Staging: vt6655-6: potential info leak in private_ioctl()
[pandora-kernel.git] / drivers / staging / vt6656 / ioctl.c
1 /*
2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
3  * All rights reserved.
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License as published by
7  * the Free Software Foundation; either version 2 of the License, or
8  * (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License along
16  * with this program; if not, write to the Free Software Foundation, Inc.,
17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * File: ioctl.c
20  *
21  * Purpose:  private ioctl functions
22  *
23  * Author: Lyndon Chen
24  *
25  * Date: Auguest 20, 2003
26  *
27  * Functions:
28  *
29  * Revision History:
30  *
31  */
32
33 #include "ioctl.h"
34 #include "iocmd.h"
35 #include "mac.h"
36 #include "card.h"
37 #include "hostap.h"
38 #include "wpactl.h"
39 #include "control.h"
40 #include "rndis.h"
41 #include "rf.h"
42
43 /*---------------------  Static Definitions -------------------------*/
44
45 /*---------------------  Static Classes  ----------------------------*/
46
47 /*---------------------  Static Variables  --------------------------*/
48 //static int          msglevel                =MSG_LEVEL_DEBUG;
49 static int          msglevel                =MSG_LEVEL_INFO;
50
51     SWPAResult wpa_Result;
52
53 /*---------------------  Static Functions  --------------------------*/
54
55 /*---------------------  Export Variables  --------------------------*/
56
57 int private_ioctl(PSDevice pDevice, struct ifreq *rq) {
58
59         PSCmdRequest        pReq = (PSCmdRequest)rq;
60     PSMgmtObject        pMgmt = &(pDevice->sMgmtObj);
61         int                     result = 0;
62     PWLAN_IE_SSID       pItemSSID;
63     SCmdBSSJoin         sJoinCmd;
64     SCmdZoneTypeSet sZoneTypeCmd;
65     SCmdScan            sScanCmd;
66     SCmdStartAP         sStartAPCmd;
67     SCmdSetWEP          sWEPCmd;
68     SCmdValue           sValue;
69     SBSSIDList          sList;
70     SNodeList           sNodeList;
71     PSBSSIDList         pList;
72     PSNodeList          pNodeList;
73     unsigned int                cbListCount;
74     PKnownBSS           pBSS;
75     PKnownNodeDB        pNode;
76     unsigned int                ii, jj;
77     SCmdLinkStatus      sLinkStatus;
78     BYTE                abySuppRates[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
79     BYTE                abyNullAddr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
80     DWORD               dwKeyIndex= 0;
81     BYTE                abyScanSSID[WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1];
82     signed long                ldBm;
83
84     pReq->wResult = 0;
85
86     switch(pReq->wCmdCode) {
87
88     case WLAN_CMD_BSS_SCAN:
89
90         if (copy_from_user(&sScanCmd, pReq->data, sizeof(SCmdScan))) {
91                         result = -EFAULT;
92                         break;
93                 }
94
95         pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
96         if (pItemSSID->len != 0) {
97             memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
98             memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
99         }
100         spin_lock_irq(&pDevice->lock);
101
102         if (memcmp(pMgmt->abyCurrBSSID, &abyNullAddr[0], 6) == 0)
103                 BSSvClearBSSList((void *) pDevice, FALSE);
104         else
105                 BSSvClearBSSList((void *) pDevice, pDevice->bLinkPass);
106
107         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_BSS_SCAN..begin\n");
108
109         if (pItemSSID->len != 0)
110                 bScheduleCommand((void *) pDevice,
111                                  WLAN_CMD_BSSID_SCAN,
112                                  abyScanSSID);
113         else
114                 bScheduleCommand((void *) pDevice, WLAN_CMD_BSSID_SCAN, NULL);
115
116         spin_unlock_irq(&pDevice->lock);
117         break;
118
119     case WLAN_CMD_ZONETYPE_SET:
120         //mike add :cann't support.
