Pileus Git - ~andy/linux/blob - drivers/staging/vt6656/wmgr.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  *
  20  * File: wmgr.c
  21  *
  22  * Purpose: Handles the 802.11 management functions
  23  *
  24  * Author: Lyndon Chen
  25  *
  26  * Date: May 8, 2002
  27  *
  28  * Functions:
  29  *      nsMgrObjectInitial - Initialize Management Objet data structure
  30  *      vMgrObjectReset - Reset Management Object data structure
  31  *      vMgrAssocBeginSta - Start associate function
  32  *      vMgrReAssocBeginSta - Start reassociate function
  33  *      vMgrDisassocBeginSta - Start disassociate function
  34  *      s_vMgrRxAssocRequest - Handle Rcv associate_request
  35  *      s_vMgrRxAssocResponse - Handle Rcv associate_response
  36  *      vMrgAuthenBeginSta - Start authentication function
  37  *      vMgrDeAuthenDeginSta - Start deauthentication function
  38  *      s_vMgrRxAuthentication - Handle Rcv authentication
  39  *      s_vMgrRxAuthenSequence_1 - Handle Rcv authentication sequence 1
  40  *      s_vMgrRxAuthenSequence_2 - Handle Rcv authentication sequence 2
  41  *      s_vMgrRxAuthenSequence_3 - Handle Rcv authentication sequence 3
  42  *      s_vMgrRxAuthenSequence_4 - Handle Rcv authentication sequence 4
  43  *      s_vMgrRxDisassociation - Handle Rcv disassociation
  44  *      s_vMgrRxBeacon - Handle Rcv Beacon
  45  *      vMgrCreateOwnIBSS - Create ad_hoc IBSS or AP BSS
  46  *      vMgrJoinBSSBegin - Join BSS function
  47  *      s_vMgrSynchBSS - Synch & adopt BSS parameters
  48  *      s_MgrMakeBeacon - Create Baecon frame
  49  *      s_MgrMakeProbeResponse - Create Probe Response frame
  50  *      s_MgrMakeAssocRequest - Create Associate Request frame
  51  *      s_MgrMakeReAssocRequest - Create ReAssociate Request frame
  52  *      s_vMgrRxProbeResponse - Handle Rcv probe_response
  53  *      s_vMrgRxProbeRequest - Handle Rcv probe_request
  54  *      bMgrPrepareBeaconToSend - Prepare Beacon frame
  55  *      s_vMgrLogStatus - Log 802.11 Status
  56  *      vMgrRxManagePacket - Rcv management frame dispatch function
  57  *      s_vMgrFormatTIM- Assembler TIM field of beacon
  58  *      vMgrTimerInit- Initial 1-sec and command call back funtions
  59  *
  60  * Revision History:
  61  *
  62  */
  63
  64 #include "tmacro.h"
  65 #include "desc.h"
  66 #include "device.h"
  67 #include "card.h"
  68 #include "80211hdr.h"
  69 #include "80211mgr.h"
  70 #include "wmgr.h"
  71 #include "wcmd.h"
  72 #include "mac.h"
  73 #include "bssdb.h"
  74 #include "power.h"
  75 #include "datarate.h"
  76 #include "baseband.h"
  77 #include "rxtx.h"
  78 #include "wpa.h"
  79 #include "rf.h"
  80 #include "iowpa.h"
  81 #include "control.h"
  82 #include "rndis.h"
  83
  84 /*---------------------  Static Definitions -------------------------*/
  85
  86
  87
  88 /*---------------------  Static Classes  ----------------------------*/
  89
  90 /*---------------------  Static Variables  --------------------------*/
  91 static int          msglevel                =MSG_LEVEL_INFO;
  92 //static int          msglevel                =MSG_LEVEL_DEBUG;
  93
  94 /*---------------------  Static Functions  --------------------------*/
  95
  96 static BOOL ChannelExceedZoneType(
  97      PSDevice pDevice,
  98      BYTE byCurrChannel
  99     );
 100
 101 // Association/diassociation functions
 102 static
 103 PSTxMgmtPacket
 104 s_MgrMakeAssocRequest(
 105      PSDevice pDevice,
 106      PSMgmtObject pMgmt,
 107      PBYTE pDAddr,
 108      WORD wCurrCapInfo,
 109      WORD wListenInterval,
 110      PWLAN_IE_SSID pCurrSSID,
 111      PWLAN_IE_SUPP_RATES pCurrRates,
 112      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 113     );
 114
 115 static
 116 void
 117 s_vMgrRxAssocRequest(
 118      PSDevice pDevice,
 119      PSMgmtObject pMgmt,
 120      PSRxMgmtPacket pRxPacket,
 121      unsigned int  uNodeIndex
 122     );
 123
 124 static
 125 PSTxMgmtPacket
 126 s_MgrMakeReAssocRequest(
 127      PSDevice pDevice,
 128      PSMgmtObject pMgmt,
 129      PBYTE pDAddr,
 130      WORD wCurrCapInfo,
 131      WORD wListenInterval,
 132      PWLAN_IE_SSID pCurrSSID,
 133      PWLAN_IE_SUPP_RATES pCurrRates,
 134      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 135     );
 136
 137 static
 138 void
 139 s_vMgrRxAssocResponse(
 140      PSDevice pDevice,
 141      PSMgmtObject pMgmt,
 142      PSRxMgmtPacket pRxPacket,
 143      BOOL bReAssocType
 144     );
 145
 146 static
 147 void
 148 s_vMgrRxDisassociation(
 149      PSDevice pDevice,
 150      PSMgmtObject pMgmt,
 151      PSRxMgmtPacket pRxPacket
 152     );
 153
 154 // Authentication/deauthen functions
 155 static
 156 void
 157 s_vMgrRxAuthenSequence_1(
 158      PSDevice pDevice,
 159      PSMgmtObject pMgmt,
 160      PWLAN_FR_AUTHEN pFrame
 161     );
 162
 163 static
 164 void
 165 s_vMgrRxAuthenSequence_2(
 166      PSDevice pDevice,
 167      PSMgmtObject pMgmt,
 168      PWLAN_FR_AUTHEN pFrame
 169     );
 170
 171 static
 172 void
 173 s_vMgrRxAuthenSequence_3(
 174      PSDevice pDevice,
 175      PSMgmtObject pMgmt,
 176      PWLAN_FR_AUTHEN pFrame
 177     );
 178
 179 static
 180 void
 181 s_vMgrRxAuthenSequence_4(
 182      PSDevice pDevice,
 183      PSMgmtObject pMgmt,
 184      PWLAN_FR_AUTHEN pFrame
 185     );
 186
 187 static
 188 void
 189 s_vMgrRxAuthentication(
 190      PSDevice pDevice,
 191      PSMgmtObject pMgmt,
 192      PSRxMgmtPacket pRxPacket
 193     );
 194
 195 static
 196 void
 197 s_vMgrRxDeauthentication(
 198      PSDevice pDevice,
 199      PSMgmtObject pMgmt,
 200      PSRxMgmtPacket pRxPacket
 201     );
 202
 203 // Scan functions
 204 // probe request/response functions
 205 static
 206 void
 207 s_vMgrRxProbeRequest(
 208      PSDevice pDevice,
 209      PSMgmtObject pMgmt,
 210      PSRxMgmtPacket pRxPacket
 211     );
 212
 213 static
 214 void
 215 s_vMgrRxProbeResponse(
 216      PSDevice pDevice,
 217      PSMgmtObject pMgmt,
 218      PSRxMgmtPacket pRxPacket
 219     );
 220
 221 // beacon functions
 222 static
 223 void
 224 s_vMgrRxBeacon(
 225      PSDevice pDevice,
 226      PSMgmtObject pMgmt,
 227      PSRxMgmtPacket pRxPacket,
 228      BOOL bInScan
 229     );
 230
 231 static
 232 void
 233 s_vMgrFormatTIM(
 234      PSMgmtObject pMgmt,
 235      PWLAN_IE_TIM pTIM
 236     );
 237
 238 static
 239 PSTxMgmtPacket
 240 s_MgrMakeBeacon(
 241      PSDevice pDevice,
 242      PSMgmtObject pMgmt,
 243      WORD wCurrCapInfo,
 244      WORD wCurrBeaconPeriod,
 245      unsigned int uCurrChannel,
 246      WORD wCurrATIMWinodw,
 247      PWLAN_IE_SSID pCurrSSID,
 248      PBYTE pCurrBSSID,
 249      PWLAN_IE_SUPP_RATES pCurrSuppRates,
 250      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 251     );
 252
 253
 254 // Association response
 255 static
 256 PSTxMgmtPacket
 257 s_MgrMakeAssocResponse(
 258      PSDevice pDevice,
 259      PSMgmtObject pMgmt,
 260      WORD wCurrCapInfo,
 261      WORD wAssocStatus,
 262      WORD wAssocAID,
 263      PBYTE pDstAddr,
 264      PWLAN_IE_SUPP_RATES pCurrSuppRates,
 265      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 266     );
 267
 268 // ReAssociation response
 269 static
 270 PSTxMgmtPacket
 271 s_MgrMakeReAssocResponse(
 272      PSDevice pDevice,
 273      PSMgmtObject pMgmt,
 274      WORD wCurrCapInfo,
 275      WORD wAssocStatus,
 276      WORD wAssocAID,
 277      PBYTE pDstAddr,
 278      PWLAN_IE_SUPP_RATES pCurrSuppRates,
 279      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
 280     );
 281
 282 // Probe response
 283 static
 284 PSTxMgmtPacket
 285 s_MgrMakeProbeResponse(
 286      PSDevice pDevice,
 287      PSMgmtObject pMgmt,
 288      WORD wCurrCapInfo,
 289      WORD wCurrBeaconPeriod,
 290      unsigned int uCurrChannel,
 291      WORD wCurrATIMWinodw,
 292      PBYTE pDstAddr,
 293      PWLAN_IE_SSID pCurrSSID,
 294      PBYTE pCurrBSSID,
 295      PWLAN_IE_SUPP_RATES pCurrSuppRates,
 296      PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
 297      BYTE byPHYType
 298     );
 299
 300 // received status
 301 static
 302 void
 303 s_vMgrLogStatus(
 304      PSMgmtObject pMgmt,
 305      WORD wStatus
 306     );
 307
 308
 309 static
 310 void
 311 s_vMgrSynchBSS (
 312      PSDevice      pDevice,
 313      unsigned int          uBSSMode,
 314      PKnownBSS     pCurr,
 315      PCMD_STATUS  pStatus
 316     );
 317
 318
 319 static BOOL
 320 s_bCipherMatch (
 321      PKnownBSS                        pBSSNode,
 322      NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
 323      PBYTE                           pbyCCSPK,
 324      PBYTE                           pbyCCSGK
 325     );
 326
 327  static void  Encyption_Rebuild(
 328      PSDevice pDevice,
 329      PKnownBSS pCurr
 330  );
 331
 332 /*---------------------  Export Variables  --------------------------*/
 333
 334 /*---------------------  Export Functions  --------------------------*/
 335
 336 /*+
 337  *
 338  * Routine Description:
 339  *    Allocates and initializes the Management object.
 340  *
 341  * Return Value:
 342  *    Ndis_staus.
 343  *
 344 -*/
 345
 346 void vMgrObjectInit(void *hDeviceContext)
 347 {
 348     PSDevice     pDevice = (PSDevice)hDeviceContext;
 349     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
 350     int ii;
 351
 352
 353     pMgmt->pbyPSPacketPool = &pMgmt->byPSPacketPool[0];
 354     pMgmt->pbyMgmtPacketPool = &pMgmt->byMgmtPacketPool[0];
 355     pMgmt->uCurrChannel = pDevice->uChannel;
 356     for (ii = 0; ii < WLAN_BSSID_LEN; ii++)
 357         pMgmt->abyDesireBSSID[ii] = 0xFF;
 358
 359     pMgmt->sAssocInfo.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 360     //memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN +1);
 361     pMgmt->byCSSPK = KEY_CTL_NONE;
 362     pMgmt->byCSSGK = KEY_CTL_NONE;
 363     pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
 364     BSSvClearBSSList((void *) pDevice, FALSE);
 365
 366     init_timer(&pMgmt->sTimerSecondCallback);
 367     pMgmt->sTimerSecondCallback.data = (unsigned long)pDevice;
 368     pMgmt->sTimerSecondCallback.function = (TimerFunction)BSSvSecondCallBack;
 369     pMgmt->sTimerSecondCallback.expires = RUN_AT(HZ);
 370
 371     init_timer(&pDevice->sTimerCommand);
 372     pDevice->sTimerCommand.data = (unsigned long)pDevice;
 373     pDevice->sTimerCommand.function = (TimerFunction)vRunCommand;
 374     pDevice->sTimerCommand.expires = RUN_AT(HZ);
 375
 376     init_timer(&pDevice->sTimerTxData);
 377     pDevice->sTimerTxData.data = (unsigned long)pDevice;
 378     pDevice->sTimerTxData.function = (TimerFunction)BSSvSecondTxData;
 379     pDevice->sTimerTxData.expires = RUN_AT(10*HZ);      //10s callback
 380     pDevice->fTxDataInSleep = FALSE;
 381     pDevice->IsTxDataTrigger = FALSE;
 382     pDevice->nTxDataTimeCout = 0;
 383
 384     pDevice->cbFreeCmdQueue = CMD_Q_SIZE;
 385     pDevice->uCmdDequeueIdx = 0;
 386     pDevice->uCmdEnqueueIdx = 0;
 387     pDevice->eCommandState = WLAN_CMD_IDLE;
 388     pDevice->bCmdRunning = FALSE;
 389     pDevice->bCmdClear = FALSE;
 390
 391     return;
 392 }
 393
 394 /*+
 395  *
 396  * Routine Description:
 397  *    Start the station association procedure.  Namely, send an
 398  *    association request frame to the AP.
 399  *
 400  * Return Value:
 401  *    None.
 402  *
 403 -*/
 404
 405 void vMgrAssocBeginSta(void *hDeviceContext,
 406                        PSMgmtObject pMgmt,
 407                        PCMD_STATUS pStatus)
 408 {
 409     PSDevice             pDevice = (PSDevice)hDeviceContext;
 410     PSTxMgmtPacket          pTxPacket;
 411
 412
 413     pMgmt->wCurrCapInfo = 0;
 414     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 415     if (pDevice->bEncryptionEnable) {
 416         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 417     }
 418     // always allow receive short preamble
 419     //if (pDevice->byPreambleType == 1) {
 420     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 421     //}
 422     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 423     if (pMgmt->wListenInterval == 0)
 424         pMgmt->wListenInterval = 1;    // at least one.
 425
 426     // ERP Phy (802.11g) should support short preamble.
 427     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 428         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 429         if (pDevice->bShortSlotTime == TRUE)
 430             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 431
 432     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 433         if (pDevice->byPreambleType == 1) {
 434             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 435         }
 436     }
 437     if (pMgmt->b11hEnable == TRUE)
 438         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 439
 440     // build an assocreq frame and send it
 441     pTxPacket = s_MgrMakeAssocRequest
 442                 (
 443                   pDevice,
 444                   pMgmt,
 445                   pMgmt->abyCurrBSSID,
 446                   pMgmt->wCurrCapInfo,
 447                   pMgmt->wListenInterval,
 448                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 449                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 450                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 451                 );
 452
 453     if (pTxPacket != NULL ){
 454         // send the frame
 455         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 456         if (*pStatus == CMD_STATUS_PENDING) {
 457             pMgmt->eCurrState = WMAC_STATE_ASSOCPENDING;
 458             *pStatus = CMD_STATUS_SUCCESS;
 459         }
 460     }
 461     else
 462         *pStatus = CMD_STATUS_RESOURCES;
 463
 464     return ;
 465 }
 466
 467
 468 /*+
 469  *
 470  * Routine Description:
 471  *    Start the station re-association procedure.
 472  *
 473  * Return Value:
 474  *    None.
 475  *
 476 -*/
 477
 478 void vMgrReAssocBeginSta(void *hDeviceContext,
 479                          PSMgmtObject pMgmt,
 480                          PCMD_STATUS pStatus)
 481 {
 482     PSDevice             pDevice = (PSDevice)hDeviceContext;
 483     PSTxMgmtPacket          pTxPacket;
 484
 485
 486
 487     pMgmt->wCurrCapInfo = 0;
 488     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
 489     if (pDevice->bEncryptionEnable) {
 490         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
 491     }
 492
 493     //if (pDevice->byPreambleType == 1) {
 494     //    pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 495     //}
 496     pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 497
 498     if (pMgmt->wListenInterval == 0)
 499         pMgmt->wListenInterval = 1;    // at least one.
 500
 501
 502     // ERP Phy (802.11g) should support short preamble.
 503     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
 504         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 505       if (pDevice->bShortSlotTime == TRUE)
 506           pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTSLOTTIME(1);
 507
 508     } else if (pMgmt->eCurrentPHYMode == PHY_TYPE_11B) {
 509         if (pDevice->byPreambleType == 1) {
 510             pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
 511         }
 512     }
 513     if (pMgmt->b11hEnable == TRUE)
 514         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SPECTRUMMNG(1);
 515
 516
 517     pTxPacket = s_MgrMakeReAssocRequest
 518                 (
 519                   pDevice,
 520                   pMgmt,
 521                   pMgmt->abyCurrBSSID,
 522                   pMgmt->wCurrCapInfo,
 523                   pMgmt->wListenInterval,
 524                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
 525                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 526                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 527                 );
 528
 529     if (pTxPacket != NULL ){
 530         // send the frame
 531         *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 532         if (*pStatus != CMD_STATUS_PENDING) {
 533             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx failed.\n");
 534         }
 535         else {
 536             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Reassociation tx sending.\n");
 537         }
 538     }
 539
 540
 541     return ;
 542 }
 543
 544 /*+
 545  *
 546  * Routine Description:
 547  *    Send an dis-association request frame to the AP.
 548  *
 549  * Return Value:
 550  *    None.
 551  *
 552 -*/
 553
 554 void vMgrDisassocBeginSta(void *hDeviceContext,
 555                           PSMgmtObject pMgmt,
 556                           PBYTE  abyDestAddress,
 557                           WORD    wReason,
 558                           PCMD_STATUS pStatus)
 559 {
 560     PSDevice            pDevice = (PSDevice)hDeviceContext;
 561     PSTxMgmtPacket      pTxPacket = NULL;
 562     WLAN_FR_DISASSOC    sFrame;
 563
 564     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
 565     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DISASSOC_FR_MAXLEN);
 566     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
 567
 568     // Setup the sFrame structure
 569     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
 570     sFrame.len = WLAN_DISASSOC_FR_MAXLEN;
 571
 572     // format fixed field frame structure
 573     vMgrEncodeDisassociation(&sFrame);
 574
 575     // Setup the header
 576     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
 577         (
 578         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
 579         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DISASSOC)
 580         ));
 581
 582     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
 583     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
 584     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
 585
 586     // Set reason code
 587     *(sFrame.pwReason) = cpu_to_le16(wReason);
 588     pTxPacket->cbMPDULen = sFrame.len;
 589     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
 590
 591     // send the frame
 592     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
 593     if (*pStatus == CMD_STATUS_PENDING) {
 594         pMgmt->eCurrState = WMAC_STATE_IDLE;
 595         *pStatus = CMD_STATUS_SUCCESS;
 596     }
 597
 598     return;
 599 }
 600
 601
 602
 603 /*+
 604  *
 605  * Routine Description:(AP function)
 606  *    Handle incoming station association request frames.
 607  *
 608  * Return Value:
 609  *    None.
 610  *
 611 -*/
 612
 613 static
 614 void
 615 s_vMgrRxAssocRequest(
 616      PSDevice pDevice,
 617      PSMgmtObject pMgmt,
 618      PSRxMgmtPacket pRxPacket,
 619      unsigned int uNodeIndex
 620     )
 621 {
 622     WLAN_FR_ASSOCREQ    sFrame;
 623     CMD_STATUS          Status;
 624     PSTxMgmtPacket      pTxPacket;
 625     WORD                wAssocStatus = 0;
 626     WORD                wAssocAID = 0;
 627     unsigned int                uRateLen = WLAN_RATES_MAXLEN;
 628     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 629     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 630
 631
 632     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 633         return;
 634     //  node index not found
 635     if (!uNodeIndex)
 636         return;
 637
 638     //check if node is authenticated
 639     //decode the frame
 640     memset(&sFrame, 0, sizeof(WLAN_FR_ASSOCREQ));
 641     memset(abyCurrSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 642     memset(abyCurrExtSuppRates, 0, WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
 643     sFrame.len = pRxPacket->cbMPDULen;
 644     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 645
 646     vMgrDecodeAssocRequest(&sFrame);
 647
 648     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 649         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 650         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 651         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 652         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 653                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 654         // Todo: check sta basic rate, if ap can't support, set status code
 655         if (pDevice->byBBType == BB_TYPE_11B) {
 656             uRateLen = WLAN_RATES_MAXLEN_11B;
 657         }
 658         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 659         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 660                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 661                                          uRateLen);
 662         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 663         if (pDevice->byBBType == BB_TYPE_11G) {
 664             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 665                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 666                                                 uRateLen);
 667         } else {
 668             abyCurrExtSuppRates[1] = 0;
 669         }
 670
 671
 672         RATEvParseMaxRate((void *)pDevice,
 673                            (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 674                            (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 675                            FALSE, // do not change our basic rate
 676                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 677                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 678                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 679                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 680                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 681                           );
 682
 683         // set max tx rate
 684         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 685                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 686         // Todo: check sta preamble, if ap can't support, set status code
 687         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 688                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 689         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 690                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 691         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 692         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 693         wAssocAID = (WORD)uNodeIndex;
 694         // check if ERP support
 695         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 696            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 697
 698         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 699             // B only STA join
 700             pDevice->bProtectMode = TRUE;
 701             pDevice->bNonERPPresent = TRUE;
 702         }
 703         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 704             pDevice->bBarkerPreambleMd = TRUE;
 705         }
 706
 707         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Associate AID= %d \n", wAssocAID);
 708         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 709                    sFrame.pHdr->sA3.abyAddr2[0],
 710                    sFrame.pHdr->sA3.abyAddr2[1],
 711                    sFrame.pHdr->sA3.abyAddr2[2],
 712                    sFrame.pHdr->sA3.abyAddr2[3],
 713                    sFrame.pHdr->sA3.abyAddr2[4],
 714                    sFrame.pHdr->sA3.abyAddr2[5]
 715                   ) ;
 716         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 717                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 718     }
 719
 720
 721     // assoc response reply..
