drivers/staging/vt6656/wmgr.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  *
  20  * File: wmgr.c
  21  *
  22  * Purpose: Handles the 802.11 management functions
  23  *
  24  * Author: Lyndon Chen
  25  *
  26  * Date: May 8, 2002
  27  *
  28  * Functions:
  29  *      nsMgrObjectInitial - Initialize Management Objet data structure
  30  *      vMgrObjectReset - Reset Management Objet data structure
  31  *      vMgrAssocBeginSta - Start associate function
  32  *      vMgrReAssocBeginSta - Start reassociate function
  33  *      vMgrDisassocBeginSta - Start disassociate function
  34  *      s_vMgrRxAssocRequest - Handle Rcv associate_request
  35  *      s_vMgrRxAssocResponse - Handle Rcv associate_response
  36  *      vMrgAuthenBeginSta - Start authentication function
  37  *      vMgrDeAuthenDeginSta - Start deauthentication function
  38  *      s_vMgrRxAuthentication - Handle Rcv authentication
  39  *      s_vMgrRxAuthenSequence_1 - Handle Rcv authentication sequence 1
  40  *      s_vMgrRxAuthenSequence_2 - Handle Rcv authentication sequence 2
  41  *      s_vMgrRxAuthenSequence_3 - Handle Rcv authentication sequence 3
  42  *      s_vMgrRxAuthenSequence_4 - Handle Rcv authentication sequence 4
  43  *      s_vMgrRxDisassociation - Handle Rcv disassociation
  44  *      s_vMgrRxBeacon - Handle Rcv Beacon
  45  *      vMgrCreateOwnIBSS - Create ad_hoc IBSS or AP BSS
  46  *      vMgrJoinBSSBegin - Join BSS function
  47  *      s_vMgrSynchBSS - Synch & adopt BSS parameters
  48  *      s_MgrMakeBeacon - Create Baecon frame
  49  *      s_MgrMakeProbeResponse - Create Probe Response frame
  50  *      s_MgrMakeAssocRequest - Create Associate Request frame
  51  *      s_MgrMakeReAssocRequest - Create ReAssociate Request frame
  52  *      s_vMgrRxProbeResponse - Handle Rcv probe_response
  53  *      s_vMrgRxProbeRequest - Handle Rcv probe_request
  54  *      bMgrPrepareBeaconToSend - Prepare Beacon frame
  55  *      s_vMgrLogStatus - Log 802.11 Status
  56  *      vMgrRxManagePacket - Rcv management frame dispatch function
  57  *      s_vMgrFormatTIM- Assember TIM field of beacon
  58  *      vMgrTimerInit- Initial 1-sec and command call back funtions
  59  *
  60  * Revision History:
  61  *
  62  */
  63
  64 #include "tmacro.h"
  65 #include "desc.h"
  66 #include "device.h"
  67 #include "card.h"
  68 #include "80211hdr.h"
  69 #include "80211mgr.h"
  70 #include "wmgr.h"
  71 #include "wcmd.h"
  72 #include "mac.h"
  73 #include "bssdb.h"
  74 #include "power.h"
  75 #include "datarate.h"
  76 #include "baseband.h"
  77 #include "rxtx.h"
  78 #include "wpa.h"
  79 #include "rf.h"
  80 #include "iowpa.h"
  81 #include "control.h"
  82 #include "rndis.h"
  83
  84 /*---------------------  Static Definitions -------------------------*/
  85
  86
  87
  88 /*---------------------  Static Classes  ----------------------------*/
  89
  90 /*---------------------  Static Variables  --------------------------*/
  91 static int          msglevel                =MSG_LEVEL_INFO;
  92 //static int          msglevel                =MSG_LEVEL_DEBUG;
  93
  94 /*---------------------  Static Functions  --------------------------*/
  95 //2008-0730-01<Add>by MikeLiu
  96 static BOOL ChannelExceedZoneType(
  97     IN PSDevice pDevice,
  98     IN BYTE byCurrChannel
  99     );
 100
 101 // Association/diassociation functions
 102 static
 103 PSTxMgmtPacket
 104 s_MgrMakeAssocRequest(
 105     IN PSDevice pDevice,
 106     IN PSMgmtObject pMgmt,
 107     IN PBYTE pDAddr,
 108     IN WORD wCurrCapInfo,
 109     IN WORD wListenInterval,
 110     IN PWLAN_IE_SSID pCurrSSID,
 111     IN PWLAN_IE_SUPP_RATES pCurrRates,
 112     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 113     );
 114
 115 static
 116 VOID
 117 s_vMgrRxAssocRequest(
 118     IN PSDevice pDevice,
 119     IN PSMgmtObject pMgmt,
 120     IN PSRxMgmtPacket pRxPacket,
 121     IN UINT  uNodeIndex
 122     );
 123
 124 static
 125 PSTxMgmtPacket
 126 s_MgrMakeReAssocRequest(
 127     IN PSDevice pDevice,
 128     IN PSMgmtObject pMgmt,
 129     IN PBYTE pDAddr,
 130     IN WORD wCurrCapInfo,
 131     IN WORD wListenInterval,
 132     IN PWLAN_IE_SSID pCurrSSID,
 133     IN PWLAN_IE_SUPP_RATES pCurrRates,
 134     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 135     );
 136
 137 static
 138 VOID
 139 s_vMgrRxAssocResponse(
 140     IN PSDevice pDevice,
 141     IN PSMgmtObject pMgmt,
 142     IN PSRxMgmtPacket pRxPacket,
 143     IN BOOL bReAssocType
 144     );
 145
 146 static
 147 VOID
 148 s_vMgrRxDisassociation(
 149     IN PSDevice pDevice,
 150     IN PSMgmtObject pMgmt,
 151     IN PSRxMgmtPacket pRxPacket
 152     );
 153
 154 // Authentication/deauthen functions
 155 static
 156 VOID
 157 s_vMgrRxAuthenSequence_1(
 158     IN PSDevice pDevice,
 159     IN PSMgmtObject pMgmt,
 160     IN PWLAN_FR_AUTHEN pFrame
 161     );
 162
 163 static
 164 VOID
 165 s_vMgrRxAuthenSequence_2(
 166     IN PSDevice pDevice,
 167     IN PSMgmtObject pMgmt,
 168     IN PWLAN_FR_AUTHEN pFrame
 169     );
 170
 171 static
 172 VOID
 173 s_vMgrRxAuthenSequence_3(
 174     IN PSDevice pDevice,
 175     IN PSMgmtObject pMgmt,
 176     IN PWLAN_FR_AUTHEN pFrame
 177     );
 178
 179 static
 180 VOID
 181 s_vMgrRxAuthenSequence_4(
 182     IN PSDevice pDevice,
 183     IN PSMgmtObject pMgmt,
 184     IN PWLAN_FR_AUTHEN pFrame
 185     );
 186
 187 static
 188 VOID
 189 s_vMgrRxAuthentication(
 190     IN PSDevice pDevice,
 191     IN PSMgmtObject pMgmt,
 192     IN PSRxMgmtPacket pRxPacket
 193     );
 194
 195 static
 196 VOID
 197 s_vMgrRxDeauthentication(
 198     IN PSDevice pDevice,
 199     IN PSMgmtObject pMgmt,
 200     IN PSRxMgmtPacket pRxPacket
 201     );
 202
 203 // Scan functions
 204 // probe request/response functions
 205 static
 206 VOID
 207 s_vMgrRxProbeRequest(
 208     IN PSDevice pDevice,
 209     IN PSMgmtObject pMgmt,
 210     IN PSRxMgmtPacket pRxPacket
 211     );
 212
 213 static
 214 VOID
 215 s_vMgrRxProbeResponse(
 216     IN PSDevice pDevice,
 217     IN PSMgmtObject pMgmt,
 218     IN PSRxMgmtPacket pRxPacket
 219     );
 220
 221 // beacon functions
 222 static
 223 VOID
 224 s_vMgrRxBeacon(
 225     IN PSDevice pDevice,
 226     IN PSMgmtObject pMgmt,
 227     IN PSRxMgmtPacket pRxPacket,
 228     IN BOOL bInScan
 229     );
 230
 231 static
 232 VOID
 233 s_vMgrFormatTIM(
 234     IN PSMgmtObject pMgmt,
 235     IN PWLAN_IE_TIM pTIM
 236     );
 237
 238 static
 239 PSTxMgmtPacket
 240 s_MgrMakeBeacon(
 241     IN PSDevice pDevice,
 242     IN PSMgmtObject pMgmt,
 243     IN WORD wCurrCapInfo,
 244     IN WORD wCurrBeaconPeriod,
 245     IN UINT uCurrChannel,
 246     IN WORD wCurrATIMWinodw,
 247     IN PWLAN_IE_SSID pCurrSSID,
 248     IN PBYTE pCurrBSSID,
 249     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 250     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 251     );
 252
 253
 254 // Association response
 255 static
 256 PSTxMgmtPacket
 257 s_MgrMakeAssocResponse(
 258     IN PSDevice pDevice,
 259     IN PSMgmtObject pMgmt,
 260     IN WORD wCurrCapInfo,
 261     IN WORD wAssocStatus,
 262     IN WORD wAssocAID,
 263     IN PBYTE pDstAddr,
 264     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 265     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 266     );
 267
 268 // ReAssociation response
 269 static
 270 PSTxMgmtPacket
 271 s_MgrMakeReAssocResponse(
 272     IN PSDevice pDevice,
 273     IN PSMgmtObject pMgmt,
 274     IN WORD wCurrCapInfo,
 275     IN WORD wAssocStatus,
 276     IN WORD wAssocAID,
 277     IN PBYTE pDstAddr,
 278     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 279     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 280     );
 281
 282 // Probe response
 283 static
 284 PSTxMgmtPacket
 285 s_MgrMakeProbeResponse(
 286     IN PSDevice pDevice,
 287     IN PSMgmtObject pMgmt,
 288     IN WORD wCurrCapInfo,
 289     IN WORD wCurrBeaconPeriod,
 290     IN UINT uCurrChannel,
 291     IN WORD wCurrATIMWinodw,
 292     IN PBYTE pDstAddr,
 293     IN PWLAN_IE_SSID pCurrSSID,
 294     IN PBYTE pCurrBSSID,
 295     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
 296     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
 297     IN BYTE byPHYType
 298     );
 299
 300 // received status
 301 static
 302 VOID
 303 s_vMgrLogStatus(
 304     IN PSMgmtObject pMgmt,
 305     IN WORD wStatus
 306     );
 307
 308
 309 static
 310 VOID
 311 s_vMgrSynchBSS (
 312     IN PSDevice      pDevice,
 313     IN UINT          uBSSMode,
 314     IN PKnownBSS     pCurr,
 315     OUT PCMD_STATUS  pStatus
 316     );
 317
 318
 319 static BOOL
 320 s_bCipherMatch (
 321     IN PKnownBSS                        pBSSNode,
 322     IN NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
 323     OUT PBYTE                           pbyCCSPK,
 324     OUT PBYTE                           pbyCCSGK
 325     );
 326
 327  static VOID  Encyption_Rebuild(
 328     IN PSDevice pDevice,
 329     IN PKnownBSS pCurr
 330  );
 331
 332
 333
 334 /*---------------------  Export Variables  --------------------------*/
 335
 336
 337 /*---------------------  Export Functions  --------------------------*/
 338
 339
 340 /*+
 341  *
 342  * Routine Description:
 343  *    Allocates and initializes the Management object.
 344  *
 345  * Return Value:
 346  *    Ndis_staus.
 347  *
 348 -*/
 349
 350 VOID
 351 vMgrObjectInit(
 352     IN  HANDLE hDeviceContext
 353     )
 354 {
 355     PSDevice     pDevice = (PSDevice)hDeviceContext;
 356     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
 357     int ii;
 358
 359
 360     pMgmt->pbyPSPacketPool = &pMgmt->byPSPacketPool[0];
 361     pMgmt->pbyMgmtPacketPool = &pMgmt->byMgmtPacketPool[0];
 362     pMgmt->uCurrChannel = pDevice->uChannel;
 363     for(ii=0;ii<WLAN_BSSID_LEN;ii++) {
 364         pMgmt->abyDesireBSSID[ii] = 0xFF;
 365     }
 366     pMgmt->sAssocInfo.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 367     //memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN +1);
 368     pMgmt->byCSSPK = KEY_CTL_NONE;
 369     pMgmt->byCSSGK = KEY_CTL_NONE;
 370     pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
 371     BSSvClearBSSList((HANDLE)pDevice, FALSE);
 372
 373     init_timer(&pMgmt->sTimerSecondCallback);
 374     pMgmt->sTimerSecondCallback.data = (ULONG)pDevice;
 375     pMgmt->sTimerSecondCallback.function = (TimerFunction)BSSvSecondCallBack;
 376     pMgmt->sTimerSecondCallback.expires = RUN_AT(HZ);
 377
 378     init_timer(&pDevice->sTimerCommand);
 379     pDevice->sTimerCommand.data = (ULONG)pDevice;
 380     pDevice->sTimerCommand.function = (TimerFunction)vRunCommand;
 381     pDevice->sTimerCommand.expires = RUN_AT(HZ);
 382
 383 //2007-0115-10<Add>by MikeLiu
 384    #ifdef TxInSleep
 385     init_timer(&pDevice->sTimerTxData);
 386     pDevice->sTimerTxData.data = (ULONG)pDevice;
 387     pDevice->sTimerTxData.function = (TimerFunction)BSSvSecondTxData;
 388     pDevice->sTimerTxData.expires = RUN_AT(10*HZ);      //10s callback
 389     pDevice->fTxDataInSleep = FALSE;
 390     pDevice->IsTxDataTrigger = FALSE;
 391     pDevice->nTxDataTimeCout = 0;
 392    #endif
 393
 394     pDevice->cbFreeCmdQueue = CMD_Q_SIZE;
 395     pDevice->uCmdDequeueIdx = 0;
 396     pDevice->uCmdEnqueueIdx = 0;
 397     pDevice->eCommandState = WLAN_CMD_IDLE;
 398     pDevice->bCmdRunning = FALSE;
 399     pDevice->bCmdClear = FALSE;
 400
 401     return;
 402 }
 403
 404
 405
 406 /*+
 407  *
 408  * Routine Description:
 409  *    Start the station association procedure.  Namely, send an
 410  *    association request frame to the AP.
 411  *
 412  * Return Value:
 413  *    None.
 414  *
 415 -*/
 416
 417
 418 VOID
 419 vMgrAssocBeginSta(
 420     IN  HANDLE hDeviceContext,
 421     IN  PSMgmtObject pMgmt,
 422     OUT PCMD_STATUS pStatus
 423     )
 424 {
 425     PSDevice             pDevice = (PSDevice)hDeviceContext;
 426     PSTxMgmtPacket          pTxPacket;
 427
 428
 429     pMgmt->wCurrCapInfo = 0;
 430     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 431     if (pDevice->bEncryptionEnable) {
 432         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 433     }
 434     // always allow receive short preamble
 435     //if (pDevice->byPreambleType == 1) {
 436     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 437     //}
 438     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 439     if (pMgmt->wListenInterval == 0)
 440         pMgmt->wListenInterval = 1;    // at least one.
 441
 442     // ERP Phy (802.11g) should support short preamble.
 443     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 444         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 445         if (pDevice->bShortSlotTime == TRUE)
 446             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 447
 448     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 449         if (pDevice->byPreambleType == 1) {
 450             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 451         }
 452     }
 453     if (pMgmt->b11hEnable == TRUE)
 454         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 455
 456     // build an assocreq frame and send it
 457     pTxPacket = s_MgrMakeAssocRequest
 458                 (
 459                   pDevice,
 460                   pMgmt,
 461                   pMgmt->abyCurrBSSID,
 462                   pMgmt->wCurrCapInfo,
 463                   pMgmt->wListenInterval,
 464                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 465                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 466                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 467                 );
 468
 469     if (pTxPacket != NULL ){
 470         // send the frame
 471         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 472         if (*pStatus == CMD_STATUS_PENDING) {
 473             pMgmt->eCurrState = WMAC_STATE_ASSOCPENDING;
 474             *pStatus = CMD_STATUS_SUCCESS;
 475         }
 476     }
 477     else
 478         *pStatus = CMD_STATUS_RESOURCES;
 479
 480     return ;
 481 }
 482
 483
 484 /*+
 485  *
 486  * Routine Description:
 487  *    Start the station re-association procedure.
 488  *
 489  * Return Value:
 490  *    None.
 491  *
 492 -*/
 493
 494 VOID
 495 vMgrReAssocBeginSta(
 496     IN  HANDLE hDeviceContext,
 497     IN  PSMgmtObject pMgmt,
 498     OUT PCMD_STATUS pStatus
 499     )
 500 {
 501     PSDevice             pDevice = (PSDevice)hDeviceContext;
 502     PSTxMgmtPacket          pTxPacket;
 503
 504
 505
 506     pMgmt->wCurrCapInfo = 0;
 507     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 508     if (pDevice->bEncryptionEnable) {
 509         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 510     }
 511
 512     //if (pDevice->byPreambleType == 1) {
 513     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 514     //}
 515     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 516
 517     if (pMgmt->wListenInterval == 0)
 518         pMgmt->wListenInterval = 1;    // at least one.
 519
 520
 521     // ERP Phy (802.11g) should support short preamble.
 522     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 523         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 524       if (pDevice->bShortSlotTime == TRUE)
 525           pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 526
 527     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 528         if (pDevice->byPreambleType == 1) {
 529             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 530         }
 531     }
 532     if (pMgmt->b11hEnable == TRUE)
 533         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 534
 535
 536     pTxPacket = s_MgrMakeReAssocRequest
 537                 (
 538                   pDevice,
 539                   pMgmt,
 540                   pMgmt->abyCurrBSSID,
 541                   pMgmt->wCurrCapInfo,
 542                   pMgmt->wListenInterval,
 543                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 544                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 545                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 546                 );
 547
 548     if (pTxPacket != NULL ){
 549         // send the frame
 550         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 551         if (*pStatus != CMD_STATUS_PENDING) {
 552             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx failed.\n");
 553         }
 554         else {
 555             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx sending.\n");
 556         }
 557     }
 558
 559
 560     return ;
 561 }
 562
 563 /*+
 564  *
 565  * Routine Description:
 566  *    Send an dis-association request frame to the AP.
 567  *
 568  * Return Value:
 569  *    None.
 570  *
 571 -*/
 572
 573 VOID
 574 vMgrDisassocBeginSta(
 575     IN  HANDLE hDeviceContext,
 576     IN  PSMgmtObject pMgmt,
 577     IN  PBYTE  abyDestAddress,
 578     IN  WORD    wReason,
 579     OUT PCMD_STATUS pStatus
 580     )
 581 {
 582     PSDevice            pDevice = (PSDevice)hDeviceContext;
 583     PSTxMgmtPacket      pTxPacket = NULL;
 584     WLAN_FR_DISASSOC    sFrame;
 585
 586     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
 587     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DISASSOC_FR_MAXLEN);
 588     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
 589
 590     // Setup the sFrame structure
 591     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
 592     sFrame.len = WLAN_DISASSOC_FR_MAXLEN;
 593
 594     // format fixed field frame structure
 595     vMgrEncodeDisassociation(&sFrame);
 596
 597     // Setup the header
 598     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
 599         (
 600         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
 601         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DISASSOC)
 602         ));
 603
 604     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
 605     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
 606     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
 607
 608     // Set reason code
 609     *(sFrame.pwReason) = cpu_to_le16(wReason);
 610     pTxPacket->cbMPDULen = sFrame.len;
 611     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
 612
 613     // send the frame
 614     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 615     if (*pStatus == CMD_STATUS_PENDING) {
 616         pMgmt->eCurrState = WMAC_STATE_IDLE;
 617         *pStatus = CMD_STATUS_SUCCESS;
 618     };
 619
 620     return;
 621 }
 622
 623
 624
 625 /*+
 626  *
 627  * Routine Description:(AP function)
 628  *    Handle incoming station association request frames.
 629  *
 630  * Return Value:
 631  *    None.
