount = 0;
2287             }
2288             else {
2289                 // Todo, initial Node content
2290                 BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
2291
2292                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2293                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2294                                                         WLAN_RATES_MAXLEN_11B);
2295                 RATEvParseMaxRate( (PVOID)pDevice,
2296                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2297                                    NULL,
2298                                    TRUE,
2299                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2300                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2301                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2302                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2303                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2304                                  );
2305
2306                 memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, sFrame.pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
2307                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2308                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate = pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
2309 /*
2310                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2311                 if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
2312                        pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
2313 */
2314             }
2315
2316             // if other stations jointed, indicate connect to upper layer..
2317             if (pMgmt->eCurrState == WMAC_STATE_STARTED) {
2318                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Current IBSS State: [Started]........to: [Jointed] \n");
2319                 pMgmt->eCurrState = WMAC_STATE_JOINTED;
2320                 pDevice->bLinkPass = TRUE;
2321                 ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2322                 if (netif_queue_stopped(pDevice->dev)){
2323                     netif_wake_queue(pDevice->dev);
2324                 }
2325                 pMgmt->sNodeDBTable[0].bActive = TRUE;
2326                 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2327
2328             };
2329         }
2330         else if (bIsSSIDEqual) {
2331
2332             // See other adhoc sta with the same SSID but BSSID is different.
2333             // adpot this vars only when TSF larger then us.
2334             if (bTSFLargeDiff && bTSFOffsetPostive) {
2335                  // we don't support ATIM under adhoc mode
2336                // if ( sFrame.pIBSSParms->wATIMWindow == 0) {
2337                      // adpot this vars
2338                      // TODO: check sFrame cap if privacy on, and support rate syn
2339                      memcpy(pMgmt->abyCurrBSSID, sFrame.pHdr->sA3.abyAddr3, WLAN_BSSID_LEN);
2340                      memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
2341                      pMgmt->wCurrATIMWindow = cpu_to_le16(sFrame.pIBSSParms->wATIMWindow);
2342                      pMgmt->wCurrBeaconPeriod = cpu_to_le16(*sFrame.pwBeaconInterval);
2343                      pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2344                                                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2345                                                       WLAN_RATES_MAXLEN_11B);
2346                      // set HW beacon interval and re-synchronizing....
2347                      DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rejoining to Other Adhoc group with same SSID........\n");
2348
2349                      MACvWriteBeaconInterval(pDevice, pMgmt->wCurrBeaconPeriod);
2350                      CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp, pRxPacket->qwLocalTSF);
2351                      CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2352
2353                      // Turn off bssid filter to avoid filter others adhoc station which bssid is different.
2354                      MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2355
2356                     byOldPreambleType = pDevice->byPreambleType;
2357                     if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo)) {
2358                         pDevice->byPreambleType = pDevice->byShortPreamble;
2359                     }
2360                     else {
2361                         pDevice->byPreambleType = 0;
2362                     }
2363                     if (pDevice->byPreambleType != byOldPreambleType)
2364                         CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2365
2366
2367                      // MACvRegBitsOff(pDevice->PortOffset, MAC_REG_RCR, RCR_BSSID);
2368                      // set highest basic rate
2369                      // s_vSetHighestBasicRate(pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates);
2370                      // Prepare beacon frame
2371                      bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt);
2372               //  }
2373             };
2374         }
2375     };
2376     // endian issue ???
2377     // Update TSF
2378     if (bUpdateTSF) {
2379         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2380         CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp , pRxPacket->qwLocalTSF);
2381         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2382         CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2383     }
2384
2385     return;
2386 }
2387
2388
2389
2390 /*+
2391  *
2392  * Routine Description:
2393  *   Instructs the hw to create a bss using the supplied
2394  *   attributes. Note that this implementation only supports Ad-Hoc
2395  *   BSS creation.
2396  *
2397  *
2398  * Return Value:
2399  *    CMD_STATUS
2400  *
2401 -*/
2402 VOID
2403 vMgrCreateOwnIBSS(
2404     IN  HANDLE hDeviceContext,
2405     OUT PCMD_STATUS pStatus
2406     )
2407 {
2408     PSDevice            pDevice = (PSDevice)hDeviceContext;
2409     PSMgmtObject        pMgmt = &(pDevice->sMgmtObj);
2410     WORD                wMaxBasicRate;
2411     WORD                wMaxSuppRate;
2412     BYTE                byTopCCKBasicRate;
2413     BYTE                byTopOFDMBasicRate;
2414     QWORD               qwCurrTSF;
2415     UINT                ii;
2416     BYTE    abyRATE[] = {0x82, 0x84, 0x8B, 0x96, 0x24, 0x30, 0x48, 0x6C, 0x0C, 0x12, 0x18, 0x60};
2417     BYTE    abyCCK_RATE[] = {0x82, 0x84, 0x8B, 0x96};
2418     BYTE    abyOFDM_RATE[] = {0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2419     WORD                wSuppRate;
2420
2421
2422
2423     HIDWORD(qwCurrTSF) = 0;
2424     LODWORD(qwCurrTSF) = 0;
2425
2426     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Create Basic Service Set .......\n");
2427
2428     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2429         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) &&
2430             (pDevice->eEncryptionStatus != Ndis802_11Encryption2Enabled) &&
2431             (pDevice->eEncryptionStatus != Ndis802_11Encryption3Enabled)) {
2432             // encryption mode error
2433             *pStatus = CMD_STATUS_FAILURE;
2434             return;
2435         }
2436     }
2437
2438     pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2439     pMgmt->abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
2440
2441     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2442         pMgmt->eCurrentPHYMode = pMgmt->byAPBBType;
2443     } else {
2444         if (pDevice->byBBType == BB_TYPE_11G)
2445             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
2446         if (pDevice->byBBType == BB_TYPE_11B)
2447             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
2448         if (pDevice->byBBType == BB_TYPE_11A)
2449             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
2450     }
2451
2452     if (pMgmt->eCurrentPHYMode != PHY_TYPE_11A) {
2453         pMgmt->abyCurrSuppRates[1] = WLAN_RATES_MAXLEN_11B;
2454         pMgmt->abyCurrExtSuppRates[1] = 0;
2455         for (ii = 0; ii < 4; ii++)
2456             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2457     } else {
2458         pMgmt->abyCurrSuppRates[1] = 8;
2459         pMgmt->abyCurrExtSuppRates[1] = 0;
2460         for (ii = 0; ii < 8; ii++)
2461             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2462     }
2463
2464
2465     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
2466         pMgmt->abyCurrSuppRates[1] = 8;
2467         pMgmt->abyCurrExtSuppRates[1] = 4;
2468         for (ii = 0; ii < 4; ii++)
2469             pMgmt->abyCurrSuppRates[2+ii] =  abyCCK_RATE[ii];
2470         for (ii = 4; ii < 8; ii++)
2471             pMgmt->abyCurrSuppRates[2+ii] =  abyOFDM_RATE[ii-4];
2472         for (ii = 0; ii < 4; ii++)
2473             pMgmt->abyCurrExtSuppRates[2+ii] =  abyOFDM_RATE[ii+4];
2474     }
2475
2476
2477     // Disable Protect Mode
2478     pDevice->bProtectMode = 0;
2479     MACvDisableProtectMD(pDevice);
2480
2481     pDevice->bBarkerPreambleMd = 0;
2482     MACvDisableBarkerPreambleMd(pDevice);
2483
2484     // Kyle Test 2003.11.04
2485
2486     // set HW beacon interval
2487     if (pMgmt->wIBSSBeaconPeriod == 0)
2488         pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
2489     MACvWriteBeaconInterval(pDevice, pMgmt->wIBSSBeaconPeriod);
2490
2491     CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2492     // clear TSF counter
2493     CARDbClearCurrentTSF(pDevice);
2494
2495     // enable TSF counter
2496     MACvRegBitsOn(pDevice,MAC_REG_TFTCTL,TFTCTL_TSFCNTREN);
2497     // set Next TBTT
2498     CARDvSetFirstNextTBTT(pDevice, pMgmt->wIBSSBeaconPeriod);
2499
2500     pMgmt->uIBSSChannel = pDevice->uChannel;
2501
2502     if (pMgmt->uIBSSChannel == 0)
2503         pMgmt->uIBSSChannel = DEFAULT_IBSS_CHANNEL;
2504
2505     // set channel and clear NAV
2506     CARDbSetMediaChannel(pDevice, pMgmt->uIBSSChannel);
2507     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2508
2509     pDevice->byPreambleType = pDevice->byShortPreamble;
2510
2511     // set basic rate
2512
2513     RATEvParseMaxRate((PVOID)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2514                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates, TRUE,
2515                       &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2516                       &byTopCCKBasicRate, &byTopOFDMBasicRate);
2517
2518
2519
2520     if (pDevice->byBBType == BB_TYPE_11A) {
2521         pDevice->bShortSlotTime = TRUE;
2522     } else {
2523         pDevice->bShortSlotTime = FALSE;
2524     }
2525     BBvSetShortSlotTime(pDevice);
2526     // vUpdateIFS() use pDevice->bShortSlotTime as parameter so it must be called
2527     // after setting ShortSlotTime.