 722     pTxPacket = s_MgrMakeAssocResponse
 723                 (
 724                   pDevice,
 725                   pMgmt,
 726                   pMgmt->wCurrCapInfo,
 727                   wAssocStatus,
 728                   wAssocAID,
 729                   sFrame.pHdr->sA3.abyAddr2,
 730                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 731                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 732                 );
 733     if (pTxPacket != NULL ){
 734
 735         if (pDevice->bEnableHostapd) {
 736             return;
 737         }
 738         /* send the frame */
 739         Status = csMgmt_xmit(pDevice, pTxPacket);
 740         if (Status != CMD_STATUS_PENDING) {
 741             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx failed\n");
 742         }
 743         else {
 744             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Assoc response tx sending..\n");
 745         }
 746
 747     }
 748
 749     return;
 750 }
 751
 752
 753 /*+
 754  *
 755  * Description:(AP function)
 756  *      Handle incoming station re-association request frames.
 757  *
 758  * Parameters:
 759  *  In:
 760  *      pMgmt           - Management Object structure
 761  *      pRxPacket       - Received Packet
 762  *  Out:
 763  *      none
 764  *
 765  * Return Value: None.
 766  *
 767 -*/
 768
 769 static
 770 void
 771 s_vMgrRxReAssocRequest(
 772      PSDevice pDevice,
 773      PSMgmtObject pMgmt,
 774      PSRxMgmtPacket pRxPacket,
 775      unsigned int uNodeIndex
 776     )
 777 {
 778     WLAN_FR_REASSOCREQ    sFrame;
 779     CMD_STATUS          Status;
 780     PSTxMgmtPacket      pTxPacket;
 781     WORD                wAssocStatus = 0;
 782     WORD                wAssocAID = 0;
 783     unsigned int                uRateLen = WLAN_RATES_MAXLEN;
 784     BYTE                abyCurrSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 785     BYTE                abyCurrExtSuppRates[WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1];
 786
 787     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP)
 788         return;
 789     //  node index not found
 790     if (!uNodeIndex)
 791         return;
 792     //check if node is authenticated
 793     //decode the frame
 794     memset(&sFrame, 0, sizeof(WLAN_FR_REASSOCREQ));
 795     sFrame.len = pRxPacket->cbMPDULen;
 796     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 797     vMgrDecodeReassocRequest(&sFrame);
 798
 799     if (pMgmt->sNodeDBTable[uNodeIndex].eNodeState >= NODE_AUTH) {
 800         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_ASSOC;
 801         pMgmt->sNodeDBTable[uNodeIndex].wCapInfo = cpu_to_le16(*sFrame.pwCapInfo);
 802         pMgmt->sNodeDBTable[uNodeIndex].wListenInterval = cpu_to_le16(*sFrame.pwListenInterval);
 803         pMgmt->sNodeDBTable[uNodeIndex].bPSEnable =
 804                 WLAN_GET_FC_PWRMGT(sFrame.pHdr->sA3.wFrameCtl) ? TRUE : FALSE;
 805         // Todo: check sta basic rate, if ap can't support, set status code
 806
 807         if (pDevice->byBBType == BB_TYPE_11B) {
 808             uRateLen = WLAN_RATES_MAXLEN_11B;
 809         }
 810
 811         abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
 812         abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
 813                                          (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 814                                          uRateLen);
 815         abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
 816         if (pDevice->byBBType == BB_TYPE_11G) {
 817             abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pExtSuppRates,
 818                                                 (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 819                                                 uRateLen);
 820         } else {
 821             abyCurrExtSuppRates[1] = 0;
 822         }
 823
 824
 825         RATEvParseMaxRate((void *)pDevice,
 826                           (PWLAN_IE_SUPP_RATES)abyCurrSuppRates,
 827                           (PWLAN_IE_SUPP_RATES)abyCurrExtSuppRates,
 828                            FALSE, // do not change our basic rate
 829                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
 830                            &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
 831                            &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
 832                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
 833                            &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
 834                           );
 835
 836         // set max tx rate
 837         pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate =
 838                 pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
 839         // Todo: check sta preamble, if ap can't support, set status code
 840         pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble =
 841                 WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
 842         pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime =
 843                 WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
 844         pMgmt->sNodeDBTable[uNodeIndex].wAID = (WORD)uNodeIndex;
 845         wAssocStatus = WLAN_MGMT_STATUS_SUCCESS;
 846         wAssocAID = (WORD)uNodeIndex;
 847
 848         // if suppurt ERP
 849         if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
 850            pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
 851
 852         if (pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate <= RATE_11M) {
 853             // B only STA join
 854             pDevice->bProtectMode = TRUE;
 855             pDevice->bNonERPPresent = TRUE;
 856         }
 857         if (pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble == FALSE) {
 858             pDevice->bBarkerPreambleMd = TRUE;
 859         }
 860
 861         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Rx ReAssociate AID= %d \n", wAssocAID);
 862         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "MAC=%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X \n",
 863                    sFrame.pHdr->sA3.abyAddr2[0],
 864                    sFrame.pHdr->sA3.abyAddr2[1],
 865                    sFrame.pHdr->sA3.abyAddr2[2],
 866                    sFrame.pHdr->sA3.abyAddr2[3],
 867                    sFrame.pHdr->sA3.abyAddr2[4],
 868                    sFrame.pHdr->sA3.abyAddr2[5]
 869                   ) ;
 870         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Max Support rate = %d \n",
 871                    pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate);
 872
 873     }
 874
 875
 876     // assoc response reply..
 877     pTxPacket = s_MgrMakeReAssocResponse
 878                 (
 879                   pDevice,
 880                   pMgmt,
 881                   pMgmt->wCurrCapInfo,
 882                   wAssocStatus,
 883                   wAssocAID,
 884                   sFrame.pHdr->sA3.abyAddr2,
 885                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
 886                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
 887                 );
 888
 889     if (pTxPacket != NULL ){
 890         /* send the frame */
 891         if (pDevice->bEnableHostapd) {
 892             return;
 893         }
 894         Status = csMgmt_xmit(pDevice, pTxPacket);
 895         if (Status != CMD_STATUS_PENDING) {
 896             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx failed\n");
 897         }
 898         else {
 899             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:ReAssoc response tx sending..\n");
 900         }
 901     }
 902     return;
 903 }
 904
 905
 906 /*+
 907  *
 908  * Routine Description:
 909  *    Handle incoming association response frames.
 910  *
 911  * Return Value:
 912  *    None.
 913  *
 914 -*/
 915
 916 static
 917 void
 918 s_vMgrRxAssocResponse(
 919      PSDevice pDevice,
 920      PSMgmtObject pMgmt,
 921      PSRxMgmtPacket pRxPacket,
 922      BOOL bReAssocType
 923     )
 924 {
 925     WLAN_FR_ASSOCRESP   sFrame;
 926     PWLAN_IE_SSID   pItemSSID;
 927     PBYTE   pbyIEs;
 928
 929
 930
 931     if (pMgmt->eCurrState == WMAC_STATE_ASSOCPENDING ||
 932          pMgmt->eCurrState == WMAC_STATE_ASSOC) {
 933
 934         sFrame.len = pRxPacket->cbMPDULen;
 935         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
 936         // decode the frame
 937         vMgrDecodeAssocResponse(&sFrame);
 938         if ((sFrame.pwCapInfo == NULL)
 939             || (sFrame.pwStatus == NULL)
 940             || (sFrame.pwAid == NULL)
 941             || (sFrame.pSuppRates == NULL)) {
 942                 DBG_PORT80(0xCC);
 943                 return;
 944         }
 945
 946         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.Capabilities = *(sFrame.pwCapInfo);
 947         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.StatusCode = *(sFrame.pwStatus);
 948         pMgmt->sAssocInfo.AssocInfo.ResponseFixedIEs.AssociationId = *(sFrame.pwAid);
 949         pMgmt->sAssocInfo.AssocInfo.AvailableResponseFixedIEs |= 0x07;
 950
 951         pMgmt->sAssocInfo.AssocInfo.ResponseIELength = sFrame.len - 24 - 6;
 952         pMgmt->sAssocInfo.AssocInfo.OffsetResponseIEs = pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs + pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 953         pbyIEs = pMgmt->sAssocInfo.abyIEs;
 954         pbyIEs += pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 955         memcpy(pbyIEs, (sFrame.pBuf + 24 +6), pMgmt->sAssocInfo.AssocInfo.ResponseIELength);
 956
 957         // save values and set current BSS state
 958         if (cpu_to_le16((*(sFrame.pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
 959             // set AID
 960             pMgmt->wCurrAID = cpu_to_le16((*(sFrame.pwAid)));
 961             if ( (pMgmt->wCurrAID >> 14) != (BIT0 | BIT1) )
 962             {
 963                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "AID from AP, has two msb clear.\n");
 964             }
 965             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Association Successful, AID=%d.\n", pMgmt->wCurrAID & ~(BIT14|BIT15));
 966             pMgmt->eCurrState = WMAC_STATE_ASSOC;
 967             BSSvUpdateAPNode((void *) pDevice,
 968                              sFrame.pwCapInfo,
 969                              sFrame.pSuppRates,
 970                              sFrame.pExtSuppRates);
 971             pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
 972             DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "Link with AP(SSID): %s\n", pItemSSID->abySSID);
 973             pDevice->bLinkPass = TRUE;
 974             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
 975
 976         //if(pDevice->bWPASuppWextEnabled == TRUE)
 977            {
 978                 BYTE buf[512];
 979                 size_t len;
 980                 union iwreq_data  wrqu;
 981                 int we_event;
 982
 983                 memset(buf, 0, 512);
 984
 985                 len = pMgmt->sAssocInfo.AssocInfo.RequestIELength;
 986                 if(len) {
 987                         memcpy(buf, pMgmt->sAssocInfo.abyIEs, len);
 988                         memset(&wrqu, 0, sizeof (wrqu));
 989                         wrqu.data.length = len;
 990                         we_event = IWEVASSOCREQIE;
 991                         PRINT_K("wireless_send_event--->IWEVASSOCREQIE\n");
 992                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
 993                 }
 994
 995                 memset(buf, 0, 512);
 996                 len = pMgmt->sAssocInfo.AssocInfo.ResponseIELength;
 997
 998                 if(len) {
 999                         memcpy(buf, pbyIEs, len);
1000                         memset(&wrqu, 0, sizeof (wrqu));
1001                         wrqu.data.length = len;
1002                         we_event = IWEVASSOCRESPIE;
1003                         PRINT_K("wireless_send_event--->IWEVASSOCRESPIE\n");
1004                         wireless_send_event(pDevice->dev, we_event, &wrqu, buf);
1005                 }
1006
1007            memset(&wrqu, 0, sizeof (wrqu));
1008         memcpy(wrqu.ap_addr.sa_data, &pMgmt->abyCurrBSSID[0], ETH_ALEN);
1009         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1010            PRINT_K("wireless_send_event--->SIOCGIWAP(associated)\n");
1011         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1012
1013         }
1014
1015         }
1016         else {
1017             if (bReAssocType) {
1018                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1019             }
1020             else {
1021                 // jump back to the auth state and indicate the error
1022                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1023             }
1024             s_vMgrLogStatus(pMgmt,cpu_to_le16((*(sFrame.pwStatus))));
1025         }
1026
1027     }
1028
1029 //need clear flags related to Networkmanager
1030               pDevice->bwextstep0 = FALSE;
1031               pDevice->bwextstep1 = FALSE;
1032               pDevice->bwextstep2 = FALSE;
1033               pDevice->bwextstep3 = FALSE;
1034               pDevice->bWPASuppWextEnabled = FALSE;
1035
1036 if(pMgmt->eCurrState == WMAC_STATE_ASSOC)
1037       timer_expire(pDevice->sTimerCommand, 0);
1038
1039     return;
1040 }
1041
1042 /*+
1043  *
1044  * Routine Description:
1045  *    Start the station authentication procedure.  Namely, send an
1046  *    authentication frame to the AP.
1047  *
1048  * Return Value:
1049  *    None.
1050  *
1051 -*/
1052
1053 void vMgrAuthenBeginSta(void *hDeviceContext,
1054                         PSMgmtObject  pMgmt,
1055                         PCMD_STATUS pStatus)
1056 {
1057     PSDevice     pDevice = (PSDevice)hDeviceContext;
1058     WLAN_FR_AUTHEN  sFrame;
1059     PSTxMgmtPacket  pTxPacket = NULL;
1060
1061     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1062     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1063     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1064     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1065     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1066     vMgrEncodeAuthen(&sFrame);
1067     /* insert values */
1068     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1069         (
1070         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1071         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)
1072         ));
1073     memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
1074     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1075     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1076     if (pMgmt->bShareKeyAlgorithm)
1077         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_SHAREDKEY);
1078     else
1079         *(sFrame.pwAuthAlgorithm) = cpu_to_le16(WLAN_AUTH_ALG_OPENSYSTEM);
1080
1081     *(sFrame.pwAuthSequence) = cpu_to_le16(1);
1082     /* Adjust the length fields */
1083     pTxPacket->cbMPDULen = sFrame.len;
1084     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1085
1086     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1087     if (*pStatus == CMD_STATUS_PENDING){
1088         pMgmt->eCurrState = WMAC_STATE_AUTHPENDING;
1089         *pStatus = CMD_STATUS_SUCCESS;
1090     }
1091
1092     return ;
1093 }
1094
1095 /*+
1096  *
1097  * Routine Description:
1098  *    Start the station(AP) deauthentication procedure.  Namely, send an
1099  *    deauthentication frame to the AP or Sta.
1100  *
1101  * Return Value:
1102  *    None.
1103  *
1104 -*/
1105
1106 void vMgrDeAuthenBeginSta(void *hDeviceContext,
1107                           PSMgmtObject pMgmt,
1108                           PBYTE abyDestAddress,
1109                           WORD wReason,
1110                           PCMD_STATUS pStatus)
1111 {
1112     PSDevice            pDevice = (PSDevice)hDeviceContext;
1113     WLAN_FR_DEAUTHEN    sFrame;
1114     PSTxMgmtPacket      pTxPacket = NULL;
1115
1116
1117     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1118     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_DEAUTHEN_FR_MAXLEN);
1119     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1120     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1121     sFrame.len = WLAN_DEAUTHEN_FR_MAXLEN;
1122     vMgrEncodeDeauthen(&sFrame);
1123     /* insert values */
1124     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1125         (
1126         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1127         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_DEAUTHEN)
1128         ));
1129
1130     memcpy( sFrame.pHdr->sA3.abyAddr1, abyDestAddress, WLAN_ADDR_LEN);
1131     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1132     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1133
1134     *(sFrame.pwReason) = cpu_to_le16(wReason);       // deauthen. bcs left BSS
1135     /* Adjust the length fields */
1136     pTxPacket->cbMPDULen = sFrame.len;
1137     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1138
1139     *pStatus = csMgmt_xmit(pDevice, pTxPacket);
1140     if (*pStatus == CMD_STATUS_PENDING){
1141         *pStatus = CMD_STATUS_SUCCESS;
1142     }
1143
1144
1145     return ;
1146 }
1147
1148
1149 /*+
1150  *
1151  * Routine Description:
1152  *    Handle incoming authentication frames.
1153  *
1154  * Return Value:
1155  *    None.
1156  *
1157 -*/
1158
1159 static
1160 void
1161 s_vMgrRxAuthentication(
1162      PSDevice pDevice,
1163      PSMgmtObject pMgmt,
1164      PSRxMgmtPacket pRxPacket
1165     )
1166 {
1167     WLAN_FR_AUTHEN  sFrame;
1168
1169     // we better be an AP or a STA in AUTHPENDING otherwise ignore
1170     if (!(pMgmt->eCurrMode == WMAC_MODE_ESS_AP ||
1171           pMgmt->eCurrState == WMAC_STATE_AUTHPENDING)) {
1172         return;
1173     }
1174
1175     // decode the frame
1176     sFrame.len = pRxPacket->cbMPDULen;
1177     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1178     vMgrDecodeAuthen(&sFrame);
1179     switch (cpu_to_le16((*(sFrame.pwAuthSequence )))){
1180         case 1:
1181             //AP funciton
1182             s_vMgrRxAuthenSequence_1(pDevice,pMgmt, &sFrame);
1183             break;
1184         case 2:
1185             s_vMgrRxAuthenSequence_2(pDevice, pMgmt, &sFrame);
1186             break;
1187         case 3:
1188             //AP funciton
1189             s_vMgrRxAuthenSequence_3(pDevice, pMgmt, &sFrame);
1190             break;
1191         case 4:
1192             s_vMgrRxAuthenSequence_4(pDevice, pMgmt, &sFrame);
1193             break;
1194         default:
1195             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Auth Sequence error, seq = %d\n",
1196                         cpu_to_le16((*(sFrame.pwAuthSequence))));
1197             break;
1198     }
1199     return;
1200 }
1201
1202
1203
1204 /*+
1205  *
1206  * Routine Description:
1207  *   Handles incoming authen frames with sequence 1.  Currently
1208  *   assumes we're an AP.  So far, no one appears to use authentication
1209  *   in Ad-Hoc mode.
1210  *
1211  * Return Value:
1212  *    None.
1213  *
1214 -*/
1215
1216
1217 static
1218 void
1219 s_vMgrRxAuthenSequence_1(
1220      PSDevice pDevice,
1221      PSMgmtObject pMgmt,
1222      PWLAN_FR_AUTHEN pFrame
1223      )
1224 {
1225     PSTxMgmtPacket      pTxPacket = NULL;
1226     unsigned int                uNodeIndex;
1227     WLAN_FR_AUTHEN      sFrame;
1228     PSKeyItem           pTransmitKey;
1229
1230     // Insert a Node entry
1231     if (!BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1232         BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
1233         memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, pFrame->pHdr->sA3.abyAddr2,
1234                WLAN_ADDR_LEN);
1235     }
1236
1237     if (pMgmt->bShareKeyAlgorithm) {
1238         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_KNOWN;
1239         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 1;
1240     }
1241     else {
1242         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1243     }
1244
1245     // send auth reply
1246     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1247     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1248     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1249     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1250     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1251     // format buffer structure
1252     vMgrEncodeAuthen(&sFrame);
1253     // insert values
1254     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1255          (
1256          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1257          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1258          WLAN_SET_FC_ISWEP(0)
1259          ));
1260     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1261     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1262     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1263     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1264     *(sFrame.pwAuthSequence) = cpu_to_le16(2);
1265
1266     if (cpu_to_le16(*(pFrame->pwAuthAlgorithm)) == WLAN_AUTH_ALG_SHAREDKEY) {
1267         if (pMgmt->bShareKeyAlgorithm)
1268             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1269         else
1270             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1271     }
1272     else {
1273         if (pMgmt->bShareKeyAlgorithm)
1274             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG);
1275         else
1276             *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1277     }
1278
1279     if (pMgmt->bShareKeyAlgorithm &&
1280         (cpu_to_le16(*(sFrame.pwStatus)) == WLAN_MGMT_STATUS_SUCCESS)) {
1281
1282         sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1283         sFrame.len += WLAN_CHALLENGE_IE_LEN;
1284         sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1285         sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1286         memset(pMgmt->abyChallenge, 0, WLAN_CHALLENGE_LEN);
1287         // get group key
1288         if(KeybGetTransmitKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, GROUP_KEY, &pTransmitKey) == TRUE) {
1289             rc4_init(&pDevice->SBox, pDevice->abyPRNG, pTransmitKey->uKeyLength+3);
1290             rc4_encrypt(&pDevice->SBox, pMgmt->abyChallenge, pMgmt->abyChallenge, WLAN_CHALLENGE_LEN);
1291         }
1292         memcpy(sFrame.pChallenge->abyChallenge, pMgmt->abyChallenge , WLAN_CHALLENGE_LEN);
1293     }
1294
1295     /* Adjust the length fields */
1296     pTxPacket->cbMPDULen = sFrame.len;
1297     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1298     // send the frame
1299     if (pDevice->bEnableHostapd) {
1300         return;
1301     }
1302     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx.. \n");
1303     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1304         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_1 tx failed.\n");
1305     }
1306     return;
1307 }
1308
1309
1310
1311 /*+
1312  *
1313  * Routine Description:
1314  *   Handles incoming auth frames with sequence number 2.  Currently
1315  *   assumes we're a station.
1316  *
1317  *
1318  * Return Value:
1319  *    None.