 632  *
 633 -*/
 634
 635 static
 636 VOID
 637 s_vMgrRxAssocRequest(
 638     IN PSDevice pDevice,
 639     IN PSMgmtObject pMgmt,
 640     IN PSRxMgmtPacket pRxPacket,
 641     IN UINT uNodeIndex
 642     )
 643 {
 644     WLAN_FR_ASSOCREQ    sFrame;
 645     CMD_STATUS          Status;
 646     PSTxMgmtPacket      pTxPacket;
 647     WORD                wAssocStatus = 0;
 648     WORD                wAssocAID = 0;
 649     UINT                uRateLen = WLAN_RATES_MAXLEN;
 650     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 651     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 652
 653
 654     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 655         return;
 656     //  node index not found
 657     if (!uNodeIndex)
 658         return;
 659
 660     //check if node is authenticated
 661     //decode the frame
 662     memset(&sFrame, 0, sizeof(WLAN_FR_ASSOCREQ));
 663     memset(abyCurrSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 664     memset(abyCurrExtSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 665     sFrame.len = pRxPacket->cbMPDULen;
 666     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 667
 668     vMgrDecodeAssocRequest(&sFrame);
 669
 670     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 671         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 672         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 673         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 674         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 675                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 676         // Todo: check sta basic rate, if ap can't support, set status code
 677         if (pDevice->byBBType == BB_TYPE_11B) {
 678             uRateLen = WLAN_RATES_MAXLEN_11B;
 679         }
 680         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 681         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 682                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 683                                          uRateLen);
 684         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 685         if (pDevice->byBBType == BB_TYPE_11G) {
 686             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 687                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 688                                                 uRateLen);
 689         } else {
 690             abyCurrExtSuppRates[1] = 0;
 691         }
 692
 693
 694         RATEvParseMaxRate((PVOID)pDevice,
 695                            (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 696                            (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 697                            FALSE, // do not change our basic rate
 698                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 699                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 700                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 701                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 702                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 703                           );
 704
 705         // set max tx rate
 706         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 707                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 708         // Todo: check sta preamble, if ap can't support, set status code
 709         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 710                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 711         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 712                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 713         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 714         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 715         wAssocAID = (WORD)uNodeIndex;
 716         // check if ERP support
 717         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 718            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 719
 720         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 721             // B only STA join
 722             pDevice->bProtectMode = TRUE;
 723             pDevice->bNonERPPresent = TRUE;
 724         }
 725         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 726             pDevice->bBarkerPreambleMd = TRUE;
 727         }
 728
 729         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Associate AID= %d \n", wAssocAID);
 730         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 731                    sFrame.pHdr->sA3.abyAddr2[0],
 732                    sFrame.pHdr->sA3.abyAddr2[1],
 733                    sFrame.pHdr->sA3.abyAddr2[2],
 734                    sFrame.pHdr->sA3.abyAddr2[3],
 735                    sFrame.pHdr->sA3.abyAddr2[4],
 736                    sFrame.pHdr->sA3.abyAddr2[5]
 737                   ) ;
 738         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 739                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 740     }
 741
 742
 743     // assoc response reply..
 744     pTxPacket = s_MgrMakeAssocResponse
 745                 (
 746                   pDevice,
 747                   pMgmt,
 748                   pMgmt->wCurrCapInfo,
 749                   wAssocStatus,
 750                   wAssocAID,
 751                   sFrame.pHdr->sA3.abyAddr2,
 752                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 753                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 754                 );
 755     if (pTxPacket != NULL ){
 756
 757         if (pDevice->bEnableHostapd) {
 758             return;
 759         }
 760         /* send the frame */
 761         Status = csMgmt_xmit(pDevice, pTxPacket);
 762         if (Status != CMD_STATUS_PENDING) {
 763             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx failed\n");
 764         }
 765         else {
 766             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx sending..\n");
 767         }
 768
 769     }
 770
 771     return;
 772 }
 773
 774
 775 /*+
 776  *
 777  * Description:(AP function)
 778  *      Handle incoming station re-association request frames.
 779  *
 780  * Parameters:
 781  *  In:
 782  *      pMgmt           - Management Object structure
 783  *      pRxPacket       - Received Packet
 784  *  Out:
 785  *      none
 786  *
 787  * Return Value: None.
 788  *
 789 -*/
 790
 791 static
 792 VOID
 793 s_vMgrRxReAssocRequest(
 794     IN PSDevice pDevice,
 795     IN PSMgmtObject pMgmt,
 796     IN PSRxMgmtPacket pRxPacket,
 797     IN UINT uNodeIndex
 798     )
 799 {
 800     WLAN_FR_REASSOCREQ    sFrame;
 801     CMD_STATUS          Status;
 802     PSTxMgmtPacket      pTxPacket;
 803     WORD                wAssocStatus = 0;
 804     WORD                wAssocAID = 0;
 805     UINT                uRateLen = WLAN_RATES_MAXLEN;
 806     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 807     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 808
 809     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 810         return;
 811     //  node index not found
 812     if (!uNodeIndex)
 813         return;
 814     //check if node is authenticated
 815     //decode the frame
 816     memset(&sFrame, 0, sizeof(WLAN_FR_REASSOCREQ));
 817     sFrame.len = pRxPacket->cbMPDULen;
 818     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 819     vMgrDecodeReassocRequest(&sFrame);
 820
 821     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 822         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 823         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 824         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 825         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 826                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 827         // Todo: check sta basic rate, if ap can't support, set status code
 828
 829         if (pDevice->byBBType == BB_TYPE_11B) {
 830             uRateLen = WLAN_RATES_MAXLEN_11B;
 831         }
 832
 833         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 834         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 835                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 836                                          uRateLen);
 837         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 838         if (pDevice->byBBType == BB_TYPE_11G) {
 839             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 840                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 841                                                 uRateLen);
 842         } else {
 843             abyCurrExtSuppRates[1] = 0;
 844         }
 845
 846
 847         RATEvParseMaxRate((PVOID)pDevice,
 848                           (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 849                           (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 850                            FALSE, // do not change our basic rate
 851                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 852                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 853                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 854                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 855                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 856                           );
 857
 858         // set max tx rate
 859         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 860                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 861         // Todo: check sta preamble, if ap can't support, set status code
 862         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 863                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 864         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 865                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 866         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 867         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 868         wAssocAID = (WORD)uNodeIndex;
 869
 870         // if suppurt ERP
 871         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 872            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 873
 874         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 875             // B only STA join
 876             pDevice->bProtectMode = TRUE;
 877             pDevice->bNonERPPresent = TRUE;
 878         }
 879         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 880             pDevice->bBarkerPreambleMd = TRUE;
 881         }
 882
 883         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Rx ReAssociate AID= %d \n", wAssocAID);
 884         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 885                    sFrame.pHdr->sA3.abyAddr2[0],
 886                    sFrame.pHdr->sA3.abyAddr2[1],
 887                    sFrame.pHdr->sA3.abyAddr2[2],
 888                    sFrame.pHdr->sA3.abyAddr2[3],
 889                    sFrame.pHdr->sA3.abyAddr2[4],
 890                    sFrame.pHdr->sA3.abyAddr2[5]
 891                   ) ;
 892         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 893                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 894
 895     }
 896
 897
 898     // assoc response reply..
 899     pTxPacket = s_MgrMakeReAssocResponse
 900                 (
 901                   pDevice,
 902                   pMgmt,
 903                   pMgmt->wCurrCapInfo,
 904                   wAssocStatus,
 905                   wAssocAID,
 906                   sFrame.pHdr->sA3.abyAddr2,
 907                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 908                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 909                 );
 910
 911     if (pTxPacket != NULL ){
 912         /* send the frame */
 913         if (pDevice->bEnableHostapd) {
 914             return;
 915         }
 916         Status = csMgmt_xmit(pDevice, pTxPacket);
 917         if (Status != CMD_STATUS_PENDING) {
 918             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx failed\n");
 919         }
 920         else {
 921             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx sending..\n");
 922         }
 923     }
 924     return;
 925 }
 926
 927
 928 /*+
 929  *
 930  * Routine Description:
 931  *    Handle incoming association response frames.
 932  *
 933  * Return Value:
 934  *    None.
 935  *
 936 -*/
 937
 938 static
 939 VOID
 940 s_vMgrRxAssocResponse(
 941     IN PSDevice pDevice,
 942     IN PSMgmtObject pMgmt,
 943     IN PSRxMgmtPacket pRxPacket,
 944     IN BOOL bReAssocType
 945     )
 946 {
 947     WLAN_FR_ASSOCRESP   sFrame;
 948     PWLAN_IE_SSID   pItemSSID;
 949     PBYTE   pbyIEs;
 950     viawget_wpa_header *wpahdr;
 951
 952
 953
 954     if (pMgmt->eCurrState == WMAC_STATE_ASSOCPENDING ||
 955          pMgmt->eCurrState == WMAC_STATE_ASSOC) {
 956
 957         sFrame.len = pRxPacket->cbMPDULen;
 958         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 959         // decode the frame
 960         vMgrDecodeAssocResponse(&sFrame);
 961         if ((sFrame.pwCapInfo == 0) ||
 962             (sFrame.pwStatus == 0) ||
 963             (sFrame.pwAid == 0) ||
 964             (sFrame.pSuppRates == 0)){
 965             DBG_PORT80(0xCC);
 966             return;
 967         };
 968
 969         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.Capabilities = *(sFrame.pwCapInfo);
 970         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.StatusCode = *(sFrame.pwStatus);
 971         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.AssociationId = *(sFrame.pwAid);
 972         pMgmt->sAssocInfo.AssocInfo.AvailableResponseFixedIEs |= 0x07;
 973
 974         pMgmt->sAssocInfo.AssocInfo.ResponseIELength = sFrame.len - 24 - 6;
 975         pMgmt->sAssocInfo.AssocInfo.OffsetResponseIEs = pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs + pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 976         pbyIEs = pMgmt->sAssocInfo.abyIEs;
 977         pbyIEs += pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 978         memcpy(pbyIEs, (sFrame.pBuf + 24 +6), pMgmt->sAssocInfo.AssocInfo.ResponseIELength);
 979
 980         // save values and set current BSS state
 981         if (cpu_to_le16((*(sFrame.pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
 982             // set AID
 983             pMgmt->wCurrAID = cpu_to_le16((*(sFrame.pwAid)));
 984             if ( (pMgmt->wCurrAID >> 14) != (BIT0 | BIT1) )
 985             {
 986                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "AID from AP, has two msb clear.\n");
 987             };
 988             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Association Successful, AID=%d.\n", pMgmt->wCurrAID & ~(BIT14|BIT15));
 989             pMgmt->eCurrState = WMAC_STATE_ASSOC;
 990             BSSvUpdateAPNode((HANDLE)pDevice, sFrame.pwCapInfo, sFrame.pSuppRates, sFrame.pExtSuppRates);
 991             pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
 992             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Link with AP(SSID): %s\n", pItemSSID->abySSID);
 993             pDevice->bLinkPass = TRUE;
 994             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
 995             if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
 996                if(skb_tailroom(pDevice->skb) <(sizeof(viawget_wpa_header)+pMgmt->sAssocInfo.AssocInfo.ResponseIELength+
 997                                                                          pMgmt->sAssocInfo.AssocInfo.RequestIELength)) {    //data room not enough
 998                      dev_kfree_skb(pDevice->skb);
 999                    pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1000                 }
1001                 wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1002                 wpahdr->type = VIAWGET_ASSOC_MSG;
1003                 wpahdr->resp_ie_len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1004                 wpahdr->req_ie_len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1005                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header), pMgmt->sAssocInfo.abyIEs, wpahdr->req_ie_len);
1006                 memcpy(pDevice->skb->data + sizeof(viawget_wpa_header) + wpahdr->req_ie_len,
1007                        pbyIEs,
1008                        wpahdr->resp_ie_len
1009                        );
1010                 skb_put(pDevice->skb, sizeof(viawget_wpa_header) + wpahdr->resp_ie_len + wpahdr->req_ie_len);
1011                 pDevice->skb->dev = pDevice->wpadev;
1012                 skb_reset_mac_header(pDevice->skb);
1013                 pDevice->skb->pkt_type = PACKET_HOST;
1014                 pDevice->skb->protocol = htons(ETH_P_802_2);
1015                 memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1016                 netif_rx(pDevice->skb);
1017                 pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1018             }
1019 //2008-0409-07, <Add> by Einsn Liu
1020 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1021         //if(pDevice->bWPASuppWextEnabled == TRUE)
1022            {
1023                 BYTE buf[512];
1024                 size_t len;
1025                 union iwreq_data  wrqu;
1026                 int we_event;
1027
1028                 memset(buf, 0, 512);
1029
1030                 len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
1031                 if(len) {
1032                         memcpy(buf, pMgmt->sAssocInfo.abyIEs, len);
1033                         memset(&wrqu, 0, sizeof (wrqu));
1034                         wrqu.data.length = len;
1035                         we_event = IWEVASSOCREQIE;
1036                         PRINT_K("wireless_send_event--->IWEVASSOCREQIE\n");
1037                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1038                 }
1039
1040                 memset(buf, 0, 512);
1041                 len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
1042
1043                 if(len) {
1044                         memcpy(buf, pbyIEs, len);
1045                         memset(&wrqu, 0, sizeof (wrqu));
1046                         wrqu.data.length = len;
1047                         we_event = IWEVASSOCRESPIE;
1048                         PRINT_K("wireless_send_event--->IWEVASSOCRESPIE\n");
1049                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1050                 }
1051
1052            memset(&wrqu, 0, sizeof (wrqu));
1053         memcpy(wrqu.ap_addr.sa_data, &pMgmt->abyCurrBSSID[0], ETH_ALEN);
1054         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1055            PRINT_K("wireless_send_event--->SIOCGIWAP(associated)\n");
1056         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1057
1058         }
1059 #endif //#ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1060 //End Add -- //2008-0409-07, <Add> by Einsn Liu
1061         }
1062         else {
1063             if (bReAssocType) {
1064                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1065             }
1066             else {
1067                 // jump back to the auth state and indicate the error
1068                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1069             }
1070             s_vMgrLogStatus(pMgmt,cpu_to_le16((*(sFrame.pwStatus))));
1071         }
1072
1073     }
1074
1075 #if 1
1076 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1077 //need clear flags related to Networkmanager
1078               pDevice->bwextstep0 = FALSE;
1079               pDevice->bwextstep1 = FALSE;
1080               pDevice->bwextstep2 = FALSE;
1081               pDevice->bwextstep3 = FALSE;
1082               pDevice->bWPASuppWextEnabled = FALSE;
1083 #endif
1084 #endif
1085
1086 if(pMgmt->eCurrState == WMAC_STATE_ASSOC)
1087       timer_expire(pDevice->sTimerCommand, 0);
1088
1089     return;
1090 }
1091
1092
1093
1094 /*+
1095  *
1096  * Routine Description:
1097  *    Start the station authentication procedure.  Namely, send an
1098  *    authentication frame to the AP.
1099  *
1100  * Return Value:
1101  *    None.
1102  *
1103 -*/
1104
1105 VOID
1106 vMgrAuthenBeginSta(
1107     IN  HANDLE hDeviceContext,
1108     IN  PSMgmtObject  pMgmt,
1109     OUT PCMD_STATUS pStatus
1110     )
1111 {
1112     PSDevice     pDevice = (PSDevice)hDeviceContext;
1113     WLAN_FR_AUTHEN  sFrame;
1114     PSTxMgmtPacket  pTxPacket = NULL;
1115
1116     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1117     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1118     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1119     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1120     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1121     vMgrEncodeAuthen(&sFrame);
1122     /* insert values */
1123     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1124         (
1125         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1126         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)
1127         ));
1128     memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
1129     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1130     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1131     if (pMgmt->bShareKeyAlgorithm)
1132         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_SHAREDKEY);
1133     else
1134         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_OPENSYSTEM);
1135
1136     *(sFrame.pwAuthSequence) = cpu_to_le16(1);
1137     /* Adjust the length fields */
1138     pTxPacket->cbMPDULen = sFrame.len;
1139     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1140
1141     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1142     if (*pStatus == CMD_STATUS_PENDING){
1143         pMgmt->eCurrState = WMAC_STATE_AUTHPENDING;
1144         *pStatus = CMD_STATUS_SUCCESS;
1145     }
1146
1147     return ;
1148 }
1149
1150
1151
1152 /*+
1153  *
1154  * Routine Description:
1155  *    Start the station(AP) deauthentication procedure.  Namely, send an
1156  *    deauthentication frame to the AP or Sta.
1157  *
1158  * Return Value:
1159  *    None.
1160  *
1161 -*/
1162
1163 VOID
1164 vMgrDeAuthenBeginSta(
1165     IN  HANDLE hDeviceContext,
1166     IN  PSMgmtObject  pMgmt,
1167     IN  PBYTE  abyDestAddress,
1168     IN  WORD    wReason,
1169     OUT PCMD_STATUS pStatus
1170     )
1171 {
1172     PSDevice            pDevice = (PSDevice)hDeviceContext;
1173     WLAN_FR_DEAUTHEN    sFrame;
1174     PSTxMgmtPacket      pTxPacket = NULL;
1175
1176
1177     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1178     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DEAUTHEN_FR_MAXLEN);
1179     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1180     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1181     sFrame.len = WLAN_DEAUTHEN_FR_MAXLEN;
1182     vMgrEncodeDeauthen(&sFrame);
1183     /* insert values */
1184     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1185         (
1186         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1187         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DEAUTHEN)
1188         ));
1189
1190     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
1191     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1192     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1193
1194     *(sFrame.pwReason) = cpu_to_le16(wReason);       // deauthen. bcs left BSS
1195     /* Adjust the length fields */
1196     pTxPacket->cbMPDULen = sFrame.len;
1197     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1198
1199     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1200     if (*pStatus == CMD_STATUS_PENDING){
1201         *pStatus = CMD_STATUS_SUCCESS;
1202     }
1203
1204
1205     return ;
1206 }
1207
1208
1209 /*+
1210  *
1211  * Routine Description:
1212  *    Handle incoming authentication frames.
1213  *
1214  * Return Value:
1215  *    None.
1216  *
1217 -*/
1218
1219 static
1220 VOID
1221 s_vMgrRxAuthentication(
1222     IN PSDevice pDevice,
1223     IN PSMgmtObject pMgmt,
1224     IN PSRxMgmtPacket pRxPacket
1225     )
1226 {
1227     WLAN_FR_AUTHEN  sFrame;
1228
1229     // we better be an AP or a STA in AUTHPENDING otherwise ignore
1230     if (!(pMgmt->eCurrMode == WMAC_MODE_ESS_AP ||
1231           pMgmt->eCurrState == WMAC_STATE_AUTHPENDING)) {
1232         return;
1233     }
1234
1235     // decode the frame
1236     sFrame.len = pRxPacket->cbMPDULen;
1237     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1238     vMgrDecodeAuthen(&sFrame);
1239     switch (cpu_to_le16((*(sFrame.pwAuthSequence )))){
1240         case 1:
1241             //AP funciton
1242             s_vMgrRxAuthenSequence_1(pDevice,pMgmt, &sFrame);
1243             break;
1244         case 2:
1245             s_vMgrRxAuthenSequence_2(pDevice, pMgmt, &sFrame);
1246             break;
1247         case 3:
1248             //AP funciton
1249             s_vMgrRxAuthenSequence_3(pDevice, pMgmt, &sFrame);
1250             break;
1251         case 4:
1252             s_vMgrRxAuthenSequence_4(pDevice, pMgmt, &sFrame);
1253             break;
1254         default:
1255             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Auth Sequence error, seq = %d\n",
1256                         cpu_to_le16((*(sFrame.pwAuthSequence))));
1257             break;
1258     }
1259     return;
1260 }
1261
1262
1263
1264 /*+
1265  *
1266  * Routine Description:
1267  *   Handles incoming authen frames with sequence 1.  Currently
1268  *   assumes we're an AP.  So far, no one appears to use authentication
1269  *   in Ad-Hoc mode.
1270  *
1271  * Return Value:
1272  *    None.
