git.oblomov.eu Git - linux-2.6/blob - drivers/staging/rt2870/sta/assoc.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         assoc.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John            2004-9-3                porting from RT2500
  36 */
  37 #include "../rt_config.h"
  38
  39 UCHAR   CipherWpaTemplate[] = {
  40                 0xdd,                                   // WPA IE
  41                 0x16,                                   // Length
  42                 0x00, 0x50, 0xf2, 0x01, // oui
  43                 0x01, 0x00,                             // Version
  44                 0x00, 0x50, 0xf2, 0x02, // Multicast
  45                 0x01, 0x00,                             // Number of unicast
  46                 0x00, 0x50, 0xf2, 0x02, // unicast
  47                 0x01, 0x00,                             // number of authentication method
  48                 0x00, 0x50, 0xf2, 0x01  // authentication
  49                 };
  50
  51 UCHAR   CipherWpa2Template[] = {
  52                 0x30,                                   // RSN IE
  53                 0x14,                                   // Length
  54                 0x01, 0x00,                             // Version
  55                 0x00, 0x0f, 0xac, 0x02, // group cipher, TKIP
  56                 0x01, 0x00,                             // number of pairwise
  57                 0x00, 0x0f, 0xac, 0x02, // unicast
  58                 0x01, 0x00,                             // number of authentication method
  59                 0x00, 0x0f, 0xac, 0x02, // authentication
  60                 0x00, 0x00,                             // RSN capability
  61                 };
  62
  63 UCHAR   Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02};
  64
  65 /*
  66         ==========================================================================
  67         Description:
  68                 association state machine init, including state transition and timer init
  69         Parameters:
  70                 S - pointer to the association state machine
  71
  72         IRQL = PASSIVE_LEVEL
  73
  74         ==========================================================================
  75  */
  76 VOID AssocStateMachineInit(
  77         IN      PRTMP_ADAPTER   pAd,
  78         IN  STATE_MACHINE *S,
  79         OUT STATE_MACHINE_FUNC Trans[])
  80 {
  81         StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG, (STATE_MACHINE_FUNC)Drop, ASSOC_IDLE, ASSOC_MACHINE_BASE);
  82
  83         // first column
  84         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)MlmeAssocReqAction);
  85         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)MlmeReassocReqAction);
  86         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)MlmeDisassocReqAction);
  87         StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
  88
  89         // second column
  90         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
  91         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
  92         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
  93         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
  94         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
  95         //
  96         // Patch 3Com AP MOde:3CRWE454G72
  97         // We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp.
  98         //
  99         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
 100         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT, (STATE_MACHINE_FUNC)AssocTimeoutAction);
 101
 102         // third column
 103         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
 104         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
 105         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
 106         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
 107         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
 108         //
 109         // Patch, AP doesn't send Reassociate Rsp frame to Station.
 110         //
 111         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
 112         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT, (STATE_MACHINE_FUNC)ReassocTimeoutAction);
 113
 114         // fourth column
 115         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
 116         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
 117         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
 118         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
 119         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT, (STATE_MACHINE_FUNC)DisassocTimeoutAction);
 120
 121         // initialize the timer
 122         RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer, GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
 123         RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer, GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
 124         RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer, GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
 125 }
 126
 127 /*
 128         ==========================================================================
 129         Description:
 130                 Association timeout procedure. After association timeout, this function
 131                 will be called and it will put a message into the MLME queue
 132         Parameters:
 133                 Standard timer parameters
 134
 135         IRQL = DISPATCH_LEVEL
 136
 137         ==========================================================================
 138  */
 139 VOID AssocTimeout(IN PVOID SystemSpecific1,
 140                                  IN PVOID FunctionContext,
 141                                  IN PVOID SystemSpecific2,
 142                                  IN PVOID SystemSpecific3)
 143 {
 144         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 145
 146         // Do nothing if the driver is starting halt state.
 147         // This might happen when timer already been fired before cancel timer with mlmehalt
 148         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 149                 return;
 150
 151         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
 152         RT28XX_MLME_HANDLER(pAd);
 153 }
 154
 155 /*
 156         ==========================================================================
 157         Description:
 158                 Reassociation timeout procedure. After reassociation timeout, this
 159                 function will be called and put a message into the MLME queue
 160         Parameters:
 161                 Standard timer parameters
 162
 163         IRQL = DISPATCH_LEVEL
 164
 165         ==========================================================================
 166  */
 167 VOID ReassocTimeout(IN PVOID SystemSpecific1,
 168                                         IN PVOID FunctionContext,
 169                                         IN PVOID SystemSpecific2,
 170                                         IN PVOID SystemSpecific3)
 171 {
 172         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 173
 174         // Do nothing if the driver is starting halt state.