1320  *
1321 -*/
1322
1323 static
1324 void
1325 s_vMgrRxAuthenSequence_2(
1326      PSDevice pDevice,
1327      PSMgmtObject pMgmt,
1328      PWLAN_FR_AUTHEN pFrame
1329     )
1330 {
1331     WLAN_FR_AUTHEN      sFrame;
1332     PSTxMgmtPacket      pTxPacket = NULL;
1333
1334
1335     switch (cpu_to_le16((*(pFrame->pwAuthAlgorithm))))
1336     {
1337         case WLAN_AUTH_ALG_OPENSYSTEM:
1338             if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1339                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Successful.\n");
1340                 pMgmt->eCurrState = WMAC_STATE_AUTH;
1341                timer_expire(pDevice->sTimerCommand, 0);
1342             }
1343             else {
1344                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (OPEN) Failed.\n");
1345                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1346                 pMgmt->eCurrState = WMAC_STATE_IDLE;
1347             }
1348             if (pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT) {
1349                 /* spin_unlock_irq(&pDevice->lock);
1350                    vCommandTimerWait((void *) pDevice, 0);
1351                    spin_lock_irq(&pDevice->lock); */
1352             }
1353             break;
1354
1355         case WLAN_AUTH_ALG_SHAREDKEY:
1356
1357             if (cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS) {
1358                 pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1359                 memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1360                 pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1361                 sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1362                 sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1363                 // format buffer structure
1364                 vMgrEncodeAuthen(&sFrame);
1365                 // insert values
1366                 sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1367                      (
1368                      WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1369                      WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1370                      WLAN_SET_FC_ISWEP(1)
1371                      ));
1372                 memcpy( sFrame.pHdr->sA3.abyAddr1, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1373                 memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1374                 memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1375                 *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1376                 *(sFrame.pwAuthSequence) = cpu_to_le16(3);
1377                 *(sFrame.pwStatus) = cpu_to_le16(WLAN_MGMT_STATUS_SUCCESS);
1378                 sFrame.pChallenge = (PWLAN_IE_CHALLENGE)(sFrame.pBuf + sFrame.len);
1379                 sFrame.len += WLAN_CHALLENGE_IE_LEN;
1380                 sFrame.pChallenge->byElementID = WLAN_EID_CHALLENGE;
1381                 sFrame.pChallenge->len = WLAN_CHALLENGE_LEN;
1382                 memcpy( sFrame.pChallenge->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN);
1383                 // Adjust the length fields
1384                 pTxPacket->cbMPDULen = sFrame.len;
1385                 pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1386                 // send the frame
1387                 if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1388                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx failed.\n");
1389                 }
1390                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Auth_reply sequence_2 tx ...\n");
1391             }
1392             else {
1393                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:rx Auth_reply sequence_2 status error ...\n");
1394                 if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1395                         /* spin_unlock_irq(&pDevice->lock);
1396                            vCommandTimerWait((void *) pDevice, 0);
1397                            spin_lock_irq(&pDevice->lock); */
1398                 }
1399                 s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))));
1400             }
1401             break;
1402         default:
1403             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt: rx auth.seq = 2 unknown AuthAlgorithm=%d\n", cpu_to_le16((*(pFrame->pwAuthAlgorithm))));
1404             break;
1405     }
1406     return;
1407 }
1408
1409
1410
1411 /*+
1412  *
1413  * Routine Description:
1414  *   Handles incoming authen frames with sequence 3.  Currently
1415  *   assumes we're an AP.  This function assumes the frame has
1416  *   already been successfully decrypted.
1417  *
1418  *
1419  * Return Value:
1420  *    None.
1421  *
1422 -*/
1423
1424 static
1425 void
1426 s_vMgrRxAuthenSequence_3(
1427      PSDevice pDevice,
1428      PSMgmtObject pMgmt,
1429      PWLAN_FR_AUTHEN pFrame
1430     )
1431 {
1432     PSTxMgmtPacket      pTxPacket = NULL;
1433     unsigned int                uStatusCode = 0 ;
1434     unsigned int                uNodeIndex = 0;
1435     WLAN_FR_AUTHEN      sFrame;
1436
1437     if (!WLAN_GET_FC_ISWEP(pFrame->pHdr->sA3.wFrameCtl)) {
1438         uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1439         goto reply;
1440     }
1441     if (BSSbIsSTAInNodeDB(pDevice, pFrame->pHdr->sA3.abyAddr2, &uNodeIndex)) {
1442          if (pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence != 1) {
1443             uStatusCode = WLAN_MGMT_STATUS_RX_AUTH_NOSEQ;
1444             goto reply;
1445          }
1446          if (memcmp(pMgmt->abyChallenge, pFrame->pChallenge->abyChallenge, WLAN_CHALLENGE_LEN) != 0) {
1447             uStatusCode = WLAN_MGMT_STATUS_CHALLENGE_FAIL;
1448             goto reply;
1449          }
1450     }
1451     else {
1452         uStatusCode = WLAN_MGMT_STATUS_UNSPEC_FAILURE;
1453         goto reply;
1454     }
1455
1456     if (uNodeIndex) {
1457         pMgmt->sNodeDBTable[uNodeIndex].eNodeState = NODE_AUTH;
1458         pMgmt->sNodeDBTable[uNodeIndex].byAuthSequence = 0;
1459     }
1460     uStatusCode = WLAN_MGMT_STATUS_SUCCESS;
1461     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Challenge text check ok..\n");
1462
1463 reply:
1464     // send auth reply
1465     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
1466     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_AUTHEN_FR_MAXLEN);
1467     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
1468     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
1469     sFrame.len = WLAN_AUTHEN_FR_MAXLEN;
1470     // format buffer structure
1471     vMgrEncodeAuthen(&sFrame);
1472     /* insert values */
1473     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
1474          (
1475          WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
1476          WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_AUTHEN)|
1477          WLAN_SET_FC_ISWEP(0)
1478          ));
1479     memcpy( sFrame.pHdr->sA3.abyAddr1, pFrame->pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
1480     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
1481     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
1482     *(sFrame.pwAuthAlgorithm) = *(pFrame->pwAuthAlgorithm);
1483     *(sFrame.pwAuthSequence) = cpu_to_le16(4);
1484     *(sFrame.pwStatus) = cpu_to_le16(uStatusCode);
1485
1486     /* Adjust the length fields */
1487     pTxPacket->cbMPDULen = sFrame.len;
1488     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
1489     // send the frame
1490     if (pDevice->bEnableHostapd) {
1491         return;
1492     }
1493     if (csMgmt_xmit(pDevice, pTxPacket) != CMD_STATUS_PENDING) {
1494         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Authreq_reply sequence_4 tx failed.\n");
1495     }
1496     return;
1497
1498 }
1499
1500
1501
1502 /*+
1503  *
1504  * Routine Description:
1505  *   Handles incoming authen frames with sequence 4
1506  *
1507  *
1508  * Return Value:
1509  *    None.
1510  *
1511 -*/
1512 static
1513 void
1514 s_vMgrRxAuthenSequence_4(
1515      PSDevice pDevice,
1516      PSMgmtObject pMgmt,
1517      PWLAN_FR_AUTHEN pFrame
1518     )
1519 {
1520
1521     if ( cpu_to_le16((*(pFrame->pwStatus))) == WLAN_MGMT_STATUS_SUCCESS ){
1522         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Successful.\n");
1523         pMgmt->eCurrState = WMAC_STATE_AUTH;
1524         timer_expire(pDevice->sTimerCommand, 0);
1525     }
1526     else{
1527         DBG_PRT(MSG_LEVEL_INFO, KERN_INFO "802.11 Authen (SHAREDKEY) Failed.\n");
1528         s_vMgrLogStatus(pMgmt, cpu_to_le16((*(pFrame->pwStatus))) );
1529         pMgmt->eCurrState = WMAC_STATE_IDLE;
1530     }
1531
1532     if ( pDevice->eCommandState == WLAN_AUTHENTICATE_WAIT ) {
1533         /* spin_unlock_irq(&pDevice->lock);
1534            vCommandTimerWait((void *) pDevice, 0);
1535            spin_lock_irq(&pDevice->lock); */
1536     }
1537 }
1538
1539 /*+
1540  *
1541  * Routine Description:
1542  *   Handles incoming disassociation frames
1543  *
1544  *
1545  * Return Value:
1546  *    None.
1547  *
1548 -*/
1549
1550 static
1551 void
1552 s_vMgrRxDisassociation(
1553      PSDevice pDevice,
1554      PSMgmtObject pMgmt,
1555      PSRxMgmtPacket pRxPacket
1556     )
1557 {
1558     WLAN_FR_DISASSOC    sFrame;
1559     unsigned int        uNodeIndex = 0;
1560     CMD_STATUS          CmdStatus;
1561
1562     if ( pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1563         // if is acting an AP..
1564         // a STA is leaving this BSS..
1565         sFrame.len = pRxPacket->cbMPDULen;
1566         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1567         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1568             BSSvRemoveOneNode(pDevice, uNodeIndex);
1569         }
1570         else {
1571             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx disassoc, sta not found\n");
1572         }
1573     }
1574     else if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ){
1575         sFrame.len = pRxPacket->cbMPDULen;
1576         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1577         vMgrDecodeDisassociation(&sFrame);
1578         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP disassociated me, reason=%d.\n", cpu_to_le16(*(sFrame.pwReason)));
1579
1580           pDevice->fWPA_Authened = FALSE;
1581
1582         //TODO: do something let upper layer know or
1583         //try to send associate packet again because of inactivity timeout
1584         if (pMgmt->eCurrState == WMAC_STATE_ASSOC) {
1585                 pDevice->bLinkPass = FALSE;
1586                 pMgmt->sNodeDBTable[0].bActive = FALSE;
1587                pDevice->byReAssocCount = 0;
1588                 pMgmt->eCurrState = WMAC_STATE_AUTH;  // jump back to the auth state!
1589                 pDevice->eCommandState = WLAN_ASSOCIATE_WAIT;
1590             vMgrReAssocBeginSta((PSDevice)pDevice, pMgmt, &CmdStatus);
1591               if(CmdStatus == CMD_STATUS_PENDING) {
1592                   pDevice->byReAssocCount ++;
1593                   return;       //mike add: you'll retry for many times, so it cann't be regarded as disconnected!
1594               }
1595         }
1596
1597   // if(pDevice->bWPASuppWextEnabled == TRUE)
1598       {
1599         union iwreq_data  wrqu;
1600         memset(&wrqu, 0, sizeof (wrqu));
1601         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1602         PRINT_K("wireless_send_event--->SIOCGIWAP(disassociated)\n");
1603         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1604      }
1605     }
1606     /* else, ignore it */
1607
1608     return;
1609 }
1610
1611
1612 /*+
1613  *
1614  * Routine Description:
1615  *   Handles incoming deauthentication frames
1616  *
1617  *
1618  * Return Value:
1619  *    None.
1620  *
1621 -*/
1622
1623 static
1624 void
1625 s_vMgrRxDeauthentication(
1626      PSDevice pDevice,
1627      PSMgmtObject pMgmt,
1628      PSRxMgmtPacket pRxPacket
1629     )
1630 {
1631     WLAN_FR_DEAUTHEN    sFrame;
1632     unsigned int        uNodeIndex = 0;
1633
1634
1635     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP ){
1636         //Todo:
1637         // if is acting an AP..
1638         // a STA is leaving this BSS..
1639         sFrame.len = pRxPacket->cbMPDULen;
1640         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1641         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex)) {
1642             BSSvRemoveOneNode(pDevice, uNodeIndex);
1643         }
1644         else {
1645             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Rx deauth, sta not found\n");
1646         }
1647     }
1648     else {
1649         if (pMgmt->eCurrMode == WMAC_MODE_ESS_STA ) {
1650             sFrame.len = pRxPacket->cbMPDULen;
1651             sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1652             vMgrDecodeDeauthen(&sFrame);
1653            pDevice->fWPA_Authened = FALSE;
1654             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO  "AP deauthed me, reason=%d.\n", cpu_to_le16((*(sFrame.pwReason))));
1655             // TODO: update BSS list for specific BSSID if pre-authentication case
1656             if (!compare_ether_addr(sFrame.pHdr->sA3.abyAddr3,
1657                                     pMgmt->abyCurrBSSID)) {
1658                 if (pMgmt->eCurrState >= WMAC_STATE_AUTHPENDING) {
1659                     pMgmt->sNodeDBTable[0].bActive = FALSE;
1660                     pMgmt->eCurrMode = WMAC_MODE_STANDBY;
1661                     pMgmt->eCurrState = WMAC_STATE_IDLE;
1662                     netif_stop_queue(pDevice->dev);
1663                     pDevice->bLinkPass = FALSE;
1664                     ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_SLOW);
1665                 }
1666             }
1667
1668   // if(pDevice->bWPASuppWextEnabled == TRUE)
1669       {
1670         union iwreq_data  wrqu;
1671         memset(&wrqu, 0, sizeof (wrqu));
1672         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1673         PRINT_K("wireless_send_event--->SIOCGIWAP(disauthen)\n");
1674         wireless_send_event(pDevice->dev, SIOCGIWAP, &wrqu, NULL);
1675      }
1676
1677         }
1678         /* else, ignore it.  TODO: IBSS authentication service
1679             would be implemented here */
1680     };
1681     return;
1682 }
1683
1684 /*+
1685  *
1686  * Routine Description:
1687  * check if current channel is match ZoneType.
1688  *for USA:1~11;
1689  *      Japan:1~13;
1690  *      Europe:1~13
1691  * Return Value:
1692  *               True:exceed;
1693  *                False:normal case
1694 -*/
1695 static BOOL
1696 ChannelExceedZoneType(
1697      PSDevice pDevice,
1698      BYTE byCurrChannel
1699     )
1700 {
1701   BOOL exceed=FALSE;
1702
1703   switch(pDevice->byZoneType) {
1704         case 0x00:                  //USA:1~11
1705                      if((byCurrChannel<1) ||(byCurrChannel>11))
1706                         exceed = TRUE;
1707                  break;
1708         case 0x01:                  //Japan:1~13
1709         case 0x02:                  //Europe:1~13
1710                      if((byCurrChannel<1) ||(byCurrChannel>13))
1711                         exceed = TRUE;
1712                  break;
1713         default:                    //reserve for other zonetype
1714                 break;
1715   }
1716
1717   return exceed;
1718 }
1719
1720 /*+
1721  *
1722  * Routine Description:
1723  *   Handles and analysis incoming beacon frames.
1724  *
1725  *
1726  * Return Value:
1727  *    None.
1728  *
1729 -*/
1730
1731 static
1732 void
1733 s_vMgrRxBeacon(
1734      PSDevice pDevice,
1735      PSMgmtObject pMgmt,
1736      PSRxMgmtPacket pRxPacket,
1737      BOOL bInScan
1738     )
1739 {
1740
1741     PKnownBSS           pBSSList;
1742     WLAN_FR_BEACON      sFrame;
1743     QWORD               qwTSFOffset;
1744     BOOL                bIsBSSIDEqual = FALSE;
1745     BOOL                bIsSSIDEqual = FALSE;
1746     BOOL                bTSFLargeDiff = FALSE;
1747     BOOL                bTSFOffsetPostive = FALSE;
1748     BOOL                bUpdateTSF = FALSE;
1749     BOOL                bIsAPBeacon = FALSE;
1750     BOOL                bIsChannelEqual = FALSE;
1751     unsigned int                uLocateByteIndex;
1752     BYTE                byTIMBitOn = 0;
1753     WORD                wAIDNumber = 0;
1754     unsigned int                uNodeIndex;
1755     QWORD               qwTimestamp, qwLocalTSF;
1756     QWORD               qwCurrTSF;
1757     WORD                wStartIndex = 0;
1758     WORD                wAIDIndex = 0;
1759     BYTE                byCurrChannel = pRxPacket->byRxChannel;
1760     ERPObject           sERP;
1761     unsigned int                uRateLen = WLAN_RATES_MAXLEN;
1762     BOOL                bChannelHit = FALSE;
1763     BYTE                byOldPreambleType;
1764
1765
1766
1767      if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)
1768         return;
1769
1770     memset(&sFrame, 0, sizeof(WLAN_FR_BEACON));
1771     sFrame.len = pRxPacket->cbMPDULen;
1772     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
1773
1774     // decode the beacon frame
1775     vMgrDecodeBeacon(&sFrame);
1776
1777     if ((sFrame.pwBeaconInterval == NULL)
1778         || (sFrame.pwCapInfo == NULL)
1779         || (sFrame.pSSID == NULL)
1780         || (sFrame.pSuppRates == NULL)) {
1781
1782         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx beacon frame error\n");
1783         return;
1784     }
1785
1786     if( byCurrChannel > CB_MAX_CHANNEL_24G )
1787     {
1788         if (sFrame.pDSParms != NULL) {
1789             if (byCurrChannel == RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
1790                 bChannelHit = TRUE;
1791             byCurrChannel = RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
1792         } else {
1793             bChannelHit = TRUE;
1794         }
1795
1796     } else {
1797         if (sFrame.pDSParms != NULL) {
1798             if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
1799                 bChannelHit = TRUE;
1800             byCurrChannel = sFrame.pDSParms->byCurrChannel;
1801         } else {
1802             bChannelHit = TRUE;
1803         }
1804     }
1805
1806 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
1807       return;
1808
1809     if (sFrame.pERP != NULL) {
1810         sERP.byERP = sFrame.pERP->byContext;
1811         sERP.bERPExist = TRUE;
1812
1813     } else {
1814         sERP.bERPExist = FALSE;
1815         sERP.byERP = 0;
1816     }
1817
1818     pBSSList = BSSpAddrIsInBSSList((void *) pDevice,
1819                                    sFrame.pHdr->sA3.abyAddr3,
1820                                    sFrame.pSSID);
1821     if (pBSSList == NULL) {
1822         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon/insert: RxChannel = : %d\n", byCurrChannel);
1823         BSSbInsertToBSSList((void *) pDevice,
1824                             sFrame.pHdr->sA3.abyAddr3,
1825                             *sFrame.pqwTimestamp,
1826                             *sFrame.pwBeaconInterval,
1827                             *sFrame.pwCapInfo,
1828                             byCurrChannel,
1829                             sFrame.pSSID,
1830                             sFrame.pSuppRates,
1831                             sFrame.pExtSuppRates,
1832                             &sERP,
1833                             sFrame.pRSN,
1834                             sFrame.pRSNWPA,
1835                             sFrame.pIE_Country,
1836                             sFrame.pIE_Quiet,
1837                             sFrame.len - WLAN_HDR_ADDR3_LEN,
1838                             sFrame.pHdr->sA4.abyAddr4,   // payload of beacon
1839                             (void *) pRxPacket);
1840     }
1841     else {
1842 //        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"update bcn: RxChannel = : %d\n", byCurrChannel);
1843         BSSbUpdateToBSSList((void *) pDevice,
1844                             *sFrame.pqwTimestamp,
1845                             *sFrame.pwBeaconInterval,
1846                             *sFrame.pwCapInfo,
1847                             byCurrChannel,
1848                             bChannelHit,
1849                             sFrame.pSSID,
1850                             sFrame.pSuppRates,
1851                             sFrame.pExtSuppRates,
1852                             &sERP,
1853                             sFrame.pRSN,
1854                             sFrame.pRSNWPA,
1855                             sFrame.pIE_Country,
1856                             sFrame.pIE_Quiet,
1857                             pBSSList,
1858                             sFrame.len - WLAN_HDR_ADDR3_LEN,
1859                             sFrame.pHdr->sA4.abyAddr4,   // payload of probresponse
1860                             (void *) pRxPacket);
1861
1862     }
1863
1864     if (bInScan) {
1865         return;
1866     }
1867
1868     if(byCurrChannel == (BYTE)pMgmt->uCurrChannel)
1869        bIsChannelEqual = TRUE;
1870
1871     if (bIsChannelEqual && (pMgmt->eCurrMode == WMAC_MODE_ESS_AP)) {
1872
1873         // if rx beacon without ERP field
1874         if (sERP.bERPExist) {
1875             if (WLAN_GET_ERP_USE_PROTECTION(sERP.byERP)){
1876                 pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
1877                 pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
1878             }
1879         }
1880         else {
1881             pDevice->byERPFlag |= WLAN_SET_ERP_USE_PROTECTION(1);
1882             pDevice->wUseProtectCntDown = USE_PROTECT_PERIOD;
1883         }
1884
1885         if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
1886             if(!WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo))
1887                 pDevice->byERPFlag |= WLAN_SET_ERP_BARKER_MODE(1);
1888             if(!sERP.bERPExist)
1889                 pDevice->byERPFlag |= WLAN_SET_ERP_NONERP_PRESENT(1);
1890         }
1891     }
1892
1893     // check if BSSID the same
1894     if (memcmp(sFrame.pHdr->sA3.abyAddr3,
1895                pMgmt->abyCurrBSSID,
1896                WLAN_BSSID_LEN) == 0) {
1897
1898         bIsBSSIDEqual = TRUE;
1899         pDevice->uCurrRSSI = pRxPacket->uRSSI;
1900         pDevice->byCurrSQ = pRxPacket->bySQ;
1901         if (pMgmt->sNodeDBTable[0].uInActiveCount != 0) {
1902             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
1903             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"BCN:Wake Count= [%d]\n", pMgmt->wCountToWakeUp);
1904         }
1905     }
1906     // check if SSID the same
1907     if (sFrame.pSSID->len == ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) {
1908         if (memcmp(sFrame.pSSID->abySSID,
1909                    ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
1910                    sFrame.pSSID->len
1911                    ) == 0) {
1912             bIsSSIDEqual = TRUE;
1913         }
1914     }
1915
1916     if ((WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)== TRUE) &&
1917         (bIsBSSIDEqual == TRUE) &&
1918         (bIsSSIDEqual == TRUE) &&
1919         (pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
1920         (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
1921         // add state check to prevent reconnect fail since we'll receive Beacon
1922
1923         bIsAPBeacon = TRUE;
1924         if (pBSSList != NULL) {
1925
1926                 // Sync ERP field
1927                 if ((pBSSList->sERP.bERPExist == TRUE) && (pDevice->byBBType == BB_TYPE_11G)) {
1928                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
1929                         pDevice->bProtectMode = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
1930                         if (pDevice->bProtectMode) {
1931                             MACvEnableProtectMD(pDevice);
1932                         } else {
1933                             MACvDisableProtectMD(pDevice);
1934                         }
1935                         vUpdateIFS(pDevice);
1936                     }
1937                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
1938                         pDevice->bNonERPPresent = (pBSSList->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
1939                     }
1940                     if ((pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
1941                         pDevice->bBarkerPreambleMd = (pBSSList->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
1942                         //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
1943                         if (pDevice->bBarkerPreambleMd) {
1944                             MACvEnableBarkerPreambleMd(pDevice);
1945                         } else {
1946                             MACvDisableBarkerPreambleMd(pDevice);
1947                         }
1948                     }
1949                 }
1950                 // Sync Short Slot Time
1951                 if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo) != pDevice->bShortSlotTime) {
1952                     BOOL    bShortSlotTime;
1953
1954                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pBSSList->wCapInfo);
1955                     //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
1956                     //Kyle check if it is OK to set G.