1273  *
1274 -*/
1275
1276
1277 static
1278 VOID
1279 s_vMgrRxAuthenSequence_1(
1280     IN PSDevice pDevice,
1281     IN PSMgmtObject pMgmt,
1282     IN PWLAN_FR_AUTHEN pFrame
1283      )
1284 {
1285     PSTxMgmtPacket      pTxPacket = NULL;
1286     UINT                uNodeIndex;
1287     WLAN_FR_AUTHEN      sFrame;
1288     PSKeyItem           pTransmitKey;
1289
1290     // Insert a Node entry
1291     if (!BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1292         BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
1293         memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, pFrame->pHdr->sA3.abyAddr2,
1294                WLAN_ADDR_LEN);
1295     }
1296
1297     if (pMgmt->bShareKeyAlgorithm) {
1298         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_KNOWN;
1299         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 1;
1300     }
1301     else {
1302         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1303     }
1304
1305     // send auth reply
1306     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1307     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1308     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1309     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1310     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1311     // format buffer structure
1312     vMgrEncodeAuthen(&sFrame);
1313     // insert values
1314     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1315          (
1316          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1317          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1318          WLAN_SET_FC_ISWEP(0)
1319          ));
1320     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1321     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1322     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1323     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1324     *(sFrame.pwAuthSequence) = cpu_to_le16(2);
1325
1326     if (cpu_to_le16(*(pFrame->pwAuthAlgorithm)) == WLAN_AUTH_ALG_SHAREDKEY) {
1327         if (pMgmt->bShareKeyAlgorithm)
1328             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1329         else
1330             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1331     }
1332     else {
1333         if (pMgmt->bShareKeyAlgorithm)
1334             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1335         else
1336             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1337     }
1338
1339     if (pMgmt->bShareKeyAlgorithm &&
1340         (cpu_to_le16(*(sFrame.pwStatus)) == WLAN_MGMT_STATUS_SUCCESS)) {
1341
1342         sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1343         sFrame.len += WLAN_CHALLENGE_IE_LEN;
1344         sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1345         sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1346         memset(pMgmt->abyChallenge, 0, WLAN_CHALLENGE_LEN);
1347         // get group key
1348         if(KeybGetTransmitKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, GROUP_KEY, &pTransmitKey) == TRUE) {
1349             rc4_init(&pDevice->SBox, pDevice->abyPRNG, pTransmitKey->uKeyLength+3);
1350             rc4_encrypt(&pDevice->SBox, pMgmt->abyChallenge, pMgmt->abyChallenge, WLAN_CHALLENGE_LEN);
1351         }
1352         memcpy(sFrame.pChallenge->abyChallenge, pMgmt->abyChallenge , WLAN_CHALLENGE_LEN);
1353     }
1354
1355     /* Adjust the length fields */
1356     pTxPacket->cbMPDULen = sFrame.len;
1357     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1358     // send the frame
1359     if (pDevice->bEnableHostapd) {
1360         return;
1361     }
1362     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx.. \n");
1363     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1364         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx failed.\n");
1365     }
1366     return;
1367 }
1368
1369
1370
1371 /*+
1372  *
1373  * Routine Description:
1374  *   Handles incoming auth frames with sequence number 2.  Currently
1375  *   assumes we're a station.
1376  *
1377  *
1378  * Return Value:
1379  *    None.
1380  *
1381 -*/
1382
1383 static
1384 VOID
1385 s_vMgrRxAuthenSequence_2(
1386     IN PSDevice pDevice,
1387     IN PSMgmtObject pMgmt,
1388     IN PWLAN_FR_AUTHEN pFrame
1389     )
1390 {
1391     WLAN_FR_AUTHEN      sFrame;
1392     PSTxMgmtPacket      pTxPacket = NULL;
1393
1394
1395     switch (cpu_to_le16((*(pFrame->pwAuthAlgorithm))))
1396     {
1397         case WLAN_AUTH_ALG_OPENSYSTEM:
1398             if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1399                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Successful.\n");
1400                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1401                timer_expire(pDevice->sTimerCommand, 0);
1402             }
1403             else {
1404                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Failed.\n");
1405                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1406                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1407             }
1408             if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1409 //                spin_unlock_irq(&pDevice->lock);
1410 //                vCommandTimerWait((HANDLE)pDevice, 0);
1411 //                spin_lock_irq(&pDevice->lock);
1412             }
1413
1414             break;
1415
1416         case WLAN_AUTH_ALG_SHAREDKEY:
1417
1418             if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1419                 pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1420                 memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1421                 pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1422                 sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1423                 sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1424                 // format buffer structure
1425                 vMgrEncodeAuthen(&sFrame);
1426                 // insert values
1427                 sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1428                      (
1429                      WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1430                      WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1431                      WLAN_SET_FC_ISWEP(1)
1432                      ));
1433                 memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1434                 memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1435                 memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1436                 *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1437                 *(sFrame.pwAuthSequence) = cpu_to_le16(3);
1438                 *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1439                 sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1440                 sFrame.len += WLAN_CHALLENGE_IE_LEN;
1441                 sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1442                 sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1443                 memcpy( sFrame.pChallenge->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN);
1444                 // Adjust the length fields
1445                 pTxPacket->cbMPDULen = sFrame.len;
1446                 pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1447                 // send the frame
1448                 if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1449                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx failed.\n");
1450                 }
1451                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx ...\n");
1452             }
1453             else {
1454                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:rx Auth_reply sequence_2 status error ...\n");
1455                 if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1456 //                    spin_unlock_irq(&pDevice->lock);
1457 //                    vCommandTimerWait((HANDLE)pDevice, 0);
1458 //                    spin_lock_irq(&pDevice->lock);
1459                 }
1460                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1461             }
1462             break;
1463         default:
1464             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt: rx auth.seq = 2 unknown AuthAlgorithm=%d\n", cpu_to_le16((*(pFrame->pwAuthAlgorithm))));
1465             break;
1466     }
1467     return;
1468 }
1469
1470
1471
1472 /*+
1473  *
1474  * Routine Description:
1475  *   Handles incoming authen frames with sequence 3.  Currently
1476  *   assumes we're an AP.  This function assumes the frame has
1477  *   already been successfully decrypted.
1478  *
1479  *
1480  * Return Value:
1481  *    None.
1482  *
1483 -*/
1484
1485 static
1486 VOID
1487 s_vMgrRxAuthenSequence_3(
1488     IN PSDevice pDevice,
1489     IN PSMgmtObject pMgmt,
1490     IN PWLAN_FR_AUTHEN pFrame
1491     )
1492 {
1493     PSTxMgmtPacket      pTxPacket = NULL;
1494     UINT                uStatusCode = 0 ;
1495     UINT                uNodeIndex = 0;
1496     WLAN_FR_AUTHEN      sFrame;
1497
1498     if (!WLAN_GET_FC_ISWEP(pFrame->pHdr->sA3.wFrameCtl)) {
1499         uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1500         goto reply;
1501     }
1502     if (BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1503          if (pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence != 1) {
1504             uStatusCode = WLAN_MGMT_STATUS_RX_AUTH_NOSEQ;
1505             goto reply;
1506          }
1507          if (memcmp(pMgmt->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN) != 0) {
1508             uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1509             goto reply;
1510          }
1511     }
1512     else {
1513         uStatusCode = WLAN_MGMT_STATUS_UNSPEC_FAILURE;
1514         goto reply;
1515     }
1516
1517     if (uNodeIndex) {
1518         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1519         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 0;
1520     }
1521     uStatusCode = WLAN_MGMT_STATUS_SUCCESS;
1522     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Challenge text check ok..\n");
1523
1524 reply:
1525     // send auth reply
1526     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1527     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1528     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1529     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1530     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1531     // format buffer structure
1532     vMgrEncodeAuthen(&sFrame);
1533     /* insert values */
1534     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1535          (
1536          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1537          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1538          WLAN_SET_FC_ISWEP(0)
1539          ));
1540     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1541     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1542     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1543     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1544     *(sFrame.pwAuthSequence) = cpu_to_le16(4);
1545     *(sFrame.pwStatus) = cpu_to_le16(uStatusCode);
1546
1547     /* Adjust the length fields */
1548     pTxPacket->cbMPDULen = sFrame.len;
1549     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1550     // send the frame
1551     if (pDevice->bEnableHostapd) {
1552         return;
1553     }
1554     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1555         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_4 tx failed.\n");
1556     }
1557     return;
1558
1559 }
1560
1561
1562
1563 /*+
1564  *
1565  * Routine Description:
1566  *   Handles incoming authen frames with sequence 4
1567  *
1568  *
1569  * Return Value:
1570  *    None.
1571  *
1572 -*/
1573 static
1574 VOID
1575 s_vMgrRxAuthenSequence_4(
1576     IN PSDevice pDevice,
1577     IN PSMgmtObject pMgmt,
1578     IN PWLAN_FR_AUTHEN pFrame
1579     )
1580 {
1581
1582     if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1583         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Successful.\n");
1584         pMgmt->eCurrState = WMAC_STATE_AUTH;
1585         timer_expire(pDevice->sTimerCommand, 0);
1586     }
1587     else{
1588         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Failed.\n");
1589         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))) );
1590         pMgmt->eCurrState = WMAC_STATE_IDLE;
1591     }
1592
1593     if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1594 //        spin_unlock_irq(&pDevice->lock);
1595 //        vCommandTimerWait((HANDLE)pDevice, 0);
1596 //        spin_lock_irq(&pDevice->lock);
1597     }
1598
1599 }
1600
1601 /*+
1602  *
1603  * Routine Description:
1604  *   Handles incoming disassociation frames
1605  *
1606  *
1607  * Return Value:
1608  *    None.
1609  *
1610 -*/
1611
1612 static
1613 VOID
1614 s_vMgrRxDisassociation(
1615     IN PSDevice pDevice,
1616     IN PSMgmtObject pMgmt,
1617     IN PSRxMgmtPacket pRxPacket
1618     )
1619 {
1620     WLAN_FR_DISASSOC    sFrame;
1621     UINT        uNodeIndex = 0;
1622     CMD_STATUS          CmdStatus;
1623     viawget_wpa_header *wpahdr;
1624
1625     if ( pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1626         // if is acting an AP..
1627         // a STA is leaving this BSS..
1628         sFrame.len = pRxPacket->cbMPDULen;
1629         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1630         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1631             BSSvRemoveOneNode(pDevice, uNodeIndex);
1632         }
1633         else {
1634             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx disassoc, sta not found\n");
1635         }
1636     }
1637     else if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ){
1638         sFrame.len = pRxPacket->cbMPDULen;
1639         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1640         vMgrDecodeDisassociation(&sFrame);
1641         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP disassociated me, reason=%d.\n", cpu_to_le16(*(sFrame.pwReason)));
1642
1643           pDevice->fWPA_Authened = FALSE;
1644         if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1645              wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1646              wpahdr->type = VIAWGET_DISASSOC_MSG;
1647              wpahdr->resp_ie_len = 0;
1648              wpahdr->req_ie_len = 0;
1649              skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1650              pDevice->skb->dev = pDevice->wpadev;
1651              skb_reset_mac_header(pDevice->skb);
1652              pDevice->skb->pkt_type = PACKET_HOST;
1653              pDevice->skb->protocol = htons(ETH_P_802_2);
1654              memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1655              netif_rx(pDevice->skb);
1656              pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1657          };
1658
1659         //TODO: do something let upper layer know or
1660         //try to send associate packet again because of inactivity timeout
1661         if (pMgmt->eCurrState == WMAC_STATE_ASSOC) {
1662                 pDevice->bLinkPass = FALSE;
1663                 pMgmt->sNodeDBTable[0].bActive = FALSE;
1664                pDevice->byReAssocCount = 0;
1665                 pMgmt->eCurrState = WMAC_STATE_AUTH;  // jump back to the auth state!
1666                 pDevice->eCommandState = WLAN_ASSOCIATE_WAIT;
1667             vMgrReAssocBeginSta((PSDevice)pDevice, pMgmt, &CmdStatus);
1668               if(CmdStatus == CMD_STATUS_PENDING) {
1669                   pDevice->byReAssocCount ++;
1670                   return;       //mike add: you'll retry for many times, so it cann't be regarded as disconnected!
1671               }
1672         };
1673
1674    #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1675   // if(pDevice->bWPASuppWextEnabled == TRUE)
1676       {
1677         union iwreq_data  wrqu;
1678         memset(&wrqu, 0, sizeof (wrqu));
1679         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1680         PRINT_K("wireless_send_event--->SIOCGIWAP(disassociated)\n");
1681         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1682      }
1683   #endif
1684     }
1685     /* else, ignore it */
1686
1687     return;
1688 }
1689
1690
1691 /*+
1692  *
1693  * Routine Description:
1694  *   Handles incoming deauthentication frames
1695  *
1696  *
1697  * Return Value:
1698  *    None.
1699  *
1700 -*/
1701
1702 static
1703 VOID
1704 s_vMgrRxDeauthentication(
1705     IN PSDevice pDevice,
1706     IN PSMgmtObject pMgmt,
1707     IN PSRxMgmtPacket pRxPacket
1708     )
1709 {
1710     WLAN_FR_DEAUTHEN    sFrame;
1711     UINT        uNodeIndex = 0;
1712     viawget_wpa_header *wpahdr;
1713
1714
1715     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1716         //Todo:
1717         // if is acting an AP..
1718         // a STA is leaving this BSS..
1719         sFrame.len = pRxPacket->cbMPDULen;
1720         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1721         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1722             BSSvRemoveOneNode(pDevice, uNodeIndex);
1723         }
1724         else {
1725             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Rx deauth, sta not found\n");
1726         }
1727     }
1728     else {
1729         if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ) {
1730             sFrame.len = pRxPacket->cbMPDULen;
1731             sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1732             vMgrDecodeDeauthen(&sFrame);
1733            pDevice->fWPA_Authened = FALSE;
1734             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO  "AP deauthed me, reason=%d.\n", cpu_to_le16((*(sFrame.pwReason))));
1735             // TODO: update BSS list for specific BSSID if pre-authentication case
1736             if (IS_ETH_ADDRESS_EQUAL(sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID)) {
1737                 if (pMgmt->eCurrState >= WMAC_STATE_AUTHPENDING) {
1738                     pMgmt->sNodeDBTable[0].bActive = FALSE;
1739                     pMgmt->eCurrMode = WMAC_MODE_STANDBY;
1740                     pMgmt->eCurrState = WMAC_STATE_IDLE;
1741                     netif_stop_queue(pDevice->dev);
1742                     pDevice->bLinkPass = FALSE;
1743                     ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_SLOW);
1744                 }
1745             };
1746
1747             if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
1748                  wpahdr = (viawget_wpa_header *)pDevice->skb->data;
1749                  wpahdr->type = VIAWGET_DISASSOC_MSG;
1750                  wpahdr->resp_ie_len = 0;
1751                  wpahdr->req_ie_len = 0;
1752                  skb_put(pDevice->skb, sizeof(viawget_wpa_header));
1753                  pDevice->skb->dev = pDevice->wpadev;
1754                  skb_reset_mac_header(pDevice->skb);
1755                  pDevice->skb->pkt_type = PACKET_HOST;
1756                  pDevice->skb->protocol = htons(ETH_P_802_2);
1757                  memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
1758                  netif_rx(pDevice->skb);
1759                  pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1760            };
1761
1762    #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
1763   // if(pDevice->bWPASuppWextEnabled == TRUE)
1764       {
1765         union iwreq_data  wrqu;
1766         memset(&wrqu, 0, sizeof (wrqu));
1767         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1768         PRINT_K("wireless_send_event--->SIOCGIWAP(disauthen)\n");
1769         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1770      }
1771   #endif
1772
1773         }
1774         /* else, ignore it.  TODO: IBSS authentication service
1775             would be implemented here */
1776     };
1777     return;
1778 }
1779
1780 //2008-0730-01<Add>by MikeLiu
1781 /*+
1782  *
1783  * Routine Description:
1784  * check if current channel is match ZoneType.
1785  *for USA:1~11;
1786  *      Japan:1~13;
1787  *      Europe:1~13
1788  * Return Value:
1789  *               True:exceed;
1790  *                False:normal case
1791 -*/
1792 static BOOL
1793 ChannelExceedZoneType(
1794     IN PSDevice pDevice,
1795     IN BYTE byCurrChannel
1796     )
1797 {
1798   BOOL exceed=FALSE;
1799
1800   switch(pDevice->byZoneType) {
1801         case 0x00:                  //USA:1~11
1802                      if((byCurrChannel<1) ||(byCurrChannel>11))
1803                         exceed = TRUE;
1804                  break;
1805         case 0x01:                  //Japan:1~13
1806         case 0x02:                  //Europe:1~13
1807                      if((byCurrChannel<1) ||(byCurrChannel>13))
1808                         exceed = TRUE;
1809                  break;
1810         default:                    //reserve for other zonetype
1811                 break;
1812   }
1813
1814   return exceed;
1815 }
1816
1817 /*+
1818  *
1819  * Routine Description:
1820  *   Handles and analysis incoming beacon frames.
1821  *
1822  *
1823  * Return Value:
1824  *    None.