2528     // CARDvSetBSSMode call vUpdateIFS()
2529     CARDvSetBSSMode(pDevice);
2530
2531     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2532         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_AP);
2533         pMgmt->eCurrMode = WMAC_MODE_ESS_AP;
2534     }
2535
2536     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2537         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
2538         pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2539     }
2540
2541     // Adopt pre-configured IBSS vars to current vars
2542     pMgmt->eCurrState = WMAC_STATE_STARTED;
2543     pMgmt->wCurrBeaconPeriod = pMgmt->wIBSSBeaconPeriod;
2544     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2545     pMgmt->wCurrATIMWindow = pMgmt->wIBSSATIMWindow;
2546     pDevice->uCurrRSSI = 0;
2547     pDevice->byCurrSQ = 0;
2548
2549 //20080131-04,<Add> by Mike Liu
2550 #ifdef Adhoc_STA
2551     memcpy(pMgmt->abyDesireSSID,pMgmt->abyAdHocSSID,
2552                       ((PWLAN_IE_SSID)pMgmt->abyAdHocSSID)->len + WLAN_IEHDR_LEN);
2553 #endif
2554
2555     memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2556     memcpy(pMgmt->abyCurrSSID,
2557            pMgmt->abyDesireSSID,
2558            ((PWLAN_IE_SSID)pMgmt->abyDesireSSID)->len + WLAN_IEHDR_LEN
2559           );
2560
2561     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2562         // AP mode BSSID = MAC addr
2563         memcpy(pMgmt->abyCurrBSSID, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
2564         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"AP beacon created BSSID:%02x-%02x-%02x-%02x-%02x-%02x \n",
2565                       pMgmt->abyCurrBSSID[0],
2566                       pMgmt->abyCurrBSSID[1],
2567                       pMgmt->abyCurrBSSID[2],
2568                       pMgmt->abyCurrBSSID[3],
2569                       pMgmt->abyCurrBSSID[4],
2570                       pMgmt->abyCurrBSSID[5]
2571                     );
2572     }
2573
2574     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2575
2576         // BSSID selected must be randomized as spec 11.1.3
2577         pMgmt->abyCurrBSSID[5] = (BYTE) (LODWORD(qwCurrTSF)& 0x000000ff);
2578         pMgmt->abyCurrBSSID[4] = (BYTE)((LODWORD(qwCurrTSF)& 0x0000ff00) >> 8);
2579         pMgmt->abyCurrBSSID[3] = (BYTE)((LODWORD(qwCurrTSF)& 0x00ff0000) >> 16);
2580         pMgmt->abyCurrBSSID[2] = (BYTE)((LODWORD(qwCurrTSF)& 0x00000ff0) >> 4);
2581         pMgmt->abyCurrBSSID[1] = (BYTE)((LODWORD(qwCurrTSF)& 0x000ff000) >> 12);
2582         pMgmt->abyCurrBSSID[0] = (BYTE)((LODWORD(qwCurrTSF)& 0x0ff00000) >> 20);
2583         pMgmt->abyCurrBSSID[5] ^= pMgmt->abyMACAddr[0];
2584         pMgmt->abyCurrBSSID[4] ^= pMgmt->abyMACAddr[1];
2585         pMgmt->abyCurrBSSID[3] ^= pMgmt->abyMACAddr[2];
2586         pMgmt->abyCurrBSSID[2] ^= pMgmt->abyMACAddr[3];
2587         pMgmt->abyCurrBSSID[1] ^= pMgmt->abyMACAddr[4];
2588         pMgmt->abyCurrBSSID[0] ^= pMgmt->abyMACAddr[5];
2589         pMgmt->abyCurrBSSID[0] &= ~IEEE_ADDR_GROUP;
2590         pMgmt->abyCurrBSSID[0] |= IEEE_ADDR_UNIVERSAL;
2591
2592
2593         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"Adhoc beacon created bssid:%02x-%02x-%02x-%02x-%02x-%02x \n",
2594                       pMgmt->abyCurrBSSID[0],
2595                       pMgmt->abyCurrBSSID[1],
2596                       pMgmt->abyCurrBSSID[2],
2597                       pMgmt->abyCurrBSSID[3],
2598                       pMgmt->abyCurrBSSID[4],
2599                       pMgmt->abyCurrBSSID[5]
2600                     );
2601     }
2602
2603     // set BSSID filter
2604     MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2605     memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
2606
2607     MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
2608     pDevice->byRxMode |= RCR_BSSID;
2609     pMgmt->bCurrBSSIDFilterOn = TRUE;
2610
2611     // Set Capability Info
2612     pMgmt->wCurrCapInfo = 0;
2613
2614     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2615         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
2616         pMgmt->byDTIMPeriod = DEFAULT_DTIM_PERIOD;
2617         pMgmt->byDTIMCount = pMgmt->byDTIMPeriod - 1;
2618         pDevice->eOPMode = OP_MODE_AP;
2619     }
2620
2621     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2622         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_IBSS(1);
2623         pDevice->eOPMode = OP_MODE_ADHOC;
2624     }
2625
2626     if (pDevice->bEncryptionEnable) {
2627         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
2628         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2629             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2630                 pMgmt->byCSSPK = KEY_CTL_CCMP;
2631                 pMgmt->byCSSGK = KEY_CTL_CCMP;
2632             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2633                 pMgmt->byCSSPK = KEY_CTL_TKIP;
2634                 pMgmt->byCSSGK = KEY_CTL_TKIP;
2635             } else {
2636                 pMgmt->byCSSPK = KEY_CTL_NONE;
2637                 pMgmt->byCSSGK = KEY_CTL_WEP;
2638             }
2639         } else {
2640             pMgmt->byCSSPK = KEY_CTL_WEP;
2641             pMgmt->byCSSGK = KEY_CTL_WEP;
2642         }
2643     };
2644
2645     pMgmt->byERPContext = 0;
2646
2647     if (pDevice->byPreambleType == 1) {
2648         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
2649     } else {
2650         pMgmt->wCurrCapInfo &= (~WLAN_SET_CAP_INFO_SHORTPREAMBLE(1));
2651     }
2652
2653     pMgmt->eCurrState = WMAC_STATE_STARTED;
2654     // Prepare beacon to send
2655     if (bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt)) {
2656         *pStatus = CMD_STATUS_SUCCESS;
2657     }
2658     return ;
2659 }
2660
2661
2662
2663 /*+
2664  *
2665  * Routine Description:
2666  *   Instructs wmac to join a bss using the supplied attributes.
2667  *   The arguments may the BSSID or SSID and the rest of the
2668  *   attributes are obtained from the scan result of known bss list.
2669  *
2670  *
2671  * Return Value:
2672  *    None.
2673  *
2674 -*/
2675
2676 VOID
2677 vMgrJoinBSSBegin(
2678     IN  HANDLE hDeviceContext,
2679     OUT PCMD_STATUS pStatus
2680     )
2681 {
2682
2683     PSDevice     pDevice = (PSDevice)hDeviceContext;
2684     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
2685     PKnownBSS       pCurr = NULL;
2686     UINT            ii, uu;
2687     PWLAN_IE_SUPP_RATES pItemRates = NULL;
2688     PWLAN_IE_SUPP_RATES pItemExtRates = NULL;
2689     PWLAN_IE_SSID   pItemSSID;
2690     UINT            uRateLen = WLAN_RATES_MAXLEN;
2691     WORD            wMaxBasicRate = RATE_1M;
2692     WORD            wMaxSuppRate = RATE_1M;
2693     WORD            wSuppRate;
2694     BYTE            byTopCCKBasicRate = RATE_1M;
2695     BYTE            byTopOFDMBasicRate = RATE_1M;
2696     BOOL            bShortSlotTime = FALSE;
2697
2698
2699     for (ii = 0; ii < MAX_BSS_NUM; ii++) {
2700         if (pMgmt->sBSSList[ii].bActive == TRUE)
2701             break;
2702     }
2703
2704     if (ii == MAX_BSS_NUM) {
2705        *pStatus = CMD_STATUS_RESOURCES;
2706         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "BSS finding:BSS list is empty.\n");
2707        return;
2708     };
2709
2710     // memset(pMgmt->abyDesireBSSID, 0,  WLAN_BSSID_LEN);
2711     // Search known BSS list for prefer BSSID or SSID
2712
2713     pCurr = BSSpSearchBSSList(pDevice,
2714                               pMgmt->abyDesireBSSID,
2715                               pMgmt->abyDesireSSID,
2716                               pDevice->eConfigPHYMode
2717                               );
2718
2719     if (pCurr == NULL){
2720        *pStatus = CMD_STATUS_RESOURCES;
2721        pItemSSID = (PWLAN_IE_SSID)pMgmt->abyDesireSSID;
2722        DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Scanning [%s] not found, disconnected !\n", pItemSSID->abySSID);
2723        return;
2724     };
2725
2726     DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP(BSS) finding:Found a AP(BSS)..\n");
2727
2728     if (WLAN_GET_CAP_INFO_ESS(cpu_to_le16(pCurr->wCapInfo))){
2729
2730         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA)||(pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK)) {
2731 /*
2732             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2733                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2734                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2735                     // encryption mode error
2736                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2737                     return;
2738                 }
2739             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2740                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2741                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2742                     // encryption mode error
2743                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2744                     return;
2745                 }
2746             }
2747 */
2748         }
2749
2750 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
2751         //if(pDevice->bWPASuppWextEnabled == TRUE)
2752             Encyption_Rebuild(pDevice, pCurr);
2753 #endif
2754
2755         // Infrastructure BSS
2756         s_vMgrSynchBSS(pDevice,
2757                        WMAC_MODE_ESS_STA,
2758                        pCurr,
2759                        pStatus
2760                        );
2761
2762         if (*pStatus == CMD_STATUS_SUCCESS){
2763
2764             // Adopt this BSS state vars in Mgmt Object
2765             pMgmt->uCurrChannel = pCurr->uChannel;
2766
2767             memset(pMgmt->abyCurrSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2768             memset(pMgmt->abyCurrExtSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2769
2770             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2771                 uRateLen = WLAN_RATES_MAXLEN_11B;
2772             }
2773
2774             pItemRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates;
2775             pItemExtRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates;
2776
2777             // Parse Support Rate IE
2778             pItemRates->byElementID = WLAN_EID_SUPP_RATES;
2779             pItemRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2780                                          pItemRates,
2781                                          uRateLen);
2782
2783             // Parse Extension Support Rate IE
2784             pItemExtRates->byElementID = WLAN_EID_EXTSUPP_RATES;
2785             pItemExtRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abyExtSuppRates,
2786                                             pItemExtRates,
2787                                             uRateLen);
2788             // Stuffing Rate IE
2789             if ((pItemExtRates->len > 0) && (pItemRates->len < 8)) {
2790                 for (ii = 0; ii < (UINT)(8 - pItemRates->len); ) {
2791                     pItemRates->abyRates[pItemRates->len + ii] = pItemExtRates->abyRates[ii];
2792                     ii ++;
2793                     if (pItemExtRates->len <= ii)
2794                         break;
2795                 }
2796                 pItemRates->len += (BYTE)ii;
2797                 if (pItemExtRates->len - ii > 0) {
2798                     pItemExtRates->len -= (BYTE)ii;
2799                     for (uu = 0; uu < pItemExtRates->len; uu ++) {
2800                         pItemExtRates->abyRates[uu] = pItemExtRates->abyRates[uu + ii];
2801                     }
2802                 } else {
2803                     pItemExtRates->len = 0;
2804                 }
2805             }
2806
2807             RATEvParseMaxRate((PVOID)pDevice, pItemRates, pItemExtRates, TRUE,
2808                               &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2809                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2810             vUpdateIFS(pDevice);
2811             // TODO: deal with if wCapInfo the privacy is on, but station WEP is off
2812             // TODO: deal with if wCapInfo the PS-Pollable is on.
2813             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2814             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2815             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2816             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2817
2818             pMgmt->eCurrMode = WMAC_MODE_ESS_STA;
2819
2820             pMgmt->eCurrState = WMAC_STATE_JOINTED;
2821             // Adopt BSS state in Adapter Device Object
2822             pDevice->eOPMode = OP_MODE_INFRASTRUCTURE;
2823             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2824
2825             // Add current BSS to Candidate list
2826             // This should only works for WPA2 BSS, and WPA2 BSS check must be done before.
2827             if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
2828                 BOOL bResult = bAdd_PMKID_Candidate((HANDLE)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2829                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate: 1(%d)\n", bResult);
2830                 if (bResult == FALSE) {
2831                     vFlush_PMKID_Candidate((HANDLE)pDevice);
2832                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFlush_PMKID_Candidate: 4\n");
2833                     bAdd_PMKID_Candidate((HANDLE)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2834                 }
2835             }
2836
2837             // Preamble type auto-switch: if AP can receive short-preamble cap,
2838             // we can turn on too.