1957                     if (pDevice->byBBType == BB_TYPE_11A) {
1958                         bShortSlotTime = TRUE;
1959                     }
1960                     else if (pDevice->byBBType == BB_TYPE_11B) {
1961                         bShortSlotTime = FALSE;
1962                     }
1963                     if (bShortSlotTime != pDevice->bShortSlotTime) {
1964                         pDevice->bShortSlotTime = bShortSlotTime;
1965                         BBvSetShortSlotTime(pDevice);
1966                         vUpdateIFS(pDevice);
1967                     }
1968                 }
1969
1970                 //
1971                 // Preamble may change dynamically
1972                 //
1973                 byOldPreambleType = pDevice->byPreambleType;
1974                 if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pBSSList->wCapInfo)) {
1975                     pDevice->byPreambleType = pDevice->byShortPreamble;
1976                 }
1977                 else {
1978                     pDevice->byPreambleType = 0;
1979                 }
1980                 if (pDevice->byPreambleType != byOldPreambleType)
1981                     CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
1982             //
1983             // Basic Rate Set may change dynamically
1984             //
1985             if (pBSSList->eNetworkTypeInUse == PHY_TYPE_11B) {
1986                 uRateLen = WLAN_RATES_MAXLEN_11B;
1987             }
1988             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abySuppRates,
1989                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
1990                                                     uRateLen);
1991             pMgmt->abyCurrExtSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pBSSList->abyExtSuppRates,
1992                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
1993                                                     uRateLen);
1994             RATEvParseMaxRate((void *)pDevice,
1995                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
1996                                (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
1997                                TRUE,
1998                                &(pMgmt->sNodeDBTable[0].wMaxBasicRate),
1999                                &(pMgmt->sNodeDBTable[0].wMaxSuppRate),
2000                                &(pMgmt->sNodeDBTable[0].wSuppRate),
2001                                &(pMgmt->sNodeDBTable[0].byTopCCKBasicRate),
2002                                &(pMgmt->sNodeDBTable[0].byTopOFDMBasicRate)
2003                               );
2004
2005         }
2006     }
2007
2008 //    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Beacon 2 \n");
2009     // check if CF field exisit
2010     if (WLAN_GET_CAP_INFO_ESS(*sFrame.pwCapInfo)) {
2011         if (sFrame.pCFParms->wCFPDurRemaining > 0) {
2012             // TODO: deal with CFP period to set NAV
2013         }
2014     }
2015
2016     HIDWORD(qwTimestamp) = cpu_to_le32(HIDWORD(*sFrame.pqwTimestamp));
2017     LODWORD(qwTimestamp) = cpu_to_le32(LODWORD(*sFrame.pqwTimestamp));
2018     HIDWORD(qwLocalTSF) = HIDWORD(pRxPacket->qwLocalTSF);
2019     LODWORD(qwLocalTSF) = LODWORD(pRxPacket->qwLocalTSF);
2020
2021     // check if beacon TSF larger or small than our local TSF
2022     if (HIDWORD(qwTimestamp) == HIDWORD(qwLocalTSF)) {
2023         if (LODWORD(qwTimestamp) >= LODWORD(qwLocalTSF)) {
2024             bTSFOffsetPostive = TRUE;
2025         }
2026         else {
2027             bTSFOffsetPostive = FALSE;
2028         }
2029     }
2030     else if (HIDWORD(qwTimestamp) > HIDWORD(qwLocalTSF)) {
2031         bTSFOffsetPostive = TRUE;
2032     }
2033     else if (HIDWORD(qwTimestamp) < HIDWORD(qwLocalTSF)) {
2034         bTSFOffsetPostive = FALSE;
2035     }
2036
2037     if (bTSFOffsetPostive) {
2038         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwTimestamp), (qwLocalTSF));
2039     }
2040     else {
2041         qwTSFOffset = CARDqGetTSFOffset(pRxPacket->byRxRate, (qwLocalTSF), (qwTimestamp));
2042     }
2043
2044     if (HIDWORD(qwTSFOffset) != 0 ||
2045         (LODWORD(qwTSFOffset) > TRIVIAL_SYNC_DIFFERENCE )) {
2046          bTSFLargeDiff = TRUE;
2047     }
2048
2049
2050     // if infra mode
2051     if (bIsAPBeacon == TRUE) {
2052
2053         // Infra mode: Local TSF always follow AP's TSF if Difference huge.
2054         if (bTSFLargeDiff)
2055             bUpdateTSF = TRUE;
2056
2057         if ((pDevice->bEnablePSMode == TRUE) && (sFrame.pTIM)) {
2058
2059                 /* deal with DTIM, analysis TIM */
2060             pMgmt->bMulticastTIM = WLAN_MGMT_IS_MULTICAST_TIM(sFrame.pTIM->byBitMapCtl) ? TRUE : FALSE ;
2061             pMgmt->byDTIMCount = sFrame.pTIM->byDTIMCount;
2062             pMgmt->byDTIMPeriod = sFrame.pTIM->byDTIMPeriod;
2063             wAIDNumber = pMgmt->wCurrAID & ~(BIT14|BIT15);
2064
2065             // check if AID in TIM field bit on
2066             // wStartIndex = N1
2067             wStartIndex = WLAN_MGMT_GET_TIM_OFFSET(sFrame.pTIM->byBitMapCtl) << 1;
2068             // AIDIndex = N2
2069             wAIDIndex = (wAIDNumber >> 3);
2070             if ((wAIDNumber > 0) && (wAIDIndex >= wStartIndex)) {
2071                 uLocateByteIndex = wAIDIndex - wStartIndex;
2072                 // len = byDTIMCount + byDTIMPeriod + byDTIMPeriod + byVirtBitMap[0~250]
2073                 if (sFrame.pTIM->len >= (uLocateByteIndex + 4)) {
2074                     byTIMBitOn  = (0x01) << ((wAIDNumber) % 8);
2075                     pMgmt->bInTIM = sFrame.pTIM->byVirtBitMap[uLocateByteIndex] & byTIMBitOn ? TRUE : FALSE;
2076                 }
2077                 else {
2078                     pMgmt->bInTIM = FALSE;
2079                 };
2080             }
2081             else {
2082                 pMgmt->bInTIM = FALSE;
2083             };
2084
2085             if (pMgmt->bInTIM ||
2086                 (pMgmt->bMulticastTIM && (pMgmt->byDTIMCount == 0))) {
2087                 pMgmt->bInTIMWake = TRUE;
2088                 // send out ps-poll packet
2089 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:In TIM\n");
2090                 if (pMgmt->bInTIM) {
2091                     PSvSendPSPOLL((PSDevice)pDevice);
2092 //                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN:PS-POLL sent..\n");
2093                 }
2094
2095             }
2096             else {
2097                 pMgmt->bInTIMWake = FALSE;
2098                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Not In TIM..\n");
2099                 if (pDevice->bPWBitOn == FALSE) {
2100                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Send Null Packet\n");
2101                     if (PSbSendNullPacket(pDevice))
2102                         pDevice->bPWBitOn = TRUE;
2103                 }
2104                 if(PSbConsiderPowerDown(pDevice, FALSE, FALSE)) {
2105                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BCN: Power down now...\n");
2106                 }
2107             }
2108
2109         }
2110
2111     }
2112     // if adhoc mode
2113     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && !bIsAPBeacon && bIsChannelEqual) {
2114         if (bIsBSSIDEqual) {
2115             // Use sNodeDBTable[0].uInActiveCount as IBSS beacons received count.
2116                     if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
2117                             pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2118
2119             // adhoc mode:TSF updated only when beacon larger then local TSF
2120             if (bTSFLargeDiff && bTSFOffsetPostive &&
2121                 (pMgmt->eCurrState == WMAC_STATE_JOINTED))
2122                 bUpdateTSF = TRUE;
2123
2124             // During dpc, already in spinlocked.
2125             if (BSSbIsSTAInNodeDB(pDevice, sFrame.pHdr->sA3.abyAddr2, &uNodeIndex)) {
2126
2127                 // Update the STA, (Technically the Beacons of all the IBSS nodes
2128                         // should be identical, but that's not happening in practice.
2129                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2130                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2131                                                         WLAN_RATES_MAXLEN_11B);
2132                 RATEvParseMaxRate((void *)pDevice,
2133                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2134                                    NULL,
2135                                    TRUE,
2136                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2137                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2138                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2139                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2140                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2141                                   );
2142                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2143                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2144                 pMgmt->sNodeDBTable[uNodeIndex].uInActiveCount = 0;
2145             }
2146             else {
2147                 // Todo, initial Node content
2148                 BSSvCreateOneNode((PSDevice)pDevice, &uNodeIndex);
2149
2150                 pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2151                                                         (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2152                                                         WLAN_RATES_MAXLEN_11B);
2153                 RATEvParseMaxRate((void *)pDevice,
2154                                    (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2155                                    NULL,
2156                                    TRUE,
2157                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxBasicRate),
2158                                    &(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate),
2159                                    &(pMgmt->sNodeDBTable[uNodeIndex].wSuppRate),
2160                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopCCKBasicRate),
2161                                    &(pMgmt->sNodeDBTable[uNodeIndex].byTopOFDMBasicRate)
2162                                  );
2163
2164                 memcpy(pMgmt->sNodeDBTable[uNodeIndex].abyMACAddr, sFrame.pHdr->sA3.abyAddr2, WLAN_ADDR_LEN);
2165                 pMgmt->sNodeDBTable[uNodeIndex].bShortPreamble = WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo);
2166                 pMgmt->sNodeDBTable[uNodeIndex].wTxDataRate = pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate;
2167 /*
2168                 pMgmt->sNodeDBTable[uNodeIndex].bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(*sFrame.pwCapInfo);
2169                 if(pMgmt->sNodeDBTable[uNodeIndex].wMaxSuppRate > RATE_11M)
2170                        pMgmt->sNodeDBTable[uNodeIndex].bERPExist = TRUE;
2171 */
2172             }
2173
2174             // if other stations jointed, indicate connect to upper layer..
2175             if (pMgmt->eCurrState == WMAC_STATE_STARTED) {
2176                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Current IBSS State: [Started]........to: [Jointed] \n");
2177                 pMgmt->eCurrState = WMAC_STATE_JOINTED;
2178                 pDevice->bLinkPass = TRUE;
2179                 ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2180                 if (netif_queue_stopped(pDevice->dev)){
2181                     netif_wake_queue(pDevice->dev);
2182                 }
2183                 pMgmt->sNodeDBTable[0].bActive = TRUE;
2184                 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
2185
2186             }
2187         }
2188         else if (bIsSSIDEqual) {
2189
2190             // See other adhoc sta with the same SSID but BSSID is different.
2191             // adpot this vars only when TSF larger then us.
2192             if (bTSFLargeDiff && bTSFOffsetPostive) {
2193                  // we don't support ATIM under adhoc mode
2194                // if ( sFrame.pIBSSParms->wATIMWindow == 0) {
2195                      // adpot this vars
2196                      // TODO: check sFrame cap if privacy on, and support rate syn
2197                      memcpy(pMgmt->abyCurrBSSID, sFrame.pHdr->sA3.abyAddr3, WLAN_BSSID_LEN);
2198                      memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
2199                      pMgmt->wCurrATIMWindow = cpu_to_le16(sFrame.pIBSSParms->wATIMWindow);
2200                      pMgmt->wCurrBeaconPeriod = cpu_to_le16(*sFrame.pwBeaconInterval);
2201                      pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)sFrame.pSuppRates,
2202                                                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2203                                                       WLAN_RATES_MAXLEN_11B);
2204                      // set HW beacon interval and re-synchronizing....
2205                      DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rejoining to Other Adhoc group with same SSID........\n");
2206
2207                      MACvWriteBeaconInterval(pDevice, pMgmt->wCurrBeaconPeriod);
2208                      CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp, pRxPacket->qwLocalTSF);
2209                      CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2210
2211                      // Turn off bssid filter to avoid filter others adhoc station which bssid is different.
2212                      MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2213
2214                     byOldPreambleType = pDevice->byPreambleType;
2215                     if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(*sFrame.pwCapInfo)) {
2216                         pDevice->byPreambleType = pDevice->byShortPreamble;
2217                     }
2218                     else {
2219                         pDevice->byPreambleType = 0;
2220                     }
2221                     if (pDevice->byPreambleType != byOldPreambleType)
2222                         CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2223
2224
2225                      // MACvRegBitsOff(pDevice->PortOffset, MAC_REG_RCR, RCR_BSSID);
2226                      // set highest basic rate
2227                      // s_vSetHighestBasicRate(pDevice, (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates);
2228                      // Prepare beacon frame
2229                         bMgrPrepareBeaconToSend((void *) pDevice, pMgmt);
2230               //  }
2231             }
2232         }
2233     }
2234     // endian issue ???
2235     // Update TSF
2236     if (bUpdateTSF) {
2237         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2238         CARDvAdjustTSF(pDevice, pRxPacket->byRxRate, qwTimestamp , pRxPacket->qwLocalTSF);
2239         CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2240         CARDvUpdateNextTBTT(pDevice, qwTimestamp, pMgmt->wCurrBeaconPeriod);
2241     }
2242
2243     return;
2244 }
2245
2246 /*+
2247  *
2248  * Routine Description:
2249  *   Instructs the hw to create a bss using the supplied
2250  *   attributes. Note that this implementation only supports Ad-Hoc
2251  *   BSS creation.
2252  *
2253  *
2254  * Return Value:
2255  *    CMD_STATUS
2256  *
2257 -*/
2258
2259 void vMgrCreateOwnIBSS(void *hDeviceContext,
2260                        PCMD_STATUS pStatus)
2261 {
2262     PSDevice            pDevice = (PSDevice)hDeviceContext;
2263     PSMgmtObject        pMgmt = &(pDevice->sMgmtObj);
2264     WORD                wMaxBasicRate;
2265     WORD                wMaxSuppRate;
2266     BYTE                byTopCCKBasicRate;
2267     BYTE                byTopOFDMBasicRate;
2268     QWORD               qwCurrTSF;
2269     unsigned int                ii;
2270     BYTE    abyRATE[] = {0x82, 0x84, 0x8B, 0x96, 0x24, 0x30, 0x48, 0x6C, 0x0C, 0x12, 0x18, 0x60};
2271     BYTE    abyCCK_RATE[] = {0x82, 0x84, 0x8B, 0x96};
2272     BYTE    abyOFDM_RATE[] = {0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2273     WORD                wSuppRate;
2274
2275
2276
2277     HIDWORD(qwCurrTSF) = 0;
2278     LODWORD(qwCurrTSF) = 0;
2279
2280     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Create Basic Service Set .......\n");
2281
2282     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2283         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) &&
2284             (pDevice->eEncryptionStatus != Ndis802_11Encryption2Enabled) &&
2285             (pDevice->eEncryptionStatus != Ndis802_11Encryption3Enabled)) {
2286             // encryption mode error
2287             *pStatus = CMD_STATUS_FAILURE;
2288             return;
2289         }
2290     }
2291
2292     pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2293     pMgmt->abyCurrExtSuppRates[0] = WLAN_EID_EXTSUPP_RATES;
2294
2295     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2296         pMgmt->eCurrentPHYMode = pMgmt->byAPBBType;
2297     } else {
2298         if (pDevice->byBBType == BB_TYPE_11G)
2299             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
2300         if (pDevice->byBBType == BB_TYPE_11B)
2301             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
2302         if (pDevice->byBBType == BB_TYPE_11A)
2303             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
2304     }
2305
2306     if (pMgmt->eCurrentPHYMode != PHY_TYPE_11A) {
2307         pMgmt->abyCurrSuppRates[1] = WLAN_RATES_MAXLEN_11B;
2308         pMgmt->abyCurrExtSuppRates[1] = 0;
2309         for (ii = 0; ii < 4; ii++)
2310             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2311     } else {
2312         pMgmt->abyCurrSuppRates[1] = 8;
2313         pMgmt->abyCurrExtSuppRates[1] = 0;
2314         for (ii = 0; ii < 8; ii++)
2315             pMgmt->abyCurrSuppRates[2+ii] = abyRATE[ii];
2316     }
2317
2318
2319     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
2320         pMgmt->abyCurrSuppRates[1] = 8;
2321         pMgmt->abyCurrExtSuppRates[1] = 4;
2322         for (ii = 0; ii < 4; ii++)
2323             pMgmt->abyCurrSuppRates[2+ii] =  abyCCK_RATE[ii];
2324         for (ii = 4; ii < 8; ii++)
2325             pMgmt->abyCurrSuppRates[2+ii] =  abyOFDM_RATE[ii-4];
2326         for (ii = 0; ii < 4; ii++)
2327             pMgmt->abyCurrExtSuppRates[2+ii] =  abyOFDM_RATE[ii+4];
2328     }
2329
2330
2331     // Disable Protect Mode
2332     pDevice->bProtectMode = 0;
2333     MACvDisableProtectMD(pDevice);
2334
2335     pDevice->bBarkerPreambleMd = 0;
2336     MACvDisableBarkerPreambleMd(pDevice);
2337
2338     // Kyle Test 2003.11.04
2339
2340     // set HW beacon interval
2341     if (pMgmt->wIBSSBeaconPeriod == 0)
2342         pMgmt->wIBSSBeaconPeriod = DEFAULT_IBSS_BI;
2343     MACvWriteBeaconInterval(pDevice, pMgmt->wIBSSBeaconPeriod);
2344
2345     CARDbGetCurrentTSF(pDevice, &qwCurrTSF);
2346     // clear TSF counter
2347     CARDbClearCurrentTSF(pDevice);
2348
2349     // enable TSF counter
2350     MACvRegBitsOn(pDevice,MAC_REG_TFTCTL,TFTCTL_TSFCNTREN);
2351     // set Next TBTT
2352     CARDvSetFirstNextTBTT(pDevice, pMgmt->wIBSSBeaconPeriod);
2353
2354     pMgmt->uIBSSChannel = pDevice->uChannel;
2355
2356     if (pMgmt->uIBSSChannel == 0)
2357         pMgmt->uIBSSChannel = DEFAULT_IBSS_CHANNEL;
2358
2359     // set channel and clear NAV
2360     CARDbSetMediaChannel(pDevice, pMgmt->uIBSSChannel);
2361     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2362
2363     pDevice->byPreambleType = pDevice->byShortPreamble;
2364
2365     // set basic rate
2366
2367     RATEvParseMaxRate((void *)pDevice,
2368                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2369                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates, TRUE,
2370                       &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2371                       &byTopCCKBasicRate, &byTopOFDMBasicRate);
2372
2373
2374
2375     if (pDevice->byBBType == BB_TYPE_11A) {
2376         pDevice->bShortSlotTime = TRUE;
2377     } else {
2378         pDevice->bShortSlotTime = FALSE;
2379     }
2380     BBvSetShortSlotTime(pDevice);
2381     // vUpdateIFS() use pDevice->bShortSlotTime as parameter so it must be called
2382     // after setting ShortSlotTime.
2383     // CARDvSetBSSMode call vUpdateIFS()
2384     CARDvSetBSSMode(pDevice);
2385
2386     if (pMgmt->eConfigMode == WMAC_CONFIG_AP) {
2387         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_AP);
2388         pMgmt->eCurrMode = WMAC_MODE_ESS_AP;
2389     }
2390
2391     if (pMgmt->eConfigMode == WMAC_CONFIG_IBSS_STA) {
2392         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
2393         pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2394     }
2395
2396     // Adopt pre-configured IBSS vars to current vars
2397     pMgmt->eCurrState = WMAC_STATE_STARTED;
2398     pMgmt->wCurrBeaconPeriod = pMgmt->wIBSSBeaconPeriod;
2399     pMgmt->uCurrChannel = pMgmt->uIBSSChannel;
2400     pMgmt->wCurrATIMWindow = pMgmt->wIBSSATIMWindow;
2401     pDevice->uCurrRSSI = 0;
2402     pDevice->byCurrSQ = 0;
2403
2404     memcpy(pMgmt->abyDesireSSID,pMgmt->abyAdHocSSID,
2405                       ((PWLAN_IE_SSID)pMgmt->abyAdHocSSID)->len + WLAN_IEHDR_LEN);
2406
2407     memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2408     memcpy(pMgmt->abyCurrSSID,
2409            pMgmt->abyDesireSSID,
2410            ((PWLAN_IE_SSID)pMgmt->abyDesireSSID)->len + WLAN_IEHDR_LEN
2411           );
2412
2413     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2414         // AP mode BSSID = MAC addr
2415         memcpy(pMgmt->abyCurrBSSID, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
2416                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"AP beacon created BSSID:"
2417                         "%pM\n", pMgmt->abyCurrBSSID);
2418     }
2419
2420     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2421
2422         // BSSID selected must be randomized as spec 11.1.3
2423         pMgmt->abyCurrBSSID[5] = (BYTE) (LODWORD(qwCurrTSF)& 0x000000ff);
2424         pMgmt->abyCurrBSSID[4] = (BYTE)((LODWORD(qwCurrTSF)& 0x0000ff00) >> 8);
2425         pMgmt->abyCurrBSSID[3] = (BYTE)((LODWORD(qwCurrTSF)& 0x00ff0000) >> 16);
2426         pMgmt->abyCurrBSSID[2] = (BYTE)((LODWORD(qwCurrTSF)& 0x00000ff0) >> 4);
2427         pMgmt->abyCurrBSSID[1] = (BYTE)((LODWORD(qwCurrTSF)& 0x000ff000) >> 12);
2428         pMgmt->abyCurrBSSID[0] = (BYTE)((LODWORD(qwCurrTSF)& 0x0ff00000) >> 20);
2429         pMgmt->abyCurrBSSID[5] ^= pMgmt->abyMACAddr[0];
2430         pMgmt->abyCurrBSSID[4] ^= pMgmt->abyMACAddr[1];
2431         pMgmt->abyCurrBSSID[3] ^= pMgmt->abyMACAddr[2];
2432         pMgmt->abyCurrBSSID[2] ^= pMgmt->abyMACAddr[3];
2433         pMgmt->abyCurrBSSID[1] ^= pMgmt->abyMACAddr[4];
2434         pMgmt->abyCurrBSSID[0] ^= pMgmt->abyMACAddr[5];
2435         pMgmt->abyCurrBSSID[0] &= ~IEEE_ADDR_GROUP;
2436         pMgmt->abyCurrBSSID[0] |= IEEE_ADDR_UNIVERSAL;
2437
2438
2439                 DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"Adhoc beacon created bssid:"
2440                         "%pM\n", pMgmt->abyCurrBSSID);
2441     }
2442
2443     // set BSSID filter
2444     MACvWriteBSSIDAddress(pDevice, pMgmt->abyCurrBSSID);
2445     memcpy(pDevice->abyBSSID, pMgmt->abyCurrBSSID, WLAN_ADDR_LEN);
2446
2447     MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
2448     pDevice->byRxMode |= RCR_BSSID;
2449     pMgmt->bCurrBSSIDFilterOn = TRUE;
2450
2451     // Set Capability Info
2452     pMgmt->wCurrCapInfo = 0;
2453
2454     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
2455         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_ESS(1);
2456         pMgmt->byDTIMPeriod = DEFAULT_DTIM_PERIOD;
2457         pMgmt->byDTIMCount = pMgmt->byDTIMPeriod - 1;
2458         pDevice->eOPMode = OP_MODE_AP;
2459     }
2460
2461     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2462         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_IBSS(1);
2463         pDevice->eOPMode = OP_MODE_ADHOC;
2464     }
2465
2466     if (pDevice->bEncryptionEnable) {
2467         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
2468         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2469             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2470                 pMgmt->byCSSPK = KEY_CTL_CCMP;
2471                 pMgmt->byCSSGK = KEY_CTL_CCMP;
2472             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2473                 pMgmt->byCSSPK = KEY_CTL_TKIP;
2474                 pMgmt->byCSSGK = KEY_CTL_TKIP;
2475             } else {
2476                 pMgmt->byCSSPK = KEY_CTL_NONE;
2477                 pMgmt->byCSSGK = KEY_CTL_WEP;
2478             }
2479         } else {
2480             pMgmt->byCSSPK = KEY_CTL_WEP;
2481             pMgmt->byCSSGK = KEY_CTL_WEP;
2482         }
2483     }
2484
2485     pMgmt->byERPContext = 0;
2486
2487     if (pDevice->byPreambleType == 1) {
2488         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_SHORTPREAMBLE(1);
2489     } else {
2490         pMgmt->wCurrCapInfo &= (~WLAN_SET_CAP_INFO_SHORTPREAMBLE(1));
2491     }
2492
2493     pMgmt->eCurrState = WMAC_STATE_STARTED;
2494     // Prepare beacon to send
2495     if (bMgrPrepareBeaconToSend((void *) pDevice, pMgmt))
2496         *pStatus = CMD_STATUS_SUCCESS;
2497
2498     return;
2499 }
2500
2501 /*+
2502  *
2503  * Routine Description:
2504  *   Instructs wmac to join a bss using the supplied attributes.