1825  *
1826 -*/
1827
1828 static
1829 VOID
1830 s_vMgrRxBeacon(
1831     IN PSDevice pDevice,
1832     IN PSMgmtObject pMgmt,
1833     IN PSRxMgmtPacket pRxPacket,
1834     IN BOOL bInScan
1835     )
1836 {
1837
1838     PKnownBSS           pBSSList;
1839     WLAN_FR_BEACON      sFrame;
1840     QWORD               qwTSFOffset;
1841     BOOL                bIsBSSIDEqual = FALSE;
1842     BOOL                bIsSSIDEqual = FALSE;
1843     BOOL                bTSFLargeDiff = FALSE;
1844     BOOL                bTSFOffsetPostive = FALSE;
1845     BOOL                bUpdateTSF = FALSE;
1846     BOOL                bIsAPBeacon = FALSE;
1847     BOOL                bIsChannelEqual = FALSE;
1848     UINT                uLocateByteIndex;
1849     BYTE                byTIMBitOn = 0;
1850     WORD                wAIDNumber = 0;
1851     UINT                uNodeIndex;
1852     QWORD               qwTimestamp, qwLocalTSF;
1853     QWORD               qwCurrTSF;
1854     WORD                wStartIndex = 0;
1855     WORD                wAIDIndex = 0;
1856     BYTE                byCurrChannel = pRxPacket->byRxChannel;
1857     ERPObject           sERP;
1858     UINT                uRateLen = WLAN_RATES_MAXLEN;
1859     BOOL                bChannelHit = FALSE;
1860     BYTE                byOldPreambleType;
1861
1862
1863
1864      if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)
1865         return;
1866
1867     memset(&sFrame, 0, sizeof(WLAN_FR_BEACON));
1868     sFrame.len = pRxPacket->cbMPDULen;
1869     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1870
1871     // decode the beacon frame
1872     vMgrDecodeBeacon(&sFrame);
1873
1874     if ((sFrame.pwBeaconInterval == 0) ||
1875         (sFrame.pwCapInfo == 0) ||
1876         (sFrame.pSSID == 0) ||
1877         (sFrame.pSuppRates == 0) ) {
1878         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx beacon frame error\n");
1879         return;
1880     };
1881
1882
1883     if( byCurrChannel > CB_MAX_CHANNEL_24G )
1884     {
1885         if (sFrame.pDSParms != NULL) {
1886             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
1887                 bChannelHit = TRUE;
1888             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
1889         } else {
1890             bChannelHit = TRUE;
1891         }
1892
1893     } else {
1894         if (sFrame.pDSParms != NULL) {
1895             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
1896                 bChannelHit = TRUE;
1897             byCurrChannel = sFrame.pDSParms->byCurrChannel;
1898         } else {
1899             bChannelHit = TRUE;
1900         }
1901     }
1902
1903 //2008-0730-01<Add>by MikeLiu
1904 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
1905       return;
1906
1907     if (sFrame.pERP != NULL) {
1908         sERP.byERP = sFrame.pERP->byContext;
1909         sERP.bERPExist = TRUE;
1910
1911     } else {
1912         sERP.bERPExist = FALSE;
1913         sERP.byERP = 0;
1914     }
1915
1916     pBSSList = BSSpAddrIsInBSSList((HANDLE)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
1917     if (pBSSList == NULL) {
1918         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon/insert: RxChannel = : %d\n", byCurrChannel);
1919         BSSbInsertToBSSList((HANDLE)pDevice,
1920                             sFrame.pHdr->sA3.abyAddr3,
1921                             *sFrame.pqwTimestamp,
1922                             *sFrame.pwBeaconInterval,
1923                             *sFrame.pwCapInfo,
1924                             byCurrChannel,
1925                             sFrame.pSSID,
1926                             sFrame.pSuppRates,
1927                             sFrame.pExtSuppRates,
1928                             &sERP,
1929                             sFrame.pRSN,
1930                             sFrame.pRSNWPA,
1931                             sFrame.pIE_Country,
1932                             sFrame.pIE_Quiet,
1933                             sFrame.len - WLAN_HDR_ADDR3_LEN,
1934                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
1935                             (HANDLE)pRxPacket
1936                            );
1937     }
1938     else {
1939 //        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"update bcn: RxChannel = : %d\n", byCurrChannel);
1940         BSSbUpdateToBSSList((HANDLE)pDevice,
1941                             *sFrame.pqwTimestamp,
1942                             *sFrame.pwBeaconInterval,
1943                             *sFrame.pwCapInfo,
1944                             byCurrChannel,
1945                             bChannelHit,
1946                             sFrame.pSSID,
1947                             sFrame.pSuppRates,
1948                             sFrame.pExtSuppRates,
1949                             &sERP,
1950                             sFrame.pRSN,
1951                             sFrame.pRSNWPA,
1952                             sFrame.pIE_Country,
1953                             sFrame.pIE_Quiet,
1954                             pBSSList,
1955                             sFrame.len - WLAN_HDR_ADDR3_LEN,
1956                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
1957                             (HANDLE)pRxPacket
1958                            );
1959
1960     }
1961
1962     if (bInScan) {
1963         return;
1964     }
1965
1966     if(byCurrChannel == (BYTE)pMgmt->uCurrChannel)
1967        bIsChannelEqual = TRUE;
1968
1969     if (bIsChannelEqual && (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)) {
1970
1971         // if rx beacon without ERP field
1972         if (sERP.bERPExist) {
1973             if (WLAN_GET_ERP_USE_PROTECTION(sERP.byERP)){
1974                 pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
1975                 pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
1976             }
1977         }
1978         else {
1979             pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
1980             pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
1981         }
1982
1983         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
1984             if(!WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo))
1985                 pDevice->byERPFlag |= WLAN_SET_ERP_BARKER_MODE(1);
1986             if(!sERP.bERPExist)
1987                 pDevice->byERPFlag |= WLAN_SET_ERP_NONERP_PRESENT(1);
1988         }
1989     }
1990
1991     // check if BSSID the same
1992     if (memcmp(sFrame.pHdr->sA3.abyAddr3,
1993                pMgmt->abyCurrBSSID,
1994                WLAN_BSSID_LEN) == 0) {
1995
1996         bIsBSSIDEqual = TRUE;
1997         pDevice->uCurrRSSI = pRxPacket->uRSSI;
1998         pDevice->byCurrSQ = pRxPacket->bySQ;
1999         if (pMgmt->sNodeDBTable[0].uInActiveCount != 0) {
2000             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2001             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"BCN:Wake Count= [%d]\n", pMgmt->wCountToWakeUp);
2002         }
2003     }
2004     // check if SSID the same
2005     if (sFrame.pSSID->len == ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) {
2006         if (memcmp(sFrame.pSSID->abySSID,
2007                    ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
2008                    sFrame.pSSID->len
2009                    ) == 0) {
2010             bIsSSIDEqual = TRUE;
2011         };
2012     }
2013
2014     if ((WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)== TRUE) &&
2015         (bIsBSSIDEqual == TRUE) &&
2016         (bIsSSIDEqual == TRUE) &&
2017         (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
2018         (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
2019         // add state check to prevent reconnect fail since we'll receive Beacon
2020
2021         bIsAPBeacon = TRUE;
2022         if (pBSSList != NULL) {
2023
2024                 // Sync ERP field
2025                 if ((pBSSList->sERP.bERPExist == TRUE) && (pDevice->byBBType == BB_TYPE_11G)) {
2026                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2027                         pDevice->bProtectMode = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2028                         if (pDevice->bProtectMode) {
2029                             MACvEnableProtectMD(pDevice);
2030                         } else {
2031                             MACvDisableProtectMD(pDevice);
2032                         }
2033                         vUpdateIFS(pDevice);
2034                     }
2035                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2036                         pDevice->bNonERPPresent = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2037                     }
2038                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2039                         pDevice->bBarkerPreambleMd = (pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2040                         //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2041                         if (pDevice->bBarkerPreambleMd) {
2042                             MACvEnableBarkerPreambleMd(pDevice);
2043                         } else {
2044                             MACvDisableBarkerPreambleMd(pDevice);
2045                         }
2046                     }
2047                 }
2048                 // Sync Short Slot Time
2049                 if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo) != pDevice->bShortSlotTime) {
2050                     BOOL    bShortSlotTime;
2051
2052                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo);
2053                     //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2054                     //Kyle check if it is OK to set G.
2055                     if (pDevice->byBBType == BB_TYPE_11A) {
2056                         bShortSlotTime = TRUE;
2057                     }
2058                     else if (pDevice->byBBType == BB_TYPE_11B) {
2059                         bShortSlotTime = FALSE;
2060                     }
2061                     if (bShortSlotTime != pDevice->bShortSlotTime) {
2062                         pDevice->bShortSlotTime = bShortSlotTime;
2063                         BBvSetShortSlotTime(pDevice);
2064                         vUpdateIFS(pDevice);
2065                     }
2066                 }
2067
2068                 //
2069                 // Preamble may change dynamiclly
2070                 //
2071                 byOldPreambleType = pDevice->byPreambleType;
2072                 if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pBSSList->wCapInfo)) {
2073                     pDevice->byPreambleType = pDevice->byShortPreamble;
2074                 }
2075                 else {
2076                     pDevice->byPreambleType = 0;
2077                 }
2078                 if (pDevice->byPreambleType != byOldPreambleType)
2079                     CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2080             //
2081             // Basic Rate Set may change dynamiclly
2082             //
2083             if (pBSSList->eNetworkTypeInUse == PHY_TYPE_11B) {
2084                 uRateLen = WLAN_RATES_MAXLEN_11B;
2085             }
2086             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abySuppRates,
2087                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2088                                                     uRateLen);
2089             pMgmt->abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abyExtSuppRates,
2090                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
2091                                                     uRateLen);
2092             RATEvParseMaxRate( (PVOID)pDevice,
2093                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2094                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
2095                                TRUE,
2096                                &(pMgmt->sNodeDBTable[0].wMaxBasicRate),
2097                                &(pMgmt->sNodeDBTable[0].wMaxSuppRate),
2098                                &(pMgmt->sNodeDBTable[0].wSuppRate),
2099                                &(pMgmt->sNodeDBTable[0].byTopCCKBasicRate),
2100                                &(pMgmt->sNodeDBTable[0].byTopOFDMBasicRate)
2101                               );
2102
2103         }
2104     }
2105
2106 //    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon 2 \n");
2107     // check if CF field exisit
2108     if (WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)) {
2109         if (sFrame.pCFParms->wCFPDurRemaining > 0) {
2110             // TODO: deal with CFP period to set NAV
2111         };
2112     };
2113
2114     HIDWORD(qwTimestamp) = cpu_to_le32(HIDWORD(*sFrame.pqwTimestamp));
2115     LODWORD(qwTimestamp) = cpu_to_le32(LODWORD(*sFrame.pqwTimestamp));
2116     HIDWORD(qwLocalTSF) = HIDWORD(pRxPacket->qwLocalTSF);
2117     LODWORD(qwLocalTSF) = LODWORD(pRxPacket->qwLocalTSF);
2118
2119     // check if beacon TSF larger or small than our local TSF
2120     if (HIDWORD(qwTimestamp) == HIDWORD(qwLocalTSF)) {
2121         if (LODWORD(qwTimestamp) >= LODWORD(qwLocalTSF)) {
2122             bTSFOffsetPostive = TRUE;
2123         }
2124         else {
2125             bTSFOffsetPostive = FALSE;
2126         }
2127     }
2128     else if (HIDWORD(qwTimestamp) > HIDWORD(qwLocalTSF)) {
2129         bTSFOffsetPostive = TRUE;
2130     }
2131     else if (HIDWORD(qwTimestamp) < HIDWORD(qwLocalTSF)) {
2132         bTSFOffsetPostive = FALSE;
2133     };
2134
2135     if (bTSFOffsetPostive) {
2136         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwTimestamp), (qwLocalTSF));
2137     }
2138     else {
2139         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwLocalTSF), (qwTimestamp));
2140     }
2141
2142     if (HIDWORD(qwTSFOffset) != 0 ||
2143         (LODWORD(qwTSFOffset) > TRIVIAL_SYNC_DIFFERENCE )) {
2144          bTSFLargeDiff = TRUE;
2145     }
2146
2147
2148     // if infra mode
2149     if (bIsAPBeacon == TRUE) {
2150
2151         // Infra mode: Local TSF always follow AP's TSF if Difference huge.
2152         if (bTSFLargeDiff)
2153             bUpdateTSF = TRUE;
2154
2155         if ((pDevice->bEnablePSMode == TRUE) &&(sFrame.pTIM != 0)) {
2156
2157             // deal with DTIM, analysis TIM
2158             pMgmt->bMulticastTIM = WLAN_MGMT_IS_MULTICAST_TIM(sFrame.pTIM->byBitMapCtl) ? TRUE : FALSE ;
2159             pMgmt->byDTIMCount = sFrame.pTIM->byDTIMCount;
2160             pMgmt->byDTIMPeriod = sFrame.pTIM->byDTIMPeriod;
2161             wAIDNumber = pMgmt->wCurrAID & ~(BIT14|BIT15);
2162
2163             // check if AID in TIM field bit on
2164             // wStartIndex = N1
2165             wStartIndex = WLAN_MGMT_GET_TIM_OFFSET(sFrame.pTIM->byBitMapCtl) << 1;
2166             // AIDIndex = N2
2167             wAIDIndex = (wAIDNumber >> 3);
2168             if ((wAIDNumber > 0) && (wAIDIndex >= wStartIndex)) {
2169                 uLocateByteIndex = wAIDIndex - wStartIndex;
2170                 // len = byDTIMCount + byDTIMPeriod + byDTIMPeriod + byVirtBitMap[0~250]
2171                 if (sFrame.pTIM->len >= (uLocateByteIndex + 4)) {
2172                     byTIMBitOn  = (0x01) << ((wAIDNumber) % 8);
2173                     pMgmt->bInTIM = sFrame.pTIM->byVirtBitMap[uLocateByteIndex] & byTIMBitOn ? TRUE : FALSE;
2174                 }
2175                 else {
2176                     pMgmt->bInTIM = FALSE;
2177                 };
2178             }
2179             else {
2180                 pMgmt->bInTIM = FALSE;
2181             };
2182
2183             if (pMgmt->bInTIM ||
2184                 (pMgmt->bMulticastTIM && (pMgmt->byDTIMCount == 0))) {
2185                 pMgmt->bInTIMWake = TRUE;
2186                 // send out ps-poll packet
2187 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:In TIM\n");
2188                 if (pMgmt->bInTIM) {
2189                     PSvSendPSPOLL((PSDevice)pDevice);
2190 //                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:PS-POLL sent..\n");
2191                 };
2192
2193             }
2194             else {
2195                 pMgmt->bInTIMWake = FALSE;
2196                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Not In TIM..\n");
2197                 if (pDevice->bPWBitOn == FALSE) {
2198                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Send Null Packet\n");
2199                     if (PSbSendNullPacket(pDevice))
2200                         pDevice->bPWBitOn = TRUE;
2201                 }
2202                 if(PSbConsiderPowerDown(pDevice, FALSE, FALSE)) {
2203                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Power down now...\n");
2204                 };
2205             }
2206
2207         }
2208
2209     }
2210     // if adhoc mode
2211     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && !bIsAPBeacon && bIsChannelEqual) {
2212         if (bIsBSSIDEqual) {
2213             // Use sNodeDBTable[0].uInActiveCount as IBSS beacons received count.
2214                     if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
2215                             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2216
2217             // adhoc mode:TSF updated only when beacon larger then local TSF
2218             if (bTSFLargeDiff && bTSFOffsetPostive &&
2219                 (pMgmt->eCurrState == WMAC_STATE_JOINTED))
2220                 bUpdateTSF = TRUE;
2221
2222             // During dpc, already in spinlocked.
2223             if (BSSbIsSTAInNodeDB(pDevice, sFrame.pHdr->sA3.abyAddr2, &uNodeIndex)) {
2224
2225                 // Update the STA, (Techically the Beacons of all the IBSS nodes
2226                         // should be identical, but that's not happening in practice.
2227                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2228                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2229                                                         WLAN_RATES_MAXLEN_11B);
2230                 RATEvParseMaxRate( (PVOID)pDevice,
2231                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2232                                    NULL,
2233                                    TRUE,
2234                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2235                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2236                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2237                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2238                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2239                                   );
2240                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2241                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2242                 pMgmt->sNodeDBTable[uNodeIndex].uInActiveCount = 0;
2243             }
2244             else {
2245                 // Todo, initial Node content
2246                 BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
2247
2248                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2249                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2250                                                         WLAN_RATES_MAXLEN_11B);
2251                 RATEvParseMaxRate( (PVOID)pDevice,
2252                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2253                                    NULL,
2254                                    TRUE,
2255                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2256                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2257                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2258                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2259                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2260                                  );
2261
2262                 memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, sFrame.pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
2263                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2264                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate = pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
2265 /*
2266                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2267                 if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
2268                        pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
2269 */
2270             }
2271
2272             // if other stations jointed, indicate connect to upper layer..
2273             if (pMgmt->eCurrState == WMAC_STATE_STARTED) {
2274                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Current IBSS State: [Started]........to: [Jointed] \n");
2275                 pMgmt->eCurrState = WMAC_STATE_JOINTED;
2276                 pDevice->bLinkPass = TRUE;
2277                 ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2278                 if (netif_queue_stopped(pDevice->dev)){
2279                     netif_wake_queue(pDevice->dev);
2280                 }
2281                 pMgmt->sNodeDBTable[0].bActive = TRUE;
2282                 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2283
2284             };
2285         }
2286         else if (bIsSSIDEqual) {
2287
2288             // See other adhoc sta with the same SSID but BSSID is different.
2289             // adpot this vars only when TSF larger then us.
2290             if (bTSFLargeDiff && bTSFOffsetPostive) {
2291                  // we don't support ATIM under adhoc mode
2292                // if ( sFrame.pIBSSParms->wATIMWindow == 0) {
2293                      // adpot this vars
2294                      // TODO: check sFrame cap if privacy on, and support rate syn
2295                      memcpy(pMgmt->abyCurrBSSID, sFrame.pHdr->sA3.abyAddr3, WLAN_BSSID_LEN);
2296                      memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
2297                      pMgmt->wCurrATIMWindow = cpu_to_le16(sFrame.pIBSSParms->wATIMWindow);
2298                      pMgmt->wCurrBeaconPeriod = cpu_to_le16(*sFrame.pwBeaconInterval);
2299                      pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2300                                                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2301                                                       WLAN_RATES_MAXLEN_11B);
2302                      // set HW beacon interval and re-synchronizing....
2303                      DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rejoining to Other Adhoc group with same SSID........\n");
2304
2305                      MACvWriteBeaconInterval(pDevice, pMgmt->wCurrBeaconPeriod);
2306                      CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp, pRxPacket->qwLocalTSF);
2307                      CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2308
2309                      // Turn off bssid filter to avoid filter others adhoc station which bssid is different.
2310                      MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2311
2312                     byOldPreambleType = pDevice->byPreambleType;
2313                     if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo)) {
2314                         pDevice->byPreambleType = pDevice->byShortPreamble;
2315                     }
2316                     else {
2317                         pDevice->byPreambleType = 0;
2318                     }
2319                     if (pDevice->byPreambleType != byOldPreambleType)
2320                         CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2321
2322
2323                      // MACvRegBitsOff(pDevice->PortOffset, MAC_REG_RCR, RCR_BSSID);
2324                      // set highest basic rate
2325                      // s_vSetHighestBasicRate(pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates);
2326                      // Prepare beacon frame
2327                      bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt);
2328               //  }
2329             };
2330         }
2331     };
2332     // endian issue ???
2333     // Update TSF
2334     if (bUpdateTSF) {
2335         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2336         CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp , pRxPacket->qwLocalTSF);
2337         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2338         CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2339     }
2340
2341     return;
2342 }
2343
2344
2345
2346 /*+
2347  *
2348  * Routine Description:
2349  *   Instructs the hw to create a bss using the supplied
2350  *   attributes. Note that this implementation only supports Ad-Hoc
2351  *   BSS creation.
2352  *
2353  *
2354  * Return Value:
2355  *    CMD_STATUS
2356  *
2357 -*/
2358 VOID
2359 vMgrCreateOwnIBSS(
2360     IN  HANDLE hDeviceContext,
2361     OUT PCMD_STATUS pStatus
2362     )
2363 {
2364     PSDevice            pDevice = (PSDevice)hDeviceContext;
2365     PSMgmtObject        pMgmt = &(pDevice->sMgmtObj);
2366     WORD                wMaxBasicRate;
2367     WORD                wMaxSuppRate;
2368     BYTE                byTopCCKBasicRate;
2369     BYTE                byTopOFDMBasicRate;
2370     QWORD               qwCurrTSF;
2371     UINT                ii;
2372     BYTE    abyRATE[] = {0x82, 0x84, 0x8B, 0x96, 0x24, 0x30, 0x48, 0x6C, 0x0C, 0x12, 0x18, 0x60};
2373     BYTE    abyCCK_RATE[] = {0x82, 0x84, 0x8B, 0x96};
2374     BYTE    abyOFDM_RATE[] = {0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2375     WORD                wSuppRate;
2376
2377
2378
2379     HIDWORD(qwCurrTSF) = 0;
2380     LODWORD(qwCurrTSF) = 0;
2381
2382     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Create Basic Service Set .......\n");
2383
2384     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2385         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) &&
2386             (pDevice->eEncryptionStatus != Ndis802_11Encryption2Enabled) &&
2387             (pDevice->eEncryptionStatus != Ndis802_11Encryption3Enabled)) {
2388             // encryption mode error
2389             *pStatus = CMD_STATUS_FAILURE;
2390             return;
2391         }
2392     }
2393
2394     pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2395     pMgmt->abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
2396
2397     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2398         pMgmt->eCurrentPHYMode = pMgmt->byAPBBType;
2399     } else {
2400         if (pDevice->byBBType == BB_TYPE_11G)
2401             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
2402         if (pDevice->byBBType == BB_TYPE_11B)
2403             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
2404         if (pDevice->byBBType == BB_TYPE_11A)
2405             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
2406     }
2407
2408     if (pMgmt->eCurrentPHYMode != PHY_TYPE_11A) {
2409         pMgmt->abyCurrSuppRates[1] = WLAN_RATES_MAXLEN_11B;
2410         pMgmt->abyCurrExtSuppRates[1] = 0;
2411         for (ii = 0; ii < 4; ii++)
2412             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2413     } else {
2414         pMgmt->abyCurrSuppRates[1] = 8;
2415         pMgmt->abyCurrExtSuppRates[1] = 0;
2416         for (ii = 0; ii < 8; ii++)
2417             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2418     }
2419
2420
2421     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
2422         pMgmt->abyCurrSuppRates[1] = 8;
2423         pMgmt->abyCurrExtSuppRates[1] = 4;
2424         for (ii = 0; ii < 4; ii++)
2425             pMgmt->abyCurrSuppRates[2+ii] =  abyCCK_RATE[ii];
2426         for (ii = 4; ii < 8; ii++)
2427             pMgmt->abyCurrSuppRates[2+ii] =  abyOFDM_RATE[ii-4];
2428         for (ii = 0; ii < 4; ii++)
2429             pMgmt->abyCurrExtSuppRates[2+ii] =  abyOFDM_RATE[ii+4];
2430     }
2431
2432
2433     // Disable Protect Mode
2434     pDevice->bProtectMode = 0;
2435     MACvDisableProtectMD(pDevice);
2436
2437     pDevice->bBarkerPreambleMd = 0;
2438     MACvDisableBarkerPreambleMd(pDevice);
2439
2440     // Kyle Test 2003.11.04
2441
2442     // set HW beacon interval
2443     if (pMgmt->wIBSSBeaconPeriod == 0)
2444         pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
2445     MACvWriteBeaconInterval(pDevice, pMgmt->wIBSSBeaconPeriod);
2446
2447     CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2448     // clear TSF counter
2449     CARDbClearCurrentTSF(pDevice);
2450
2451     // enable TSF counter
2452     MACvRegBitsOn(pDevice,MAC_REG_TFTCTL,TFTCTL_TSFCNTREN);
2453     // set Next TBTT
2454     CARDvSetFirstNextTBTT(pDevice, pMgmt->wIBSSBeaconPeriod);
2455
2456     pMgmt->uIBSSChannel = pDevice->uChannel;
2457
2458     if (pMgmt->uIBSSChannel == 0)
2459         pMgmt->uIBSSChannel = DEFAULT_IBSS_CHANNEL;
2460
2461     // set channel and clear NAV
2462     CARDbSetMediaChannel(pDevice, pMgmt->uIBSSChannel);
2463     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2464
2465     pDevice->byPreambleType = pDevice->byShortPreamble;
2466
2467     // set basic rate
2468
2469     RATEvParseMaxRate((PVOID)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2470                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates, TRUE,
2471                       &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2472                       &byTopCCKBasicRate, &byTopOFDMBasicRate);
2473
2474
2475
2476     if (pDevice->byBBType == BB_TYPE_11A) {
2477         pDevice->bShortSlotTime = TRUE;
2478     } else {
2479         pDevice->bShortSlotTime = FALSE;
2480     }
2481     BBvSetShortSlotTime(pDevice);
2482     // vUpdateIFS() use pDevice->bShortSlotTime as parameter so it must be called
2483     // after setting ShortSlotTime.