2839             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2840                 pDevice->byPreambleType = pDevice->byShortPreamble;
2841             }
2842             else {
2843                 pDevice->byPreambleType = 0;
2844             }
2845             // Change PreambleType must set RSPINF again
2846             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2847
2848             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join ESS\n");
2849
2850             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11G) {
2851
2852                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2853                     pDevice->bProtectMode = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2854                     if (pDevice->bProtectMode) {
2855                         MACvEnableProtectMD(pDevice);
2856                     } else {
2857                         MACvDisableProtectMD(pDevice);
2858                     }
2859                     vUpdateIFS(pDevice);
2860                 }
2861                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2862                     pDevice->bNonERPPresent = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2863                 }
2864                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2865                     pDevice->bBarkerPreambleMd = (pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2866                     //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2867                     if (pDevice->bBarkerPreambleMd) {
2868                         MACvEnableBarkerPreambleMd(pDevice);
2869                     } else {
2870                         MACvDisableBarkerPreambleMd(pDevice);
2871                     }
2872                 }
2873             }
2874             //DBG_PRN_WLAN05(("wCapInfo: %X\n", pCurr->wCapInfo));
2875             if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo) != pDevice->bShortSlotTime) {
2876                 if (pDevice->byBBType == BB_TYPE_11A) {
2877                     bShortSlotTime = TRUE;
2878                 }
2879                 else if (pDevice->byBBType == BB_TYPE_11B) {
2880                     bShortSlotTime = FALSE;
2881                 }
2882                 else {
2883                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo);
2884                 }
2885                 //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2886                 if (bShortSlotTime != pDevice->bShortSlotTime) {
2887                     pDevice->bShortSlotTime = bShortSlotTime;
2888                     BBvSetShortSlotTime(pDevice);
2889                     vUpdateIFS(pDevice);
2890                 }
2891             }
2892
2893             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"End of Join AP -- A/B/G Action\n");
2894         }
2895         else {
2896             pMgmt->eCurrState = WMAC_STATE_IDLE;
2897         };
2898
2899
2900      }
2901      else {
2902         // ad-hoc mode BSS
2903         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2904
2905             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2906 /*
2907                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2908                     // encryption mode error
2909                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2910                     return;
2911                 }
2912 */
2913             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2914 /*
2915                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2916                     // encryption mode error
2917                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2918                     return;
2919                 }
2920 */
2921             } else {
2922                 // encryption mode error
2923                 pMgmt->eCurrState = WMAC_STATE_IDLE;
2924                 return;
2925             }
2926         }
2927
2928         s_vMgrSynchBSS(pDevice,
2929                        WMAC_MODE_IBSS_STA,
2930                        pCurr,
2931                        pStatus
2932                        );
2933
2934         if (*pStatus == CMD_STATUS_SUCCESS){
2935             // Adopt this BSS state vars in Mgmt Object
2936             // TODO: check if CapInfo privacy on, but we don't..
2937             pMgmt->uCurrChannel = pCurr->uChannel;
2938
2939
2940             // Parse Support Rate IE
2941             pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2942             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2943                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2944                                                     WLAN_RATES_MAXLEN_11B);
2945             // set basic rate
2946             RATEvParseMaxRate((PVOID)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2947                               NULL, TRUE, &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2948                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2949             vUpdateIFS(pDevice);
2950             pMgmt->wCurrCapInfo = pCurr->wCapInfo;
2951             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2952             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2953             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2954             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2955 //          pMgmt->wCurrATIMWindow = pCurr->wATIMWindow;
2956             pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2957             pMgmt->eCurrState = WMAC_STATE_STARTED;
2958             // Adopt BSS state in Adapter Device Object
2959             pDevice->eOPMode = OP_MODE_ADHOC;
2960             pDevice->bLinkPass = TRUE;
2961             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2962             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2963
2964             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join IBSS ok:%02x-%02x-%02x-%02x-%02x-%02x \n",
2965                   pMgmt->abyCurrBSSID[0],
2966                   pMgmt->abyCurrBSSID[1],
2967                   pMgmt->abyCurrBSSID[2],
2968                   pMgmt->abyCurrBSSID[3],
2969                   pMgmt->abyCurrBSSID[4],
2970                   pMgmt->abyCurrBSSID[5]
2971                 );
2972             // Preamble type auto-switch: if AP can receive short-preamble cap,
2973             // and if registry setting is short preamble we can turn on too.
2974
2975             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2976                 pDevice->byPreambleType = pDevice->byShortPreamble;
2977             }
2978             else {
2979                 pDevice->byPreambleType = 0;
2980             }
2981             // Change PreambleType must set RSPINF again
2982             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2983
2984             // Prepare beacon
2985             bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt);
2986         }
2987         else {
2988             pMgmt->eCurrState = WMAC_STATE_IDLE;
2989         };
2990      };
2991     return;
2992 }
2993
2994
2995
2996 /*+
2997  *
2998  * Routine Description:
2999  * Set HW to synchronize a specific BSS from known BSS list.
3000  *
3001  *
3002  * Return Value:
3003  *    PCM_STATUS
3004  *
3005 -*/
3006 static
3007 VOID
3008 s_vMgrSynchBSS (
3009     IN PSDevice      pDevice,
3010     IN UINT          uBSSMode,
3011     IN PKnownBSS     pCurr,
3012     OUT PCMD_STATUS  pStatus
3013     )
3014 {
3015     PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
3016                                                      //1M,   2M,   5M,   11M,  18M,  24M,  36M,  54M
3017     BYTE abyCurrSuppRatesG[] = {WLAN_EID_SUPP_RATES, 8, 0x02, 0x04, 0x0B, 0x16, 0x24, 0x30, 0x48, 0x6C};
3018     BYTE abyCurrExtSuppRatesG[] = {WLAN_EID_EXTSUPP_RATES, 4, 0x0C, 0x12, 0x18, 0x60};
3019                                                            //6M,   9M,   12M,  48M
3020     BYTE abyCurrSuppRatesA[] = {WLAN_EID_SUPP_RATES, 8, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
3021     BYTE abyCurrSuppRatesB[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
3022
3023
3024     *pStatus = CMD_STATUS_FAILURE;
3025
3026     if (s_bCipherMatch(pCurr,
3027                        pDevice->eEncryptionStatus,
3028                        &(pMgmt->byCSSPK),
3029                        &(pMgmt->byCSSGK)) == FALSE) {
3030         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "s_bCipherMatch Fail .......\n");
3031         return;
3032     }
3033
3034     pMgmt->pCurrBSS = pCurr;
3035
3036     // if previous mode is IBSS.
3037     if(pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3038         MACvRegBitsOff(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
3039     }
3040
3041     // Init the BSS informations
3042     pDevice->bCCK = TRUE;
3043     pDevice->bProtectMode = FALSE;
3044     MACvDisableProtectMD(pDevice);
3045     pDevice->bBarkerPreambleMd = FALSE;
3046     MACvDisableBarkerPreambleMd(pDevice);
3047     pDevice->bNonERPPresent = FALSE;
3048     pDevice->byPreambleType = 0;
3049     pDevice->wBasicRate = 0;
3050     // Set Basic Rate
3051     CARDbAddBasicRate((PVOID)pDevice, RATE_1M);
3052
3053     // calculate TSF offset
3054     // TSF Offset = Received Timestamp TSF - Marked Local's TSF
3055     CARDvAdjustTSF(pDevice, pCurr->byRxRate, pCurr->qwBSSTimestamp, pCurr->qwLocalTSF);
3056
3057     // set HW beacon interval
3058     MACvWriteBeaconInterval(pDevice, pCurr->wBeaconInterval);
3059
3060     // set Next TBTT
3061     // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
3062     CARDvSetFirstNextTBTT(pDevice, pCurr->wBeaconInterval);
3063
3064     // set BSSID
3065     MACvWriteBSSIDAddress(pDevice, pCurr->abyBSSID);
3066
3067     MEMvCopy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, 6);
3068
3069     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = %02x-%02x-%02x=%02x-%02x-%02x\n",
3070         pMgmt->abyCurrBSSID[0],
3071         pMgmt->abyCurrBSSID[1],
3072         pMgmt->abyCurrBSSID[2],
3073         pMgmt->abyCurrBSSID[3],
3074         pMgmt->abyCurrBSSID[4],
3075         pMgmt->abyCurrBSSID[5]);
3076
3077     if (pCurr->eNetworkTypeInUse == PHY_TYPE_11A) {
3078         if ((pDevice->eConfigPHYMode == PHY_TYPE_11A) ||
3079             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3080             pDevice->byBBType = BB_TYPE_11A;
3081             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
3082             pDevice->bShortSlotTime = TRUE;
3083             BBvSetShortSlotTime(pDevice);
3084             CARDvSetBSSMode(pDevice);
3085         } else {
3086             return;
3087         }
3088     } else if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
3089         if ((pDevice->eConfigPHYMode == PHY_TYPE_11B) ||
3090             (pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
3091             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3092             pDevice->byBBType = BB_TYPE_11B;
3093             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
3094             pDevice->bShortSlotTime = FALSE;
3095             BBvSetShortSlotTime(pDevice);
3096             CARDvSetBSSMode(pDevice);
3097         } else {
3098             return;
3099         }
3100     } else {
3101         if ((pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
3102             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3103             pDevice->byBBType = BB_TYPE_11G;
3104             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
3105             pDevice->bShortSlotTime = TRUE;
3106             BBvSetShortSlotTime(pDevice);
3107             CARDvSetBSSMode(pDevice);
3108         } else if (pDevice->eConfigPHYMode == PHY_TYPE_11B) {
3109             pDevice->byBBType = BB_TYPE_11B;
3110             pDevice->bShortSlotTime = FALSE;
3111             BBvSetShortSlotTime(pDevice);
3112             CARDvSetBSSMode(pDevice);
3113         } else {
3114             return;
3115         }
3116     }
3117
3118     if (uBSSMode == WMAC_MODE_ESS_STA) {
3119         MACvRegBitsOff(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
3120         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
3121         pDevice->byRxMode |= RCR_BSSID;
3122         pMgmt->bCurrBSSIDFilterOn = TRUE;
3123     }
3124
3125     // set channel and clear NAV
3126     CARDbSetMediaChannel(pDevice, pCurr->uChannel);
3127     pMgmt->uCurrChannel = pCurr->uChannel;
3128     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "<----s_bSynchBSS Set Channel [%d]\n", pCurr->uChannel);
3129
3130     if ((pDevice->bUpdateBBVGA) &&
3131         (pDevice->byBBVGACurrent != pDevice->abyBBVGA[0])) {
3132         pDevice->byBBVGACurrent = pDevice->abyBBVGA[0];
3133         BBvSetVGAGainOffset(pDevice, pDevice->byBBVGACurrent);
3134         BBvSetShortSlotTime(pDevice);
3135     }
3136     //
3137     // Notes:
3138     // 1. In Ad-hoc mode : check if received others beacon as jointed indication,
3139     //    otherwise we will start own IBSS.
3140     // 2. In Infra mode : Supposed we already synchronized with AP right now.