121            result=-EOPNOTSUPP;
122           break;
123
124         if (copy_from_user(&sZoneTypeCmd, pReq->data, sizeof(SCmdZoneTypeSet))) {
125                         result = -EFAULT;
126                         break;
127                 }
128
129           if(sZoneTypeCmd.bWrite==TRUE) {
130           //////write zonetype
131                 if(sZoneTypeCmd.ZoneType == ZoneType_USA) {
132                   //set to USA
133                    printk("set_ZoneType:USA\n");
134                 }
135                 else if(sZoneTypeCmd.ZoneType == ZoneType_Japan) {
136                   //set to Japan
137                   printk("set_ZoneType:Japan\n");
138                 }
139                else if(sZoneTypeCmd.ZoneType == ZoneType_Europe) {
140                   //set to Europe
141                   printk("set_ZoneType:Europe\n");
142                 }
143             }
144         else {
145           ///////read zonetype
146           BYTE                       zonetype=0;
147
148
149            if(zonetype == 0x00)  { //USA
150              sZoneTypeCmd.ZoneType = ZoneType_USA;
151            }
152          else if(zonetype == 0x01) { //Japan
153              sZoneTypeCmd.ZoneType = ZoneType_Japan;
154           }
155          else if(zonetype == 0x02) { //Europe
156              sZoneTypeCmd.ZoneType = ZoneType_Europe;
157          }
158          else { //Unknown ZoneType
159                 printk("Error:ZoneType[%x] Unknown ???\n",zonetype);
160                  result = -EFAULT;
161                 break;
162          }
163            if (copy_to_user(pReq->data, &sZoneTypeCmd, sizeof(SCmdZoneTypeSet))) {
164                         result = -EFAULT;
165                         break;
166                 }
167         }
168
169              break;
170
171     case WLAN_CMD_BSS_JOIN:
172
173         if (copy_from_user(&sJoinCmd, pReq->data, sizeof(SCmdBSSJoin))) {
174                         result = -EFAULT;
175                         break;
176                 }
177
178         pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
179         memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
180                 memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
181             if (sJoinCmd.wBSSType == ADHOC) {
182                 pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
183                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to adhoc mode\n");
184             }
185             else {
186                 pMgmt->eConfigMode = WMAC_CONFIG_ESS_STA;
187                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to STA mode\n");
188             }
189             if (sJoinCmd.bPSEnable == TRUE) {
190             pDevice->ePSMode = WMAC_POWER_FAST;
191 //            pDevice->ePSMode = WMAC_POWER_MAX;
192             pMgmt->wListenInterval = 2;
193             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving On\n");
194         }
195         else {
196             pDevice->ePSMode = WMAC_POWER_CAM;
197             pMgmt->wListenInterval = 1;
198             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving Off \n");
199         }
200
201         if (sJoinCmd.bShareKeyAuth == TRUE){
202             pMgmt->bShareKeyAlgorithm = TRUE;
203             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key \n");
204         }
205         else {
206             pMgmt->bShareKeyAlgorithm = FALSE;
207             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System \n");
208         }
209             pDevice->uChannel = sJoinCmd.uChannel;
210         netif_stop_queue(pDevice->dev);
211         spin_lock_irq(&pDevice->lock);
212         pMgmt->eCurrState = WMAC_STATE_IDLE;
213         bScheduleCommand((void *) pDevice,
214                          WLAN_CMD_BSSID_SCAN,
215                          pMgmt->abyDesireSSID);
216         bScheduleCommand((void *) pDevice, WLAN_CMD_SSID, NULL);
217         spin_unlock_irq(&pDevice->lock);
218         break;
219
220     case WLAN_CMD_SET_WEP:
221         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WEP Key. \n");
222         memset(&sWEPCmd, 0 ,sizeof(SCmdSetWEP));
223         if (copy_from_user(&sWEPCmd, pReq->data, sizeof(SCmdSetWEP))) {
224                         result = -EFAULT;
225                         break;
226                 }
227             if (sWEPCmd.bEnableWep != TRUE) {
228                 int uu;
229
230             pDevice->bEncryptionEnable = FALSE;
231             pDevice->eEncryptionStatus = Ndis802_11EncryptionDisabled;
232             spin_lock_irq(&pDevice->lock);
233             for (uu = 0; uu < MAX_KEY_TABLE; uu++)
234                 MACvDisableKeyEntry(pDevice, uu);
235             spin_unlock_irq(&pDevice->lock);
236             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WEP function disable.\n");
237             break;
238         }
239
240         for (ii = 0; ii < WLAN_WEP_NKEYS; ii ++) {
241             if (sWEPCmd.bWepKeyAvailable[ii]) {
242                 if (ii == sWEPCmd.byKeyIndex)
243 //2006-1207-01<Modify>by Einsn Liu
244 //                  dwKeyIndex|= (1 << 31);
245                     dwKeyIndex=ii|(1 << 31);
246                 else
247                     dwKeyIndex = ii;
248                 spin_lock_irq(&pDevice->lock);
249                 KeybSetDefaultKey(  pDevice,
250                                     &(pDevice->sKey),
251                                     dwKeyIndex,
252                                     sWEPCmd.auWepKeyLength[ii],
253                                     NULL,
254                                     (PBYTE)&sWEPCmd.abyWepKey[ii][0],
255                                     KEY_CTL_WEP
256                                   );
257                spin_unlock_irq(&pDevice->lock);
258
259             }
260         }
261         pDevice->byKeyIndex = sWEPCmd.byKeyIndex;
262         pDevice->bTransmitKey = TRUE;
263         pDevice->bEncryptionEnable = TRUE;
264         pDevice->eEncryptionStatus = Ndis802_11Encryption1Enabled;
265
266         break;
267
268     case WLAN_CMD_GET_LINK:
269         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_GET_LINK status. \n");
270
271         memset(sLinkStatus.abySSID, 0 , WLAN_SSID_MAXLEN + 1);
272
273         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)
274             sLinkStatus.wBSSType = ADHOC;
275         else
276             sLinkStatus.wBSSType = INFRA;
277
278         if (pMgmt->eCurrState == WMAC_STATE_JOINTED)
279             sLinkStatus.byState = ADHOC_JOINTED;
280         else
281             sLinkStatus.byState = ADHOC_STARTED;
282
283         sLinkStatus.uChannel = pMgmt->uCurrChannel;
284         if (pDevice->bLinkPass == TRUE) {
285             sLinkStatus.bLink = TRUE;
286                     pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
287                     memcpy(sLinkStatus.abySSID, pItemSSID->abySSID, pItemSSID->len);
288                     memcpy(sLinkStatus.abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
289                     sLinkStatus.uLinkRate = pMgmt->sNodeDBTable[0].wTxDataRate;
290             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO" Link Success ! \n");
291         }
292         else {
293             sLinkStatus.bLink = FALSE;
294             sLinkStatus.uLinkRate = 0;
295         }
296         if (copy_to_user(pReq->data, &sLinkStatus, sizeof(SCmdLinkStatus))) {
297                         result = -EFAULT;
298                         break;
299                 }
300
301         break;
302
303     case WLAN_CMD_GET_LISTLEN:
304                 cbListCount = 0;
305                 pBSS = &(pMgmt->sBSSList[0]);
306         for (ii = 0; ii < MAX_BSS_NUM; ii++) {
307             pBSS = &(pMgmt->sBSSList[ii]);
308             if (!pBSS->bActive)
309                 continue;
310             cbListCount++;
311         }
312         sList.uItem = cbListCount;
313         if (copy_to_user(pReq->data, &sList, sizeof(SBSSIDList))) {
314                         result = -EFAULT;
315                         break;
316                 }