2484     // CARDvSetBSSMode call vUpdateIFS()
2485     CARDvSetBSSMode(pDevice);
2486
2487     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2488         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_AP);
2489         pMgmt->eCurrMode = WMAC_MODE_ESS_AP;
2490     }
2491
2492     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2493         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
2494         pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2495     }
2496
2497     // Adopt pre-configured IBSS vars to current vars
2498     pMgmt->eCurrState = WMAC_STATE_STARTED;
2499     pMgmt->wCurrBeaconPeriod = pMgmt->wIBSSBeaconPeriod;
2500     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2501     pMgmt->wCurrATIMWindow = pMgmt->wIBSSATIMWindow;
2502     pDevice->uCurrRSSI = 0;
2503     pDevice->byCurrSQ = 0;
2504
2505 //20080131-04,<Add> by Mike Liu
2506 #ifdef Adhoc_STA
2507     memcpy(pMgmt->abyDesireSSID,pMgmt->abyAdHocSSID,
2508                       ((PWLAN_IE_SSID)pMgmt->abyAdHocSSID)->len + WLAN_IEHDR_LEN);
2509 #endif
2510
2511     memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2512     memcpy(pMgmt->abyCurrSSID,
2513            pMgmt->abyDesireSSID,
2514            ((PWLAN_IE_SSID)pMgmt->abyDesireSSID)->len + WLAN_IEHDR_LEN
2515           );
2516
2517     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2518         // AP mode BSSID = MAC addr
2519         memcpy(pMgmt->abyCurrBSSID, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
2520         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"AP beacon created BSSID:%02x-%02x-%02x-%02x-%02x-%02x \n",
2521                       pMgmt->abyCurrBSSID[0],
2522                       pMgmt->abyCurrBSSID[1],
2523                       pMgmt->abyCurrBSSID[2],
2524                       pMgmt->abyCurrBSSID[3],
2525                       pMgmt->abyCurrBSSID[4],
2526                       pMgmt->abyCurrBSSID[5]
2527                     );
2528     }
2529
2530     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2531
2532         // BSSID selected must be randomized as spec 11.1.3
2533         pMgmt->abyCurrBSSID[5] = (BYTE) (LODWORD(qwCurrTSF)& 0x000000ff);
2534         pMgmt->abyCurrBSSID[4] = (BYTE)((LODWORD(qwCurrTSF)& 0x0000ff00) >> 8);
2535         pMgmt->abyCurrBSSID[3] = (BYTE)((LODWORD(qwCurrTSF)& 0x00ff0000) >> 16);
2536         pMgmt->abyCurrBSSID[2] = (BYTE)((LODWORD(qwCurrTSF)& 0x00000ff0) >> 4);
2537         pMgmt->abyCurrBSSID[1] = (BYTE)((LODWORD(qwCurrTSF)& 0x000ff000) >> 12);
2538         pMgmt->abyCurrBSSID[0] = (BYTE)((LODWORD(qwCurrTSF)& 0x0ff00000) >> 20);
2539         pMgmt->abyCurrBSSID[5] ^= pMgmt->abyMACAddr[0];
2540         pMgmt->abyCurrBSSID[4] ^= pMgmt->abyMACAddr[1];
2541         pMgmt->abyCurrBSSID[3] ^= pMgmt->abyMACAddr[2];
2542         pMgmt->abyCurrBSSID[2] ^= pMgmt->abyMACAddr[3];
2543         pMgmt->abyCurrBSSID[1] ^= pMgmt->abyMACAddr[4];
2544         pMgmt->abyCurrBSSID[0] ^= pMgmt->abyMACAddr[5];
2545         pMgmt->abyCurrBSSID[0] &= ~IEEE_ADDR_GROUP;
2546         pMgmt->abyCurrBSSID[0] |= IEEE_ADDR_UNIVERSAL;
2547
2548
2549         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"Adhoc beacon created bssid:%02x-%02x-%02x-%02x-%02x-%02x \n",
2550                       pMgmt->abyCurrBSSID[0],
2551                       pMgmt->abyCurrBSSID[1],
2552                       pMgmt->abyCurrBSSID[2],
2553                       pMgmt->abyCurrBSSID[3],
2554                       pMgmt->abyCurrBSSID[4],
2555                       pMgmt->abyCurrBSSID[5]
2556                     );
2557     }
2558
2559     // set BSSID filter
2560     MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2561     memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
2562
2563     MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
2564     pDevice->byRxMode |= RCR_BSSID;
2565     pMgmt->bCurrBSSIDFilterOn = TRUE;
2566
2567     // Set Capability Info
2568     pMgmt->wCurrCapInfo = 0;
2569
2570     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2571         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
2572         pMgmt->byDTIMPeriod = DEFAULT_DTIM_PERIOD;
2573         pMgmt->byDTIMCount = pMgmt->byDTIMPeriod - 1;
2574         pDevice->eOPMode = OP_MODE_AP;
2575     }
2576
2577     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2578         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_IBSS(1);
2579         pDevice->eOPMode = OP_MODE_ADHOC;
2580     }
2581
2582     if (pDevice->bEncryptionEnable) {
2583         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
2584         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2585             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2586                 pMgmt->byCSSPK = KEY_CTL_CCMP;
2587                 pMgmt->byCSSGK = KEY_CTL_CCMP;
2588             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2589                 pMgmt->byCSSPK = KEY_CTL_TKIP;
2590                 pMgmt->byCSSGK = KEY_CTL_TKIP;
2591             } else {
2592                 pMgmt->byCSSPK = KEY_CTL_NONE;
2593                 pMgmt->byCSSGK = KEY_CTL_WEP;
2594             }
2595         } else {
2596             pMgmt->byCSSPK = KEY_CTL_WEP;
2597             pMgmt->byCSSGK = KEY_CTL_WEP;
2598         }
2599     };
2600
2601     pMgmt->byERPContext = 0;
2602
2603     if (pDevice->byPreambleType == 1) {
2604         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
2605     } else {
2606         pMgmt->wCurrCapInfo &= (~WLAN_SET_CAP_INFO_SHORTPREAMBLE(1));
2607     }
2608
2609     pMgmt->eCurrState = WMAC_STATE_STARTED;
2610     // Prepare beacon to send
2611     if (bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt)) {
2612         *pStatus = CMD_STATUS_SUCCESS;
2613     }
2614     return ;
2615 }
2616
2617
2618
2619 /*+
2620  *
2621  * Routine Description:
2622  *   Instructs wmac to join a bss using the supplied attributes.
2623  *   The arguments may the BSSID or SSID and the rest of the
2624  *   attributes are obtained from the scan result of known bss list.
2625  *
2626  *
2627  * Return Value:
2628  *    None.
2629  *
2630 -*/
2631
2632 VOID
2633 vMgrJoinBSSBegin(
2634     IN  HANDLE hDeviceContext,
2635     OUT PCMD_STATUS pStatus
2636     )
2637 {
2638
2639     PSDevice     pDevice = (PSDevice)hDeviceContext;
2640     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
2641     PKnownBSS       pCurr = NULL;
2642     UINT            ii, uu;
2643     PWLAN_IE_SUPP_RATES pItemRates = NULL;
2644     PWLAN_IE_SUPP_RATES pItemExtRates = NULL;
2645     PWLAN_IE_SSID   pItemSSID;
2646     UINT            uRateLen = WLAN_RATES_MAXLEN;
2647     WORD            wMaxBasicRate = RATE_1M;
2648     WORD            wMaxSuppRate = RATE_1M;
2649     WORD            wSuppRate;
2650     BYTE            byTopCCKBasicRate = RATE_1M;
2651     BYTE            byTopOFDMBasicRate = RATE_1M;
2652     BOOL            bShortSlotTime = FALSE;
2653
2654
2655     for (ii = 0; ii < MAX_BSS_NUM; ii++) {
2656         if (pMgmt->sBSSList[ii].bActive == TRUE)
2657             break;
2658     }
2659
2660     if (ii == MAX_BSS_NUM) {
2661        *pStatus = CMD_STATUS_RESOURCES;
2662         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "BSS finding:BSS list is empty.\n");
2663        return;
2664     };
2665
2666     // memset(pMgmt->abyDesireBSSID, 0,  WLAN_BSSID_LEN);
2667     // Search known BSS list for prefer BSSID or SSID
2668
2669     pCurr = BSSpSearchBSSList(pDevice,
2670                               pMgmt->abyDesireBSSID,
2671                               pMgmt->abyDesireSSID,
2672                               pDevice->eConfigPHYMode
2673                               );
2674
2675     if (pCurr == NULL){
2676        *pStatus = CMD_STATUS_RESOURCES;
2677        pItemSSID = (PWLAN_IE_SSID)pMgmt->abyDesireSSID;
2678        DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Scanning [%s] not found, disconnected !\n", pItemSSID->abySSID);
2679        return;
2680     };
2681
2682     DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP(BSS) finding:Found a AP(BSS)..\n");
2683
2684     if (WLAN_GET_CAP_INFO_ESS(cpu_to_le16(pCurr->wCapInfo))){
2685
2686         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA)||(pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK)) {
2687 /*
2688             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2689                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2690                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2691                     // encryption mode error
2692                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2693                     return;
2694                 }
2695             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2696                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2697                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2698                     // encryption mode error
2699                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2700                     return;
2701                 }
2702             }
2703 */
2704         }
2705
2706 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
2707         //if(pDevice->bWPASuppWextEnabled == TRUE)
2708             Encyption_Rebuild(pDevice, pCurr);
2709 #endif
2710
2711         // Infrastructure BSS
2712         s_vMgrSynchBSS(pDevice,
2713                        WMAC_MODE_ESS_STA,
2714                        pCurr,
2715                        pStatus
2716                        );
2717
2718         if (*pStatus == CMD_STATUS_SUCCESS){
2719
2720             // Adopt this BSS state vars in Mgmt Object
2721             pMgmt->uCurrChannel = pCurr->uChannel;
2722
2723             memset(pMgmt->abyCurrSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2724             memset(pMgmt->abyCurrExtSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2725
2726             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2727                 uRateLen = WLAN_RATES_MAXLEN_11B;
2728             }
2729
2730             pItemRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates;
2731             pItemExtRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates;
2732
2733             // Parse Support Rate IE
2734             pItemRates->byElementID = WLAN_EID_SUPP_RATES;
2735             pItemRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2736                                          pItemRates,
2737                                          uRateLen);
2738
2739             // Parse Extension Support Rate IE
2740             pItemExtRates->byElementID = WLAN_EID_EXTSUPP_RATES;
2741             pItemExtRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abyExtSuppRates,
2742                                             pItemExtRates,
2743                                             uRateLen);
2744             // Stuffing Rate IE
2745             if ((pItemExtRates->len > 0) && (pItemRates->len < 8)) {
2746                 for (ii = 0; ii < (UINT)(8 - pItemRates->len); ) {
2747                     pItemRates->abyRates[pItemRates->len + ii] = pItemExtRates->abyRates[ii];
2748                     ii ++;
2749                     if (pItemExtRates->len <= ii)
2750                         break;
2751                 }
2752                 pItemRates->len += (BYTE)ii;
2753                 if (pItemExtRates->len - ii > 0) {
2754                     pItemExtRates->len -= (BYTE)ii;
2755                     for (uu = 0; uu < pItemExtRates->len; uu ++) {
2756                         pItemExtRates->abyRates[uu] = pItemExtRates->abyRates[uu + ii];
2757                     }
2758                 } else {
2759                     pItemExtRates->len = 0;
2760                 }
2761             }
2762
2763             RATEvParseMaxRate((PVOID)pDevice, pItemRates, pItemExtRates, TRUE,
2764                               &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2765                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2766             vUpdateIFS(pDevice);
2767             // TODO: deal with if wCapInfo the privacy is on, but station WEP is off
2768             // TODO: deal with if wCapInfo the PS-Pollable is on.
2769             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2770             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2771             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2772             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2773
2774             pMgmt->eCurrMode = WMAC_MODE_ESS_STA;
2775
2776             pMgmt->eCurrState = WMAC_STATE_JOINTED;
2777             // Adopt BSS state in Adapter Device Object
2778             pDevice->eOPMode = OP_MODE_INFRASTRUCTURE;
2779             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2780
2781             // Add current BSS to Candidate list
2782             // This should only works for WPA2 BSS, and WPA2 BSS check must be done before.
2783             if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
2784                 BOOL bResult = bAdd_PMKID_Candidate((HANDLE)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2785                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate: 1(%d)\n", bResult);
2786                 if (bResult == FALSE) {
2787                     vFlush_PMKID_Candidate((HANDLE)pDevice);
2788                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFlush_PMKID_Candidate: 4\n");
2789                     bAdd_PMKID_Candidate((HANDLE)pDevice, pMgmt->abyCurrBSSID, &pCurr->sRSNCapObj);
2790                 }
2791             }
2792
2793             // Preamble type auto-switch: if AP can receive short-preamble cap,
2794             // we can turn on too.
2795             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2796                 pDevice->byPreambleType = pDevice->byShortPreamble;
2797             }
2798             else {
2799                 pDevice->byPreambleType = 0;
2800             }
2801             // Change PreambleType must set RSPINF again
2802             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2803
2804             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join ESS\n");
2805
2806             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11G) {
2807
2808                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2809                     pDevice->bProtectMode = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2810                     if (pDevice->bProtectMode) {
2811                         MACvEnableProtectMD(pDevice);
2812                     } else {
2813                         MACvDisableProtectMD(pDevice);
2814                     }
2815                     vUpdateIFS(pDevice);
2816                 }
2817                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2818                     pDevice->bNonERPPresent = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2819                 }
2820                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2821                     pDevice->bBarkerPreambleMd = (pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2822                     //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2823                     if (pDevice->bBarkerPreambleMd) {
2824                         MACvEnableBarkerPreambleMd(pDevice);
2825                     } else {
2826                         MACvDisableBarkerPreambleMd(pDevice);
2827                     }
2828                 }
2829             }
2830             //DBG_PRN_WLAN05(("wCapInfo: %X\n", pCurr->wCapInfo));
2831             if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo) != pDevice->bShortSlotTime) {
2832                 if (pDevice->byBBType == BB_TYPE_11A) {
2833                     bShortSlotTime = TRUE;
2834                 }
2835                 else if (pDevice->byBBType == BB_TYPE_11B) {
2836                     bShortSlotTime = FALSE;
2837                 }
2838                 else {
2839                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo);
2840                 }
2841                 //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2842                 if (bShortSlotTime != pDevice->bShortSlotTime) {
2843                     pDevice->bShortSlotTime = bShortSlotTime;
2844                     BBvSetShortSlotTime(pDevice);
2845                     vUpdateIFS(pDevice);
2846                 }
2847             }
2848
2849             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"End of Join AP -- A/B/G Action\n");
2850         }
2851         else {
2852             pMgmt->eCurrState = WMAC_STATE_IDLE;
2853         };
2854
2855
2856      }
2857      else {
2858         // ad-hoc mode BSS
2859         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2860
2861             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2862 /*
2863                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2864                     // encryption mode error
2865                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2866                     return;
2867                 }
2868 */
2869             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2870 /*
2871                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2872                     // encryption mode error
2873                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2874                     return;
2875                 }
2876 */
2877             } else {
2878                 // encryption mode error
2879                 pMgmt->eCurrState = WMAC_STATE_IDLE;
2880                 return;
2881             }
2882         }
2883
2884         s_vMgrSynchBSS(pDevice,
2885                        WMAC_MODE_IBSS_STA,
2886                        pCurr,
2887                        pStatus
2888                        );
2889
2890         if (*pStatus == CMD_STATUS_SUCCESS){
2891             // Adopt this BSS state vars in Mgmt Object
2892             // TODO: check if CapInfo privacy on, but we don't..
2893             pMgmt->uCurrChannel = pCurr->uChannel;
2894
2895
2896             // Parse Support Rate IE
2897             pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2898             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2899                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2900                                                     WLAN_RATES_MAXLEN_11B);
2901             // set basic rate
2902             RATEvParseMaxRate((PVOID)pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2903                               NULL, TRUE, &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2904                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2905             vUpdateIFS(pDevice);
2906             pMgmt->wCurrCapInfo = pCurr->wCapInfo;
2907             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2908             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2909             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2910             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2911 //          pMgmt->wCurrATIMWindow = pCurr->wATIMWindow;
2912             pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2913             pMgmt->eCurrState = WMAC_STATE_STARTED;
2914             // Adopt BSS state in Adapter Device Object
2915             pDevice->eOPMode = OP_MODE_ADHOC;
2916             pDevice->bLinkPass = TRUE;
2917             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2918             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2919
2920             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join IBSS ok:%02x-%02x-%02x-%02x-%02x-%02x \n",
2921                   pMgmt->abyCurrBSSID[0],
2922                   pMgmt->abyCurrBSSID[1],
2923                   pMgmt->abyCurrBSSID[2],
2924                   pMgmt->abyCurrBSSID[3],
2925                   pMgmt->abyCurrBSSID[4],
2926                   pMgmt->abyCurrBSSID[5]
2927                 );
2928             // Preamble type auto-switch: if AP can receive short-preamble cap,
2929             // and if registry setting is short preamble we can turn on too.
2930
2931             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2932                 pDevice->byPreambleType = pDevice->byShortPreamble;
2933             }
2934             else {
2935                 pDevice->byPreambleType = 0;
2936             }
2937             // Change PreambleType must set RSPINF again
2938             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2939
2940             // Prepare beacon
2941             bMgrPrepareBeaconToSend((HANDLE)pDevice, pMgmt);
2942         }
2943         else {
2944             pMgmt->eCurrState = WMAC_STATE_IDLE;
2945         };
2946      };
2947     return;
2948 }
2949
2950
2951
2952 /*+
2953  *
2954  * Routine Description:
2955  * Set HW to synchronize a specific BSS from known BSS list.
2956  *
2957  *
2958  * Return Value:
2959  *    PCM_STATUS
2960  *
2961 -*/
2962 static
2963 VOID
2964 s_vMgrSynchBSS (
2965     IN PSDevice      pDevice,
2966     IN UINT          uBSSMode,
2967     IN PKnownBSS     pCurr,
2968     OUT PCMD_STATUS  pStatus
2969     )
2970 {
2971     PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
2972                                                      //1M,   2M,   5M,   11M,  18M,  24M,  36M,  54M
2973     BYTE abyCurrSuppRatesG[] = {WLAN_EID_SUPP_RATES, 8, 0x02, 0x04, 0x0B, 0x16, 0x24, 0x30, 0x48, 0x6C};
2974     BYTE abyCurrExtSuppRatesG[] = {WLAN_EID_EXTSUPP_RATES, 4, 0x0C, 0x12, 0x18, 0x60};
2975                                                            //6M,   9M,   12M,  48M
2976     BYTE abyCurrSuppRatesA[] = {WLAN_EID_SUPP_RATES, 8, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2977     BYTE abyCurrSuppRatesB[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
2978
2979
2980     *pStatus = CMD_STATUS_FAILURE;
2981
2982     if (s_bCipherMatch(pCurr,
2983                        pDevice->eEncryptionStatus,
2984                        &(pMgmt->byCSSPK),
2985                        &(pMgmt->byCSSGK)) == FALSE) {
2986         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "s_bCipherMatch Fail .......\n");
2987         return;
2988     }
2989
2990     pMgmt->pCurrBSS = pCurr;
2991
2992     // if previous mode is IBSS.