3141
3142     if (uBSSMode == WMAC_MODE_IBSS_STA) {
3143         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
3144         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
3145         pDevice->byRxMode |= RCR_BSSID;
3146         pMgmt->bCurrBSSIDFilterOn = TRUE;
3147     };
3148
3149     if (pDevice->byBBType == BB_TYPE_11A) {
3150         MEMvCopy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesA[0], sizeof(abyCurrSuppRatesA));
3151         pMgmt->abyCurrExtSuppRates[1] = 0;
3152     } else if (pDevice->byBBType == BB_TYPE_11B) {
3153         MEMvCopy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesB[0], sizeof(abyCurrSuppRatesB));
3154         pMgmt->abyCurrExtSuppRates[1] = 0;
3155     } else {
3156         MEMvCopy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesG[0], sizeof(abyCurrSuppRatesG));
3157         MEMvCopy(pMgmt->abyCurrExtSuppRates, &abyCurrExtSuppRatesG[0], sizeof(abyCurrExtSuppRatesG));
3158     }
3159     pMgmt->byERPContext = pCurr->sERP.byERP;
3160
3161     *pStatus = CMD_STATUS_SUCCESS;
3162
3163     return;
3164 };
3165
3166
3167 //mike add: fix NetworkManager 0.7.0 hidden ssid mode in WPA encryption
3168 //                   ,need reset eAuthenMode and eEncryptionStatus
3169  static VOID  Encyption_Rebuild(
3170     IN PSDevice pDevice,
3171     IN PKnownBSS pCurr
3172  )
3173  {
3174   PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
3175  // UINT            ii , uSameBssidNum=0;
3176
3177         //  for (ii = 0; ii < MAX_BSS_NUM; ii++) {
3178           //   if (pMgmt->sBSSList[ii].bActive &&
3179             //      IS_ETH_ADDRESS_EQUAL(pMgmt->sBSSList[ii].abyBSSID, pCurr->abyBSSID)) {
3180              //       uSameBssidNum++;
3181                //   }
3182            // }
3183   //   if( uSameBssidNum>=2) {   //we only check AP in hidden sssid  mode
3184         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||           //networkmanager 0.7.0 does not give the pairwise-key selsection,
3185              (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {         // so we need re-selsect it according to real pairwise-key info.
3186                if(pCurr->bWPAValid == TRUE)  {   //WPA-PSK
3187                           pMgmt->eAuthenMode = WMAC_AUTH_WPAPSK;
3188                     if(pCurr->abyPKType[0] == WPA_TKIP) {
3189                         pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;    //TKIP
3190                         PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-TKIP]\n");
3191                       }
3192                    else if(pCurr->abyPKType[0] == WPA_AESCCMP) {
3193                         pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3194                           PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-AES]\n");
3195                      }
3196                 }
3197                else if(pCurr->bWPA2Valid == TRUE) {  //WPA2-PSK
3198                          pMgmt->eAuthenMode = WMAC_AUTH_WPA2PSK;
3199                        if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_TKIP) {
3200                            pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;     //TKIP
3201                              PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-TKIP]\n");
3202                         }
3203                        else if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_CCMP) {
3204                            pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3205                             PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-AES]\n");
3206                         }
3207                 }
3208               }
3209         //  }
3210       return;
3211  }
3212
3213
3214 /*+
3215  *
3216  * Routine Description:
3217  *  Format TIM field
3218  *
3219  *
3220  * Return Value:
3221  *    VOID
3222  *
3223 -*/
3224
3225 static
3226 VOID
3227 s_vMgrFormatTIM(
3228     IN PSMgmtObject pMgmt,
3229     IN PWLAN_IE_TIM pTIM
3230     )
3231 {
3232     BYTE        byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
3233     BYTE        byMap;
3234     UINT        ii, jj;
3235     BOOL        bStartFound = FALSE;
3236     BOOL        bMulticast = FALSE;
3237     WORD        wStartIndex = 0;
3238     WORD        wEndIndex = 0;
3239
3240
3241     // Find size of partial virtual bitmap
3242     for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
3243         byMap = pMgmt->abyPSTxMap[ii];
3244         if (!ii) {
3245             // Mask out the broadcast bit which is indicated separately.
3246             bMulticast = (byMap & byMask[0]) != 0;
3247             if(bMulticast) {
3248                pMgmt->sNodeDBTable[0].bRxPSPoll = TRUE;
3249             }
3250             byMap = 0;
3251         }
3252         if (byMap) {
3253             if (!bStartFound) {
3254                 bStartFound = TRUE;
3255                 wStartIndex = (WORD)ii;
3256             }
3257             wEndIndex = (WORD)ii;
3258         }
3259     };
3260
3261
3262     // Round start index down to nearest even number
3263     wStartIndex &=  ~BIT0;
3264
3265     // Round end index up to nearest even number
3266     wEndIndex = ((wEndIndex + 1) & ~BIT0);
3267
3268     // Size of element payload
3269
3270     pTIM->len =  3 + (wEndIndex - wStartIndex) + 1;
3271
3272     // Fill in the Fixed parts of the TIM
3273     pTIM->byDTIMCount = pMgmt->byDTIMCount;
3274     pTIM->byDTIMPeriod = pMgmt->byDTIMPeriod;
3275     pTIM->byBitMapCtl = (bMulticast ? TIM_MULTICAST_MASK : 0) |
3276         (((wStartIndex >> 1) << 1) & TIM_BITMAPOFFSET_MASK);
3277
3278     // Append variable part of TIM
3279
3280     for (ii = wStartIndex, jj =0 ; ii <= wEndIndex; ii++, jj++) {
3281          pTIM->byVirtBitMap[jj] = pMgmt->abyPSTxMap[ii];
3282     }
3283
3284     // Aid = 0 don't used.
3285     pTIM->byVirtBitMap[0]  &= ~BIT0;
3286 }
3287
3288
3289 /*+
3290  *
3291  * Routine Description:
3292  *  Constructs an Beacon frame( Ad-hoc mode)
3293  *
3294  *
3295  * Return Value:
3296  *    PTR to frame; or NULL on allocation failue
3297  *
3298 -*/
3299
3300 static
3301 PSTxMgmtPacket
3302 s_MgrMakeBeacon(
3303     IN PSDevice pDevice,
3304     IN PSMgmtObject pMgmt,
3305     IN WORD wCurrCapInfo,
3306     IN WORD wCurrBeaconPeriod,
3307     IN UINT uCurrChannel,
3308     IN WORD wCurrATIMWinodw,
3309     IN PWLAN_IE_SSID pCurrSSID,
3310     IN PBYTE pCurrBSSID,
3311     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
3312     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3313     )
3314 {
3315     PSTxMgmtPacket      pTxPacket = NULL;
3316     WLAN_FR_BEACON      sFrame;
3317     BYTE                abyBroadcastAddr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
3318
3319
3320     // prepare beacon frame
3321     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3322     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_BEACON_FR_MAXLEN);
3323     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3324     // Setup the sFrame structure.
3325     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3326     sFrame.len = WLAN_BEACON_FR_MAXLEN;
3327     vMgrEncodeBeacon(&sFrame);
3328     // Setup the header
3329     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3330         (
3331         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3332         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_BEACON)
3333         ));
3334
3335     if (pDevice->bEnablePSMode) {
3336         sFrame.pHdr->sA3.wFrameCtl |= cpu_to_le16((WORD)WLAN_SET_FC_PWRMGT(1));
3337     }
3338
3339     memcpy( sFrame.pHdr->sA3.abyAddr1, abyBroadcastAddr, WLAN_ADDR_LEN);
3340     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3341     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3342     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3343     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3344     // Copy SSID
3345     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3346     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3347     memcpy(sFrame.pSSID,
3348              pCurrSSID,
3349              ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3350             );
3351     // Copy the rate set
3352     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3353     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3354     memcpy(sFrame.pSuppRates,
3355            pCurrSuppRates,
3356            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3357           );
3358     // DS parameter
3359     if (pDevice->byBBType != BB_TYPE_11A) {
3360         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3361         sFrame.len += (1) + WLAN_IEHDR_LEN;
3362         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3363         sFrame.pDSParms->len = 1;
3364         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3365     }
3366     // TIM field
3367     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
3368         sFrame.pTIM = (PWLAN_IE_TIM)(sFrame.pBuf + sFrame.len);
3369         sFrame.pTIM->byElementID = WLAN_EID_TIM;
3370         s_vMgrFormatTIM(pMgmt, sFrame.pTIM);
3371         sFrame.len += (WLAN_IEHDR_LEN + sFrame.pTIM->len);
3372     }
3373
3374     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3375
3376         // IBSS parameter
3377         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3378         sFrame.len += (2) + WLAN_IEHDR_LEN;
3379         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3380         sFrame.pIBSSParms->len = 2;
3381         sFrame.pIBSSParms->wATIMWindow = wCurrATIMWinodw;
3382         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3383             /* RSN parameter */
3384             sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3385             sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3386             sFrame.pRSNWPA->len = 12;
3387             sFrame.pRSNWPA->abyOUI[0] = 0x00;
3388             sFrame.pRSNWPA->abyOUI[1] = 0x50;
3389             sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3390             sFrame.pRSNWPA->abyOUI[3] = 0x01;
3391             sFrame.pRSNWPA->wVersion = 1;
3392             sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3393             sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3394             sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3395             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled)
3396                 sFrame.pRSNWPA->abyMulticast[3] = 0x04;//AES
3397             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled)
3398                 sFrame.pRSNWPA->abyMulticast[3] = 0x02;//TKIP
3399             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled)
3400                 sFrame.pRSNWPA->abyMulticast[3] = 0x01;//WEP40
3401             else
3402                 sFrame.pRSNWPA->abyMulticast[3] = 0x00;//NONE
3403
3404             // Pairwise Key Cipher Suite
3405             sFrame.pRSNWPA->wPKCount = 0;
3406             // Auth Key Management Suite
3407             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3408             sFrame.pRSNWPA->len +=2;
3409
3410             // RSN Capabilites
3411             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3412             sFrame.pRSNWPA->len +=2;
3413             sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3414         }
3415     }
3416
3417
3418     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
3419         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3420         sFrame.len += 1 + WLAN_IEHDR_LEN;
3421         sFrame.pERP->byElementID = WLAN_EID_ERP;
3422         sFrame.pERP->len = 1;
3423         sFrame.pERP->byContext = 0;
3424         if (pDevice->bProtectMode == TRUE)
3425             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3426         if (pDevice->bNonERPPresent == TRUE)
3427             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3428         if (pDevice->bBarkerPreambleMd == TRUE)
3429             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3430     }
3431     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3432         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3433         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3434         MEMvCopy(sFrame.pExtSuppRates,
3435              pCurrExtSuppRates,
3436              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3437              );
3438     }
3439     // hostapd wpa/wpa2 IE
3440     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3441          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3442              if (pMgmt->wWPAIELen != 0) {
3443                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3444                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3445                  sFrame.len += pMgmt->wWPAIELen;
3446              }
3447          }
3448     }
3449
3450     /* Adjust the length fields */
3451     pTxPacket->cbMPDULen = sFrame.len;
3452     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3453
3454     return pTxPacket;
3455 }
3456
3457
3458
3459
3460
3461 /*+
3462  *
3463  * Routine Description:
3464  *  Constructs an Prob-response frame
3465  *
3466  *
3467  * Return Value:
3468  *    PTR to frame; or NULL on allocation failue
3469  *
3470 -*/
3471
3472
3473
3474
3475 PSTxMgmtPacket
3476 s_MgrMakeProbeResponse(
3477     IN PSDevice pDevice,
3478     IN PSMgmtObject pMgmt,
3479     IN WORD wCurrCapInfo,
3480     IN WORD wCurrBeaconPeriod,
3481     IN UINT uCurrChannel,
3482     IN WORD wCurrATIMWinodw,
3483     IN PBYTE pDstAddr,
3484     IN PWLAN_IE_SSID pCurrSSID,
3485     IN PBYTE pCurrBSSID,
3486     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
3487     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
3488     IN BYTE byPHYType
3489     )
3490 {
3491     PSTxMgmtPacket      pTxPacket = NULL;
3492     WLAN_FR_PROBERESP   sFrame;
3493
3494
3495
3496     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3497     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_PROBERESP_FR_MAXLEN);
3498     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3499     // Setup the sFrame structure.