317         pReq->wResult = 0;
318         break;
319
320     case WLAN_CMD_GET_LIST:
321         if (copy_from_user(&sList, pReq->data, sizeof(SBSSIDList))) {
322                         result = -EFAULT;
323                         break;
324                 }
325         pList = (PSBSSIDList)kmalloc(sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)), (int)GFP_ATOMIC);
326         if (pList == NULL) {
327             result = -ENOMEM;
328             break;
329         }
330                 pList->uItem = sList.uItem;
331                 pBSS = &(pMgmt->sBSSList[0]);
332         for (ii = 0, jj = 0; jj < MAX_BSS_NUM ; jj++) {
333             pBSS = &(pMgmt->sBSSList[jj]);
334             if (pBSS->bActive) {
335                     pList->sBSSIDList[ii].uChannel = pBSS->uChannel;
336                     pList->sBSSIDList[ii].wBeaconInterval = pBSS->wBeaconInterval;
337                     pList->sBSSIDList[ii].wCapInfo = pBSS->wCapInfo;
338                     RFvRSSITodBm(pDevice, (BYTE)(pBSS->uRSSI), &ldBm);
339                     pList->sBSSIDList[ii].uRSSI = (unsigned int) ldBm;
340 //                  pList->sBSSIDList[ii].uRSSI = pBSS->uRSSI;
341                     memcpy(pList->sBSSIDList[ii].abyBSSID, pBSS->abyBSSID, WLAN_BSSID_LEN);
342                     pItemSSID = (PWLAN_IE_SSID)pBSS->abySSID;
343                     memset(pList->sBSSIDList[ii].abySSID, 0, WLAN_SSID_MAXLEN + 1);
344                     memcpy(pList->sBSSIDList[ii].abySSID, pItemSSID->abySSID, pItemSSID->len);
345                 if (WLAN_GET_CAP_INFO_ESS(pBSS->wCapInfo)) {
346                         pList->sBSSIDList[ii].byNetType = INFRA;
347                 }
348                 else {
349                         pList->sBSSIDList[ii].byNetType = ADHOC;
350                     }
351                     if (WLAN_GET_CAP_INFO_PRIVACY(pBSS->wCapInfo)) {
352                         pList->sBSSIDList[ii].bWEPOn = TRUE;
353                 }
354                 else {
355                         pList->sBSSIDList[ii].bWEPOn = FALSE;
356                     }
357                     ii ++;
358                     if (ii >= pList->uItem)
359                         break;
360             }
361         }
362
363         if (copy_to_user(pReq->data, pList, sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)))) {
364                         result = -EFAULT;
365                         break;
366                 }
367         kfree(pList);
368         pReq->wResult = 0;
369         break;
370
371     case WLAN_CMD_GET_MIB:
372         if (copy_to_user(pReq->data, &(pDevice->s802_11Counter), sizeof(SDot11MIBCount))) {
373                         result = -EFAULT;
374                         break;
375                 }
376         break;
377
378     case WLAN_CMD_GET_STAT:
379         if (copy_to_user(pReq->data, &(pDevice->scStatistic), sizeof(SStatCounter))) {
380                         result = -EFAULT;
381                         break;
382                 }
383         break;
384     case WLAN_CMD_STOP_MAC:
385
386         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_STOP_MAC\n");
387         // Todo xxxxxx
388         netif_stop_queue(pDevice->dev);
389         spin_lock_irq(&pDevice->lock);
390         if (pDevice->bRadioOff == FALSE) {
391             CARDbRadioPowerOff(pDevice);
392         }
393         pDevice->bLinkPass = FALSE;
394         ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_SLOW);
395         memset(pMgmt->abyCurrBSSID, 0, 6);
396         pMgmt->eCurrState = WMAC_STATE_IDLE;
397 //        del_timer(&pDevice->sTimerCommand);
398 //        del_timer(&pMgmt->sTimerSecondCallback);
399         pDevice->bCmdRunning = FALSE;
400         spin_unlock_irq(&pDevice->lock);
401
402         break;
403
404     case WLAN_CMD_START_MAC:
405
406         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_START_MAC\n");
407         // Todo xxxxxxx
408         if (pDevice->bRadioOff == TRUE)
409             CARDbRadioPowerOn(pDevice);
410         break;
411