2993     if(pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2994         MACvRegBitsOff(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
2995     }
2996
2997     // Init the BSS informations
2998     pDevice->bCCK = TRUE;
2999     pDevice->bProtectMode = FALSE;
3000     MACvDisableProtectMD(pDevice);
3001     pDevice->bBarkerPreambleMd = FALSE;
3002     MACvDisableBarkerPreambleMd(pDevice);
3003     pDevice->bNonERPPresent = FALSE;
3004     pDevice->byPreambleType = 0;
3005     pDevice->wBasicRate = 0;
3006     // Set Basic Rate
3007     CARDbAddBasicRate((PVOID)pDevice, RATE_1M);
3008
3009     // calculate TSF offset
3010     // TSF Offset = Received Timestamp TSF - Marked Local's TSF
3011     CARDvAdjustTSF(pDevice, pCurr->byRxRate, pCurr->qwBSSTimestamp, pCurr->qwLocalTSF);
3012
3013     // set HW beacon interval
3014     MACvWriteBeaconInterval(pDevice, pCurr->wBeaconInterval);
3015
3016     // set Next TBTT
3017     // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
3018     CARDvSetFirstNextTBTT(pDevice, pCurr->wBeaconInterval);
3019
3020     // set BSSID
3021     MACvWriteBSSIDAddress(pDevice, pCurr->abyBSSID);
3022
3023     memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, 6);
3024
3025     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = %02x-%02x-%02x=%02x-%02x-%02x\n",
3026         pMgmt->abyCurrBSSID[0],
3027         pMgmt->abyCurrBSSID[1],
3028         pMgmt->abyCurrBSSID[2],
3029         pMgmt->abyCurrBSSID[3],
3030         pMgmt->abyCurrBSSID[4],
3031         pMgmt->abyCurrBSSID[5]);
3032
3033     if (pCurr->eNetworkTypeInUse == PHY_TYPE_11A) {
3034         if ((pDevice->eConfigPHYMode == PHY_TYPE_11A) ||
3035             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3036             pDevice->byBBType = BB_TYPE_11A;
3037             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
3038             pDevice->bShortSlotTime = TRUE;
3039             BBvSetShortSlotTime(pDevice);
3040             CARDvSetBSSMode(pDevice);
3041         } else {
3042             return;
3043         }
3044     } else if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
3045         if ((pDevice->eConfigPHYMode == PHY_TYPE_11B) ||
3046             (pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
3047             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3048             pDevice->byBBType = BB_TYPE_11B;
3049             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
3050             pDevice->bShortSlotTime = FALSE;
3051             BBvSetShortSlotTime(pDevice);
3052             CARDvSetBSSMode(pDevice);
3053         } else {
3054             return;
3055         }
3056     } else {
3057         if ((pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
3058             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
3059             pDevice->byBBType = BB_TYPE_11G;
3060             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
3061             pDevice->bShortSlotTime = TRUE;
3062             BBvSetShortSlotTime(pDevice);
3063             CARDvSetBSSMode(pDevice);
3064         } else if (pDevice->eConfigPHYMode == PHY_TYPE_11B) {
3065             pDevice->byBBType = BB_TYPE_11B;
3066             pDevice->bShortSlotTime = FALSE;
3067             BBvSetShortSlotTime(pDevice);
3068             CARDvSetBSSMode(pDevice);
3069         } else {
3070             return;
3071         }
3072     }
3073
3074     if (uBSSMode == WMAC_MODE_ESS_STA) {
3075         MACvRegBitsOff(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
3076         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
3077         pDevice->byRxMode |= RCR_BSSID;
3078         pMgmt->bCurrBSSIDFilterOn = TRUE;
3079     }
3080
3081     // set channel and clear NAV
3082     CARDbSetMediaChannel(pDevice, pCurr->uChannel);
3083     pMgmt->uCurrChannel = pCurr->uChannel;
3084     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "<----s_bSynchBSS Set Channel [%d]\n", pCurr->uChannel);
3085
3086     if ((pDevice->bUpdateBBVGA) &&
3087         (pDevice->byBBVGACurrent != pDevice->abyBBVGA[0])) {
3088         pDevice->byBBVGACurrent = pDevice->abyBBVGA[0];
3089         BBvSetVGAGainOffset(pDevice, pDevice->byBBVGACurrent);
3090         BBvSetShortSlotTime(pDevice);
3091     }
3092     //
3093     // Notes:
3094     // 1. In Ad-hoc mode : check if received others beacon as jointed indication,
3095     //    otherwise we will start own IBSS.
3096     // 2. In Infra mode : Supposed we already synchronized with AP right now.
3097
3098     if (uBSSMode == WMAC_MODE_IBSS_STA) {
3099         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
3100         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
3101         pDevice->byRxMode |= RCR_BSSID;
3102         pMgmt->bCurrBSSIDFilterOn = TRUE;
3103     };
3104
3105     if (pDevice->byBBType == BB_TYPE_11A) {
3106         memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesA[0], sizeof(abyCurrSuppRatesA));
3107         pMgmt->abyCurrExtSuppRates[1] = 0;
3108     } else if (pDevice->byBBType == BB_TYPE_11B) {
3109         memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesB[0], sizeof(abyCurrSuppRatesB));
3110         pMgmt->abyCurrExtSuppRates[1] = 0;
3111     } else {
3112         memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesG[0], sizeof(abyCurrSuppRatesG));
3113         memcpy(pMgmt->abyCurrExtSuppRates, &abyCurrExtSuppRatesG[0], sizeof(abyCurrExtSuppRatesG));
3114     }
3115     pMgmt->byERPContext = pCurr->sERP.byERP;
3116
3117     *pStatus = CMD_STATUS_SUCCESS;
3118
3119     return;
3120 };
3121
3122
3123 //mike add: fix NetworkManager 0.7.0 hidden ssid mode in WPA encryption
3124 //                   ,need reset eAuthenMode and eEncryptionStatus
3125  static VOID  Encyption_Rebuild(
3126     IN PSDevice pDevice,
3127     IN PKnownBSS pCurr
3128  )
3129  {
3130   PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
3131  // UINT            ii , uSameBssidNum=0;
3132
3133         //  for (ii = 0; ii < MAX_BSS_NUM; ii++) {
3134           //   if (pMgmt->sBSSList[ii].bActive &&
3135             //      IS_ETH_ADDRESS_EQUAL(pMgmt->sBSSList[ii].abyBSSID, pCurr->abyBSSID)) {
3136              //       uSameBssidNum++;
3137                //   }
3138            // }
3139   //   if( uSameBssidNum>=2) {   //we only check AP in hidden sssid  mode
3140         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||           //networkmanager 0.7.0 does not give the pairwise-key selsection,
3141              (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {         // so we need re-selsect it according to real pairwise-key info.
3142                if(pCurr->bWPAValid == TRUE)  {   //WPA-PSK
3143                           pMgmt->eAuthenMode = WMAC_AUTH_WPAPSK;
3144                     if(pCurr->abyPKType[0] == WPA_TKIP) {
3145                         pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;    //TKIP
3146                         PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-TKIP]\n");
3147                       }
3148                    else if(pCurr->abyPKType[0] == WPA_AESCCMP) {
3149                         pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3150                           PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-AES]\n");
3151                      }
3152                 }
3153                else if(pCurr->bWPA2Valid == TRUE) {  //WPA2-PSK
3154                          pMgmt->eAuthenMode = WMAC_AUTH_WPA2PSK;
3155                        if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_TKIP) {
3156                            pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;     //TKIP
3157                              PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-TKIP]\n");
3158                         }
3159                        else if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_CCMP) {
3160                            pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3161                             PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-AES]\n");
3162                         }
3163                 }
3164               }
3165         //  }
3166       return;
3167  }
3168
3169
3170 /*+
3171  *
3172  * Routine Description:
3173  *  Format TIM field
3174  *
3175  *
3176  * Return Value:
3177  *    VOID
3178  *
3179 -*/
3180
3181 static
3182 VOID
3183 s_vMgrFormatTIM(
3184     IN PSMgmtObject pMgmt,
3185     IN PWLAN_IE_TIM pTIM
3186     )
3187 {
3188     BYTE        byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
3189     BYTE        byMap;
3190     UINT        ii, jj;
3191     BOOL        bStartFound = FALSE;
3192     BOOL        bMulticast = FALSE;
3193     WORD        wStartIndex = 0;
3194     WORD        wEndIndex = 0;
3195
3196
3197     // Find size of partial virtual bitmap
3198     for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
3199         byMap = pMgmt->abyPSTxMap[ii];
3200         if (!ii) {
3201             // Mask out the broadcast bit which is indicated separately.
3202             bMulticast = (byMap & byMask[0]) != 0;
3203             if(bMulticast) {
3204                pMgmt->sNodeDBTable[0].bRxPSPoll = TRUE;
3205             }
3206             byMap = 0;
3207         }
3208         if (byMap) {
3209             if (!bStartFound) {
3210                 bStartFound = TRUE;
3211                 wStartIndex = (WORD)ii;
3212             }
3213             wEndIndex = (WORD)ii;
3214         }
3215     };
3216
3217
3218     // Round start index down to nearest even number
3219     wStartIndex &=  ~BIT0;
3220
3221     // Round end index up to nearest even number
3222     wEndIndex = ((wEndIndex + 1) & ~BIT0);
3223
3224     // Size of element payload
3225
3226     pTIM->len =  3 + (wEndIndex - wStartIndex) + 1;
3227
3228     // Fill in the Fixed parts of the TIM
3229     pTIM->byDTIMCount = pMgmt->byDTIMCount;
3230     pTIM->byDTIMPeriod = pMgmt->byDTIMPeriod;
3231     pTIM->byBitMapCtl = (bMulticast ? TIM_MULTICAST_MASK : 0) |
3232         (((wStartIndex >> 1) << 1) & TIM_BITMAPOFFSET_MASK);
3233
3234     // Append variable part of TIM
3235
3236     for (ii = wStartIndex, jj =0 ; ii <= wEndIndex; ii++, jj++) {
3237          pTIM->byVirtBitMap[jj] = pMgmt->abyPSTxMap[ii];
3238     }
3239
3240     // Aid = 0 don't used.
3241     pTIM->byVirtBitMap[0]  &= ~BIT0;
3242 }
3243
3244
3245 /*+
3246  *
3247  * Routine Description:
3248  *  Constructs an Beacon frame( Ad-hoc mode)
3249  *
3250  *
3251  * Return Value:
3252  *    PTR to frame; or NULL on allocation failue
3253  *
3254 -*/
3255
3256 static
3257 PSTxMgmtPacket
3258 s_MgrMakeBeacon(
3259     IN PSDevice pDevice,
3260     IN PSMgmtObject pMgmt,
3261     IN WORD wCurrCapInfo,
3262     IN WORD wCurrBeaconPeriod,
3263     IN UINT uCurrChannel,
3264     IN WORD wCurrATIMWinodw,
3265     IN PWLAN_IE_SSID pCurrSSID,
3266     IN PBYTE pCurrBSSID,
3267     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
3268     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3269     )
3270 {
3271     PSTxMgmtPacket      pTxPacket = NULL;
3272     WLAN_FR_BEACON      sFrame;
3273     BYTE                abyBroadcastAddr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
3274
3275
3276     // prepare beacon frame
3277     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3278     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_BEACON_FR_MAXLEN);
3279     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3280     // Setup the sFrame structure.
3281     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3282     sFrame.len = WLAN_BEACON_FR_MAXLEN;
3283     vMgrEncodeBeacon(&sFrame);
3284     // Setup the header
3285     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3286         (
3287         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3288         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_BEACON)
3289         ));
3290
3291     if (pDevice->bEnablePSMode) {
3292         sFrame.pHdr->sA3.wFrameCtl |= cpu_to_le16((WORD)WLAN_SET_FC_PWRMGT(1));
3293     }
3294
3295     memcpy( sFrame.pHdr->sA3.abyAddr1, abyBroadcastAddr, WLAN_ADDR_LEN);
3296     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3297     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3298     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3299     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3300     // Copy SSID
3301     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3302     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3303     memcpy(sFrame.pSSID,
3304              pCurrSSID,
3305              ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3306             );
3307     // Copy the rate set
3308     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3309     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3310     memcpy(sFrame.pSuppRates,
3311            pCurrSuppRates,
3312            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3313           );
3314     // DS parameter
3315     if (pDevice->byBBType != BB_TYPE_11A) {
3316         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3317         sFrame.len += (1) + WLAN_IEHDR_LEN;
3318         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3319         sFrame.pDSParms->len = 1;
3320         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3321     }
3322     // TIM field
3323     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
3324         sFrame.pTIM = (PWLAN_IE_TIM)(sFrame.pBuf + sFrame.len);
3325         sFrame.pTIM->byElementID = WLAN_EID_TIM;
3326         s_vMgrFormatTIM(pMgmt, sFrame.pTIM);
3327         sFrame.len += (WLAN_IEHDR_LEN + sFrame.pTIM->len);
3328     }
3329
3330     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3331
3332         // IBSS parameter
3333         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3334         sFrame.len += (2) + WLAN_IEHDR_LEN;
3335         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3336         sFrame.pIBSSParms->len = 2;
3337         sFrame.pIBSSParms->wATIMWindow = wCurrATIMWinodw;
3338         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3339             /* RSN parameter */
3340             sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3341             sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3342             sFrame.pRSNWPA->len = 12;
3343             sFrame.pRSNWPA->abyOUI[0] = 0x00;
3344             sFrame.pRSNWPA->abyOUI[1] = 0x50;
3345             sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3346             sFrame.pRSNWPA->abyOUI[3] = 0x01;
3347             sFrame.pRSNWPA->wVersion = 1;
3348             sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3349             sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3350             sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3351             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled)
3352                 sFrame.pRSNWPA->abyMulticast[3] = 0x04;//AES
3353             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled)
3354                 sFrame.pRSNWPA->abyMulticast[3] = 0x02;//TKIP
3355             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled)
3356                 sFrame.pRSNWPA->abyMulticast[3] = 0x01;//WEP40
3357             else
3358                 sFrame.pRSNWPA->abyMulticast[3] = 0x00;//NONE
3359
3360             // Pairwise Key Cipher Suite
3361             sFrame.pRSNWPA->wPKCount = 0;
3362             // Auth Key Management Suite
3363             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3364             sFrame.pRSNWPA->len +=2;
3365
3366             // RSN Capabilites
3367             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3368             sFrame.pRSNWPA->len +=2;
3369             sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3370         }
3371     }
3372
3373
3374     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
3375         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3376         sFrame.len += 1 + WLAN_IEHDR_LEN;
3377         sFrame.pERP->byElementID = WLAN_EID_ERP;
3378         sFrame.pERP->len = 1;
3379         sFrame.pERP->byContext = 0;
3380         if (pDevice->bProtectMode == TRUE)
3381             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3382         if (pDevice->bNonERPPresent == TRUE)
3383             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3384         if (pDevice->bBarkerPreambleMd == TRUE)
3385             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3386     }
3387     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3388         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3389         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3390         memcpy(sFrame.pExtSuppRates,
3391              pCurrExtSuppRates,
3392              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3393              );
3394     }
3395     // hostapd wpa/wpa2 IE
3396     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3397          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3398              if (pMgmt->wWPAIELen != 0) {
3399                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3400                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3401                  sFrame.len += pMgmt->wWPAIELen;
3402              }
3403          }
3404     }
3405
3406     /* Adjust the length fields */
3407     pTxPacket->cbMPDULen = sFrame.len;
3408     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3409
3410     return pTxPacket;
3411 }
3412
3413
3414
3415
3416
3417 /*+
3418  *
3419  * Routine Description:
3420  *  Constructs an Prob-response frame
3421  *
3422  *
3423  * Return Value:
3424  *    PTR to frame; or NULL on allocation failue
3425  *
3426 -*/
3427
3428
3429
3430
3431 PSTxMgmtPacket
3432 s_MgrMakeProbeResponse(
3433     IN PSDevice pDevice,
3434     IN PSMgmtObject pMgmt,
3435     IN WORD wCurrCapInfo,
3436     IN WORD wCurrBeaconPeriod,
3437     IN UINT uCurrChannel,
3438     IN WORD wCurrATIMWinodw,
3439     IN PBYTE pDstAddr,
3440     IN PWLAN_IE_SSID pCurrSSID,
3441     IN PBYTE pCurrBSSID,
3442     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
3443     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
3444     IN BYTE byPHYType
3445     )
3446 {
3447     PSTxMgmtPacket      pTxPacket = NULL;
3448     WLAN_FR_PROBERESP   sFrame;
3449
3450
3451
3452     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3453     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_PROBERESP_FR_MAXLEN);
3454     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3455     // Setup the sFrame structure.
3456     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3457     sFrame.len = WLAN_PROBERESP_FR_MAXLEN;
3458     vMgrEncodeProbeResponse(&sFrame);
3459     // Setup the header
3460     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3461         (
3462         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3463         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_PROBERESP)
3464         ));
3465     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3466     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3467     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3468     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3469     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3470
3471     if (byPHYType == BB_TYPE_11B) {
3472         *sFrame.pwCapInfo &= cpu_to_le16((WORD)~(WLAN_SET_CAP_INFO_SHORTSLOTTIME(1)));
3473     }
3474
3475     // Copy SSID
3476     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3477     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3478     memcpy(sFrame.pSSID,
3479            pCurrSSID,
3480            ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3481            );
3482     // Copy the rate set
3483     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3484
3485     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3486     memcpy(sFrame.pSuppRates,
3487            pCurrSuppRates,
3488            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3489           );
3490
3491     // DS parameter
3492     if (pDevice->byBBType != BB_TYPE_11A) {
3493         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3494         sFrame.len += (1) + WLAN_IEHDR_LEN;
3495         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3496         sFrame.pDSParms->len = 1;
3497         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3498     }
3499
3500     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3501         // IBSS parameter
3502         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3503         sFrame.len += (2) + WLAN_IEHDR_LEN;
3504         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3505         sFrame.pIBSSParms->len = 2;
3506         sFrame.pIBSSParms->wATIMWindow = 0;
3507     }
3508     if (pDevice->byBBType == BB_TYPE_11G) {
3509         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3510         sFrame.len += 1 + WLAN_IEHDR_LEN;
3511         sFrame.pERP->byElementID = WLAN_EID_ERP;
3512         sFrame.pERP->len = 1;
3513         sFrame.pERP->byContext = 0;
3514         if (pDevice->bProtectMode == TRUE)
3515             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3516         if (pDevice->bNonERPPresent == TRUE)
3517             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3518         if (pDevice->bBarkerPreambleMd == TRUE)
3519             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3520     }
3521
3522     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3523         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3524         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3525         memcpy(sFrame.pExtSuppRates,
3526              pCurrExtSuppRates,
3527              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3528              );
3529     }
3530
3531     // hostapd wpa/wpa2 IE
3532     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3533          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3534              if (pMgmt->wWPAIELen != 0) {
3535                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3536                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3537                  sFrame.len += pMgmt->wWPAIELen;
3538              }
3539          }
3540     }
3541
3542     // Adjust the length fields
3543     pTxPacket->cbMPDULen = sFrame.len;
3544     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3545
3546     return pTxPacket;
3547 }
3548
3549
3550
3551 /*+
3552  *
3553  * Routine Description:
3554  *  Constructs an association request frame
3555  *
3556  *
3557  * Return Value:
3558  *    A ptr to frame or NULL on allocation failue
3559  *
3560 -*/
3561
3562
3563 PSTxMgmtPacket
3564 s_MgrMakeAssocRequest(
3565     IN PSDevice pDevice,
3566     IN PSMgmtObject pMgmt,
3567     IN PBYTE pDAddr,
3568     IN WORD wCurrCapInfo,
3569     IN WORD wListenInterval,
3570     IN PWLAN_IE_SSID pCurrSSID,
3571     IN PWLAN_IE_SUPP_RATES pCurrRates,
3572     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3573     )
3574 {
3575     PSTxMgmtPacket      pTxPacket = NULL;
3576     WLAN_FR_ASSOCREQ    sFrame;
3577     PBYTE               pbyIEs;
3578     PBYTE               pbyRSN;
3579
3580
3581     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3582     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3583     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3584     // Setup the sFrame structure.