3500     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3501     sFrame.len = WLAN_PROBERESP_FR_MAXLEN;
3502     vMgrEncodeProbeResponse(&sFrame);
3503     // Setup the header
3504     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3505         (
3506         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3507         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_PROBERESP)
3508         ));
3509     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3510     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3511     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3512     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3513     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3514
3515     if (byPHYType == BB_TYPE_11B) {
3516         *sFrame.pwCapInfo &= cpu_to_le16((WORD)~(WLAN_SET_CAP_INFO_SHORTSLOTTIME(1)));
3517     }
3518
3519     // Copy SSID
3520     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3521     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3522     memcpy(sFrame.pSSID,
3523            pCurrSSID,
3524            ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3525            );
3526     // Copy the rate set
3527     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3528
3529     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3530     memcpy(sFrame.pSuppRates,
3531            pCurrSuppRates,
3532            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3533           );
3534
3535     // DS parameter
3536     if (pDevice->byBBType != BB_TYPE_11A) {
3537         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3538         sFrame.len += (1) + WLAN_IEHDR_LEN;
3539         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3540         sFrame.pDSParms->len = 1;
3541         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3542     }
3543
3544     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3545         // IBSS parameter
3546         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3547         sFrame.len += (2) + WLAN_IEHDR_LEN;
3548         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3549         sFrame.pIBSSParms->len = 2;
3550         sFrame.pIBSSParms->wATIMWindow = 0;
3551     }
3552     if (pDevice->byBBType == BB_TYPE_11G) {
3553         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3554         sFrame.len += 1 + WLAN_IEHDR_LEN;
3555         sFrame.pERP->byElementID = WLAN_EID_ERP;
3556         sFrame.pERP->len = 1;
3557         sFrame.pERP->byContext = 0;
3558         if (pDevice->bProtectMode == TRUE)
3559             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3560         if (pDevice->bNonERPPresent == TRUE)
3561             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3562         if (pDevice->bBarkerPreambleMd == TRUE)
3563             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3564     }
3565
3566     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3567         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3568         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3569         MEMvCopy(sFrame.pExtSuppRates,
3570              pCurrExtSuppRates,
3571              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3572              );
3573     }
3574
3575     // hostapd wpa/wpa2 IE
3576     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3577          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3578              if (pMgmt->wWPAIELen != 0) {
3579                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3580                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3581                  sFrame.len += pMgmt->wWPAIELen;
3582              }
3583          }
3584     }
3585
3586     // Adjust the length fields
3587     pTxPacket->cbMPDULen = sFrame.len;
3588     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3589
3590     return pTxPacket;
3591 }
3592
3593
3594
3595 /*+
3596  *
3597  * Routine Description:
3598  *  Constructs an association request frame
3599  *
3600  *
3601  * Return Value:
3602  *    A ptr to frame or NULL on allocation failue
3603  *
3604 -*/
3605
3606
3607 PSTxMgmtPacket
3608 s_MgrMakeAssocRequest(
3609     IN PSDevice pDevice,
3610     IN PSMgmtObject pMgmt,
3611     IN PBYTE pDAddr,
3612     IN WORD wCurrCapInfo,
3613     IN WORD wListenInterval,
3614     IN PWLAN_IE_SSID pCurrSSID,
3615     IN PWLAN_IE_SUPP_RATES pCurrRates,
3616     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3617     )
3618 {
3619     PSTxMgmtPacket      pTxPacket = NULL;
3620     WLAN_FR_ASSOCREQ    sFrame;
3621     PBYTE               pbyIEs;
3622     PBYTE               pbyRSN;
3623
3624
3625     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3626     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3627     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3628     // Setup the sFrame structure.
3629     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3630     sFrame.len = WLAN_ASSOCREQ_FR_MAXLEN;
3631     // format fixed field frame structure
3632     vMgrEncodeAssocRequest(&sFrame);
3633     // Setup the header
3634     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3635         (
3636         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3637         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCREQ)
3638         ));
3639     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3640     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3641     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3642
3643     // Set the capibility and listen interval
3644     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3645     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3646
3647     // sFrame.len point to end of fixed field
3648     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3649     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3650     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3651
3652     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3653     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3654     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3655     MEMvCopy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3656     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3657
3658     // Copy the rate set
3659     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3660     if ((pDevice->byBBType == BB_TYPE_11B) && (pCurrRates->len > 4))
3661         sFrame.len += 4 + WLAN_IEHDR_LEN;
3662     else
3663         sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3664     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3665
3666     // Copy the extension rate set
3667     if ((pDevice->byBBType == BB_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3668         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3669         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3670         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3671     }
3672
3673     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3674     MEMvCopy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3675     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3676
3677
3678     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3679          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3680          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3681         (pMgmt->pCurrBSS != NULL)) {
3682         /* WPA IE */
3683         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3684         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3685         sFrame.pRSNWPA->len = 16;
3686         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3687         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3688         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3689         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3690         sFrame.pRSNWPA->wVersion = 1;
3691         //Group Key Cipher Suite
3692         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3693         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3694         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3695         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3696             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3697         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3698             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3699         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3700             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3701         } else {
3702             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3703         }
3704         // Pairwise Key Cipher Suite
3705         sFrame.pRSNWPA->wPKCount = 1;
3706         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3707         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3708         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3709         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3710             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3711         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3712             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3713         } else {
3714             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3715         }
3716         // Auth Key Management Suite
3717         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3718         *pbyRSN++=0x01;
3719         *pbyRSN++=0x00;
3720         *pbyRSN++=0x00;
3721
3722         *pbyRSN++=0x50;
3723         *pbyRSN++=0xf2;
3724         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3725             *pbyRSN++=WPA_AUTH_PSK;
3726         }
3727         else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3728             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3729         }
3730         else {
3731             *pbyRSN++=WPA_NONE;
3732         }
3733
3734         sFrame.pRSNWPA->len +=6;
3735
3736         // RSN Capabilites
3737
3738         *pbyRSN++=0x00;
3739         *pbyRSN++=0x00;
3740         sFrame.pRSNWPA->len +=2;
3741
3742         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3743         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3744         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3745         MEMvCopy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3746         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3747
3748     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3749                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3750                (pMgmt->pCurrBSS != NULL)) {
3751         UINT                ii;
3752         PWORD               pwPMKID;
3753
3754         // WPA IE
3755         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3756         sFrame.pRSN->byElementID = WLAN_EID_RSN;
3757         sFrame.pRSN->len = 6; //Version(2)+GK(4)
3758         sFrame.pRSN->wVersion = 1;
3759         //Group Key Cipher Suite
3760         sFrame.pRSN->abyRSN[0] = 0x00;
3761         sFrame.pRSN->abyRSN[1] = 0x0F;
3762         sFrame.pRSN->abyRSN[2] = 0xAC;
3763         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3764             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3765         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3766             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3767         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3768             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3769         } else {
3770             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3771         }
3772
3773         // Pairwise Key Cipher Suite
3774         sFrame.pRSN->abyRSN[4] = 1;
3775         sFrame.pRSN->abyRSN[5] = 0;
3776         sFrame.pRSN->abyRSN[6] = 0x00;
3777         sFrame.pRSN->abyRSN[7] = 0x0F;
3778         sFrame.pRSN->abyRSN[8] = 0xAC;
3779         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3780             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3781         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3782             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3783         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3784             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3785         } else {
3786             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3787         }
3788         sFrame.pRSN->len += 6;
3789
3790         // Auth Key Management Suite
3791         sFrame.pRSN->abyRSN[10] = 1;
3792         sFrame.pRSN->abyRSN[11] = 0;
3793         sFrame.pRSN->abyRSN[12] = 0x00;
3794         sFrame.pRSN->abyRSN[13] = 0x0F;
3795         sFrame.pRSN->abyRSN[14] = 0xAC;
3796         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3797             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3798         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3799             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3800         } else {
3801             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3802         }
3803         sFrame.pRSN->len +=6;
3804
3805         // RSN Capabilites
3806         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
3807             MEMvCopy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3808         } else {
3809             sFrame.pRSN->abyRSN[16] = 0;
3810             sFrame.pRSN->abyRSN[17] = 0;
3811         }
3812         sFrame.pRSN->len +=2;
3813
3814         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3815             // RSN PMKID
3816             pbyRSN = &sFrame.pRSN->abyRSN[18];
3817             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
3818             *pwPMKID = 0;            // Initialize PMKID count
3819             pbyRSN += 2;             // Point to PMKID list
3820             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3821                 if (MEMEqualMemory(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, U_ETHER_ADDR_LEN)) {
3822                     (*pwPMKID) ++;
3823                     MEMvCopy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
3824                     pbyRSN += 16;
3825                 }
3826             }
3827             if (*pwPMKID != 0) {
3828                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
3829             }
3830         }
3831
3832         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3833         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3834         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3835         MEMvCopy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3836         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3837     }
3838
3839
3840     // Adjust the length fields
3841     pTxPacket->cbMPDULen = sFrame.len;
3842     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3843     return pTxPacket;
3844 }
3845
3846
3847
3848
3849
3850
3851
3852
3853 /*+
3854  *
3855  * Routine Description:
3856  *  Constructs an re-association request frame
3857  *
3858  *
3859  * Return Value:
3860  *    A ptr to frame or NULL on allocation failue
3861  *
3862 -*/
3863
3864
3865 PSTxMgmtPacket
3866 s_MgrMakeReAssocRequest(
3867     IN PSDevice pDevice,
3868     IN PSMgmtObject pMgmt,
3869     IN PBYTE pDAddr,
3870     IN WORD wCurrCapInfo,
3871     IN WORD wListenInterval,
3872     IN PWLAN_IE_SSID pCurrSSID,
3873     IN PWLAN_IE_SUPP_RATES pCurrRates,
3874     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3875     )
3876 {
3877     PSTxMgmtPacket      pTxPacket = NULL;
3878     WLAN_FR_REASSOCREQ  sFrame;
3879     PBYTE               pbyIEs;
3880     PBYTE               pbyRSN;
3881
3882
3883     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3884     memset( pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_REASSOCREQ_FR_MAXLEN);
3885     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3886     /* Setup the sFrame structure. */
3887     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3888     sFrame.len = WLAN_REASSOCREQ_FR_MAXLEN;
3889
3890     // format fixed field frame structure
3891     vMgrEncodeReassocRequest(&sFrame);
3892
3893     /* Setup the header */
3894     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3895         (
3896         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3897         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCREQ)
3898         ));
3899     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3900     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3901     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3902
3903     /* Set the capibility and listen interval */
3904     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3905     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3906
3907     memcpy(sFrame.pAddrCurrAP, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3908     /* Copy the SSID */
3909     /* sFrame.len point to end of fixed field */
3910     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3911     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3912     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3913
3914     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3915     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3916     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3917     MEMvCopy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3918     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3919
3920     /* Copy the rate set */
3921     /* sFrame.len point to end of SSID */
3922     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3923     sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3924     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3925
3926     // Copy the extension rate set
3927     if ((pMgmt->eCurrentPHYMode == PHY_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3928         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3929         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3930         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3931     }