2505  *   The arguments may the BSSID or SSID and the rest of the
2506  *   attributes are obtained from the scan result of known bss list.
2507  *
2508  *
2509  * Return Value:
2510  *    None.
2511  *
2512 -*/
2513
2514 void vMgrJoinBSSBegin(void *hDeviceContext, PCMD_STATUS pStatus)
2515 {
2516     PSDevice     pDevice = (PSDevice)hDeviceContext;
2517     PSMgmtObject    pMgmt = &(pDevice->sMgmtObj);
2518     PKnownBSS       pCurr = NULL;
2519     unsigned int            ii, uu;
2520     PWLAN_IE_SUPP_RATES pItemRates = NULL;
2521     PWLAN_IE_SUPP_RATES pItemExtRates = NULL;
2522     PWLAN_IE_SSID   pItemSSID;
2523     unsigned int            uRateLen = WLAN_RATES_MAXLEN;
2524     WORD            wMaxBasicRate = RATE_1M;
2525     WORD            wMaxSuppRate = RATE_1M;
2526     WORD            wSuppRate;
2527     BYTE            byTopCCKBasicRate = RATE_1M;
2528     BYTE            byTopOFDMBasicRate = RATE_1M;
2529     BOOL            bShortSlotTime = FALSE;
2530
2531
2532     for (ii = 0; ii < MAX_BSS_NUM; ii++) {
2533         if (pMgmt->sBSSList[ii].bActive == TRUE)
2534             break;
2535     }
2536
2537     if (ii == MAX_BSS_NUM) {
2538        *pStatus = CMD_STATUS_RESOURCES;
2539         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "BSS finding:BSS list is empty.\n");
2540        return;
2541     }
2542
2543     // memset(pMgmt->abyDesireBSSID, 0,  WLAN_BSSID_LEN);
2544     // Search known BSS list for prefer BSSID or SSID
2545
2546     pCurr = BSSpSearchBSSList(pDevice,
2547                               pMgmt->abyDesireBSSID,
2548                               pMgmt->abyDesireSSID,
2549                               pDevice->eConfigPHYMode
2550                               );
2551
2552     if (pCurr == NULL){
2553        *pStatus = CMD_STATUS_RESOURCES;
2554        pItemSSID = (PWLAN_IE_SSID)pMgmt->abyDesireSSID;
2555        DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Scanning [%s] not found, disconnected !\n", pItemSSID->abySSID);
2556        return;
2557     }
2558
2559     DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "AP(BSS) finding:Found a AP(BSS)..\n");
2560
2561     if (WLAN_GET_CAP_INFO_ESS(cpu_to_le16(pCurr->wCapInfo))){
2562
2563         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
2564             (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK)) {
2565                 /*
2566             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2567                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2568                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2569                     // encryption mode error
2570                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2571                     return;
2572                 }
2573             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2574                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2575                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"No match RSN info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
2576                     // encryption mode error
2577                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2578                     return;
2579                 }
2580             }
2581 */
2582         }
2583
2584         //if(pDevice->bWPASuppWextEnabled == TRUE)
2585             Encyption_Rebuild(pDevice, pCurr);
2586
2587         // Infrastructure BSS
2588         s_vMgrSynchBSS(pDevice,
2589                        WMAC_MODE_ESS_STA,
2590                        pCurr,
2591                        pStatus
2592                        );
2593
2594         if (*pStatus == CMD_STATUS_SUCCESS){
2595
2596             // Adopt this BSS state vars in Mgmt Object
2597             pMgmt->uCurrChannel = pCurr->uChannel;
2598
2599             memset(pMgmt->abyCurrSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2600             memset(pMgmt->abyCurrExtSuppRates, 0 , WLAN_IEHDR_LEN + WLAN_RATES_MAXLEN + 1);
2601
2602             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2603                 uRateLen = WLAN_RATES_MAXLEN_11B;
2604             }
2605
2606             pItemRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates;
2607             pItemExtRates = (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates;
2608
2609             // Parse Support Rate IE
2610             pItemRates->byElementID = WLAN_EID_SUPP_RATES;
2611             pItemRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2612                                          pItemRates,
2613                                          uRateLen);
2614
2615             // Parse Extension Support Rate IE
2616             pItemExtRates->byElementID = WLAN_EID_EXTSUPP_RATES;
2617             pItemExtRates->len = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abyExtSuppRates,
2618                                             pItemExtRates,
2619                                             uRateLen);
2620             // Stuffing Rate IE
2621             if ((pItemExtRates->len > 0) && (pItemRates->len < 8)) {
2622                 for (ii = 0; ii < (unsigned int) (8 - pItemRates->len); ) {
2623                         pItemRates->abyRates[pItemRates->len + ii] =
2624                                 pItemExtRates->abyRates[ii];
2625                         ii++;
2626                     if (pItemExtRates->len <= ii)
2627                         break;
2628                 }
2629                 pItemRates->len += (BYTE)ii;
2630                 if (pItemExtRates->len - ii > 0) {
2631                     pItemExtRates->len -= (BYTE)ii;
2632                     for (uu = 0; uu < pItemExtRates->len; uu ++) {
2633                         pItemExtRates->abyRates[uu] = pItemExtRates->abyRates[uu + ii];
2634                     }
2635                 } else {
2636                     pItemExtRates->len = 0;
2637                 }
2638             }
2639
2640             RATEvParseMaxRate((void *)pDevice, pItemRates, pItemExtRates, TRUE,
2641                               &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2642                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2643             vUpdateIFS(pDevice);
2644             // TODO: deal with if wCapInfo the privacy is on, but station WEP is off
2645             // TODO: deal with if wCapInfo the PS-Pollable is on.
2646             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2647             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2648             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2649             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
2650
2651             pMgmt->eCurrMode = WMAC_MODE_ESS_STA;
2652
2653             pMgmt->eCurrState = WMAC_STATE_JOINTED;
2654             // Adopt BSS state in Adapter Device Object
2655             pDevice->eOPMode = OP_MODE_INFRASTRUCTURE;
2656             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2657
2658             // Add current BSS to Candidate list
2659             // This should only work for WPA2 BSS, and WPA2 BSS check must be done before.
2660             if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
2661                 BOOL bResult = bAdd_PMKID_Candidate((void *) pDevice,
2662                                                     pMgmt->abyCurrBSSID,
2663                                                     &pCurr->sRSNCapObj);
2664                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate: 1(%d)\n", bResult);
2665                 if (bResult == FALSE) {
2666                         vFlush_PMKID_Candidate((void *) pDevice);
2667                         DBG_PRT(MSG_LEVEL_DEBUG,
2668                                 KERN_INFO "vFlush_PMKID_Candidate: 4\n");
2669                         bAdd_PMKID_Candidate((void *) pDevice,
2670                                              pMgmt->abyCurrBSSID,
2671                                              &pCurr->sRSNCapObj);
2672                 }
2673             }
2674
2675             // Preamble type auto-switch: if AP can receive short-preamble cap,
2676             // we can turn on too.
2677             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2678                 pDevice->byPreambleType = pDevice->byShortPreamble;
2679             }
2680             else {
2681                 pDevice->byPreambleType = 0;
2682             }
2683             // Change PreambleType must set RSPINF again
2684             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2685
2686             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join ESS\n");
2687
2688             if (pCurr->eNetworkTypeInUse == PHY_TYPE_11G) {
2689
2690                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION) != pDevice->bProtectMode) {//0000 0010
2691                     pDevice->bProtectMode = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2692                     if (pDevice->bProtectMode) {
2693                         MACvEnableProtectMD(pDevice);
2694                     } else {
2695                         MACvDisableProtectMD(pDevice);
2696                     }
2697                     vUpdateIFS(pDevice);
2698                 }
2699                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_NONERP_PRESENT) != pDevice->bNonERPPresent) {//0000 0001
2700                     pDevice->bNonERPPresent = (pCurr->sERP.byERP & WLAN_EID_ERP_USE_PROTECTION);
2701                 }
2702                 if ((pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE) != pDevice->bBarkerPreambleMd) {//0000 0100
2703                     pDevice->bBarkerPreambleMd = (pCurr->sERP.byERP & WLAN_EID_ERP_BARKER_MODE);
2704                     //BarkerPreambleMd has higher priority than shortPreamble bit in Cap
2705                     if (pDevice->bBarkerPreambleMd) {
2706                         MACvEnableBarkerPreambleMd(pDevice);
2707                     } else {
2708                         MACvDisableBarkerPreambleMd(pDevice);
2709                     }
2710                 }
2711             }
2712             //DBG_PRN_WLAN05(("wCapInfo: %X\n", pCurr->wCapInfo));
2713             if (WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo) != pDevice->bShortSlotTime) {
2714                 if (pDevice->byBBType == BB_TYPE_11A) {
2715                     bShortSlotTime = TRUE;
2716                 }
2717                 else if (pDevice->byBBType == BB_TYPE_11B) {
2718                     bShortSlotTime = FALSE;
2719                 }
2720                 else {
2721                     bShortSlotTime = WLAN_GET_CAP_INFO_SHORTSLOTTIME(pCurr->wCapInfo);
2722                 }
2723                 //DBG_PRN_WLAN05(("Set Short Slot Time: %d\n", pDevice->bShortSlotTime));
2724                 if (bShortSlotTime != pDevice->bShortSlotTime) {
2725                     pDevice->bShortSlotTime = bShortSlotTime;
2726                     BBvSetShortSlotTime(pDevice);
2727                     vUpdateIFS(pDevice);
2728                 }
2729             }
2730
2731             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"End of Join AP -- A/B/G Action\n");
2732         }
2733         else {
2734             pMgmt->eCurrState = WMAC_STATE_IDLE;
2735         };
2736
2737
2738      }
2739      else {
2740         // ad-hoc mode BSS
2741         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
2742
2743             if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2744 /*
2745                 if (WPA_SearchRSN(0, WPA_TKIP, pCurr) == FALSE) {
2746                     // encryption mode error
2747                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2748                     return;
2749                 }
2750 */
2751             } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2752 /*
2753                 if (WPA_SearchRSN(0, WPA_AESCCMP, pCurr) == FALSE) {
2754                     // encryption mode error
2755                     pMgmt->eCurrState = WMAC_STATE_IDLE;
2756                     return;
2757                 }
2758 */
2759             } else {
2760                 // encryption mode error
2761                 pMgmt->eCurrState = WMAC_STATE_IDLE;
2762                 return;
2763             }
2764         }
2765
2766         s_vMgrSynchBSS(pDevice,
2767                        WMAC_MODE_IBSS_STA,
2768                        pCurr,
2769                        pStatus
2770                        );
2771
2772         if (*pStatus == CMD_STATUS_SUCCESS){
2773             // Adopt this BSS state vars in Mgmt Object
2774             // TODO: check if CapInfo privacy on, but we don't..
2775             pMgmt->uCurrChannel = pCurr->uChannel;
2776
2777
2778             // Parse Support Rate IE
2779             pMgmt->abyCurrSuppRates[0] = WLAN_EID_SUPP_RATES;
2780             pMgmt->abyCurrSuppRates[1] = RATEuSetIE((PWLAN_IE_SUPP_RATES)pCurr->abySuppRates,
2781                                                     (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2782                                                     WLAN_RATES_MAXLEN_11B);
2783             // set basic rate
2784             RATEvParseMaxRate((void *)pDevice,
2785                               (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
2786                               NULL, TRUE, &wMaxBasicRate, &wMaxSuppRate, &wSuppRate,
2787                               &byTopCCKBasicRate, &byTopOFDMBasicRate);
2788             vUpdateIFS(pDevice);
2789             pMgmt->wCurrCapInfo = pCurr->wCapInfo;
2790             pMgmt->wCurrBeaconPeriod = pCurr->wBeaconInterval;
2791             memset(pMgmt->abyCurrSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2792             memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2793             memcpy(pMgmt->abyCurrSSID, pCurr->abySSID, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN);
2794 //          pMgmt->wCurrATIMWindow = pCurr->wATIMWindow;
2795             pMgmt->eCurrMode = WMAC_MODE_IBSS_STA;
2796             pMgmt->eCurrState = WMAC_STATE_STARTED;
2797             // Adopt BSS state in Adapter Device Object
2798             pDevice->eOPMode = OP_MODE_ADHOC;
2799             pDevice->bLinkPass = TRUE;
2800             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
2801             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
2802
2803                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join IBSS ok:%pM\n",
2804                         pMgmt->abyCurrBSSID);
2805             // Preamble type auto-switch: if AP can receive short-preamble cap,
2806             // and if registry setting is short preamble we can turn on too.
2807
2808             if (WLAN_GET_CAP_INFO_SHORTPREAMBLE(pCurr->wCapInfo)) {
2809                 pDevice->byPreambleType = pDevice->byShortPreamble;
2810             }
2811             else {
2812                 pDevice->byPreambleType = 0;
2813             }
2814             // Change PreambleType must set RSPINF again
2815             CARDvSetRSPINF(pDevice, (BYTE)pDevice->byBBType);
2816
2817             // Prepare beacon
2818                 bMgrPrepareBeaconToSend((void *) pDevice, pMgmt);
2819         }
2820         else {
2821             pMgmt->eCurrState = WMAC_STATE_IDLE;
2822         };
2823      };
2824     return;
2825 }
2826
2827
2828
2829 /*+
2830  *
2831  * Routine Description:
2832  * Set HW to synchronize a specific BSS from known BSS list.
2833  *
2834  *
2835  * Return Value:
2836  *    PCM_STATUS
2837  *
2838 -*/
2839 static
2840 void
2841 s_vMgrSynchBSS (
2842      PSDevice      pDevice,
2843      unsigned int          uBSSMode,
2844      PKnownBSS     pCurr,
2845      PCMD_STATUS  pStatus
2846     )
2847 {
2848     PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
2849                                                      //1M,   2M,   5M,   11M,  18M,  24M,  36M,  54M
2850     BYTE abyCurrSuppRatesG[] = {WLAN_EID_SUPP_RATES, 8, 0x02, 0x04, 0x0B, 0x16, 0x24, 0x30, 0x48, 0x6C};
2851     BYTE abyCurrExtSuppRatesG[] = {WLAN_EID_EXTSUPP_RATES, 4, 0x0C, 0x12, 0x18, 0x60};
2852                                                            //6M,   9M,   12M,  48M
2853     BYTE abyCurrSuppRatesA[] = {WLAN_EID_SUPP_RATES, 8, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6C};
2854     BYTE abyCurrSuppRatesB[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
2855
2856
2857     *pStatus = CMD_STATUS_FAILURE;
2858
2859     if (s_bCipherMatch(pCurr,
2860                        pDevice->eEncryptionStatus,
2861                        &(pMgmt->byCSSPK),
2862                        &(pMgmt->byCSSGK)) == FALSE) {
2863         DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "s_bCipherMatch Fail .......\n");
2864         return;
2865     }
2866
2867     pMgmt->pCurrBSS = pCurr;
2868
2869     // if previous mode is IBSS.
2870     if(pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
2871         MACvRegBitsOff(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
2872     }
2873
2874     // Init the BSS informations
2875     pDevice->bCCK = TRUE;
2876     pDevice->bProtectMode = FALSE;
2877     MACvDisableProtectMD(pDevice);
2878     pDevice->bBarkerPreambleMd = FALSE;
2879     MACvDisableBarkerPreambleMd(pDevice);
2880     pDevice->bNonERPPresent = FALSE;
2881     pDevice->byPreambleType = 0;
2882     pDevice->wBasicRate = 0;
2883     // Set Basic Rate
2884     CARDbAddBasicRate((void *)pDevice, RATE_1M);
2885
2886     // calculate TSF offset
2887     // TSF Offset = Received Timestamp TSF - Marked Local's TSF
2888     CARDvAdjustTSF(pDevice, pCurr->byRxRate, pCurr->qwBSSTimestamp, pCurr->qwLocalTSF);
2889
2890     // set HW beacon interval
2891     MACvWriteBeaconInterval(pDevice, pCurr->wBeaconInterval);
2892
2893     // set Next TBTT
2894     // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
2895     CARDvSetFirstNextTBTT(pDevice, pCurr->wBeaconInterval);
2896
2897     // set BSSID
2898     MACvWriteBSSIDAddress(pDevice, pCurr->abyBSSID);
2899
2900     memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, 6);
2901
2902         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = "
2903                 "%pM\n", pMgmt->abyCurrBSSID);
2904
2905     if (pCurr->eNetworkTypeInUse == PHY_TYPE_11A) {
2906         if ((pDevice->eConfigPHYMode == PHY_TYPE_11A) ||
2907             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
2908             pDevice->byBBType = BB_TYPE_11A;
2909             pMgmt->eCurrentPHYMode = PHY_TYPE_11A;
2910             pDevice->bShortSlotTime = TRUE;
2911             BBvSetShortSlotTime(pDevice);
2912             CARDvSetBSSMode(pDevice);
2913         } else {
2914             return;
2915         }
2916     } else if (pCurr->eNetworkTypeInUse == PHY_TYPE_11B) {
2917         if ((pDevice->eConfigPHYMode == PHY_TYPE_11B) ||
2918             (pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
2919             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
2920             pDevice->byBBType = BB_TYPE_11B;
2921             pMgmt->eCurrentPHYMode = PHY_TYPE_11B;
2922             pDevice->bShortSlotTime = FALSE;
2923             BBvSetShortSlotTime(pDevice);
2924             CARDvSetBSSMode(pDevice);
2925         } else {
2926             return;
2927         }
2928     } else {
2929         if ((pDevice->eConfigPHYMode == PHY_TYPE_11G) ||
2930             (pDevice->eConfigPHYMode == PHY_TYPE_AUTO)) {
2931             pDevice->byBBType = BB_TYPE_11G;
2932             pMgmt->eCurrentPHYMode = PHY_TYPE_11G;
2933             pDevice->bShortSlotTime = TRUE;
2934             BBvSetShortSlotTime(pDevice);
2935             CARDvSetBSSMode(pDevice);
2936         } else if (pDevice->eConfigPHYMode == PHY_TYPE_11B) {
2937             pDevice->byBBType = BB_TYPE_11B;
2938             pDevice->bShortSlotTime = FALSE;
2939             BBvSetShortSlotTime(pDevice);
2940             CARDvSetBSSMode(pDevice);
2941         } else {
2942             return;
2943         }
2944     }
2945
2946     if (uBSSMode == WMAC_MODE_ESS_STA) {
2947         MACvRegBitsOff(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
2948         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
2949         pDevice->byRxMode |= RCR_BSSID;
2950         pMgmt->bCurrBSSIDFilterOn = TRUE;
2951     }
2952
2953     // set channel and clear NAV
2954     CARDbSetMediaChannel(pDevice, pCurr->uChannel);
2955     pMgmt->uCurrChannel = pCurr->uChannel;
2956     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "<----s_bSynchBSS Set Channel [%d]\n", pCurr->uChannel);
2957
2958     if ((pDevice->bUpdateBBVGA) &&
2959         (pDevice->byBBVGACurrent != pDevice->abyBBVGA[0])) {
2960         pDevice->byBBVGACurrent = pDevice->abyBBVGA[0];
2961         BBvSetVGAGainOffset(pDevice, pDevice->byBBVGACurrent);
2962         BBvSetShortSlotTime(pDevice);
2963     }
2964     //
2965     // Notes:
2966     // 1. In Ad-hoc mode : check if received others beacon as jointed indication,
2967     //    otherwise we will start own IBSS.
2968     // 2. In Infra mode : Supposed we already synchronized with AP right now.