3585     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3586     sFrame.len = WLAN_ASSOCREQ_FR_MAXLEN;
3587     // format fixed field frame structure
3588     vMgrEncodeAssocRequest(&sFrame);
3589     // Setup the header
3590     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3591         (
3592         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3593         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCREQ)
3594         ));
3595     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3596     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3597     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3598
3599     // Set the capibility and listen interval
3600     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3601     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3602
3603     // sFrame.len point to end of fixed field
3604     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3605     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3606     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3607
3608     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3609     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3610     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3611     memcpy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3612     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3613
3614     // Copy the rate set
3615     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3616     if ((pDevice->byBBType == BB_TYPE_11B) && (pCurrRates->len > 4))
3617         sFrame.len += 4 + WLAN_IEHDR_LEN;
3618     else
3619         sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3620     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3621
3622     // Copy the extension rate set
3623     if ((pDevice->byBBType == BB_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3624         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3625         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3626         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3627     }
3628
3629     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3630     memcpy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3631     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3632
3633
3634     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3635          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3636          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3637         (pMgmt->pCurrBSS != NULL)) {
3638         /* WPA IE */
3639         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3640         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3641         sFrame.pRSNWPA->len = 16;
3642         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3643         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3644         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3645         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3646         sFrame.pRSNWPA->wVersion = 1;
3647         //Group Key Cipher Suite
3648         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3649         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3650         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3651         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3652             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3653         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3654             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3655         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3656             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3657         } else {
3658             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3659         }
3660         // Pairwise Key Cipher Suite
3661         sFrame.pRSNWPA->wPKCount = 1;
3662         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3663         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3664         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3665         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3666             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3667         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3668             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3669         } else {
3670             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3671         }
3672         // Auth Key Management Suite
3673         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3674         *pbyRSN++=0x01;
3675         *pbyRSN++=0x00;
3676         *pbyRSN++=0x00;
3677
3678         *pbyRSN++=0x50;
3679         *pbyRSN++=0xf2;
3680         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3681             *pbyRSN++=WPA_AUTH_PSK;
3682         }
3683         else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3684             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3685         }
3686         else {
3687             *pbyRSN++=WPA_NONE;
3688         }
3689
3690         sFrame.pRSNWPA->len +=6;
3691
3692         // RSN Capabilites
3693
3694         *pbyRSN++=0x00;
3695         *pbyRSN++=0x00;
3696         sFrame.pRSNWPA->len +=2;
3697
3698         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3699         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3700         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3701         memcpy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3702         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3703
3704     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3705                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3706                (pMgmt->pCurrBSS != NULL)) {
3707         UINT                ii;
3708         PWORD               pwPMKID;
3709
3710         // WPA IE
3711         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3712         sFrame.pRSN->byElementID = WLAN_EID_RSN;
3713         sFrame.pRSN->len = 6; //Version(2)+GK(4)
3714         sFrame.pRSN->wVersion = 1;
3715         //Group Key Cipher Suite
3716         sFrame.pRSN->abyRSN[0] = 0x00;
3717         sFrame.pRSN->abyRSN[1] = 0x0F;
3718         sFrame.pRSN->abyRSN[2] = 0xAC;
3719         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3720             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3721         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3722             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3723         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3724             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3725         } else {
3726             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3727         }
3728
3729         // Pairwise Key Cipher Suite
3730         sFrame.pRSN->abyRSN[4] = 1;
3731         sFrame.pRSN->abyRSN[5] = 0;
3732         sFrame.pRSN->abyRSN[6] = 0x00;
3733         sFrame.pRSN->abyRSN[7] = 0x0F;
3734         sFrame.pRSN->abyRSN[8] = 0xAC;
3735         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3736             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3737         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3738             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3739         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3740             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3741         } else {
3742             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3743         }
3744         sFrame.pRSN->len += 6;
3745
3746         // Auth Key Management Suite
3747         sFrame.pRSN->abyRSN[10] = 1;
3748         sFrame.pRSN->abyRSN[11] = 0;
3749         sFrame.pRSN->abyRSN[12] = 0x00;
3750         sFrame.pRSN->abyRSN[13] = 0x0F;
3751         sFrame.pRSN->abyRSN[14] = 0xAC;
3752         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3753             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3754         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3755             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3756         } else {
3757             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3758         }
3759         sFrame.pRSN->len +=6;
3760
3761         // RSN Capabilites
3762         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
3763             memcpy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3764         } else {
3765             sFrame.pRSN->abyRSN[16] = 0;
3766             sFrame.pRSN->abyRSN[17] = 0;
3767         }
3768         sFrame.pRSN->len +=2;
3769
3770         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3771             // RSN PMKID
3772             pbyRSN = &sFrame.pRSN->abyRSN[18];
3773             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
3774             *pwPMKID = 0;            // Initialize PMKID count
3775             pbyRSN += 2;             // Point to PMKID list
3776             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3777                 if ( !memcmp(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, U_ETHER_ADDR_LEN)) {
3778                     (*pwPMKID) ++;
3779                     memcpy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
3780                     pbyRSN += 16;
3781                 }
3782             }
3783             if (*pwPMKID != 0) {
3784                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
3785             }
3786         }
3787
3788         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3789         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3790         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3791         memcpy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3792         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3793     }
3794
3795
3796     // Adjust the length fields
3797     pTxPacket->cbMPDULen = sFrame.len;
3798     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3799     return pTxPacket;
3800 }
3801
3802
3803
3804
3805
3806
3807
3808
3809 /*+
3810  *
3811  * Routine Description:
3812  *  Constructs an re-association request frame
3813  *
3814  *
3815  * Return Value:
3816  *    A ptr to frame or NULL on allocation failue
3817  *
3818 -*/
3819
3820
3821 PSTxMgmtPacket
3822 s_MgrMakeReAssocRequest(
3823     IN PSDevice pDevice,
3824     IN PSMgmtObject pMgmt,
3825     IN PBYTE pDAddr,
3826     IN WORD wCurrCapInfo,
3827     IN WORD wListenInterval,
3828     IN PWLAN_IE_SSID pCurrSSID,
3829     IN PWLAN_IE_SUPP_RATES pCurrRates,
3830     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3831     )
3832 {
3833     PSTxMgmtPacket      pTxPacket = NULL;
3834     WLAN_FR_REASSOCREQ  sFrame;
3835     PBYTE               pbyIEs;
3836     PBYTE               pbyRSN;
3837
3838
3839     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3840     memset( pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_REASSOCREQ_FR_MAXLEN);
3841     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3842     /* Setup the sFrame structure. */
3843     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3844     sFrame.len = WLAN_REASSOCREQ_FR_MAXLEN;
3845
3846     // format fixed field frame structure
3847     vMgrEncodeReassocRequest(&sFrame);
3848
3849     /* Setup the header */
3850     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3851         (
3852         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3853         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCREQ)
3854         ));
3855     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3856     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3857     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3858
3859     /* Set the capibility and listen interval */
3860     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3861     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3862
3863     memcpy(sFrame.pAddrCurrAP, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3864     /* Copy the SSID */
3865     /* sFrame.len point to end of fixed field */
3866     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3867     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3868     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3869
3870     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3871     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3872     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3873     memcpy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3874     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3875
3876     /* Copy the rate set */
3877     /* sFrame.len point to end of SSID */
3878     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3879     sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3880     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3881
3882     // Copy the extension rate set
3883     if ((pMgmt->eCurrentPHYMode == PHY_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3884         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3885         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3886         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3887     }
3888
3889     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3890     memcpy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3891     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3892
3893     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3894          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3895          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3896         (pMgmt->pCurrBSS != NULL)) {
3897         /* WPA IE */
3898         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3899         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3900         sFrame.pRSNWPA->len = 16;
3901         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3902         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3903         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3904         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3905         sFrame.pRSNWPA->wVersion = 1;
3906         //Group Key Cipher Suite
3907         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3908         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3909         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3910         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3911             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3912         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3913             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3914         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3915             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3916         } else {
3917             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3918         }
3919         // Pairwise Key Cipher Suite
3920         sFrame.pRSNWPA->wPKCount = 1;
3921         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3922         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3923         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3924         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3925             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3926         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3927             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3928         } else {
3929             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3930         }
3931         // Auth Key Management Suite
3932         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3933         *pbyRSN++=0x01;
3934         *pbyRSN++=0x00;
3935         *pbyRSN++=0x00;
3936
3937         *pbyRSN++=0x50;
3938         *pbyRSN++=0xf2;
3939         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3940             *pbyRSN++=WPA_AUTH_PSK;
3941         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3942             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3943         } else {
3944             *pbyRSN++=WPA_NONE;
3945         }
3946
3947         sFrame.pRSNWPA->len +=6;
3948
3949         // RSN Capabilites
3950         *pbyRSN++=0x00;
3951         *pbyRSN++=0x00;
3952         sFrame.pRSNWPA->len +=2;
3953
3954         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3955         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3956         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3957         memcpy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3958         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3959
3960     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3961                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3962                (pMgmt->pCurrBSS != NULL)) {
3963         UINT                ii;
3964         PWORD               pwPMKID;
3965
3966         /* WPA IE */
3967         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3968         sFrame.pRSN->byElementID = WLAN_EID_RSN;
3969         sFrame.pRSN->len = 6; //Version(2)+GK(4)
3970         sFrame.pRSN->wVersion = 1;
3971         //Group Key Cipher Suite
3972         sFrame.pRSN->abyRSN[0] = 0x00;
3973         sFrame.pRSN->abyRSN[1] = 0x0F;
3974         sFrame.pRSN->abyRSN[2] = 0xAC;
3975         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3976             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3977         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3978             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3979         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3980             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3981         } else {
3982             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3983         }
3984
3985         // Pairwise Key Cipher Suite
3986         sFrame.pRSN->abyRSN[4] = 1;
3987         sFrame.pRSN->abyRSN[5] = 0;
3988         sFrame.pRSN->abyRSN[6] = 0x00;
3989         sFrame.pRSN->abyRSN[7] = 0x0F;
3990         sFrame.pRSN->abyRSN[8] = 0xAC;
3991         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3992             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3993         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3994             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3995         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3996             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3997         } else {
3998             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3999         }
4000         sFrame.pRSN->len += 6;
4001
4002         // Auth Key Management Suite
4003         sFrame.pRSN->abyRSN[10] = 1;
4004         sFrame.pRSN->abyRSN[11] = 0;
4005         sFrame.pRSN->abyRSN[12] = 0x00;
4006         sFrame.pRSN->abyRSN[13] = 0x0F;
4007         sFrame.pRSN->abyRSN[14] = 0xAC;
4008         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
4009             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
4010         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
4011             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
4012         } else {
4013             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
4014         }
4015         sFrame.pRSN->len +=6;
4016
4017         // RSN Capabilites
4018         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
4019             memcpy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
4020         } else {
4021             sFrame.pRSN->abyRSN[16] = 0;
4022             sFrame.pRSN->abyRSN[17] = 0;
4023         }
4024         sFrame.pRSN->len +=2;
4025
4026         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
4027             // RSN PMKID
4028             pbyRSN = &sFrame.pRSN->abyRSN[18];
4029             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
4030             *pwPMKID = 0;            // Initialize PMKID count
4031             pbyRSN += 2;             // Point to PMKID list
4032             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
4033                 if ( !memcmp(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0], pMgmt->abyCurrBSSID, U_ETHER_ADDR_LEN)) {
4034                     (*pwPMKID) ++;
4035                     memcpy(pbyRSN, pDevice->gsPMKID.BSSIDInfo[ii].PMKID, 16);
4036                     pbyRSN += 16;
4037                 }
4038             }
4039             if (*pwPMKID != 0) {
4040                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
4041             }
4042         }
4043
4044         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4045         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
4046         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4047         memcpy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
4048         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
4049     }
4050
4051
4052
4053     /* Adjust the length fields */
4054     pTxPacket->cbMPDULen = sFrame.len;
4055     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4056
4057     return pTxPacket;
4058 }
4059
4060
4061
4062 /*+
4063  *
4064  * Routine Description:
4065  *  Constructs an assoc-response frame
4066  *
4067  *
4068  * Return Value:
4069  *    PTR to frame; or NULL on allocation failue
4070  *
4071 -*/
4072
4073
4074 PSTxMgmtPacket
4075 s_MgrMakeAssocResponse(
4076     IN PSDevice pDevice,
4077     IN PSMgmtObject pMgmt,
4078     IN WORD wCurrCapInfo,
4079     IN WORD wAssocStatus,
4080     IN WORD wAssocAID,
4081     IN PBYTE pDstAddr,
4082     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
4083     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4084     )
4085 {
4086     PSTxMgmtPacket      pTxPacket = NULL;
4087     WLAN_FR_ASSOCRESP   sFrame;
4088
4089
4090     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4091     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4092     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4093     // Setup the sFrame structure
4094     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4095     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4096     vMgrEncodeAssocResponse(&sFrame);
4097     // Setup the header
4098     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4099         (
4100         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4101         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCRESP)
4102         ));
4103     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4104     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4105     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4106
4107     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4108     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4109     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4110
4111     // Copy the rate set
4112     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4113     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4114     memcpy(sFrame.pSuppRates,
4115            pCurrSuppRates,
4116            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4117           );
4118
4119     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4120         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4121         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4122         memcpy(sFrame.pExtSuppRates,
4123              pCurrExtSuppRates,
4124              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4125              );
4126     }
4127
4128     // Adjust the length fields
4129     pTxPacket->cbMPDULen = sFrame.len;
4130     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4131
4132     return pTxPacket;
4133 }
4134
4135
4136 /*+
4137  *
4138  * Routine Description:
4139  *  Constructs an reassoc-response frame
4140  *
4141  *
4142  * Return Value:
4143  *    PTR to frame; or NULL on allocation failue
4144  *
4145 -*/
4146
4147
4148 PSTxMgmtPacket
4149 s_MgrMakeReAssocResponse(
4150     IN PSDevice pDevice,
4151     IN PSMgmtObject pMgmt,
4152     IN WORD wCurrCapInfo,
4153     IN WORD wAssocStatus,
4154     IN WORD wAssocAID,
4155     IN PBYTE pDstAddr,
4156     IN PWLAN_IE_SUPP_RATES pCurrSuppRates,
4157     IN PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4158     )
4159 {
4160     PSTxMgmtPacket      pTxPacket = NULL;
4161     WLAN_FR_REASSOCRESP   sFrame;
4162
4163
4164     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4165     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4166     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4167     // Setup the sFrame structure
4168     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4169     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4170     vMgrEncodeReassocResponse(&sFrame);
4171     // Setup the header
4172     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4173         (
4174         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4175         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCRESP)
4176         ));
4177     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4178     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4179     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4180
4181     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4182     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4183     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4184
4185     // Copy the rate set
4186     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4187     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4188     memcpy(sFrame.pSuppRates,
4189              pCurrSuppRates,
4190              ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4191              );
4192
4193     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4194         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4195         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4196         memcpy(sFrame.pExtSuppRates,
4197              pCurrExtSuppRates,
4198              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4199              );
4200     }
4201
4202     // Adjust the length fields
4203     pTxPacket->cbMPDULen = sFrame.len;
4204     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4205
4206     return pTxPacket;
4207 }
4208
4209
4210 /*+
4211  *
4212  * Routine Description:
4213  *  Handles probe response management frames.
4214  *
4215  *
4216  * Return Value:
4217  *    none.
4218  *
4219 -*/
4220
4221 static
4222 VOID
4223 s_vMgrRxProbeResponse(
4224     IN PSDevice pDevice,
4225     IN PSMgmtObject pMgmt,
4226     IN PSRxMgmtPacket pRxPacket
4227     )
4228 {
4229     PKnownBSS           pBSSList = NULL;
4230     WLAN_FR_PROBERESP   sFrame;
4231     BYTE                byCurrChannel = pRxPacket->byRxChannel;
4232     ERPObject           sERP;
4233     BOOL                bChannelHit = TRUE;
4234
4235
4236     memset(&sFrame, 0, sizeof(WLAN_FR_PROBERESP));
4237     // decode the frame
4238     sFrame.len = pRxPacket->cbMPDULen;
4239     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4240     vMgrDecodeProbeResponse(&sFrame);
4241
4242     if ((sFrame.pqwTimestamp == 0) ||
4243         (sFrame.pwBeaconInterval == 0) ||
4244         (sFrame.pwCapInfo == 0) ||
4245         (sFrame.pSSID == 0) ||
4246         (sFrame.pSuppRates == 0)) {
4247         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe resp:Fail addr:[%p] \n", pRxPacket->p80211Header);
4248         DBG_PORT80(0xCC);
4249         return;
4250     };
4251
4252     if(sFrame.pSSID->len == 0)
4253        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx Probe resp: SSID len = 0 \n");
4254
4255
4256     //{{ RobertYu:20050201, 11a  byCurrChannel != sFrame.pDSParms->byCurrChannel mapping
4257     if( byCurrChannel > CB_MAX_CHANNEL_24G )
4258     {
4259         if (sFrame.pDSParms != 0) {
4260             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
4261                 bChannelHit = TRUE;
4262             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
4263         } else {
4264             bChannelHit = TRUE;
4265         }
4266
4267     } else {
4268         if (sFrame.pDSParms != 0) {
4269             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
4270                 bChannelHit = TRUE;
4271             byCurrChannel = sFrame.pDSParms->byCurrChannel;
4272         } else {
4273             bChannelHit = TRUE;
4274         }
4275     }
4276     //RobertYu:20050201
4277
4278 //2008-0730-01<Add>by MikeLiu
4279 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
4280       return;
4281
4282     if (sFrame.pERP != NULL) {
4283         sERP.byERP = sFrame.pERP->byContext;
4284         sERP.bERPExist = TRUE;
4285     } else {
4286         sERP.bERPExist = FALSE;
4287         sERP.byERP = 0;
4288     }
4289
4290
4291     // update or insert the bss
4292     pBSSList = BSSpAddrIsInBSSList((HANDLE)pDevice, sFrame.pHdr->sA3.abyAddr3, sFrame.pSSID);
4293     if (pBSSList) {
4294         BSSbUpdateToBSSList((HANDLE)pDevice,
4295                             *sFrame.pqwTimestamp,
4296                             *sFrame.pwBeaconInterval,
4297                             *sFrame.pwCapInfo,
4298                             byCurrChannel,
4299                             bChannelHit,
4300                             sFrame.pSSID,
4301                             sFrame.pSuppRates,
4302                             sFrame.pExtSuppRates,
4303                             &sERP,
4304                             sFrame.pRSN,
4305                             sFrame.pRSNWPA,
4306                             sFrame.pIE_Country,
4307                             sFrame.pIE_Quiet,
4308                             pBSSList,
4309                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4310                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
4311                             (HANDLE)pRxPacket
4312                            );
4313     }
4314     else {
4315         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Probe resp/insert: RxChannel = : %d\n", byCurrChannel);
4316         BSSbInsertToBSSList((HANDLE)pDevice,
4317                             sFrame.pHdr->sA3.abyAddr3,
4318                             *sFrame.pqwTimestamp,
4319                             *sFrame.pwBeaconInterval,
4320                             *sFrame.pwCapInfo,
4321                             byCurrChannel,
4322                             sFrame.pSSID,
4323                             sFrame.pSuppRates,
4324                             sFrame.pExtSuppRates,
4325                             &sERP,
4326                             sFrame.pRSN,
4327                             sFrame.pRSNWPA,
4328                             sFrame.pIE_Country,
4329                             sFrame.pIE_Quiet,
4330                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4331                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
4332                             (HANDLE)pRxPacket
4333                            );
4334     }
4335     return;
4336
4337 }
4338
4339 /*+
4340  *
4341  * Routine Description:(AP)or(Ad-hoc STA)
4342  *  Handles probe request management frames.
4343  *
4344  *
4345  * Return Value:
4346  *    none.
4347  *
4348 -*/
4349
4350
4351 static
4352 VOID
4353 s_vMgrRxProbeRequest(
4354     IN PSDevice pDevice,
4355     IN PSMgmtObject pMgmt,
4356     IN PSRxMgmtPacket pRxPacket
4357     )
4358 {
4359     WLAN_FR_PROBEREQ    sFrame;
4360     CMD_STATUS          Status;
4361     PSTxMgmtPacket      pTxPacket;
4362     BYTE                byPHYType = BB_TYPE_11B;
4363
4364     // STA in Ad-hoc mode: when latest TBTT beacon transmit success,
4365     // STA have to response this request.