3932
3933     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3934     MEMvCopy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3935     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3936
3937     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3938          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3939          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3940         (pMgmt->pCurrBSS != NULL)) {
3941         /* WPA IE */
3942         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3943         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3944         sFrame.pRSNWPA->len = 16;
3945         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3946         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3947         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3948         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3949         sFrame.pRSNWPA->wVersion = 1;
3950         //Group Key Cipher Suite
3951         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3952         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3953         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3954         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3955             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3956         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3957             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3958         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3959             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3960         } else {
3961             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3962         }
3963         // Pairwise Key Cipher Suite
3964         sFrame.pRSNWPA->wPKCount = 1;
3965         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3966         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3967         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3968         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3969             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3970         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3971             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3972         } else {
3973             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3974         }
3975         // Auth Key Management Suite
3976         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3977         *pbyRSN++=0x01;
3978         *pbyRSN++=0x00;
3979         *pbyRSN++=0x00;
3980
3981         *pbyRSN++=0x50;
3982         *pbyRSN++=0xf2;
3983         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3984             *pbyRSN++=WPA_AUTH_PSK;
3985         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3986             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3987         } else {
3988             *pbyRSN++=WPA_NONE;
3989         }
3990
3991         sFrame.pRSNWPA->len +=6;
3992
3993         // RSN Capabilites
3994         *pbyRSN++=0x00;
3995         *pbyRSN++=0x00;
3996         sFrame.pRSNWPA->len +=2;
3997
3998         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3999         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
4000         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
4001         MEMvCopy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
4002         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
4003
4004     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
4005                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
4006                (pMgmt->pCurrBSS != NULL)) {
4007         UINT                ii;
4008         PWORD               pwPMKID;
4009
4010         /* WPA IE */
4011         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
4012         sFrame.pRSN->byElementID = WLAN_EID_RSN;
4013         sFrame.pRSN->len = 6; //Version(2)+GK(4)
4014         sFrame.pRSN->wVersion = 1;
4015         //Group Key Cipher Suite
4016         sFrame.pRSN->abyRSN[0] = 0x00;
4017         sFrame.pRSN->abyRSN[1] = 0x0F;
4018         sFrame.pRSN->abyRSN[2] = 0xAC;
4019         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
4020             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
4021         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
4022             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
4023         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
4024             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
4025         } else {
4026             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
4027         }
4028
4029         // Pairwise Key Cipher Suite
4030         sFrame.pRSN->abyRSN[4] = 1;
4031         sFrame.pRSN->abyRSN[5] = 0;
4032         sFrame.pRSN->abyRSN[6] = 0x00;
4033         sFrame.pRSN->abyRSN[7] = 0x0F;
4034         sFrame.pRSN->abyRSN[8] = 0xAC;
4035         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
4036             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
4037         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
4038             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
4039         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
4040             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
4041         } else {
4042             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
4043         }
4044         sFrame.pRSN->len += 6;
4045
4046         // Auth Key Management Suite
4047         sFrame.pRSN->abyRSN[10] = 1;
4048         sFrame.pRSN->abyRSN[11] = 0;
4049         sFrame.pRSN->abyRSN[12] = 0x00;
4050         sFrame.pRSN->abyRSN[13] = 0x0F;
4051         sFrame.pRSN->abyRSN[14] = 0xAC;
4052         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
4053             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
4054         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
4055             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
4056         } else {
4057             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
4058         }
4059         sFrame.pRSN->len +=6;
4060
4061         // RSN Capabilites
4062         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
4063             MEMvCopy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
4064         } else {
4065             sFrame.pRSN->abyRSN[16] = 0;
4066             sFrame.pRSN->abyRSN[17] = 0;
4067         }
4068         sFrame.pRSN->len +=2;
4069
4070         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
4071             // RSN PMKID
4072             pbyRSN = &sFrame.pRSN->abyRSN[18];
4073             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
4074             *pwPMKID = 0;            // Initialize PMKID count
4075             pbyRSN += 2;             // Point to PMKID list
4076             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
4077                 if (MEMEqualMemory(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, U_ETHER_ADDR_LEN)) {
4078                     (*pwPMKID) ++;
4079                     MEMvCopy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
4080                     pbyRSN += 16;
4081                 }
4082             }
4083             if (*pwPMKID != 0) {
4084                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
4085             }
4086         }
4087
4088         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4089         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
4090         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4091         MEMvCopy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
4092         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4093     }
4094
4095
4096
4097     /* Adjust the length fields */
4098     pTxPacket->cbMPDULen = sFrame.len;
4099     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4100
4101     return pTxPacket;
4102 }
4103
4104
4105
4106 /*+
4107  *
4108  * Routine Description:
4109  *  Constructs an assoc-response frame
4110  *
4111  *
4112  * Return Value:
4113  *    PTR to frame; or NULL on allocation failue
4114  *
4115 -*/
4116
4117
4118 PSTxMgmtPacket
4119 s_MgrMakeAssocResponse(
4120     IN PSDevice pDevice,
4121     IN PSMgmtObject pMgmt,
4122     IN WORD wCurrCapInfo,
4123     IN WORD wAssocStatus,
4124     IN WORD wAssocAID,
4125     IN PBYTE pDstAddr,
4126     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
4127     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4128     )
4129 {
4130     PSTxMgmtPacket      pTxPacket = NULL;
4131     WLAN_FR_ASSOCRESP   sFrame;
4132
4133
4134     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4135     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4136     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4137     // Setup the sFrame structure
4138     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4139     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4140     vMgrEncodeAssocResponse(&sFrame);
4141     // Setup the header
4142     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4143         (
4144         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4145         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCRESP)
4146         ));
4147     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4148     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4149     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4150
4151     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4152     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4153     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4154
4155     // Copy the rate set
4156     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4157     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4158     memcpy(sFrame.pSuppRates,
4159            pCurrSuppRates,
4160            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4161           );
4162
4163     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4164         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4165         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4166         MEMvCopy(sFrame.pExtSuppRates,
4167              pCurrExtSuppRates,
4168              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4169              );
4170     }
4171
4172     // Adjust the length fields
4173     pTxPacket->cbMPDULen = sFrame.len;
4174     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4175
4176     return pTxPacket;
4177 }
4178
4179
4180 /*+
4181  *
4182  * Routine Description:
4183  *  Constructs an reassoc-response frame
4184  *
4185  *
4186  * Return Value:
4187  *    PTR to frame; or NULL on allocation failue
4188  *
4189 -*/
4190
4191
4192 PSTxMgmtPacket
4193 s_MgrMakeReAssocResponse(
4194     IN PSDevice pDevice,
4195     IN PSMgmtObject pMgmt,
4196     IN WORD wCurrCapInfo,
4197     IN WORD wAssocStatus,
4198     IN WORD wAssocAID,
4199     IN PBYTE pDstAddr,
4200     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
4201     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4202     )
4203 {
4204     PSTxMgmtPacket      pTxPacket = NULL;
4205     WLAN_FR_REASSOCRESP   sFrame;
4206
4207
4208     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4209     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4210     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4211     // Setup the sFrame structure
4212     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4213     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4214     vMgrEncodeReassocResponse(&sFrame);
4215     // Setup the header
4216     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4217         (
4218         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4219         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCRESP)
4220         ));
4221     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4222     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4223     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4224
4225     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4226     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4227     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4228
4229     // Copy the rate set
4230     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4231     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4232     memcpy(sFrame.pSuppRates,
4233              pCurrSuppRates,
4234              ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4235              );
4236
4237     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4238         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4239         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4240         MEMvCopy(sFrame.pExtSuppRates,
4241              pCurrExtSuppRates,
4242              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4243              );
4244     }
4245
4246     // Adjust the length fields
4247     pTxPacket->cbMPDULen = sFrame.len;
4248     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4249
4250     return pTxPacket;
4251 }
4252
4253
4254 /*+
4255  *
4256  * Routine Description:
4257  *  Handles probe response management frames.
4258  *
4259  *
4260  * Return Value:
4261  *    none.
4262  *
4263 -*/
4264
4265 static
4266 VOID
4267 s_vMgrRxProbeResponse(
4268     IN PSDevice pDevice,
4269     IN PSMgmtObject pMgmt,
4270     IN PSRxMgmtPacket pRxPacket
4271     )
4272 {
4273     PKnownBSS           pBSSList = NULL;
4274     WLAN_FR_PROBERESP   sFrame;
4275     BYTE                byCurrChannel = pRxPacket->byRxChannel;
4276     ERPObject           sERP;
4277     BOOL                bChannelHit = TRUE;
4278
4279
4280     memset(&sFrame, 0, sizeof(WLAN_FR_PROBERESP));
4281     // decode the frame
4282     sFrame.len = pRxPacket->cbMPDULen;
4283     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4284     vMgrDecodeProbeResponse(&sFrame);
4285
4286     if ((sFrame.pqwTimestamp == 0) ||
4287         (sFrame.pwBeaconInterval == 0) ||
4288         (sFrame.pwCapInfo == 0) ||
4289         (sFrame.pSSID == 0) ||
4290         (sFrame.pSuppRates == 0)) {
4291         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe resp:Fail addr:[%p] \n", pRxPacket->p80211Header);
4292         DBG_PORT80(0xCC);
4293         return;
4294     };
4295
4296     if(sFrame.pSSID->len == 0)
4297        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx Probe resp: SSID len = 0 \n");
4298
4299
4300     //{{ RobertYu:20050201, 11a  byCurrChannel != sFrame.pDSParms->byCurrChannel mapping
4301     if( byCurrChannel > CB_MAX_CHANNEL_24G )
4302     {
4303         if (sFrame.pDSParms != 0) {
4304             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
4305                 bChannelHit = TRUE;
4306             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
4307         } else {
4308             bChannelHit = TRUE;
4309         }
4310
4311     } else {
4312         if (sFrame.pDSParms != 0) {
4313             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
4314                 bChannelHit = TRUE;
4315             byCurrChannel = sFrame.pDSParms->byCurrChannel;
4316         } else {
4317             bChannelHit = TRUE;
4318         }
4319     }
4320     //RobertYu:20050201
4321
4322 //2008-0730-01<Add>by MikeLiu
4323 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
4324       return;
4325
4326     if (sFrame.pERP != NULL) {
4327         sERP.byERP = sFrame.pERP->byContext;
4328         sERP.bERPExist = TRUE;
4329     } else {
4330         sERP.bERPExist = FALSE;
4331         sERP.byERP = 0;
4332     }
4333
4334
4335     // update or insert the bss
4336     pBSSList = BSSpAddrIsInBSSList((HANDLE)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
4337     if (pBSSList) {
4338         BSSbUpdateToBSSList((HANDLE)pDevice,
4339                             *sFrame.pqwTimestamp,
4340                             *sFrame.pwBeaconInterval,
4341                             *sFrame.pwCapInfo,
4342                             byCurrChannel,
4343                             bChannelHit,
4344                             sFrame.pSSID,
4345                             sFrame.pSuppRates,
4346                             sFrame.pExtSuppRates,
4347                             &sERP,
4348                             sFrame.pRSN,
4349                             sFrame.pRSNWPA,
4350                             sFrame.pIE_Country,
4351                             sFrame.pIE_Quiet,
4352                             pBSSList,
4353                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4354                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
4355                             (HANDLE)pRxPacket
4356                            );
4357     }
4358     else {
4359         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Probe resp/insert: RxChannel = : %d\n", byCurrChannel);
4360         BSSbInsertToBSSList((HANDLE)pDevice,
4361                             sFrame.pHdr->sA3.abyAddr3,
4362                             *sFrame.pqwTimestamp,
4363                             *sFrame.pwBeaconInterval,
4364                             *sFrame.pwCapInfo,
4365                             byCurrChannel,
4366                             sFrame.pSSID,
4367                             sFrame.pSuppRates,
4368                             sFrame.pExtSuppRates,
4369                             &sERP,
4370                             sFrame.pRSN,
4371                             sFrame.pRSNWPA,
4372                             sFrame.pIE_Country,
4373                             sFrame.pIE_Quiet,
4374                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4375                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
4376                             (HANDLE)pRxPacket
4377                            );
4378     }
4379     return;
4380
4381 }
4382
4383 /*+
4384  *
4385  * Routine Description:(AP)or(Ad-hoc STA)
4386  *  Handles probe request management frames.