2969
2970     if (uBSSMode == WMAC_MODE_IBSS_STA) {
2971         MACvRegBitsOn(pDevice, MAC_REG_HOSTCR, HOSTCR_ADHOC);
2972         MACvRegBitsOn(pDevice, MAC_REG_RCR, RCR_BSSID);
2973         pDevice->byRxMode |= RCR_BSSID;
2974         pMgmt->bCurrBSSIDFilterOn = TRUE;
2975     }
2976
2977     if (pDevice->byBBType == BB_TYPE_11A) {
2978         memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesA[0], sizeof(abyCurrSuppRatesA));
2979         pMgmt->abyCurrExtSuppRates[1] = 0;
2980     } else if (pDevice->byBBType == BB_TYPE_11B) {
2981         memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesB[0], sizeof(abyCurrSuppRatesB));
2982         pMgmt->abyCurrExtSuppRates[1] = 0;
2983     } else {
2984         memcpy(pMgmt->abyCurrSuppRates, &abyCurrSuppRatesG[0], sizeof(abyCurrSuppRatesG));
2985         memcpy(pMgmt->abyCurrExtSuppRates, &abyCurrExtSuppRatesG[0], sizeof(abyCurrExtSuppRatesG));
2986     }
2987     pMgmt->byERPContext = pCurr->sERP.byERP;
2988
2989     *pStatus = CMD_STATUS_SUCCESS;
2990
2991     return;
2992 };
2993
2994
2995 //mike add: fix NetworkManager 0.7.0 hidden ssid mode in WPA encryption
2996 //                   ,need reset eAuthenMode and eEncryptionStatus
2997  static void  Encyption_Rebuild(
2998      PSDevice pDevice,
2999      PKnownBSS pCurr
3000  )
3001  {
3002   PSMgmtObject  pMgmt = &(pDevice->sMgmtObj);
3003   /* unsigned int ii, uSameBssidNum=0; */
3004
3005   //   if( uSameBssidNum>=2) {   //we only check AP in hidden sssid  mode
3006         if ((pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||           //networkmanager 0.7.0 does not give the pairwise-key selsection,
3007              (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {         // so we need re-selsect it according to real pairwise-key info.
3008                if(pCurr->bWPAValid == TRUE)  {   //WPA-PSK
3009                           pMgmt->eAuthenMode = WMAC_AUTH_WPAPSK;
3010                     if(pCurr->abyPKType[0] == WPA_TKIP) {
3011                         pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;    //TKIP
3012                         PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-TKIP]\n");
3013                       }
3014                    else if(pCurr->abyPKType[0] == WPA_AESCCMP) {
3015                         pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3016                           PRINT_K("Encyption_Rebuild--->ssid reset config to [WPAPSK-AES]\n");
3017                      }
3018                 }
3019                else if(pCurr->bWPA2Valid == TRUE) {  //WPA2-PSK
3020                          pMgmt->eAuthenMode = WMAC_AUTH_WPA2PSK;
3021                        if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_TKIP) {
3022                            pDevice->eEncryptionStatus = Ndis802_11Encryption2Enabled;     //TKIP
3023                              PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-TKIP]\n");
3024                         }
3025                        else if(pCurr->abyCSSPK[0] == WLAN_11i_CSS_CCMP) {
3026                            pDevice->eEncryptionStatus = Ndis802_11Encryption3Enabled;    //AES
3027                             PRINT_K("Encyption_Rebuild--->ssid reset config to [WPA2PSK-AES]\n");
3028                         }
3029                 }
3030               }
3031         //  }
3032       return;
3033  }
3034
3035
3036 /*+
3037  *
3038  * Routine Description:
3039  *  Format TIM field
3040  *
3041  *
3042  * Return Value:
3043  *    void
3044  *
3045 -*/
3046
3047 static
3048 void
3049 s_vMgrFormatTIM(
3050      PSMgmtObject pMgmt,
3051      PWLAN_IE_TIM pTIM
3052     )
3053 {
3054     BYTE        byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
3055     BYTE        byMap;
3056     unsigned int        ii, jj;
3057     BOOL        bStartFound = FALSE;
3058     BOOL        bMulticast = FALSE;
3059     WORD        wStartIndex = 0;
3060     WORD        wEndIndex = 0;
3061
3062
3063     // Find size of partial virtual bitmap
3064     for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
3065         byMap = pMgmt->abyPSTxMap[ii];
3066         if (!ii) {
3067             // Mask out the broadcast bit which is indicated separately.
3068             bMulticast = (byMap & byMask[0]) != 0;
3069             if(bMulticast) {
3070                pMgmt->sNodeDBTable[0].bRxPSPoll = TRUE;
3071             }
3072             byMap = 0;
3073         }
3074         if (byMap) {
3075             if (!bStartFound) {
3076                 bStartFound = TRUE;
3077                 wStartIndex = (WORD)ii;
3078             }
3079             wEndIndex = (WORD)ii;
3080         }
3081     }
3082
3083
3084     // Round start index down to nearest even number
3085     wStartIndex &=  ~BIT0;
3086
3087     // Round end index up to nearest even number
3088     wEndIndex = ((wEndIndex + 1) & ~BIT0);
3089
3090     // Size of element payload
3091
3092     pTIM->len =  3 + (wEndIndex - wStartIndex) + 1;
3093
3094     // Fill in the Fixed parts of the TIM
3095     pTIM->byDTIMCount = pMgmt->byDTIMCount;
3096     pTIM->byDTIMPeriod = pMgmt->byDTIMPeriod;
3097     pTIM->byBitMapCtl = (bMulticast ? TIM_MULTICAST_MASK : 0) |
3098         (((wStartIndex >> 1) << 1) & TIM_BITMAPOFFSET_MASK);
3099
3100     // Append variable part of TIM
3101
3102     for (ii = wStartIndex, jj =0 ; ii <= wEndIndex; ii++, jj++) {
3103          pTIM->byVirtBitMap[jj] = pMgmt->abyPSTxMap[ii];
3104     }
3105
3106     // Aid = 0 don't used.
3107     pTIM->byVirtBitMap[0]  &= ~BIT0;
3108 }
3109
3110
3111 /*+
3112  *
3113  * Routine Description:
3114  *  Constructs an Beacon frame( Ad-hoc mode)
3115  *
3116  *
3117  * Return Value:
3118  *    PTR to frame; or NULL on allocation failure
3119  *
3120 -*/
3121
3122 static
3123 PSTxMgmtPacket
3124 s_MgrMakeBeacon(
3125      PSDevice pDevice,
3126      PSMgmtObject pMgmt,
3127      WORD wCurrCapInfo,
3128      WORD wCurrBeaconPeriod,
3129      unsigned int uCurrChannel,
3130      WORD wCurrATIMWinodw,
3131      PWLAN_IE_SSID pCurrSSID,
3132      PBYTE pCurrBSSID,
3133      PWLAN_IE_SUPP_RATES pCurrSuppRates,
3134      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3135     )
3136 {
3137     PSTxMgmtPacket      pTxPacket = NULL;
3138     WLAN_FR_BEACON      sFrame;
3139     BYTE                abyBroadcastAddr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
3140
3141
3142     // prepare beacon frame
3143     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3144     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_BEACON_FR_MAXLEN);
3145     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3146     // Setup the sFrame structure.
3147     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3148     sFrame.len = WLAN_BEACON_FR_MAXLEN;
3149     vMgrEncodeBeacon(&sFrame);
3150     // Setup the header
3151     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3152         (
3153         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3154         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_BEACON)
3155         ));
3156
3157     if (pDevice->bEnablePSMode) {
3158         sFrame.pHdr->sA3.wFrameCtl |= cpu_to_le16((WORD)WLAN_SET_FC_PWRMGT(1));
3159     }
3160
3161     memcpy( sFrame.pHdr->sA3.abyAddr1, abyBroadcastAddr, WLAN_ADDR_LEN);
3162     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3163     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3164     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3165     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3166     // Copy SSID
3167     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3168     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3169     memcpy(sFrame.pSSID,
3170              pCurrSSID,
3171              ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3172             );
3173     // Copy the rate set
3174     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3175     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3176     memcpy(sFrame.pSuppRates,
3177            pCurrSuppRates,
3178            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3179           );
3180     // DS parameter
3181     if (pDevice->byBBType != BB_TYPE_11A) {
3182         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3183         sFrame.len += (1) + WLAN_IEHDR_LEN;
3184         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3185         sFrame.pDSParms->len = 1;
3186         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3187     }
3188     // TIM field
3189     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
3190         sFrame.pTIM = (PWLAN_IE_TIM)(sFrame.pBuf + sFrame.len);
3191         sFrame.pTIM->byElementID = WLAN_EID_TIM;
3192         s_vMgrFormatTIM(pMgmt, sFrame.pTIM);
3193         sFrame.len += (WLAN_IEHDR_LEN + sFrame.pTIM->len);
3194     }
3195
3196     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
3197
3198         // IBSS parameter
3199         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3200         sFrame.len += (2) + WLAN_IEHDR_LEN;
3201         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3202         sFrame.pIBSSParms->len = 2;
3203         sFrame.pIBSSParms->wATIMWindow = wCurrATIMWinodw;
3204         if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3205             /* RSN parameter */
3206             sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3207             sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3208             sFrame.pRSNWPA->len = 12;
3209             sFrame.pRSNWPA->abyOUI[0] = 0x00;
3210             sFrame.pRSNWPA->abyOUI[1] = 0x50;
3211             sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3212             sFrame.pRSNWPA->abyOUI[3] = 0x01;
3213             sFrame.pRSNWPA->wVersion = 1;
3214             sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3215             sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3216             sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3217             if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled)
3218                 sFrame.pRSNWPA->abyMulticast[3] = 0x04;//AES
3219             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled)
3220                 sFrame.pRSNWPA->abyMulticast[3] = 0x02;//TKIP
3221             else if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled)
3222                 sFrame.pRSNWPA->abyMulticast[3] = 0x01;//WEP40
3223             else
3224                 sFrame.pRSNWPA->abyMulticast[3] = 0x00;//NONE
3225
3226             // Pairwise Key Cipher Suite
3227             sFrame.pRSNWPA->wPKCount = 0;
3228             // Auth Key Management Suite
3229             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3230             sFrame.pRSNWPA->len +=2;
3231
3232             // RSN Capabilites
3233             *((PWORD)(sFrame.pBuf + sFrame.len + sFrame.pRSNWPA->len))=0;
3234             sFrame.pRSNWPA->len +=2;
3235             sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3236         }
3237     }
3238
3239
3240     if (pMgmt->eCurrentPHYMode == PHY_TYPE_11G) {
3241         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3242         sFrame.len += 1 + WLAN_IEHDR_LEN;
3243         sFrame.pERP->byElementID = WLAN_EID_ERP;
3244         sFrame.pERP->len = 1;
3245         sFrame.pERP->byContext = 0;
3246         if (pDevice->bProtectMode == TRUE)
3247             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3248         if (pDevice->bNonERPPresent == TRUE)
3249             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3250         if (pDevice->bBarkerPreambleMd == TRUE)
3251             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3252     }
3253     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3254         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3255         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3256         memcpy(sFrame.pExtSuppRates,
3257              pCurrExtSuppRates,
3258              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3259              );
3260     }
3261     // hostapd wpa/wpa2 IE
3262     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3263          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3264              if (pMgmt->wWPAIELen != 0) {
3265                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3266                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3267                  sFrame.len += pMgmt->wWPAIELen;
3268              }
3269          }
3270     }
3271
3272     /* Adjust the length fields */
3273     pTxPacket->cbMPDULen = sFrame.len;
3274     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3275
3276     return pTxPacket;
3277 }
3278
3279
3280
3281
3282
3283 /*+
3284  *
3285  * Routine Description:
3286  *  Constructs an Prob-response frame
3287  *
3288  *
3289  * Return Value:
3290  *    PTR to frame; or NULL on allocation failure
3291  *
3292 -*/
3293
3294
3295
3296
3297 PSTxMgmtPacket
3298 s_MgrMakeProbeResponse(
3299      PSDevice pDevice,
3300      PSMgmtObject pMgmt,
3301      WORD wCurrCapInfo,
3302      WORD wCurrBeaconPeriod,
3303      unsigned int uCurrChannel,
3304      WORD wCurrATIMWinodw,
3305      PBYTE pDstAddr,
3306      PWLAN_IE_SSID pCurrSSID,
3307      PBYTE pCurrBSSID,
3308      PWLAN_IE_SUPP_RATES pCurrSuppRates,
3309      PWLAN_IE_SUPP_RATES pCurrExtSuppRates,
3310      BYTE byPHYType
3311     )
3312 {
3313     PSTxMgmtPacket      pTxPacket = NULL;
3314     WLAN_FR_PROBERESP   sFrame;
3315
3316
3317
3318     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3319     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_PROBERESP_FR_MAXLEN);
3320     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3321     // Setup the sFrame structure.
3322     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3323     sFrame.len = WLAN_PROBERESP_FR_MAXLEN;
3324     vMgrEncodeProbeResponse(&sFrame);
3325     // Setup the header
3326     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3327         (
3328         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3329         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_PROBERESP)
3330         ));
3331     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3332     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3333     memcpy( sFrame.pHdr->sA3.abyAddr3, pCurrBSSID, WLAN_BSSID_LEN);
3334     *sFrame.pwBeaconInterval = cpu_to_le16(wCurrBeaconPeriod);
3335     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3336
3337     if (byPHYType == BB_TYPE_11B) {
3338         *sFrame.pwCapInfo &= cpu_to_le16((WORD)~(WLAN_SET_CAP_INFO_SHORTSLOTTIME(1)));
3339     }
3340
3341     // Copy SSID
3342     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3343     sFrame.len += ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len + WLAN_IEHDR_LEN;
3344     memcpy(sFrame.pSSID,
3345            pCurrSSID,
3346            ((PWLAN_IE_SSID)pCurrSSID)->len + WLAN_IEHDR_LEN
3347            );
3348     // Copy the rate set
3349     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3350
3351     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3352     memcpy(sFrame.pSuppRates,
3353            pCurrSuppRates,
3354            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3355           );
3356
3357     // DS parameter
3358     if (pDevice->byBBType != BB_TYPE_11A) {
3359         sFrame.pDSParms = (PWLAN_IE_DS_PARMS)(sFrame.pBuf + sFrame.len);
3360         sFrame.len += (1) + WLAN_IEHDR_LEN;
3361         sFrame.pDSParms->byElementID = WLAN_EID_DS_PARMS;
3362         sFrame.pDSParms->len = 1;
3363         sFrame.pDSParms->byCurrChannel = (BYTE)uCurrChannel;
3364     }
3365
3366     if (pMgmt->eCurrMode != WMAC_MODE_ESS_AP) {
3367         // IBSS parameter
3368         sFrame.pIBSSParms = (PWLAN_IE_IBSS_PARMS)(sFrame.pBuf + sFrame.len);
3369         sFrame.len += (2) + WLAN_IEHDR_LEN;
3370         sFrame.pIBSSParms->byElementID = WLAN_EID_IBSS_PARMS;
3371         sFrame.pIBSSParms->len = 2;
3372         sFrame.pIBSSParms->wATIMWindow = 0;
3373     }
3374     if (pDevice->byBBType == BB_TYPE_11G) {
3375         sFrame.pERP = (PWLAN_IE_ERP)(sFrame.pBuf + sFrame.len);
3376         sFrame.len += 1 + WLAN_IEHDR_LEN;
3377         sFrame.pERP->byElementID = WLAN_EID_ERP;
3378         sFrame.pERP->len = 1;
3379         sFrame.pERP->byContext = 0;
3380         if (pDevice->bProtectMode == TRUE)
3381             sFrame.pERP->byContext |= WLAN_EID_ERP_USE_PROTECTION;
3382         if (pDevice->bNonERPPresent == TRUE)
3383             sFrame.pERP->byContext |= WLAN_EID_ERP_NONERP_PRESENT;
3384         if (pDevice->bBarkerPreambleMd == TRUE)
3385             sFrame.pERP->byContext |= WLAN_EID_ERP_BARKER_MODE;
3386     }
3387
3388     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3389         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3390         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3391         memcpy(sFrame.pExtSuppRates,
3392              pCurrExtSuppRates,
3393              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3394              );
3395     }
3396
3397     // hostapd wpa/wpa2 IE
3398     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnableHostapd == TRUE)) {
3399          if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
3400              if (pMgmt->wWPAIELen != 0) {
3401                  sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3402                  memcpy(sFrame.pRSN, pMgmt->abyWPAIE, pMgmt->wWPAIELen);
3403                  sFrame.len += pMgmt->wWPAIELen;
3404              }
3405          }
3406     }
3407
3408     // Adjust the length fields
3409     pTxPacket->cbMPDULen = sFrame.len;
3410     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3411
3412     return pTxPacket;
3413 }
3414
3415
3416
3417 /*+
3418  *
3419  * Routine Description:
3420  *  Constructs an association request frame
3421  *
3422  *
3423  * Return Value:
3424  *    A ptr to frame or NULL on allocation failue
3425  *
3426 -*/
3427
3428
3429 PSTxMgmtPacket
3430 s_MgrMakeAssocRequest(
3431      PSDevice pDevice,
3432      PSMgmtObject pMgmt,
3433      PBYTE pDAddr,
3434      WORD wCurrCapInfo,
3435      WORD wListenInterval,
3436      PWLAN_IE_SSID pCurrSSID,
3437      PWLAN_IE_SUPP_RATES pCurrRates,
3438      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3439     )
3440 {
3441     PSTxMgmtPacket      pTxPacket = NULL;
3442     WLAN_FR_ASSOCREQ    sFrame;
3443     PBYTE               pbyIEs;
3444     PBYTE               pbyRSN;
3445
3446
3447     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3448     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3449     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3450     // Setup the sFrame structure.