4366     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
4367         ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && pDevice->bBeaconSent)) {
4368
4369         memset(&sFrame, 0, sizeof(WLAN_FR_PROBEREQ));
4370         // decode the frame
4371         sFrame.len = pRxPacket->cbMPDULen;
4372         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4373         vMgrDecodeProbeRequest(&sFrame);
4374 /*
4375         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%02x-%02x-%02x=%02x-%02x-%02x \n",
4376                   sFrame.pHdr->sA3.abyAddr2[0],
4377                   sFrame.pHdr->sA3.abyAddr2[1],
4378                   sFrame.pHdr->sA3.abyAddr2[2],
4379                   sFrame.pHdr->sA3.abyAddr2[3],
4380                   sFrame.pHdr->sA3.abyAddr2[4],
4381                   sFrame.pHdr->sA3.abyAddr2[5]
4382                 );
4383 */
4384         if (sFrame.pSSID->len != 0) {
4385             if (sFrame.pSSID->len != ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len)
4386                 return;
4387             if (memcmp(sFrame.pSSID->abySSID,
4388                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
4389                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) != 0) {
4390                        return;
4391             }
4392         }
4393
4394         if ((sFrame.pSuppRates->len > 4) || (sFrame.pExtSuppRates != NULL)) {
4395             byPHYType = BB_TYPE_11G;
4396         }
4397
4398         // Probe response reply..
4399         pTxPacket = s_MgrMakeProbeResponse
4400                     (
4401                       pDevice,
4402                       pMgmt,
4403                       pMgmt->wCurrCapInfo,
4404                       pMgmt->wCurrBeaconPeriod,
4405                       pMgmt->uCurrChannel,
4406                       0,
4407                       sFrame.pHdr->sA3.abyAddr2,
4408                       (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4409                       (PBYTE)pMgmt->abyCurrBSSID,
4410                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4411                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
4412                        byPHYType
4413                     );
4414         if (pTxPacket != NULL ){
4415             /* send the frame */
4416             Status = csMgmt_xmit(pDevice, pTxPacket);
4417             if (Status != CMD_STATUS_PENDING) {
4418                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx failed\n");
4419             }
4420             else {
4421 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx sending..\n");
4422             }
4423         }
4424     }
4425
4426     return;
4427 }
4428
4429
4430
4431
4432
4433 /*+
4434  *
4435  * Routine Description:
4436  *
4437  *  Entry point for the reception and handling of 802.11 management
4438  *  frames. Makes a determination of the frame type and then calls
4439  *  the appropriate function.
4440  *
4441  *
4442  * Return Value:
4443  *    none.
4444  *
4445 -*/
4446
4447
4448 VOID
4449 vMgrRxManagePacket(
4450     IN  HANDLE hDeviceContext,
4451     IN PSMgmtObject pMgmt,
4452     IN PSRxMgmtPacket pRxPacket
4453      )
4454 {
4455     PSDevice    pDevice = (PSDevice)hDeviceContext;
4456     BOOL        bInScan = FALSE;
4457     UINT        uNodeIndex = 0;
4458     NODE_STATE  eNodeState = 0;
4459     CMD_STATUS  Status;
4460
4461
4462     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
4463         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex))
4464             eNodeState = pMgmt->sNodeDBTable[uNodeIndex].eNodeState;
4465     }
4466
4467     switch( WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) ){
4468
4469         case WLAN_FSTYPE_ASSOCREQ:
4470             // Frame Clase = 2
4471             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocreq\n");
4472             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4473                 (eNodeState < NODE_AUTH)) {
4474                 // send deauth notification
4475                 // reason = (6) class 2 received from nonauth sta
4476                 vMgrDeAuthenBeginSta(pDevice,
4477                                      pMgmt,
4478                                      pRxPacket->p80211Header->sA3.abyAddr2,
4479                                      (6),
4480                                      &Status
4481                                      );
4482                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 1\n");
4483             }
4484             else {
4485                 s_vMgrRxAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4486             }
4487             break;
4488
4489         case WLAN_FSTYPE_ASSOCRESP:
4490             // Frame Clase = 2
4491             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp1\n");
4492             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, FALSE);
4493             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp2\n");
4494             break;
4495
4496         case WLAN_FSTYPE_REASSOCREQ:
4497             // Frame Clase = 2
4498             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocreq\n");
4499             // Todo: reassoc
4500             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4501                (eNodeState < NODE_AUTH)) {
4502                 // send deauth notification
4503                 // reason = (6) class 2 received from nonauth sta
4504                 vMgrDeAuthenBeginSta(pDevice,
4505                                      pMgmt,
4506                                      pRxPacket->p80211Header->sA3.abyAddr2,
4507                                      (6),
4508                                      &Status
4509                                      );
4510                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 2\n");
4511
4512             }
4513             s_vMgrRxReAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4514             break;
4515
4516         case WLAN_FSTYPE_REASSOCRESP:
4517             // Frame Clase = 2
4518             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocresp\n");
4519             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, TRUE);
4520             break;
4521
4522         case WLAN_FSTYPE_PROBEREQ:
4523             // Frame Clase = 0
4524             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx probereq\n");
4525             s_vMgrRxProbeRequest(pDevice, pMgmt, pRxPacket);
4526             break;
4527
4528         case WLAN_FSTYPE_PROBERESP:
4529             // Frame Clase = 0
4530             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx proberesp\n");
4531
4532             s_vMgrRxProbeResponse(pDevice, pMgmt, pRxPacket);
4533             break;
4534
4535         case WLAN_FSTYPE_BEACON:
4536             // Frame Clase = 0
4537             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx beacon\n");
4538             if (pMgmt->eScanState != WMAC_NO_SCANNING) {
4539                 bInScan = TRUE;
4540             };
4541             s_vMgrRxBeacon(pDevice, pMgmt, pRxPacket, bInScan);
4542             break;
4543
4544         case WLAN_FSTYPE_ATIM:
4545             // Frame Clase = 1
4546             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx atim\n");
4547             break;
4548
4549         case WLAN_FSTYPE_DISASSOC:
4550             // Frame Clase = 2
4551             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx disassoc\n");
4552             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4553                 (eNodeState < NODE_AUTH)) {
4554                 // send deauth notification
4555                 // reason = (6) class 2 received from nonauth sta
4556                 vMgrDeAuthenBeginSta(pDevice,
4557                                      pMgmt,
4558                                      pRxPacket->p80211Header->sA3.abyAddr2,
4559                                      (6),
4560                                      &Status
4561                                      );
4562                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 3\n");
4563             }
4564             s_vMgrRxDisassociation(pDevice, pMgmt, pRxPacket);
4565             break;
4566
4567         case WLAN_FSTYPE_AUTHEN:
4568             // Frame Clase = 1
4569             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO  "rx authen\n");
4570             s_vMgrRxAuthentication(pDevice, pMgmt, pRxPacket);
4571             break;
4572
4573         case WLAN_FSTYPE_DEAUTHEN:
4574             // Frame Clase = 1
4575             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx deauthen\n");
4576             s_vMgrRxDeauthentication(pDevice, pMgmt, pRxPacket);
4577             break;
4578
4579         default:
4580             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx unknown mgmt\n");
4581     }
4582
4583     return;
4584 }
4585
4586
4587
4588
4589 /*+
4590  *
4591  * Routine Description:
4592  *
4593  *
4594  *  Prepare beacon to send
4595  *
4596  * Return Value:
4597  *    TRUE if success; FALSE if failed.
4598  *
4599 -*/
4600 BOOL
4601 bMgrPrepareBeaconToSend(
4602     IN HANDLE hDeviceContext,
4603     IN PSMgmtObject pMgmt
4604     )
4605 {
4606     PSDevice            pDevice = (PSDevice)hDeviceContext;
4607     PSTxMgmtPacket      pTxPacket;
4608
4609 //    pDevice->bBeaconBufReady = FALSE;
4610     if (pDevice->bEncryptionEnable || pDevice->bEnable8021x){
4611         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
4612     }
4613     else {
4614         pMgmt->wCurrCapInfo &= ~WLAN_SET_CAP_INFO_PRIVACY(1);
4615     }
4616     pTxPacket = s_MgrMakeBeacon
4617                 (
4618                   pDevice,
4619                   pMgmt,
4620                   pMgmt->wCurrCapInfo,
4621                   pMgmt->wCurrBeaconPeriod,
4622                   pMgmt->uCurrChannel,
4623                   pMgmt->wCurrATIMWindow, //0,
4624                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4625                   (PBYTE)pMgmt->abyCurrBSSID,
4626                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4627                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
4628                 );
4629
4630     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) &&
4631         (pMgmt->abyCurrBSSID[0] == 0))
4632         return FALSE;
4633
4634     csBeacon_xmit(pDevice, pTxPacket);
4635     MACvRegBitsOn(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
4636
4637     return TRUE;
4638 }
4639
4640
4641
4642
4643 /*+
4644  *
4645  * Routine Description:
4646  *
4647  *  Log a warning message based on the contents of the Status
4648  *  Code field of an 802.11 management frame.  Defines are
4649  *  derived from 802.11-1997 SPEC.
4650  *
4651  * Return Value:
4652  *    none.
4653  *
4654 -*/
4655 static
4656 VOID
4657 s_vMgrLogStatus(
4658     IN PSMgmtObject pMgmt,
4659     IN WORD  wStatus
4660     )
4661 {
4662     switch( wStatus ){
4663         case WLAN_MGMT_STATUS_UNSPEC_FAILURE:
4664             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Unspecified error.\n");
4665             break;
4666         case WLAN_MGMT_STATUS_CAPS_UNSUPPORTED:
4667             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Can't support all requested capabilities.\n");
4668             break;
4669         case WLAN_MGMT_STATUS_REASSOC_NO_ASSOC:
4670             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Reassoc denied, can't confirm original Association.\n");
4671             break;
4672         case WLAN_MGMT_STATUS_ASSOC_DENIED_UNSPEC:
4673             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, undefine in spec\n");
4674             break;
4675         case WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG:
4676             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Peer doesn't support authen algorithm.\n");
4677             break;
4678         case WLAN_MGMT_STATUS_RX_AUTH_NOSEQ:
4679             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen frame received out of sequence.\n");
4680             break;
4681         case WLAN_MGMT_STATUS_CHALLENGE_FAIL:
4682             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, challenge  failure.\n");
4683             break;
4684         case WLAN_MGMT_STATUS_AUTH_TIMEOUT:
4685             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, timeout waiting for next frame.\n");
4686             break;
4687         case WLAN_MGMT_STATUS_ASSOC_DENIED_BUSY:
4688             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, AP too busy.\n");
4689             break;
4690         case WLAN_MGMT_STATUS_ASSOC_DENIED_RATES:
4691             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we haven't enough basic rates.\n");
4692             break;
4693         case WLAN_MGMT_STATUS_ASSOC_DENIED_SHORTPREAMBLE:
4694             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support short preamble.\n");
4695             break;
4696         case WLAN_MGMT_STATUS_ASSOC_DENIED_PBCC:
4697             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support PBCC.\n");
4698             break;
4699         case WLAN_MGMT_STATUS_ASSOC_DENIED_AGILITY:
4700             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support channel agility.\n");
4701             break;
4702         default:
4703             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Unknown status code %d.\n", wStatus);
4704             break;
4705     }
4706 }
4707
4708
4709 /*
4710  *
4711  * Description:
4712  *    Add BSSID in PMKID Candidate list.
4713  *
4714  * Parameters:
4715  *  In:
4716  *      hDeviceContext - device structure point
4717  *      pbyBSSID - BSSID address for adding
4718  *      wRSNCap - BSS's RSN capability
4719  *  Out:
4720  *      none
4721  *
4722  * Return Value: none.
4723  *
4724 -*/
4725 BOOL
4726 bAdd_PMKID_Candidate (
4727     IN HANDLE    hDeviceContext,
4728     IN PBYTE          pbyBSSID,
4729     IN PSRSNCapObject psRSNCapObj
4730     )
4731 {
4732     PSDevice         pDevice = (PSDevice)hDeviceContext;
4733     PPMKID_CANDIDATE pCandidateList;
4734     UINT             ii = 0;
4735
4736     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate START: (%d)\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4737
4738     if ((pDevice == NULL) || (pbyBSSID == NULL) || (psRSNCapObj == NULL))
4739         return FALSE;
4740
4741     if (pDevice->gsPMKIDCandidate.NumCandidates >= MAX_PMKIDLIST)
4742         return FALSE;
4743
4744
4745
4746     // Update Old Candidate
4747     for (ii = 0; ii < pDevice->gsPMKIDCandidate.NumCandidates; ii++) {
4748         pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[ii];
4749         if ( !memcmp(pCandidateList->BSSID, pbyBSSID, U_ETHER_ADDR_LEN)) {
4750             if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4751                 pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4752             } else {
4753                 pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4754             }
4755             return TRUE;
4756         }
4757     }
4758
4759     // New Candidate
4760     pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[pDevice->gsPMKIDCandidate.NumCandidates];
4761     if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4762         pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4763     } else {
4764         pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4765     }
4766     memcpy(pCandidateList->BSSID, pbyBSSID, U_ETHER_ADDR_LEN);
4767     pDevice->gsPMKIDCandidate.NumCandidates++;
4768     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"NumCandidates:%d\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4769     return TRUE;
4770 }
4771
4772 /*
4773  *
4774  * Description:
4775  *    Flush PMKID Candidate list.
4776  *
4777  * Parameters:
4778  *  In:
4779  *      hDeviceContext - device structure point
4780  *  Out:
4781  *      none
4782  *
4783  * Return Value: none.
4784  *
4785 -*/
4786 VOID
4787 vFlush_PMKID_Candidate (
4788     IN HANDLE hDeviceContext
4789     )
4790 {
4791     PSDevice        pDevice = (PSDevice)hDeviceContext;
4792
4793     if (pDevice == NULL)
4794         return;
4795
4796     memset(&pDevice->gsPMKIDCandidate, 0, sizeof(SPMKIDCandidateEvent));
4797 }
4798
4799 static BOOL
4800 s_bCipherMatch (
4801     IN PKnownBSS                        pBSSNode,
4802     IN NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
4803     OUT PBYTE                           pbyCCSPK,
4804     OUT PBYTE                           pbyCCSGK
4805     )
4806 {
4807     BYTE byMulticastCipher = KEY_CTL_INVALID;
4808     BYTE byCipherMask = 0x00;
4809     int i;
4810
4811     if (pBSSNode == NULL)
4812         return FALSE;
4813
4814     // check cap. of BSS
4815     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4816          (EncStatus == Ndis802_11Encryption1Enabled)) {
4817         // default is WEP only
4818         byMulticastCipher = KEY_CTL_WEP;
4819     }
4820
4821     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4822         (pBSSNode->bWPA2Valid == TRUE) &&
4823           //20080123-01,<Add> by Einsn Liu
4824         ((EncStatus == Ndis802_11Encryption3Enabled)||(EncStatus == Ndis802_11Encryption2Enabled))) {
4825         //WPA2
4826         // check Group Key Cipher
4827         if ((pBSSNode->byCSSGK == WLAN_11i_CSS_WEP40) ||
4828             (pBSSNode->byCSSGK == WLAN_11i_CSS_WEP104)) {
4829             byMulticastCipher = KEY_CTL_WEP;
4830         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_TKIP) {
4831             byMulticastCipher = KEY_CTL_TKIP;
4832         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_CCMP) {
4833             byMulticastCipher = KEY_CTL_CCMP;
4834         } else {
4835             byMulticastCipher = KEY_CTL_INVALID;
4836         }
4837
4838         // check Pairwise Key Cipher
4839         for(i=0;i<pBSSNode->wCSSPKCount;i++) {
4840             if ((pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP40) ||
4841                 (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP104)) {
4842                 // this should not happen as defined 802.11i
4843                 byCipherMask |= 0x01;
4844             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_TKIP) {
4845                 byCipherMask |= 0x02;
4846             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_CCMP) {
4847                 byCipherMask |= 0x04;
4848             } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_USE_GROUP) {
4849                 // use group key only ignore all others
4850                 byCipherMask = 0;
4851                 i = pBSSNode->wCSSPKCount;
4852             }
4853         }
4854
4855     } else if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4856                 (pBSSNode->bWPAValid == TRUE) &&
4857                 ((EncStatus == Ndis802_11Encryption2Enabled) || (EncStatus == Ndis802_11Encryption3Enabled))) {
4858         //WPA
4859         // check Group Key Cipher
4860         if ((pBSSNode->byGKType == WPA_WEP40) ||
4861             (pBSSNode->byGKType == WPA_WEP104)) {
4862             byMulticastCipher = KEY_CTL_WEP;
4863         } else if (pBSSNode->byGKType == WPA_TKIP) {
4864             byMulticastCipher = KEY_CTL_TKIP;
4865         } else if (pBSSNode->byGKType == WPA_AESCCMP) {
4866             byMulticastCipher = KEY_CTL_CCMP;
4867         } else {
4868             byMulticastCipher = KEY_CTL_INVALID;
4869         }
4870
4871         // check Pairwise Key Cipher
4872         for(i=0;i<pBSSNode->wPKCount;i++) {
4873             if (pBSSNode->abyPKType[i] == WPA_TKIP) {
4874                 byCipherMask |= 0x02;
4875             } else if (pBSSNode->abyPKType[i] == WPA_AESCCMP) {
4876                 byCipherMask |= 0x04;
4877             } else if (pBSSNode->abyPKType[i] == WPA_NONE) {
4878                 // use group key only ignore all others
4879                 byCipherMask = 0;
4880                 i = pBSSNode->wPKCount;
4881             }
4882         }
4883     }
4884
4885     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"%d, %d, %d, %d, EncStatus:%d\n",
4886         byMulticastCipher, byCipherMask, pBSSNode->bWPAValid, pBSSNode->bWPA2Valid, EncStatus);
4887
4888     // mask our cap. with BSS
4889     if (EncStatus == Ndis802_11Encryption1Enabled) {
4890
4891         // For supporting Cisco migration mode, don't care pairwise key cipher
4892         //if ((byMulticastCipher == KEY_CTL_WEP) &&
4893         //    (byCipherMask == 0)) {
4894         if ((byMulticastCipher == KEY_CTL_WEP) &&
4895             (byCipherMask == 0)) {
4896             *pbyCCSGK = KEY_CTL_WEP;
4897             *pbyCCSPK = KEY_CTL_NONE;
4898             return TRUE;
4899         } else {
4900             return FALSE;
4901         }
4902
4903     } else if (EncStatus == Ndis802_11Encryption2Enabled) {
4904         if ((byMulticastCipher == KEY_CTL_TKIP) &&
4905             (byCipherMask == 0)) {
4906             *pbyCCSGK = KEY_CTL_TKIP;
4907             *pbyCCSPK = KEY_CTL_NONE;
4908             return TRUE;
4909         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4910                    ((byCipherMask & 0x02) != 0)) {
4911             *pbyCCSGK = KEY_CTL_WEP;
4912             *pbyCCSPK = KEY_CTL_TKIP;
4913             return TRUE;
4914         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4915                    ((byCipherMask & 0x02) != 0)) {
4916             *pbyCCSGK = KEY_CTL_TKIP;
4917             *pbyCCSPK = KEY_CTL_TKIP;
4918             return TRUE;
4919         } else {
4920             return FALSE;
4921         }
4922     } else if (EncStatus == Ndis802_11Encryption3Enabled) {
4923         if ((byMulticastCipher == KEY_CTL_CCMP) &&
4924             (byCipherMask == 0)) {
4925             // When CCMP is enable, "Use group cipher suite" shall not be a valid option.
4926             return FALSE;
4927         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4928                    ((byCipherMask & 0x04) != 0)) {
4929             *pbyCCSGK = KEY_CTL_WEP;
4930             *pbyCCSPK = KEY_CTL_CCMP;
4931             return TRUE;
4932         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4933                    ((byCipherMask & 0x04) != 0)) {
4934             *pbyCCSGK = KEY_CTL_TKIP;
4935             *pbyCCSPK = KEY_CTL_CCMP;
4936             return TRUE;
4937         } else if ((byMulticastCipher == KEY_CTL_CCMP) &&
4938                    ((byCipherMask & 0x04) != 0)) {
4939             *pbyCCSGK = KEY_CTL_CCMP;
4940             *pbyCCSPK = KEY_CTL_CCMP;
4941             return TRUE;
4942         } else {
4943             return FALSE;
4944         }
4945     }
4946     return TRUE;
4947 }
4948
4949