4387  *
4388  *
4389  * Return Value:
4390  *    none.
4391  *
4392 -*/
4393
4394
4395 static
4396 VOID
4397 s_vMgrRxProbeRequest(
4398     IN PSDevice pDevice,
4399     IN PSMgmtObject pMgmt,
4400     IN PSRxMgmtPacket pRxPacket
4401     )
4402 {
4403     WLAN_FR_PROBEREQ    sFrame;
4404     CMD_STATUS          Status;
4405     PSTxMgmtPacket      pTxPacket;
4406     BYTE                byPHYType = BB_TYPE_11B;
4407
4408     // STA in Ad-hoc mode: when latest TBTT beacon transmit success,
4409     // STA have to response this request.
4410     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
4411         ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && pDevice->bBeaconSent)) {
4412
4413         memset(&sFrame, 0, sizeof(WLAN_FR_PROBEREQ));
4414         // decode the frame
4415         sFrame.len = pRxPacket->cbMPDULen;
4416         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4417         vMgrDecodeProbeRequest(&sFrame);
4418 /*
4419         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%02x-%02x-%02x=%02x-%02x-%02x \n",
4420                   sFrame.pHdr->sA3.abyAddr2[0],
4421                   sFrame.pHdr->sA3.abyAddr2[1],
4422                   sFrame.pHdr->sA3.abyAddr2[2],
4423                   sFrame.pHdr->sA3.abyAddr2[3],
4424                   sFrame.pHdr->sA3.abyAddr2[4],
4425                   sFrame.pHdr->sA3.abyAddr2[5]
4426                 );
4427 */
4428         if (sFrame.pSSID->len != 0) {
4429             if (sFrame.pSSID->len != ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len)
4430                 return;
4431             if (memcmp(sFrame.pSSID->abySSID,
4432                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
4433                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) != 0) {
4434                        return;
4435             }
4436         }
4437
4438         if ((sFrame.pSuppRates->len > 4) || (sFrame.pExtSuppRates != NULL)) {
4439             byPHYType = BB_TYPE_11G;
4440         }
4441
4442         // Probe response reply..
4443         pTxPacket = s_MgrMakeProbeResponse
4444                     (
4445                       pDevice,
4446                       pMgmt,
4447                       pMgmt->wCurrCapInfo,
4448                       pMgmt->wCurrBeaconPeriod,
4449                       pMgmt->uCurrChannel,
4450                       0,
4451                       sFrame.pHdr->sA3.abyAddr2,
4452                       (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4453                       (PBYTE)pMgmt->abyCurrBSSID,
4454                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4455                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
4456                        byPHYType
4457                     );
4458         if (pTxPacket != NULL ){
4459             /* send the frame */
4460             Status = csMgmt_xmit(pDevice, pTxPacket);
4461             if (Status != CMD_STATUS_PENDING) {
4462                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx failed\n");
4463             }
4464             else {
4465 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx sending..\n");
4466             }
4467         }
4468     }
4469
4470     return;
4471 }
4472
4473
4474
4475
4476
4477 /*+
4478  *
4479  * Routine Description:
4480  *
4481  *  Entry point for the reception and handling of 802.11 management
4482  *  frames. Makes a determination of the frame type and then calls
4483  *  the appropriate function.
4484  *
4485  *
4486  * Return Value:
4487  *    none.
4488  *
4489 -*/
4490
4491
4492 VOID
4493 vMgrRxManagePacket(
4494     IN  HANDLE hDeviceContext,
4495     IN PSMgmtObject pMgmt,
4496     IN PSRxMgmtPacket pRxPacket
4497      )
4498 {
4499     PSDevice    pDevice = (PSDevice)hDeviceContext;
4500     BOOL        bInScan = FALSE;
4501     UINT        uNodeIndex = 0;
4502     NODE_STATE  eNodeState = 0;
4503     CMD_STATUS  Status;
4504
4505
4506     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
4507         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex))
4508             eNodeState = pMgmt->sNodeDBTable[uNodeIndex].eNodeState;
4509     }
4510
4511     switch( WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) ){
4512
4513         case WLAN_FSTYPE_ASSOCREQ:
4514             // Frame Clase = 2
4515             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocreq\n");
4516             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4517                 (eNodeState < NODE_AUTH)) {
4518                 // send deauth notification
4519                 // reason = (6) class 2 received from nonauth sta
4520                 vMgrDeAuthenBeginSta(pDevice,
4521                                      pMgmt,
4522                                      pRxPacket->p80211Header->sA3.abyAddr2,
4523                                      (6),
4524                                      &Status
4525                                      );
4526                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 1\n");
4527             }
4528             else {
4529                 s_vMgrRxAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4530             }
4531             break;
4532
4533         case WLAN_FSTYPE_ASSOCRESP:
4534             // Frame Clase = 2
4535             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp1\n");
4536             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, FALSE);
4537             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp2\n");
4538             break;
4539
4540         case WLAN_FSTYPE_REASSOCREQ:
4541             // Frame Clase = 2
4542             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocreq\n");
4543             // Todo: reassoc
4544             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4545                (eNodeState < NODE_AUTH)) {
4546                 // send deauth notification
4547                 // reason = (6) class 2 received from nonauth sta
4548                 vMgrDeAuthenBeginSta(pDevice,
4549                                      pMgmt,
4550                                      pRxPacket->p80211Header->sA3.abyAddr2,
4551                                      (6),
4552                                      &Status
4553                                      );
4554                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 2\n");
4555
4556             }
4557             s_vMgrRxReAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4558             break;
4559
4560         case WLAN_FSTYPE_REASSOCRESP:
4561             // Frame Clase = 2
4562             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocresp\n");
4563             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, TRUE);
4564             break;
4565
4566         case WLAN_FSTYPE_PROBEREQ:
4567             // Frame Clase = 0
4568             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx probereq\n");
4569             s_vMgrRxProbeRequest(pDevice, pMgmt, pRxPacket);
4570             break;
4571
4572         case WLAN_FSTYPE_PROBERESP:
4573             // Frame Clase = 0
4574             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx proberesp\n");
4575
4576             s_vMgrRxProbeResponse(pDevice, pMgmt, pRxPacket);
4577             break;
4578
4579         case WLAN_FSTYPE_BEACON:
4580             // Frame Clase = 0
4581             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx beacon\n");
4582             if (pMgmt->eScanState != WMAC_NO_SCANNING) {
4583                 bInScan = TRUE;
4584             };
4585             s_vMgrRxBeacon(pDevice, pMgmt, pRxPacket, bInScan);
4586             break;
4587
4588         case WLAN_FSTYPE_ATIM:
4589             // Frame Clase = 1
4590             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx atim\n");
4591             break;
4592
4593         case WLAN_FSTYPE_DISASSOC:
4594             // Frame Clase = 2
4595             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx disassoc\n");
4596             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4597                 (eNodeState < NODE_AUTH)) {
4598                 // send deauth notification
4599                 // reason = (6) class 2 received from nonauth sta
4600                 vMgrDeAuthenBeginSta(pDevice,
4601                                      pMgmt,
4602                                      pRxPacket->p80211Header->sA3.abyAddr2,
4603                                      (6),
4604                                      &Status
4605                                      );
4606                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 3\n");
4607             }
4608             s_vMgrRxDisassociation(pDevice, pMgmt, pRxPacket);
4609             break;
4610
4611         case WLAN_FSTYPE_AUTHEN:
4612             // Frame Clase = 1
4613             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO  "rx authen\n");
4614             s_vMgrRxAuthentication(pDevice, pMgmt, pRxPacket);
4615             break;
4616
4617         case WLAN_FSTYPE_DEAUTHEN:
4618             // Frame Clase = 1
4619             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx deauthen\n");
4620             s_vMgrRxDeauthentication(pDevice, pMgmt, pRxPacket);
4621             break;
4622
4623         default:
4624             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx unknown mgmt\n");
4625     }
4626
4627     return;
4628 }
4629
4630
4631
4632
4633 /*+
4634  *
4635  * Routine Description:
4636  *
4637  *
4638  *  Prepare beacon to send
4639  *
4640  * Return Value:
4641  *    TRUE if success; FALSE if failed.
4642  *
4643 -*/
4644 BOOL
4645 bMgrPrepareBeaconToSend(
4646     IN HANDLE hDeviceContext,
4647     IN PSMgmtObject pMgmt
4648     )
4649 {
4650     PSDevice            pDevice = (PSDevice)hDeviceContext;
4651     PSTxMgmtPacket      pTxPacket;
4652
4653 //    pDevice->bBeaconBufReady = FALSE;
4654     if (pDevice->bEncryptionEnable || pDevice->bEnable8021x){
4655         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
4656     }
4657     else {
4658         pMgmt->wCurrCapInfo &= ~WLAN_SET_CAP_INFO_PRIVACY(1);
4659     }
4660     pTxPacket = s_MgrMakeBeacon
4661                 (
4662                   pDevice,
4663                   pMgmt,
4664                   pMgmt->wCurrCapInfo,
4665                   pMgmt->wCurrBeaconPeriod,
4666                   pMgmt->uCurrChannel,
4667                   pMgmt->wCurrATIMWindow, //0,
4668                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4669                   (PBYTE)pMgmt->abyCurrBSSID,
4670                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4671                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
4672                 );
4673
4674     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) &&
4675         (pMgmt->abyCurrBSSID[0] == 0))
4676         return FALSE;
4677
4678     csBeacon_xmit(pDevice, pTxPacket);
4679     MACvRegBitsOn(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
4680
4681     return TRUE;
4682 }
4683
4684
4685
4686
4687 /*+
4688  *
4689  * Routine Description:
4690  *
4691  *  Log a warning message based on the contents of the Status
4692  *  Code field of an 802.11 management frame.  Defines are
4693  *  derived from 802.11-1997 SPEC.
4694  *
4695  * Return Value:
4696  *    none.