412     case WLAN_CMD_SET_HOSTAPD:
413
414         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD\n");
415
416         if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
417                         result = -EFAULT;
418                         break;
419                 }
420                 if (sValue.dwValue == 1) {
421             if (vt6656_hostap_set_hostapd(pDevice, 1, 1) == 0){
422                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HOSTAP\n");
423             }
424             else {
425                             result = -EFAULT;
426                             break;
427                         }
428         }
429         else {
430             vt6656_hostap_set_hostapd(pDevice, 0, 1);
431             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HOSTAP\n");
432         }
433
434         break;
435
436     case WLAN_CMD_SET_HOSTAPD_STA:
437
438         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD_STA\n");
439
440         break;
441     case WLAN_CMD_SET_802_1X:
442
443         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_802_1X\n");
444         if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
445                         result = -EFAULT;
446                         break;
447                 }
448
449                 if (sValue.dwValue == 1) {
450             pDevice->bEnable8021x = TRUE;
451             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable 802.1x\n");
452         }
453         else {
454             pDevice->bEnable8021x = FALSE;
455             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable 802.1x\n");
456         }
457
458         break;
459
460
461     case WLAN_CMD_SET_HOST_WEP:
462
463         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOST_WEP\n");
464         if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
465                         result = -EFAULT;
466                         break;
467                 }
468
469                 if (sValue.dwValue == 1) {
470             pDevice->bEnableHostWEP = TRUE;
471             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HostWEP\n");
472         }
473         else {
474             pDevice->bEnableHostWEP = FALSE;
475             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HostWEP\n");
476         }
477
478         break;
479
480     case WLAN_CMD_SET_WPA:
481          DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WPA\n");
482
483         if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
484                         result = -EFAULT;
485                         break;
486                 }
487                 if (sValue.dwValue == 1) {
488                      DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "up wpadev\n");
489                    memcpy(pDevice->wpadev->dev_addr,
490                           pDevice->dev->dev_addr,
491                           ETH_ALEN);
492                    pDevice->bWPADEVUp = TRUE;
493         }
494         else {
495             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "close wpadev\n");
496            pDevice->bWPADEVUp = FALSE;
497         }
498
499         break;
500
501     case WLAN_CMD_AP_START:
502
503         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_AP_START\n");
504         if (pDevice->bRadioOff == TRUE) {
505             CARDbRadioPowerOn(pDevice);
506             add_timer(&pMgmt->sTimerSecondCallback);
507         }
508         if (copy_from_user(&sStartAPCmd, pReq->data, sizeof(SCmdStartAP))) {
509                         result = -EFAULT;
510                         break;
511                 }
512
513             if (sStartAPCmd.wBSSType == AP) {
514                 pMgmt->eConfigMode = WMAC_CONFIG_AP;
515                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to AP mode\n");
516             }
517             else {
518                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct BSS type not set to AP mode\n");
519                         result = -EFAULT;
520                         break;