 175         // This might happen when timer already been fired before cancel timer with mlmehalt
 176         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 177                 return;
 178
 179         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
 180         RT28XX_MLME_HANDLER(pAd);
 181 }
 182
 183 /*
 184         ==========================================================================
 185         Description:
 186                 Disassociation timeout procedure. After disassociation timeout, this
 187                 function will be called and put a message into the MLME queue
 188         Parameters:
 189                 Standard timer parameters
 190
 191         IRQL = DISPATCH_LEVEL
 192
 193         ==========================================================================
 194  */
 195 VOID DisassocTimeout(IN PVOID SystemSpecific1,
 196                                         IN PVOID FunctionContext,
 197                                         IN PVOID SystemSpecific2,
 198                                         IN PVOID SystemSpecific3)
 199 {
 200         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 201
 202         // Do nothing if the driver is starting halt state.
 203         // This might happen when timer already been fired before cancel timer with mlmehalt
 204         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 205                 return;
 206
 207         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
 208         RT28XX_MLME_HANDLER(pAd);
 209 }
 210
 211 /*
 212         ==========================================================================
 213         Description:
 214                 mlme assoc req handling procedure
 215         Parameters:
 216                 Adapter - Adapter pointer
 217                 Elem - MLME Queue Element
 218         Pre:
 219                 the station has been authenticated and the following information is stored in the config
 220                         -# SSID
 221                         -# supported rates and their length
 222                         -# listen interval (Adapter->StaCfg.default_listen_count)
 223                         -# Transmit power  (Adapter->StaCfg.tx_power)
 224         Post  :
 225                 -# An association request frame is generated and sent to the air
 226                 -# Association timer starts
 227                 -# Association state -> ASSOC_WAIT_RSP
 228
 229         IRQL = DISPATCH_LEVEL
 230
 231         ==========================================================================
 232  */
 233 VOID MlmeAssocReqAction(
 234         IN PRTMP_ADAPTER pAd,
 235         IN MLME_QUEUE_ELEM *Elem)
 236 {
 237         UCHAR                   ApAddr[6];
 238         HEADER_802_11   AssocHdr;
 239         UCHAR                   Ccx2Len = 5;
 240         UCHAR                   WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
 241         USHORT                  ListenIntv;
 242         ULONG                   Timeout;
 243         USHORT                  CapabilityInfo;
 244         BOOLEAN                 TimerCancelled;
 245         PUCHAR                  pOutBuffer = NULL;
 246         NDIS_STATUS             NStatus;
 247         ULONG                   FrameLen = 0;
 248         ULONG                   tmp;
 249         USHORT                  VarIesOffset;
 250         UCHAR                   CkipFlag;
 251         UCHAR                   CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH];
 252         UCHAR                   AironetCkipIe = IE_AIRONET_CKIP;
 253         UCHAR                   AironetCkipLen = CKIP_NEGOTIATION_LENGTH;
 254         UCHAR                   AironetIPAddressIE = IE_AIRONET_IPADDRESS;
 255         UCHAR                   AironetIPAddressLen = AIRONET_IPADDRESS_LENGTH;
 256         UCHAR                   AironetIPAddressBuffer[AIRONET_IPADDRESS_LENGTH] = {0x00, 0x40, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
 257         USHORT                  Status;
 258
 259         // Block all authentication request durning WPA block period
 260         if (pAd->StaCfg.bBlockAssoc == TRUE)
 261         {
 262                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block Assoc request durning WPA block period!\n"));
 263                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 264                 Status = MLME_STATE_MACHINE_REJECT;
 265                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 266         }
 267         // check sanity first
 268         else if (MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
 269         {
 270                 RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
 271                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 272
 273                 // Get an unused nonpaged memory
 274                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
 275                 if (NStatus != NDIS_STATUS_SUCCESS)
 276                 {
 277                         DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
 278                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 279                         Status = MLME_FAIL_NO_RESOURCE;
 280                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 281                         return;
 282                 }
 283
 284                 // Add by James 03/06/27
 285                 pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 286                 // Association don't need to report MAC address
 287                 pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
 288                         NDIS_802_11_AI_REQFI_CAPABILITIES | NDIS_802_11_AI_REQFI_LISTENINTERVAL;
 289                 pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities = CapabilityInfo;
 290                 pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval = ListenIntv;
 291                 // Only reassociate need this
 292                 //COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr);
 293                 pAd->StaCfg.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 294
 295         NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
 296                 // First add SSID
 297                 VarIesOffset = 0;
 298                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe, 1);
 299                 VarIesOffset += 1;
 300                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SsidLen, 1);
 301                 VarIesOffset += 1;
 302                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
 303                 VarIesOffset += pAd->MlmeAux.SsidLen;
 304
 305                 // Second add Supported rates
 306                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe, 1);
 307                 VarIesOffset += 1;
 308                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SupRateLen, 1);
 309                 VarIesOffset += 1;
 310                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
 311                 VarIesOffset += pAd->MlmeAux.SupRateLen;
 312                 // End Add by James
 313
 314         if ((pAd->CommonCfg.Channel > 14) &&
 315             (pAd->CommonCfg.bIEEE80211H == TRUE))
 316             CapabilityInfo |= 0x0100;
 317
 318                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
 319                 MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr, ApAddr);
 320
 321                 // Build basic frame first
 322                 MakeOutgoingFrame(pOutBuffer,                           &FrameLen,
 323                                                   sizeof(HEADER_802_11),        &AssocHdr,