3451     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3452     sFrame.len = WLAN_ASSOCREQ_FR_MAXLEN;
3453     // format fixed field frame structure
3454     vMgrEncodeAssocRequest(&sFrame);
3455     // Setup the header
3456     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3457         (
3458         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3459         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCREQ)
3460         ));
3461     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3462     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3463     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3464
3465     // Set the capability and listen interval
3466     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3467     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3468
3469     // sFrame.len point to end of fixed field
3470     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3471     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3472     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3473
3474     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3475     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3476     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3477     memcpy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3478     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3479
3480     // Copy the rate set
3481     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3482     if ((pDevice->byBBType == BB_TYPE_11B) && (pCurrRates->len > 4))
3483         sFrame.len += 4 + WLAN_IEHDR_LEN;
3484     else
3485         sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3486     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3487
3488     // Copy the extension rate set
3489     if ((pDevice->byBBType == BB_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3490         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3491         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3492         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3493     }
3494
3495     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3496     memcpy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3497     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3498
3499
3500     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3501          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3502          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3503         (pMgmt->pCurrBSS != NULL)) {
3504         /* WPA IE */
3505         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3506         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3507         sFrame.pRSNWPA->len = 16;
3508         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3509         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3510         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3511         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3512         sFrame.pRSNWPA->wVersion = 1;
3513         //Group Key Cipher Suite
3514         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3515         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3516         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3517         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3518             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3519         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3520             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3521         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3522             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3523         } else {
3524             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3525         }
3526         // Pairwise Key Cipher Suite
3527         sFrame.pRSNWPA->wPKCount = 1;
3528         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3529         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3530         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3531         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3532             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3533         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3534             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3535         } else {
3536             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3537         }
3538         // Auth Key Management Suite
3539         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3540         *pbyRSN++=0x01;
3541         *pbyRSN++=0x00;
3542         *pbyRSN++=0x00;
3543
3544         *pbyRSN++=0x50;
3545         *pbyRSN++=0xf2;
3546         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3547             *pbyRSN++=WPA_AUTH_PSK;
3548         }
3549         else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3550             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3551         }
3552         else {
3553             *pbyRSN++=WPA_NONE;
3554         }
3555
3556         sFrame.pRSNWPA->len +=6;
3557
3558         // RSN Capabilites
3559
3560         *pbyRSN++=0x00;
3561         *pbyRSN++=0x00;
3562         sFrame.pRSNWPA->len +=2;
3563
3564         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3565         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3566         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3567         memcpy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3568         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3569
3570     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3571                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3572                (pMgmt->pCurrBSS != NULL)) {
3573         unsigned int ii;
3574         PWORD               pwPMKID;
3575
3576         // WPA IE
3577         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3578         sFrame.pRSN->byElementID = WLAN_EID_RSN;
3579         sFrame.pRSN->len = 6; //Version(2)+GK(4)
3580         sFrame.pRSN->wVersion = 1;
3581         //Group Key Cipher Suite
3582         sFrame.pRSN->abyRSN[0] = 0x00;
3583         sFrame.pRSN->abyRSN[1] = 0x0F;
3584         sFrame.pRSN->abyRSN[2] = 0xAC;
3585         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3586             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3587         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3588             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3589         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3590             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3591         } else {
3592             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3593         }
3594
3595         // Pairwise Key Cipher Suite
3596         sFrame.pRSN->abyRSN[4] = 1;
3597         sFrame.pRSN->abyRSN[5] = 0;
3598         sFrame.pRSN->abyRSN[6] = 0x00;
3599         sFrame.pRSN->abyRSN[7] = 0x0F;
3600         sFrame.pRSN->abyRSN[8] = 0xAC;
3601         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3602             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3603         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3604             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3605         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3606             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3607         } else {
3608             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3609         }
3610         sFrame.pRSN->len += 6;
3611
3612         // Auth Key Management Suite
3613         sFrame.pRSN->abyRSN[10] = 1;
3614         sFrame.pRSN->abyRSN[11] = 0;
3615         sFrame.pRSN->abyRSN[12] = 0x00;
3616         sFrame.pRSN->abyRSN[13] = 0x0F;
3617         sFrame.pRSN->abyRSN[14] = 0xAC;
3618         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3619             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3620         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3621             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3622         } else {
3623             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3624         }
3625         sFrame.pRSN->len +=6;
3626
3627         // RSN Capabilites
3628         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
3629             memcpy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3630         } else {
3631             sFrame.pRSN->abyRSN[16] = 0;
3632             sFrame.pRSN->abyRSN[17] = 0;
3633         }
3634         sFrame.pRSN->len +=2;
3635
3636         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3637             // RSN PMKID
3638             pbyRSN = &sFrame.pRSN->abyRSN[18];
3639             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
3640             *pwPMKID = 0;            // Initialize PMKID count
3641             pbyRSN += 2;             // Point to PMKID list
3642         for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3643                 if (!memcmp(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0],
3644                              pMgmt->abyCurrBSSID,
3645                              ETH_ALEN)) {
3646                         (*pwPMKID)++;
3647                         memcpy(pbyRSN,
3648                                pDevice->gsPMKID.BSSIDInfo[ii].PMKID,
3649                                16);
3650                         pbyRSN += 16;
3651                 }
3652         }
3653             if (*pwPMKID != 0) {
3654                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
3655             }
3656         }
3657
3658         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3659         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3660         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3661         memcpy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3662         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3663     }
3664
3665
3666     // Adjust the length fields
3667     pTxPacket->cbMPDULen = sFrame.len;
3668     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3669     return pTxPacket;
3670 }
3671
3672
3673
3674
3675
3676
3677
3678
3679 /*+
3680  *
3681  * Routine Description:
3682  *  Constructs an re-association request frame
3683  *
3684  *
3685  * Return Value:
3686  *    A ptr to frame or NULL on allocation failure
3687  *
3688 -*/
3689
3690
3691 PSTxMgmtPacket
3692 s_MgrMakeReAssocRequest(
3693      PSDevice pDevice,
3694      PSMgmtObject pMgmt,
3695      PBYTE pDAddr,
3696      WORD wCurrCapInfo,
3697      WORD wListenInterval,
3698      PWLAN_IE_SSID pCurrSSID,
3699      PWLAN_IE_SUPP_RATES pCurrRates,
3700      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3701     )
3702 {
3703     PSTxMgmtPacket      pTxPacket = NULL;
3704     WLAN_FR_REASSOCREQ  sFrame;
3705     PBYTE               pbyIEs;
3706     PBYTE               pbyRSN;
3707
3708
3709     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3710     memset( pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_REASSOCREQ_FR_MAXLEN);
3711     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3712     /* Setup the sFrame structure. */
3713     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3714     sFrame.len = WLAN_REASSOCREQ_FR_MAXLEN;
3715
3716     // format fixed field frame structure
3717     vMgrEncodeReassocRequest(&sFrame);
3718
3719     /* Setup the header */
3720     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3721         (
3722         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3723         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCREQ)
3724         ));
3725     memcpy( sFrame.pHdr->sA3.abyAddr1, pDAddr, WLAN_ADDR_LEN);
3726     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3727     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3728
3729     /* Set the capability and listen interval */
3730     *(sFrame.pwCapInfo) = cpu_to_le16(wCurrCapInfo);
3731     *(sFrame.pwListenInterval) = cpu_to_le16(wListenInterval);
3732
3733     memcpy(sFrame.pAddrCurrAP, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3734     /* Copy the SSID */
3735     /* sFrame.len point to end of fixed field */
3736     sFrame.pSSID = (PWLAN_IE_SSID)(sFrame.pBuf + sFrame.len);
3737     sFrame.len += pCurrSSID->len + WLAN_IEHDR_LEN;
3738     memcpy(sFrame.pSSID, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3739
3740     pMgmt->sAssocInfo.AssocInfo.RequestIELength = pCurrSSID->len + WLAN_IEHDR_LEN;
3741     pMgmt->sAssocInfo.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
3742     pbyIEs = pMgmt->sAssocInfo.abyIEs;
3743     memcpy(pbyIEs, pCurrSSID, pCurrSSID->len + WLAN_IEHDR_LEN);
3744     pbyIEs += pCurrSSID->len + WLAN_IEHDR_LEN;
3745
3746     /* Copy the rate set */
3747     /* sFrame.len point to end of SSID */
3748     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3749     sFrame.len += pCurrRates->len + WLAN_IEHDR_LEN;
3750     memcpy(sFrame.pSuppRates, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3751
3752     // Copy the extension rate set
3753     if ((pMgmt->eCurrentPHYMode == PHY_TYPE_11G) && (pCurrExtSuppRates->len > 0)) {
3754         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3755         sFrame.len += pCurrExtSuppRates->len + WLAN_IEHDR_LEN;
3756         memcpy(sFrame.pExtSuppRates, pCurrExtSuppRates, pCurrExtSuppRates->len + WLAN_IEHDR_LEN);
3757     }
3758
3759     pMgmt->sAssocInfo.AssocInfo.RequestIELength += pCurrRates->len + WLAN_IEHDR_LEN;
3760     memcpy(pbyIEs, pCurrRates, pCurrRates->len + WLAN_IEHDR_LEN);
3761     pbyIEs += pCurrRates->len + WLAN_IEHDR_LEN;
3762
3763     if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
3764          (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
3765          (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE)) &&
3766         (pMgmt->pCurrBSS != NULL)) {
3767         /* WPA IE */
3768         sFrame.pRSNWPA = (PWLAN_IE_RSN_EXT)(sFrame.pBuf + sFrame.len);
3769         sFrame.pRSNWPA->byElementID = WLAN_EID_RSN_WPA;
3770         sFrame.pRSNWPA->len = 16;
3771         sFrame.pRSNWPA->abyOUI[0] = 0x00;
3772         sFrame.pRSNWPA->abyOUI[1] = 0x50;
3773         sFrame.pRSNWPA->abyOUI[2] = 0xf2;
3774         sFrame.pRSNWPA->abyOUI[3] = 0x01;
3775         sFrame.pRSNWPA->wVersion = 1;
3776         //Group Key Cipher Suite
3777         sFrame.pRSNWPA->abyMulticast[0] = 0x00;
3778         sFrame.pRSNWPA->abyMulticast[1] = 0x50;
3779         sFrame.pRSNWPA->abyMulticast[2] = 0xf2;
3780         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3781             sFrame.pRSNWPA->abyMulticast[3] = pMgmt->pCurrBSS->byGKType;
3782         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3783             sFrame.pRSNWPA->abyMulticast[3] = WPA_TKIP;
3784         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3785             sFrame.pRSNWPA->abyMulticast[3] = WPA_AESCCMP;
3786         } else {
3787             sFrame.pRSNWPA->abyMulticast[3] = WPA_NONE;
3788         }
3789         // Pairwise Key Cipher Suite
3790         sFrame.pRSNWPA->wPKCount = 1;
3791         sFrame.pRSNWPA->PKSList[0].abyOUI[0] = 0x00;
3792         sFrame.pRSNWPA->PKSList[0].abyOUI[1] = 0x50;
3793         sFrame.pRSNWPA->PKSList[0].abyOUI[2] = 0xf2;
3794         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3795             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_TKIP;
3796         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3797             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_AESCCMP;
3798         } else {
3799             sFrame.pRSNWPA->PKSList[0].abyOUI[3] = WPA_NONE;
3800         }
3801         // Auth Key Management Suite
3802         pbyRSN = (PBYTE)(sFrame.pBuf + sFrame.len + 2 + sFrame.pRSNWPA->len);
3803         *pbyRSN++=0x01;
3804         *pbyRSN++=0x00;
3805         *pbyRSN++=0x00;
3806
3807         *pbyRSN++=0x50;
3808         *pbyRSN++=0xf2;
3809         if (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) {
3810             *pbyRSN++=WPA_AUTH_PSK;
3811         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA) {
3812             *pbyRSN++=WPA_AUTH_IEEE802_1X;
3813         } else {
3814             *pbyRSN++=WPA_NONE;
3815         }
3816
3817         sFrame.pRSNWPA->len +=6;
3818
3819         // RSN Capabilites
3820         *pbyRSN++=0x00;
3821         *pbyRSN++=0x00;
3822         sFrame.pRSNWPA->len +=2;
3823
3824         sFrame.len += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3825         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3826         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3827         memcpy(pbyIEs, sFrame.pRSNWPA, sFrame.pRSNWPA->len + WLAN_IEHDR_LEN);
3828         pbyIEs += sFrame.pRSNWPA->len + WLAN_IEHDR_LEN;
3829
3830     } else if (((pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
3831                 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) &&
3832                (pMgmt->pCurrBSS != NULL)) {
3833         unsigned int ii;
3834         PWORD               pwPMKID;
3835
3836         /* WPA IE */
3837         sFrame.pRSN = (PWLAN_IE_RSN)(sFrame.pBuf + sFrame.len);
3838         sFrame.pRSN->byElementID = WLAN_EID_RSN;
3839         sFrame.pRSN->len = 6; //Version(2)+GK(4)
3840         sFrame.pRSN->wVersion = 1;
3841         //Group Key Cipher Suite
3842         sFrame.pRSN->abyRSN[0] = 0x00;
3843         sFrame.pRSN->abyRSN[1] = 0x0F;
3844         sFrame.pRSN->abyRSN[2] = 0xAC;
3845         if (pMgmt->byCSSGK == KEY_CTL_WEP) {
3846             sFrame.pRSN->abyRSN[3] = pMgmt->pCurrBSS->byCSSGK;
3847         } else if (pMgmt->byCSSGK == KEY_CTL_TKIP) {
3848             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_TKIP;
3849         } else if (pMgmt->byCSSGK == KEY_CTL_CCMP) {
3850             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_CCMP;
3851         } else {
3852             sFrame.pRSN->abyRSN[3] = WLAN_11i_CSS_UNKNOWN;
3853         }
3854
3855         // Pairwise Key Cipher Suite
3856         sFrame.pRSN->abyRSN[4] = 1;
3857         sFrame.pRSN->abyRSN[5] = 0;
3858         sFrame.pRSN->abyRSN[6] = 0x00;
3859         sFrame.pRSN->abyRSN[7] = 0x0F;
3860         sFrame.pRSN->abyRSN[8] = 0xAC;
3861         if (pMgmt->byCSSPK == KEY_CTL_TKIP) {
3862             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_TKIP;
3863         } else if (pMgmt->byCSSPK == KEY_CTL_CCMP) {
3864             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_CCMP;
3865         } else if (pMgmt->byCSSPK == KEY_CTL_NONE) {
3866             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_USE_GROUP;
3867         } else {
3868             sFrame.pRSN->abyRSN[9] = WLAN_11i_CSS_UNKNOWN;
3869         }
3870         sFrame.pRSN->len += 6;
3871
3872         // Auth Key Management Suite
3873         sFrame.pRSN->abyRSN[10] = 1;
3874         sFrame.pRSN->abyRSN[11] = 0;
3875         sFrame.pRSN->abyRSN[12] = 0x00;
3876         sFrame.pRSN->abyRSN[13] = 0x0F;
3877         sFrame.pRSN->abyRSN[14] = 0xAC;
3878         if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK) {
3879             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_PSK;
3880         } else if (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) {
3881             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_802_1X;
3882         } else {
3883             sFrame.pRSN->abyRSN[15] = WLAN_11i_AKMSS_UNKNOWN;
3884         }
3885         sFrame.pRSN->len +=6;
3886
3887         // RSN Capabilites
3888         if (pMgmt->pCurrBSS->sRSNCapObj.bRSNCapExist == TRUE) {
3889             memcpy(&sFrame.pRSN->abyRSN[16], &pMgmt->pCurrBSS->sRSNCapObj.wRSNCap, 2);
3890         } else {
3891             sFrame.pRSN->abyRSN[16] = 0;
3892             sFrame.pRSN->abyRSN[17] = 0;
3893         }
3894         sFrame.pRSN->len +=2;
3895
3896         if ((pDevice->gsPMKID.BSSIDInfoCount > 0) && (pDevice->bRoaming == TRUE) && (pMgmt->eAuthenMode == WMAC_AUTH_WPA2)) {
3897             // RSN PMKID
3898             pbyRSN = &sFrame.pRSN->abyRSN[18];
3899             pwPMKID = (PWORD)pbyRSN; // Point to PMKID count
3900             *pwPMKID = 0;            // Initialize PMKID count
3901             pbyRSN += 2;             // Point to PMKID list
3902             for (ii = 0; ii < pDevice->gsPMKID.BSSIDInfoCount; ii++) {
3903                 if (!memcmp(&pDevice->gsPMKID.BSSIDInfo[ii].BSSID[0],
3904                             pMgmt->abyCurrBSSID,
3905                             ETH_ALEN)) {
3906                         (*pwPMKID)++;
3907                         memcpy(pbyRSN,
3908                                pDevice->gsPMKID.BSSIDInfo[ii].PMKID,
3909                                16);
3910                         pbyRSN += 16;
3911                 }
3912             }
3913             if (*pwPMKID != 0) {
3914                 sFrame.pRSN->len += (2 + (*pwPMKID)*16);
3915             }
3916         }
3917
3918         sFrame.len += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3919         // copy to AssocInfo. for OID_802_11_ASSOCIATION_INFORMATION
3920         pMgmt->sAssocInfo.AssocInfo.RequestIELength += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3921         memcpy(pbyIEs, sFrame.pRSN, sFrame.pRSN->len + WLAN_IEHDR_LEN);
3922         pbyIEs += sFrame.pRSN->len + WLAN_IEHDR_LEN;
3923     }
3924
3925
3926
3927     /* Adjust the length fields */
3928     pTxPacket->cbMPDULen = sFrame.len;
3929     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
3930
3931     return pTxPacket;
3932 }
3933
3934 /*+
3935  *
3936  * Routine Description:
3937  *  Constructs an assoc-response frame
3938  *
3939  *
3940  * Return Value:
3941  *    PTR to frame; or NULL on allocation failure
3942  *
3943 -*/
3944
3945 PSTxMgmtPacket
3946 s_MgrMakeAssocResponse(
3947      PSDevice pDevice,
3948      PSMgmtObject pMgmt,
3949      WORD wCurrCapInfo,
3950      WORD wAssocStatus,
3951      WORD wAssocAID,
3952      PBYTE pDstAddr,
3953      PWLAN_IE_SUPP_RATES pCurrSuppRates,
3954      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
3955     )
3956 {
3957     PSTxMgmtPacket      pTxPacket = NULL;
3958     WLAN_FR_ASSOCRESP   sFrame;
3959
3960
3961     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
3962     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
3963     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
3964     // Setup the sFrame structure
3965     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
3966     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
3967     vMgrEncodeAssocResponse(&sFrame);
3968     // Setup the header
3969     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
3970         (
3971         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
3972         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_ASSOCRESP)
3973         ));
3974     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
3975     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
3976     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
3977
3978     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
3979     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
3980     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
3981
3982     // Copy the rate set
3983     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3984     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
3985     memcpy(sFrame.pSuppRates,
3986            pCurrSuppRates,
3987            ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
3988           );
3989
3990     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
3991         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
3992         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
3993         memcpy(sFrame.pExtSuppRates,
3994              pCurrExtSuppRates,
3995              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
3996              );
3997     }
3998
3999     // Adjust the length fields
4000     pTxPacket->cbMPDULen = sFrame.len;
4001     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4002
4003     return pTxPacket;
4004 }
4005
4006
4007 /*+
4008  *
4009  * Routine Description:
4010  *  Constructs an reassoc-response frame
4011  *
4012  *
4013  * Return Value:
4014  *    PTR to frame; or NULL on allocation failure
4015  *
4016 -*/
4017
4018
4019 PSTxMgmtPacket
4020 s_MgrMakeReAssocResponse(
4021      PSDevice pDevice,
4022      PSMgmtObject pMgmt,
4023      WORD wCurrCapInfo,
4024      WORD wAssocStatus,
4025      WORD wAssocAID,
4026      PBYTE pDstAddr,
4027      PWLAN_IE_SUPP_RATES pCurrSuppRates,
4028      PWLAN_IE_SUPP_RATES pCurrExtSuppRates
4029     )
4030 {
4031     PSTxMgmtPacket      pTxPacket = NULL;
4032     WLAN_FR_REASSOCRESP   sFrame;
4033
4034
4035     pTxPacket = (PSTxMgmtPacket)pMgmt->pbyMgmtPacketPool;
4036     memset(pTxPacket, 0, sizeof(STxMgmtPacket) + WLAN_ASSOCREQ_FR_MAXLEN);
4037     pTxPacket->p80211Header = (PUWLAN_80211HDR)((PBYTE)pTxPacket + sizeof(STxMgmtPacket));
4038     // Setup the sFrame structure
4039     sFrame.pBuf = (PBYTE)pTxPacket->p80211Header;
4040     sFrame.len = WLAN_REASSOCRESP_FR_MAXLEN;
4041     vMgrEncodeReassocResponse(&sFrame);
4042     // Setup the header
4043     sFrame.pHdr->sA3.wFrameCtl = cpu_to_le16(
4044         (
4045         WLAN_SET_FC_FTYPE(WLAN_TYPE_MGR) |
4046         WLAN_SET_FC_FSTYPE(WLAN_FSTYPE_REASSOCRESP)
4047         ));
4048     memcpy( sFrame.pHdr->sA3.abyAddr1, pDstAddr, WLAN_ADDR_LEN);
4049     memcpy( sFrame.pHdr->sA3.abyAddr2, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
4050     memcpy( sFrame.pHdr->sA3.abyAddr3, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
4051
4052     *sFrame.pwCapInfo = cpu_to_le16(wCurrCapInfo);
4053     *sFrame.pwStatus = cpu_to_le16(wAssocStatus);
4054     *sFrame.pwAid = cpu_to_le16((WORD)(wAssocAID | BIT14 | BIT15));
4055
4056     // Copy the rate set
4057     sFrame.pSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4058     sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN;
4059     memcpy(sFrame.pSuppRates,
4060              pCurrSuppRates,
4061              ((PWLAN_IE_SUPP_RATES)pCurrSuppRates)->len + WLAN_IEHDR_LEN
4062              );
4063
4064     if (((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len != 0) {
4065         sFrame.pExtSuppRates = (PWLAN_IE_SUPP_RATES)(sFrame.pBuf + sFrame.len);
4066         sFrame.len += ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
4067         memcpy(sFrame.pExtSuppRates,
4068              pCurrExtSuppRates,
4069              ((PWLAN_IE_SUPP_RATES)pCurrExtSuppRates)->len + WLAN_IEHDR_LEN
4070              );
4071     }
4072
4073     // Adjust the length fields
4074     pTxPacket->cbMPDULen = sFrame.len;
4075     pTxPacket->cbPayloadLen = sFrame.len - WLAN_HDR_ADDR3_LEN;
4076
4077     return pTxPacket;
4078 }
4079
4080
4081 /*+
4082  *
4083  * Routine Description:
4084  *  Handles probe response management frames.
4085  *
4086  *
4087  * Return Value:
4088  *    none.
4089  *
4090 -*/
4091
4092 static
4093 void
4094 s_vMgrRxProbeResponse(
4095      PSDevice pDevice,
4096      PSMgmtObject pMgmt,
4097      PSRxMgmtPacket pRxPacket
4098     )
4099 {
4100     PKnownBSS           pBSSList = NULL;
4101     WLAN_FR_PROBERESP   sFrame;
4102     BYTE                byCurrChannel = pRxPacket->byRxChannel;
4103     ERPObject           sERP;
4104     BOOL                bChannelHit = TRUE;
4105
4106
4107     memset(&sFrame, 0, sizeof(WLAN_FR_PROBERESP));
4108     // decode the frame
4109     sFrame.len = pRxPacket->cbMPDULen;
4110     sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4111     vMgrDecodeProbeResponse(&sFrame);
4112
4113     if ((sFrame.pqwTimestamp == NULL)
4114         || (sFrame.pwBeaconInterval == NULL)
4115         || (sFrame.pwCapInfo == NULL)
4116         || (sFrame.pSSID == NULL)
4117         || (sFrame.pSuppRates == NULL)) {
4118
4119         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe resp:Fail addr:[%p]\n",
4120                 pRxPacket->p80211Header);
4121         DBG_PORT80(0xCC);
4122         return;
4123     }
4124
4125     if(sFrame.pSSID->len == 0)
4126        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Rx Probe resp: SSID len = 0 \n");
4127
4128
4129     //{{ RobertYu:20050201, 11a  byCurrChannel != sFrame.pDSParms->byCurrChannel mapping
4130     if( byCurrChannel > CB_MAX_CHANNEL_24G )
4131     {
4132         if (sFrame.pDSParms) {
4133                 if (byCurrChannel ==
4134                     RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1])
4135                         bChannelHit = TRUE;
4136                 byCurrChannel =
4137                         RFaby11aChannelIndex[sFrame.pDSParms->byCurrChannel-1];
4138         } else {
4139                 bChannelHit = TRUE;
4140         }
4141     } else {
4142         if (sFrame.pDSParms) {
4143                 if (byCurrChannel == sFrame.pDSParms->byCurrChannel)
4144                         bChannelHit = TRUE;
4145                 byCurrChannel = sFrame.pDSParms->byCurrChannel;
4146         } else {
4147                 bChannelHit = TRUE;
4148         }
4149     }
4150     //RobertYu:20050201
4151
4152 if(ChannelExceedZoneType(pDevice,byCurrChannel)==TRUE)
4153       return;
4154
4155     if (sFrame.pERP) {
4156         sERP.byERP = sFrame.pERP->byContext;
4157         sERP.bERPExist = TRUE;
4158     } else {
4159         sERP.bERPExist = FALSE;
4160         sERP.byERP = 0;
4161     }
4162
4163
4164     // update or insert the bss
4165     pBSSList = BSSpAddrIsInBSSList((void *) pDevice,
4166                                    sFrame.pHdr->sA3.abyAddr3,
4167                                    sFrame.pSSID);
4168     if (pBSSList) {
4169         BSSbUpdateToBSSList((void *) pDevice,
4170                             *sFrame.pqwTimestamp,
4171                             *sFrame.pwBeaconInterval,
4172                             *sFrame.pwCapInfo,
4173                             byCurrChannel,
4174                             bChannelHit,
4175                             sFrame.pSSID,
4176                             sFrame.pSuppRates,
4177                             sFrame.pExtSuppRates,
4178                             &sERP,
4179                             sFrame.pRSN,
4180                             sFrame.pRSNWPA,
4181                             sFrame.pIE_Country,
4182                             sFrame.pIE_Quiet,
4183                             pBSSList,
4184                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4185                             /* payload of probresponse */
4186                             sFrame.pHdr->sA4.abyAddr4,
4187                             (void *) pRxPacket);
4188     } else {
4189         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Probe resp/insert: RxChannel = : %d\n", byCurrChannel);
4190         BSSbInsertToBSSList((void *) pDevice,
4191                             sFrame.pHdr->sA3.abyAddr3,
4192                             *sFrame.pqwTimestamp,
4193                             *sFrame.pwBeaconInterval,
4194                             *sFrame.pwCapInfo,
4195                             byCurrChannel,
4196                             sFrame.pSSID,
4197                             sFrame.pSuppRates,
4198                             sFrame.pExtSuppRates,
4199                             &sERP,
4200                             sFrame.pRSN,
4201                             sFrame.pRSNWPA,
4202                             sFrame.pIE_Country,
4203                             sFrame.pIE_Quiet,
4204                             sFrame.len - WLAN_HDR_ADDR3_LEN,
4205                             sFrame.pHdr->sA4.abyAddr4,   /* payload of beacon */
4206                             (void *) pRxPacket);
4207     }
4208     return;
4209
4210 }
4211
4212 /*+
4213  *
4214  * Routine Description:(AP)or(Ad-hoc STA)
4215  *  Handles probe request management frames.