521             }
522
523
524             if (sStartAPCmd.wBBPType == PHY80211g) {
525             pMgmt->byAPBBType = PHY_TYPE_11G;
526         }
527         else if (sStartAPCmd.wBBPType == PHY80211a) {
528                  pMgmt->byAPBBType = PHY_TYPE_11A;
529         }
530         else {
531             pMgmt->byAPBBType = PHY_TYPE_11B;
532         }
533
534         pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
535         memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
536                 memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
537
538             if ((sStartAPCmd.uChannel > 0)&&(sStartAPCmd.uChannel <= 14))
539                 pDevice->uChannel = sStartAPCmd.uChannel;
540
541             if ((sStartAPCmd.uBeaconInt >= 20) && (sStartAPCmd.uBeaconInt <= 1000))
542             pMgmt->wIBSSBeaconPeriod = sStartAPCmd.uBeaconInt;
543         else
544             pMgmt->wIBSSBeaconPeriod = 100;
545
546         if (sStartAPCmd.bShareKeyAuth == TRUE){
547             pMgmt->bShareKeyAlgorithm = TRUE;
548             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key \n");
549         }
550         else {
551             pMgmt->bShareKeyAlgorithm = FALSE;
552             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System \n");
553         }
554         memcpy(pMgmt->abyIBSSSuppRates, abySuppRates, 6);
555
556         if (sStartAPCmd.byBasicRate & BIT3) {
557             pMgmt->abyIBSSSuppRates[2] |= BIT7;
558             pMgmt->abyIBSSSuppRates[3] |= BIT7;
559             pMgmt->abyIBSSSuppRates[4] |= BIT7;
560             pMgmt->abyIBSSSuppRates[5] |= BIT7;
561         }else if (sStartAPCmd.byBasicRate & BIT2) {
562              pMgmt->abyIBSSSuppRates[2] |= BIT7;
563              pMgmt->abyIBSSSuppRates[3] |= BIT7;
564              pMgmt->abyIBSSSuppRates[4] |= BIT7;
565         }else if (sStartAPCmd.byBasicRate & BIT1) {
566              pMgmt->abyIBSSSuppRates[2] |= BIT7;
567              pMgmt->abyIBSSSuppRates[3] |= BIT7;
568         }else if (sStartAPCmd.byBasicRate & BIT1) {
569              pMgmt->abyIBSSSuppRates[2] |= BIT7;
570         }else {
571             //default 1,2M
572              pMgmt->abyIBSSSuppRates[2] |= BIT7;
573              pMgmt->abyIBSSSuppRates[3] |= BIT7;
574         }
575
576         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Support Rate= %x %x %x %x\n",
577                 pMgmt->abyIBSSSuppRates[2],
578                 pMgmt->abyIBSSSuppRates[3],
579                 pMgmt->abyIBSSSuppRates[4],
580                 pMgmt->abyIBSSSuppRates[5]
581                 );
582
583         netif_stop_queue(pDevice->dev);
584         spin_lock_irq(&pDevice->lock);
585         bScheduleCommand((void *) pDevice, WLAN_CMD_RUN_AP, NULL);
586         spin_unlock_irq(&pDevice->lock);
587         break;
588
589     case WLAN_CMD_GET_NODE_CNT:
590
591                 cbListCount = 0;
592                 pNode = &(pMgmt->sNodeDBTable[0]);
593         for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
594             pNode = &(pMgmt->sNodeDBTable[ii]);
595             if (!pNode->bActive)
596                 continue;
597             cbListCount++;
598         }
599
600         sNodeList.uItem = cbListCount;
601         if (copy_to_user(pReq->data, &sNodeList, sizeof(SNodeList))) {
602                         result = -EFAULT;
603                         break;
604                 }
605         pReq->wResult = 0;
606         break;
607
608     case WLAN_CMD_GET_NODE_LIST:
609
610         if (copy_from_user(&sNodeList, pReq->data, sizeof(SNodeList))) {
611                         result = -EFAULT;
612                         break;
613                 }
614         pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);
615         if (pNodeList == NULL) {
616             result = -ENOMEM;
617             break;
618         }
619                 pNodeList->uItem = sNodeList.uItem;
620                 pNode = &(pMgmt->sNodeDBTable[0]);
621         for (ii = 0, jj = 0; ii < (MAX_NODE_NUM + 1); ii++) {