4697  *
4698 -*/
4699 static
4700 VOID
4701 s_vMgrLogStatus(
4702     IN PSMgmtObject pMgmt,
4703     IN WORD  wStatus
4704     )
4705 {
4706     switch( wStatus ){
4707         case WLAN_MGMT_STATUS_UNSPEC_FAILURE:
4708             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Unspecified error.\n");
4709             break;
4710         case WLAN_MGMT_STATUS_CAPS_UNSUPPORTED:
4711             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Can't support all requested capabilities.\n");
4712             break;
4713         case WLAN_MGMT_STATUS_REASSOC_NO_ASSOC:
4714             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Reassoc denied, can't confirm original Association.\n");
4715             break;
4716         case WLAN_MGMT_STATUS_ASSOC_DENIED_UNSPEC:
4717             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, undefine in spec\n");
4718             break;
4719         case WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG:
4720             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Peer doesn't support authen algorithm.\n");
4721             break;
4722         case WLAN_MGMT_STATUS_RX_AUTH_NOSEQ:
4723             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen frame received out of sequence.\n");
4724             break;
4725         case WLAN_MGMT_STATUS_CHALLENGE_FAIL:
4726             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, challenge  failure.\n");
4727             break;
4728         case WLAN_MGMT_STATUS_AUTH_TIMEOUT:
4729             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, timeout waiting for next frame.\n");
4730             break;
4731         case WLAN_MGMT_STATUS_ASSOC_DENIED_BUSY:
4732             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, AP too busy.\n");
4733             break;
4734         case WLAN_MGMT_STATUS_ASSOC_DENIED_RATES:
4735             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we haven't enough basic rates.\n");
4736             break;
4737         case WLAN_MGMT_STATUS_ASSOC_DENIED_SHORTPREAMBLE:
4738             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support short preamble.\n");
4739             break;
4740         case WLAN_MGMT_STATUS_ASSOC_DENIED_PBCC:
4741             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support PBCC.\n");
4742             break;
4743         case WLAN_MGMT_STATUS_ASSOC_DENIED_AGILITY:
4744             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support channel agility.\n");
4745             break;
4746         default:
4747             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Unknown status code %d.\n", wStatus);
4748             break;
4749     }
4750 }
4751
4752
4753 /*
4754  *
4755  * Description:
4756  *    Add BSSID in PMKID Candidate list.
4757  *
4758  * Parameters:
4759  *  In:
4760  *      hDeviceContext - device structure point
4761  *      pbyBSSID - BSSID address for adding
4762  *      wRSNCap - BSS's RSN capability
4763  *  Out:
4764  *      none
4765  *
4766  * Return Value: none.
4767  *
4768 -*/
4769 BOOL
4770 bAdd_PMKID_Candidate (
4771     IN HANDLE    hDeviceContext,
4772     IN PBYTE          pbyBSSID,
4773     IN PSRSNCapObject psRSNCapObj
4774     )
4775 {
4776     PSDevice         pDevice = (PSDevice)hDeviceContext;
4777     PPMKID_CANDIDATE pCandidateList;
4778     UINT             ii = 0;
4779
4780     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate START: (%d)\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4781
4782     if ((pDevice == NULL) || (pbyBSSID == NULL) || (psRSNCapObj == NULL))
4783         return FALSE;
4784
4785     if (pDevice->gsPMKIDCandidate.NumCandidates >= MAX_PMKIDLIST)
4786         return FALSE;
4787
4788
4789
4790     // Update Old Candidate
4791     for (ii = 0; ii < pDevice->gsPMKIDCandidate.NumCandidates; ii++) {
4792         pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[ii];
4793         if (MEMEqualMemory(pCandidateList->BSSID, pbyBSSID, U_ETHER_ADDR_LEN)) {
4794             if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4795                 pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4796             } else {
4797                 pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4798             }
4799             return TRUE;
4800         }
4801     }
4802
4803     // New Candidate
4804     pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[pDevice->gsPMKIDCandidate.NumCandidates];
4805     if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4806         pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4807     } else {
4808         pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4809     }
4810     MEMvCopy(pCandidateList->BSSID, pbyBSSID, U_ETHER_ADDR_LEN);
4811     pDevice->gsPMKIDCandidate.NumCandidates++;
4812     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"NumCandidates:%d\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4813     return TRUE;
4814 }
4815
4816 /*
4817  *
4818  * Description:
4819  *    Flush PMKID Candidate list.
4820  *
4821  * Parameters:
4822  *  In:
4823  *      hDeviceContext - device structure point
4824  *  Out:
4825  *      none
4826  *
4827  * Return Value: none.
4828  *
4829 -*/
4830 VOID
4831 vFlush_PMKID_Candidate (
4832     IN HANDLE hDeviceContext
4833     )
4834 {
4835     PSDevice        pDevice = (PSDevice)hDeviceContext;
4836
4837     if (pDevice == NULL)
4838         return;
4839
4840     ZERO_MEMORY(&pDevice->gsPMKIDCandidate, sizeof(SPMKIDCandidateEvent));
4841 }
4842
4843 static BOOL
4844 s_bCipherMatch (
4845     IN PKnownBSS                        pBSSNode,
4846     IN NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
4847     OUT PBYTE                           pbyCCSPK,
4848     OUT PBYTE                           pbyCCSGK
4849     )
4850 {
4851     BYTE byMulticastCipher = KEY_CTL_INVALID;
4852     BYTE byCipherMask = 0x00;
4853     int i;
4854
4855     if (pBSSNode == NULL)
4856         return FALSE;
4857
4858     // check cap. of BSS
4859     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4860          (EncStatus == Ndis802_11Encryption1Enabled)) {
4861         // default is WEP only
4862         byMulticastCipher = KEY_CTL_WEP;
4863     }
4864
4865     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4866         (pBSSNode->bWPA2Valid == TRUE) &&
4867           //20080123-01,<Add> by Einsn Liu
4868         ((EncStatus == Ndis802_11Encryption3Enabled)||(EncStatus == Ndis802_11Encryption2Enabled))) {
4869         //WPA2
4870         // check Group Key Cipher
4871         if ((pBSSNode->byCSSGK == WLAN_11i_CSS_WEP40) ||
4872             (pBSSNode->byCSSGK == WLAN_11i_CSS_WEP104)) {
4873             byMulticastCipher = KEY_CTL_WEP;
4874         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_TKIP) {
4875             byMulticastCipher = KEY_CTL_TKIP;
4876         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_CCMP) {
4877             byMulticastCipher = KEY_CTL_CCMP;
4878         } else {
4879             byMulticastCipher = KEY_CTL_INVALID;
4880         }
4881
4882         // check Pairwise Key Cipher
4883         for(i=0;i<pBSSNode->wCSSPKCount;i++) {
4884             if ((pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP40) ||
4885                 (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP104)) {
4886                 // this should not happen as defined 802.11i
4887                 byCipherMask |= 0x01;
4888             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_TKIP) {
4889                 byCipherMask |= 0x02;
4890             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_CCMP) {
4891                 byCipherMask |= 0x04;
4892             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_USE_GROUP) {
4893                 // use group key only ignore all others
4894                 byCipherMask = 0;
4895                 i = pBSSNode->wCSSPKCount;
4896             }
4897         }
4898
4899     } else if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4900                 (pBSSNode->bWPAValid == TRUE) &&
4901                 ((EncStatus == Ndis802_11Encryption2Enabled) || (EncStatus == Ndis802_11Encryption3Enabled))) {
4902         //WPA
4903         // check Group Key Cipher
4904         if ((pBSSNode->byGKType == WPA_WEP40) ||
4905             (pBSSNode->byGKType == WPA_WEP104)) {
4906             byMulticastCipher = KEY_CTL_WEP;
4907         } else if (pBSSNode->byGKType == WPA_TKIP) {
4908             byMulticastCipher = KEY_CTL_TKIP;
4909         } else if (pBSSNode->byGKType == WPA_AESCCMP) {
4910             byMulticastCipher = KEY_CTL_CCMP;
4911         } else {
4912             byMulticastCipher = KEY_CTL_INVALID;
4913         }
4914
4915         // check Pairwise Key Cipher
4916         for(i=0;i<pBSSNode->wPKCount;i++) {
4917             if (pBSSNode->abyPKType[i] == WPA_TKIP) {
4918                 byCipherMask |= 0x02;
4919             } else if (pBSSNode->abyPKType[i] == WPA_AESCCMP) {
4920                 byCipherMask |= 0x04;
4921             } else if (pBSSNode->abyPKType[i] == WPA_NONE) {
4922                 // use group key only ignore all others
4923                 byCipherMask = 0;
4924                 i = pBSSNode->wPKCount;
4925             }
4926         }
4927     }
4928
4929     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"%d, %d, %d, %d, EncStatus:%d\n",
4930         byMulticastCipher, byCipherMask, pBSSNode->bWPAValid, pBSSNode->bWPA2Valid, EncStatus);
4931
4932     // mask our cap. with BSS
4933     if (EncStatus == Ndis802_11Encryption1Enabled) {
4934
4935         // For supporting Cisco migration mode, don't care pairwise key cipher
4936         //if ((byMulticastCipher == KEY_CTL_WEP) &&
4937         //    (byCipherMask == 0)) {
4938         if ((byMulticastCipher == KEY_CTL_WEP) &&
4939             (byCipherMask == 0)) {
4940             *pbyCCSGK = KEY_CTL_WEP;
4941             *pbyCCSPK = KEY_CTL_NONE;
4942             return TRUE;
4943         } else {
4944             return FALSE;
4945         }
4946
4947     } else if (EncStatus == Ndis802_11Encryption2Enabled) {
4948         if ((byMulticastCipher == KEY_CTL_TKIP) &&
4949             (byCipherMask == 0)) {
4950             *pbyCCSGK = KEY_CTL_TKIP;
4951             *pbyCCSPK = KEY_CTL_NONE;
4952             return TRUE;
4953         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4954                    ((byCipherMask & 0x02) != 0)) {
4955             *pbyCCSGK = KEY_CTL_WEP;
4956             *pbyCCSPK = KEY_CTL_TKIP;
4957             return TRUE;
4958         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4959                    ((byCipherMask & 0x02) != 0)) {
4960             *pbyCCSGK = KEY_CTL_TKIP;
4961             *pbyCCSPK = KEY_CTL_TKIP;
4962             return TRUE;
4963         } else {
4964             return FALSE;
4965         }
4966     } else if (EncStatus == Ndis802_11Encryption3Enabled) {
4967         if ((byMulticastCipher == KEY_CTL_CCMP) &&
4968             (byCipherMask == 0)) {
4969             // When CCMP is enable, "Use group cipher suite" shall not be a valid option.
4970             return FALSE;
4971         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4972                    ((byCipherMask & 0x04) != 0)) {
4973             *pbyCCSGK = KEY_CTL_WEP;
4974             *pbyCCSPK = KEY_CTL_CCMP;
4975             return TRUE;
4976         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4977                    ((byCipherMask & 0x04) != 0)) {
4978             *pbyCCSGK = KEY_CTL_TKIP;
4979             *pbyCCSPK = KEY_CTL_CCMP;
4980             return TRUE;
4981         } else if ((byMulticastCipher == KEY_CTL_CCMP) &&
4982                    ((byCipherMask & 0x04) != 0)) {
4983             *pbyCCSGK = KEY_CTL_CCMP;
4984             *pbyCCSPK = KEY_CTL_CCMP;
4985             return TRUE;
4986         } else {
4987             return FALSE;
4988         }
4989     }
4990     return TRUE;
4991 }
4992
4993