4216  *
4217  *
4218  * Return Value:
4219  *    none.
4220  *
4221 -*/
4222
4223
4224 static
4225 void
4226 s_vMgrRxProbeRequest(
4227      PSDevice pDevice,
4228      PSMgmtObject pMgmt,
4229      PSRxMgmtPacket pRxPacket
4230     )
4231 {
4232     WLAN_FR_PROBEREQ    sFrame;
4233     CMD_STATUS          Status;
4234     PSTxMgmtPacket      pTxPacket;
4235     BYTE                byPHYType = BB_TYPE_11B;
4236
4237     // STA in Ad-hoc mode: when latest TBTT beacon transmit success,
4238     // STA have to response this request.
4239     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
4240         ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) && pDevice->bBeaconSent)) {
4241
4242         memset(&sFrame, 0, sizeof(WLAN_FR_PROBEREQ));
4243         // decode the frame
4244         sFrame.len = pRxPacket->cbMPDULen;
4245         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
4246         vMgrDecodeProbeRequest(&sFrame);
4247 /*
4248         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%pM\n",
4249                 sFrame.pHdr->sA3.abyAddr2);
4250 */
4251         if (sFrame.pSSID->len != 0) {
4252             if (sFrame.pSSID->len != ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len)
4253                 return;
4254             if (memcmp(sFrame.pSSID->abySSID,
4255                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->abySSID,
4256                        ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len) != 0) {
4257                        return;
4258             }
4259         }
4260
4261         if ((sFrame.pSuppRates->len > 4) || (sFrame.pExtSuppRates != NULL)) {
4262             byPHYType = BB_TYPE_11G;
4263         }
4264
4265         // Probe response reply..
4266         pTxPacket = s_MgrMakeProbeResponse
4267                     (
4268                       pDevice,
4269                       pMgmt,
4270                       pMgmt->wCurrCapInfo,
4271                       pMgmt->wCurrBeaconPeriod,
4272                       pMgmt->uCurrChannel,
4273                       0,
4274                       sFrame.pHdr->sA3.abyAddr2,
4275                       (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4276                       (PBYTE)pMgmt->abyCurrBSSID,
4277                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4278                       (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates,
4279                        byPHYType
4280                     );
4281         if (pTxPacket != NULL ){
4282             /* send the frame */
4283             Status = csMgmt_xmit(pDevice, pTxPacket);
4284             if (Status != CMD_STATUS_PENDING) {
4285                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx failed\n");
4286             }
4287             else {
4288 //                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Mgt:Probe response tx sending..\n");
4289             }
4290         }
4291     }
4292
4293     return;
4294 }
4295
4296 /*+
4297  *
4298  * Routine Description:
4299  *
4300  *  Entry point for the reception and handling of 802.11 management
4301  *  frames. Makes a determination of the frame type and then calls
4302  *  the appropriate function.
4303  *
4304  *
4305  * Return Value:
4306  *    none.
4307  *
4308 -*/
4309
4310 void vMgrRxManagePacket(void *hDeviceContext,
4311                         PSMgmtObject pMgmt,
4312                         PSRxMgmtPacket pRxPacket)
4313 {
4314     PSDevice    pDevice = (PSDevice)hDeviceContext;
4315     BOOL        bInScan = FALSE;
4316     unsigned int        uNodeIndex = 0;
4317     NODE_STATE  eNodeState = 0;
4318     CMD_STATUS  Status;
4319
4320
4321     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
4322         if (BSSbIsSTAInNodeDB(pDevice, pRxPacket->p80211Header->sA3.abyAddr2, &uNodeIndex))
4323             eNodeState = pMgmt->sNodeDBTable[uNodeIndex].eNodeState;
4324     }
4325
4326     switch( WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) ){
4327
4328         case WLAN_FSTYPE_ASSOCREQ:
4329             // Frame Clase = 2
4330             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocreq\n");
4331             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4332                 (eNodeState < NODE_AUTH)) {
4333                 // send deauth notification
4334                 // reason = (6) class 2 received from nonauth sta
4335                 vMgrDeAuthenBeginSta(pDevice,
4336                                      pMgmt,
4337                                      pRxPacket->p80211Header->sA3.abyAddr2,
4338                                      (6),
4339                                      &Status
4340                                      );
4341                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 1\n");
4342             }
4343             else {
4344                 s_vMgrRxAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4345             }
4346             break;
4347
4348         case WLAN_FSTYPE_ASSOCRESP:
4349             // Frame Clase = 2
4350             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp1\n");
4351             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, FALSE);
4352             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx assocresp2\n");
4353             break;
4354
4355         case WLAN_FSTYPE_REASSOCREQ:
4356             // Frame Clase = 2
4357             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocreq\n");
4358             // Todo: reassoc
4359             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4360                (eNodeState < NODE_AUTH)) {
4361                 // send deauth notification
4362                 // reason = (6) class 2 received from nonauth sta
4363                 vMgrDeAuthenBeginSta(pDevice,
4364                                      pMgmt,
4365                                      pRxPacket->p80211Header->sA3.abyAddr2,
4366                                      (6),
4367                                      &Status
4368                                      );
4369                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 2\n");
4370
4371             }
4372             s_vMgrRxReAssocRequest(pDevice, pMgmt, pRxPacket, uNodeIndex);
4373             break;
4374
4375         case WLAN_FSTYPE_REASSOCRESP:
4376             // Frame Clase = 2
4377             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx reassocresp\n");
4378             s_vMgrRxAssocResponse(pDevice, pMgmt, pRxPacket, TRUE);
4379             break;
4380
4381         case WLAN_FSTYPE_PROBEREQ:
4382             // Frame Clase = 0
4383             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx probereq\n");
4384             s_vMgrRxProbeRequest(pDevice, pMgmt, pRxPacket);
4385             break;
4386
4387         case WLAN_FSTYPE_PROBERESP:
4388             // Frame Clase = 0
4389             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx proberesp\n");
4390
4391             s_vMgrRxProbeResponse(pDevice, pMgmt, pRxPacket);
4392             break;
4393
4394         case WLAN_FSTYPE_BEACON:
4395             // Frame Clase = 0
4396             //DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx beacon\n");
4397             if (pMgmt->eScanState != WMAC_NO_SCANNING) {
4398                 bInScan = TRUE;
4399             }
4400             s_vMgrRxBeacon(pDevice, pMgmt, pRxPacket, bInScan);
4401             break;
4402
4403         case WLAN_FSTYPE_ATIM:
4404             // Frame Clase = 1
4405             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx atim\n");
4406             break;
4407
4408         case WLAN_FSTYPE_DISASSOC:
4409             // Frame Clase = 2
4410             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx disassoc\n");
4411             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) &&
4412                 (eNodeState < NODE_AUTH)) {
4413                 // send deauth notification
4414                 // reason = (6) class 2 received from nonauth sta
4415                 vMgrDeAuthenBeginSta(pDevice,
4416                                      pMgmt,
4417                                      pRxPacket->p80211Header->sA3.abyAddr2,
4418                                      (6),
4419                                      &Status
4420                                      );
4421                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wmgr: send vMgrDeAuthenBeginSta 3\n");
4422             }
4423             s_vMgrRxDisassociation(pDevice, pMgmt, pRxPacket);
4424             break;
4425
4426         case WLAN_FSTYPE_AUTHEN:
4427             // Frame Clase = 1
4428             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO  "rx authen\n");
4429             s_vMgrRxAuthentication(pDevice, pMgmt, pRxPacket);
4430             break;
4431
4432         case WLAN_FSTYPE_DEAUTHEN:
4433             // Frame Clase = 1
4434             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx deauthen\n");
4435             s_vMgrRxDeauthentication(pDevice, pMgmt, pRxPacket);
4436             break;
4437
4438         default:
4439             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "rx unknown mgmt\n");
4440     }
4441
4442     return;
4443 }
4444
4445 /*+
4446  *
4447  * Routine Description:
4448  *
4449  *
4450  *  Prepare beacon to send
4451  *
4452  * Return Value:
4453  *    TRUE if success; FALSE if failed.
4454  *
4455 -*/
4456 BOOL bMgrPrepareBeaconToSend(void *hDeviceContext, PSMgmtObject pMgmt)
4457 {
4458     PSDevice            pDevice = (PSDevice)hDeviceContext;
4459     PSTxMgmtPacket      pTxPacket;
4460
4461 //    pDevice->bBeaconBufReady = FALSE;
4462     if (pDevice->bEncryptionEnable || pDevice->bEnable8021x){
4463         pMgmt->wCurrCapInfo |= WLAN_SET_CAP_INFO_PRIVACY(1);
4464     }
4465     else {
4466         pMgmt->wCurrCapInfo &= ~WLAN_SET_CAP_INFO_PRIVACY(1);
4467     }
4468     pTxPacket = s_MgrMakeBeacon
4469                 (
4470                   pDevice,
4471                   pMgmt,
4472                   pMgmt->wCurrCapInfo,
4473                   pMgmt->wCurrBeaconPeriod,
4474                   pMgmt->uCurrChannel,
4475                   pMgmt->wCurrATIMWindow, //0,
4476                   (PWLAN_IE_SSID)pMgmt->abyCurrSSID,
4477                   (PBYTE)pMgmt->abyCurrBSSID,
4478                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates,
4479                   (PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates
4480                 );
4481
4482     if ((pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) &&
4483         (pMgmt->abyCurrBSSID[0] == 0))
4484         return FALSE;
4485
4486     csBeacon_xmit(pDevice, pTxPacket);
4487     MACvRegBitsOn(pDevice, MAC_REG_TCR, TCR_AUTOBCNTX);
4488
4489     return TRUE;
4490 }
4491
4492
4493
4494
4495 /*+
4496  *
4497  * Routine Description:
4498  *
4499  *  Log a warning message based on the contents of the Status
4500  *  Code field of an 802.11 management frame.  Defines are
4501  *  derived from 802.11-1997 SPEC.
4502  *
4503  * Return Value:
4504  *    none.
4505  *
4506 -*/
4507 static
4508 void
4509 s_vMgrLogStatus(
4510      PSMgmtObject pMgmt,
4511      WORD  wStatus
4512     )
4513 {
4514     switch( wStatus ){
4515         case WLAN_MGMT_STATUS_UNSPEC_FAILURE:
4516             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Unspecified error.\n");
4517             break;
4518         case WLAN_MGMT_STATUS_CAPS_UNSUPPORTED:
4519             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Can't support all requested capabilities.\n");
4520             break;
4521         case WLAN_MGMT_STATUS_REASSOC_NO_ASSOC:
4522             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Reassoc denied, can't confirm original Association.\n");
4523             break;
4524         case WLAN_MGMT_STATUS_ASSOC_DENIED_UNSPEC:
4525             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, undefine in spec\n");
4526             break;
4527         case WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG:
4528             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Peer doesn't support authen algorithm.\n");
4529             break;
4530         case WLAN_MGMT_STATUS_RX_AUTH_NOSEQ:
4531             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen frame received out of sequence.\n");
4532             break;
4533         case WLAN_MGMT_STATUS_CHALLENGE_FAIL:
4534             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, challenge  failure.\n");
4535             break;
4536         case WLAN_MGMT_STATUS_AUTH_TIMEOUT:
4537             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Authen rejected, timeout waiting for next frame.\n");
4538             break;
4539         case WLAN_MGMT_STATUS_ASSOC_DENIED_BUSY:
4540             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, AP too busy.\n");
4541             break;
4542         case WLAN_MGMT_STATUS_ASSOC_DENIED_RATES:
4543             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we haven't enough basic rates.\n");
4544             break;
4545         case WLAN_MGMT_STATUS_ASSOC_DENIED_SHORTPREAMBLE:
4546             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support short preamble.\n");
4547             break;
4548         case WLAN_MGMT_STATUS_ASSOC_DENIED_PBCC:
4549             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support PBCC.\n");
4550             break;
4551         case WLAN_MGMT_STATUS_ASSOC_DENIED_AGILITY:
4552             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Status code == Assoc denied, we do not support channel agility.\n");
4553             break;
4554         default:
4555             DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "Unknown status code %d.\n", wStatus);
4556             break;
4557     }
4558 }
4559
4560 /*
4561  *
4562  * Description:
4563  *    Add BSSID in PMKID Candidate list.
4564  *
4565  * Parameters:
4566  *  In:
4567  *      hDeviceContext - device structure point
4568  *      pbyBSSID - BSSID address for adding
4569  *      wRSNCap - BSS's RSN capability
4570  *  Out:
4571  *      none
4572  *
4573  * Return Value: none.
4574  *
4575 -*/
4576
4577 BOOL bAdd_PMKID_Candidate(void *hDeviceContext,
4578                           PBYTE pbyBSSID,
4579                           PSRSNCapObject psRSNCapObj)
4580 {
4581     PSDevice         pDevice = (PSDevice)hDeviceContext;
4582     PPMKID_CANDIDATE pCandidateList;
4583     unsigned int             ii = 0;
4584
4585     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"bAdd_PMKID_Candidate START: (%d)\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4586
4587     if ((pDevice == NULL) || (pbyBSSID == NULL) || (psRSNCapObj == NULL))
4588         return FALSE;
4589
4590     if (pDevice->gsPMKIDCandidate.NumCandidates >= MAX_PMKIDLIST)
4591         return FALSE;
4592
4593
4594
4595     // Update Old Candidate
4596     for (ii = 0; ii < pDevice->gsPMKIDCandidate.NumCandidates; ii++) {
4597         pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[ii];
4598         if (!memcmp(pCandidateList->BSSID, pbyBSSID, ETH_ALEN)) {
4599                 if ((psRSNCapObj->bRSNCapExist == TRUE)
4600                     && (psRSNCapObj->wRSNCap & BIT0)) {
4601                         pCandidateList->Flags |=
4602                                 NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4603                 } else {
4604                         pCandidateList->Flags &=
4605                                 ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4606                 }
4607             return TRUE;
4608         }
4609     }
4610
4611     // New Candidate
4612     pCandidateList = &pDevice->gsPMKIDCandidate.CandidateList[pDevice->gsPMKIDCandidate.NumCandidates];
4613     if ((psRSNCapObj->bRSNCapExist == TRUE) && (psRSNCapObj->wRSNCap & BIT0)) {
4614         pCandidateList->Flags |= NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
4615     } else {
4616         pCandidateList->Flags &= ~(NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED);
4617     }
4618     memcpy(pCandidateList->BSSID, pbyBSSID, ETH_ALEN);
4619     pDevice->gsPMKIDCandidate.NumCandidates++;
4620     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"NumCandidates:%d\n", (int)pDevice->gsPMKIDCandidate.NumCandidates);
4621     return TRUE;
4622 }
4623
4624 /*
4625  *
4626  * Description:
4627  *    Flush PMKID Candidate list.
4628  *
4629  * Parameters:
4630  *  In:
4631  *      hDeviceContext - device structure point
4632  *  Out:
4633  *      none
4634  *
4635  * Return Value: none.
4636  *
4637 -*/
4638
4639 void vFlush_PMKID_Candidate(void *hDeviceContext)
4640 {
4641     PSDevice        pDevice = (PSDevice)hDeviceContext;
4642
4643     if (pDevice == NULL)
4644         return;
4645
4646     memset(&pDevice->gsPMKIDCandidate, 0, sizeof(SPMKIDCandidateEvent));
4647 }
4648
4649 static BOOL
4650 s_bCipherMatch (
4651      PKnownBSS                        pBSSNode,
4652      NDIS_802_11_ENCRYPTION_STATUS    EncStatus,
4653      PBYTE                           pbyCCSPK,
4654      PBYTE                           pbyCCSGK
4655     )
4656 {
4657     BYTE byMulticastCipher = KEY_CTL_INVALID;
4658     BYTE byCipherMask = 0x00;
4659     int i;
4660
4661     if (pBSSNode == NULL)
4662         return FALSE;
4663
4664     // check cap. of BSS
4665     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4666          (EncStatus == Ndis802_11Encryption1Enabled)) {
4667         // default is WEP only
4668         byMulticastCipher = KEY_CTL_WEP;
4669     }
4670
4671     if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4672         (pBSSNode->bWPA2Valid == TRUE) &&
4673
4674         ((EncStatus == Ndis802_11Encryption3Enabled) ||
4675          (EncStatus == Ndis802_11Encryption2Enabled))) {
4676         //WPA2
4677         // check Group Key Cipher
4678         if ((pBSSNode->byCSSGK == WLAN_11i_CSS_WEP40) ||
4679             (pBSSNode->byCSSGK == WLAN_11i_CSS_WEP104)) {
4680             byMulticastCipher = KEY_CTL_WEP;
4681         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_TKIP) {
4682             byMulticastCipher = KEY_CTL_TKIP;
4683         } else if (pBSSNode->byCSSGK == WLAN_11i_CSS_CCMP) {
4684             byMulticastCipher = KEY_CTL_CCMP;
4685         } else {
4686             byMulticastCipher = KEY_CTL_INVALID;
4687         }
4688
4689         /* check Pairwise Key Cipher */
4690         for (i = 0; i < pBSSNode->wCSSPKCount; i++) {
4691                 if ((pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP40) ||
4692                     (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_WEP104)) {
4693                         /* this should not happen as defined 802.11i */
4694                         byCipherMask |= 0x01;
4695                 } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_TKIP) {
4696                         byCipherMask |= 0x02;
4697                 } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_CCMP) {
4698                         byCipherMask |= 0x04;
4699                 } else if (pBSSNode->abyCSSPK[i] == WLAN_11i_CSS_USE_GROUP) {
4700                         /* use group key only ignore all others */
4701                         byCipherMask = 0;
4702                         i = pBSSNode->wCSSPKCount;
4703                 }
4704         }
4705
4706     } else if ((WLAN_GET_CAP_INFO_PRIVACY(pBSSNode->wCapInfo) != 0) &&
4707                 (pBSSNode->bWPAValid == TRUE) &&
4708                 ((EncStatus == Ndis802_11Encryption2Enabled) || (EncStatus == Ndis802_11Encryption3Enabled))) {
4709         //WPA
4710         // check Group Key Cipher
4711         if ((pBSSNode->byGKType == WPA_WEP40) ||
4712             (pBSSNode->byGKType == WPA_WEP104)) {
4713             byMulticastCipher = KEY_CTL_WEP;
4714         } else if (pBSSNode->byGKType == WPA_TKIP) {
4715             byMulticastCipher = KEY_CTL_TKIP;
4716         } else if (pBSSNode->byGKType == WPA_AESCCMP) {
4717             byMulticastCipher = KEY_CTL_CCMP;
4718         } else {
4719             byMulticastCipher = KEY_CTL_INVALID;
4720         }
4721
4722         /* check Pairwise Key Cipher */
4723         for (i = 0; i < pBSSNode->wPKCount; i++) {
4724                 if (pBSSNode->abyPKType[i] == WPA_TKIP) {
4725                         byCipherMask |= 0x02;
4726                 } else if (pBSSNode->abyPKType[i] == WPA_AESCCMP) {
4727                         byCipherMask |= 0x04;
4728                 } else if (pBSSNode->abyPKType[i] == WPA_NONE) {
4729                         /* use group key only ignore all others */
4730                         byCipherMask = 0;
4731                         i = pBSSNode->wPKCount;
4732                 }
4733         }
4734     }
4735
4736     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"%d, %d, %d, %d, EncStatus:%d\n",
4737         byMulticastCipher, byCipherMask, pBSSNode->bWPAValid, pBSSNode->bWPA2Valid, EncStatus);
4738
4739     // mask our cap. with BSS
4740     if (EncStatus == Ndis802_11Encryption1Enabled) {
4741
4742         // For supporting Cisco migration mode, don't care pairwise key cipher
4743         //if ((byMulticastCipher == KEY_CTL_WEP) &&
4744         //    (byCipherMask == 0)) {
4745         if ((byMulticastCipher == KEY_CTL_WEP) &&
4746             (byCipherMask == 0)) {
4747             *pbyCCSGK = KEY_CTL_WEP;
4748             *pbyCCSPK = KEY_CTL_NONE;
4749             return TRUE;
4750         } else {
4751             return FALSE;
4752         }
4753
4754     } else if (EncStatus == Ndis802_11Encryption2Enabled) {
4755         if ((byMulticastCipher == KEY_CTL_TKIP) &&
4756             (byCipherMask == 0)) {
4757             *pbyCCSGK = KEY_CTL_TKIP;
4758             *pbyCCSPK = KEY_CTL_NONE;
4759             return TRUE;
4760         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4761                    ((byCipherMask & 0x02) != 0)) {
4762             *pbyCCSGK = KEY_CTL_WEP;
4763             *pbyCCSPK = KEY_CTL_TKIP;
4764             return TRUE;
4765         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4766                    ((byCipherMask & 0x02) != 0)) {
4767             *pbyCCSGK = KEY_CTL_TKIP;
4768             *pbyCCSPK = KEY_CTL_TKIP;
4769             return TRUE;
4770         } else {
4771             return FALSE;
4772         }
4773     } else if (EncStatus == Ndis802_11Encryption3Enabled) {
4774         if ((byMulticastCipher == KEY_CTL_CCMP) &&
4775             (byCipherMask == 0)) {
4776             // When CCMP is enable, "Use group cipher suite" shall not be a valid option.
4777             return FALSE;
4778         } else if ((byMulticastCipher == KEY_CTL_WEP) &&
4779                    ((byCipherMask & 0x04) != 0)) {
4780             *pbyCCSGK = KEY_CTL_WEP;
4781             *pbyCCSPK = KEY_CTL_CCMP;
4782             return TRUE;
4783         } else if ((byMulticastCipher == KEY_CTL_TKIP) &&
4784                    ((byCipherMask & 0x04) != 0)) {
4785             *pbyCCSGK = KEY_CTL_TKIP;
4786             *pbyCCSPK = KEY_CTL_CCMP;
4787             return TRUE;
4788         } else if ((byMulticastCipher == KEY_CTL_CCMP) &&
4789                    ((byCipherMask & 0x04) != 0)) {
4790             *pbyCCSGK = KEY_CTL_CCMP;
4791             *pbyCCSPK = KEY_CTL_CCMP;
4792             return TRUE;
4793         } else {
4794             return FALSE;
4795         }
4796     }
4797     return TRUE;
4798 }
4799
4800