622             pNode = &(pMgmt->sNodeDBTable[ii]);
623             if (pNode->bActive) {
624                     pNodeList->sNodeList[jj].wAID = pNode->wAID;
625                     memcpy(pNodeList->sNodeList[jj].abyMACAddr, pNode->abyMACAddr, WLAN_ADDR_LEN);
626                     pNodeList->sNodeList[jj].wTxDataRate = pNode->wTxDataRate;
627                     pNodeList->sNodeList[jj].wInActiveCount = (WORD)pNode->uInActiveCount;
628                     pNodeList->sNodeList[jj].wEnQueueCnt = (WORD)pNode->wEnQueueCnt;
629                     pNodeList->sNodeList[jj].wFlags = (WORD)pNode->dwFlags;
630                     pNodeList->sNodeList[jj].bPWBitOn = pNode->bPSEnable;
631                     pNodeList->sNodeList[jj].byKeyIndex = pNode->byKeyIndex;
632                     pNodeList->sNodeList[jj].wWepKeyLength = pNode->uWepKeyLength;
633                     memcpy(&(pNodeList->sNodeList[jj].abyWepKey[0]), &(pNode->abyWepKey[0]), WEP_KEYMAXLEN);
634                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "key= %2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
635                             pNodeList->sNodeList[jj].abyWepKey[0],
636                             pNodeList->sNodeList[jj].abyWepKey[1],
637                             pNodeList->sNodeList[jj].abyWepKey[2],
638                             pNodeList->sNodeList[jj].abyWepKey[3],
639                             pNodeList->sNodeList[jj].abyWepKey[4]
640                            );
641                     pNodeList->sNodeList[jj].bIsInFallback = pNode->bIsInFallback;
642                     pNodeList->sNodeList[jj].uTxFailures = pNode->uTxFailures;
643                     pNodeList->sNodeList[jj].uTxAttempts = pNode->uTxAttempts;
644                     pNodeList->sNodeList[jj].wFailureRatio = (WORD)pNode->uFailureRatio;
645                     jj ++;
646                     if (jj >= pNodeList->uItem)
647                         break;
648                 }
649                 }
650         if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {
651                         result = -EFAULT;
652                         break;
653                 }
654         kfree(pNodeList);
655         pReq->wResult = 0;
656         break;
657
658     case 0xFF:
659         memset(wpa_Result.ifname,0,sizeof(wpa_Result.ifname));
660             wpa_Result.proto = 0;
661             wpa_Result.key_mgmt = 0;
662             wpa_Result.eap_type = 0;
663             wpa_Result.authenticated = FALSE;
664               pDevice->fWPA_Authened = FALSE;
665         if (copy_from_user(&wpa_Result, pReq->data, sizeof(wpa_Result))) {
666             result = -EFAULT;
667                         break;
668                 }
669 //DavidWang  for some AP maybe good authenticate
670    if(wpa_Result.key_mgmt==0x20)
671       pMgmt->Cisco_cckm =1;
672     else
673     pMgmt->Cisco_cckm =0;
674
675
676 if(wpa_Result.authenticated==TRUE) {
677    {
678      union iwreq_data      wrqu;
679
680      pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
681
682      memset(&wrqu, 0, sizeof(wrqu));
683      wrqu.data.flags = RT_WPACONNECTED_EVENT_FLAG;
684      wrqu.data.length =pItemSSID->len;
685      wireless_send_event(pDevice->dev, IWEVCUSTOM, &wrqu, pItemSSID->abySSID);
686    }
687          pDevice->fWPA_Authened = TRUE;           //is successful peer to wpa_Result.authenticated?
688 }
689
690         //printk("get private wpa_supplicant announce WPA SM\n");
691         //printk("wpa-->ifname=%s\n",wpa_Result.ifname);
692         //printk("wpa-->proto=%d\n",wpa_Result.proto);
693         //printk("wpa-->key-mgmt=%d\n",wpa_Result.key_mgmt);
694         //printk("wpa-->eap_type=%d\n",wpa_Result.eap_type);
695         //printk("wpa-->authenticated is %s\n",(wpa_Result.authenticated==TRUE)?"TRUE":"FALSE");
696
697         pReq->wResult = 0;
698         break;
699
700     default:
701         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Private command not support..\n");
702     }
703
704     return result;
705 }