 324                                                   2,                                            &CapabilityInfo,
 325                                                   2,                                            &ListenIntv,
 326                                                   1,                                            &SsidIe,
 327                                                   1,                                            &pAd->MlmeAux.SsidLen,
 328                                                   pAd->MlmeAux.SsidLen,         pAd->MlmeAux.Ssid,
 329                                                   1,                                            &SupRateIe,
 330                                                   1,                                            &pAd->MlmeAux.SupRateLen,
 331                                                   pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
 332                                                   END_OF_ARGS);
 333
 334                 if (pAd->MlmeAux.ExtRateLen != 0)
 335                 {
 336                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 337                                                           1,                        &ExtRateIe,
 338                                                           1,                        &pAd->MlmeAux.ExtRateLen,
 339                                                           pAd->MlmeAux.ExtRateLen,  pAd->MlmeAux.ExtRate,
 340                                                           END_OF_ARGS);
 341                         FrameLen += tmp;
 342                 }
 343
 344 #ifdef DOT11_N_SUPPORT
 345                 // HT
 346                 if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
 347                 {
 348                         ULONG TmpLen;
 349                         UCHAR HtLen;
 350                         UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
 351                         if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
 352                         {
 353                                 HtLen = SIZE_HT_CAP_IE + 4;
 354                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 355                                                           1,                                &WpaIe,
 356                                                           1,                                &HtLen,
 357                                                           4,                                &BROADCOM[0],
 358                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 359                                                           END_OF_ARGS);
 360                         }
 361                         else
 362                         {
 363 #ifdef RT_BIG_ENDIAN
 364                         HT_CAPABILITY_IE HtCapabilityTmp;
 365 #endif
 366
 367 #ifndef RT_BIG_ENDIAN
 368                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 369                                                           1,                                &HtCapIe,
 370                                                           1,                                &pAd->MlmeAux.HtCapabilityLen,
 371                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 372                                                           END_OF_ARGS);
 373 #else
 374                 NdisZeroMemory(&HtCapabilityTmp, sizeof(HT_CAPABILITY_IE));
 375                 NdisMoveMemory(&HtCapabilityTmp, &pAd->MlmeAux.HtCapability, pAd->MlmeAux.HtCapabilityLen);
 376                         *(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
 377                         *(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
 378
 379                         MakeOutgoingFrame(pOutBuffer + FrameLen,         &TmpLen,
 380                                                                 1,                           &HtCapIe,
 381                                                                 1,                           &pAd->MlmeAux.HtCapabilityLen,
 382                                                                 pAd->MlmeAux.HtCapabilityLen,&HtCapabilityTmp,
 383                                                                 END_OF_ARGS);
 384 #endif
 385                         }
 386                         FrameLen += TmpLen;
 387                 }
 388 #endif // DOT11_N_SUPPORT //
 389
 390                 // add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
 391                 // Case I: (Aggregation + Piggy-Back)
 392                 // 1. user enable aggregation, AND
 393                 // 2. Mac support piggy-back
 394                 // 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
 395                 // Case II: (Aggregation)
 396                 // 1. user enable aggregation, AND
 397                 // 2. AP annouces it's AGGREGATION-capable in BEACON
 398                 if (pAd->CommonCfg.bAggregationCapable)
 399                 {
 400                         if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
 401                         {
 402                                 ULONG TmpLen;
 403                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
 404                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 405                                                                   9,                             RalinkIe,
 406                                                                   END_OF_ARGS);
 407                                 FrameLen += TmpLen;
 408                         }
 409                         else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
 410                         {
 411                                 ULONG TmpLen;
 412                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
 413                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 414                                                                   9,                             RalinkIe,
 415                                                                   END_OF_ARGS);
 416                                 FrameLen += TmpLen;
 417                         }
 418                 }
 419                 else
 420                 {
 421                         ULONG TmpLen;
 422                         UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06, 0x00, 0x00, 0x00};
 423                         MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 424                                                           9,                                             RalinkIe,
 425                                                           END_OF_ARGS);
 426                         FrameLen += TmpLen;
 427                 }
 428
 429                 if (pAd->MlmeAux.APEdcaParm.bValid)
 430                 {
 431                         if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
 432                         {
 433                                 QBSS_STA_INFO_PARM QosInfo;
 434
 435                                 NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
 436                                 QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 437                                 QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 438                                 QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 439                                 QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
 440                                 QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
 441                                 WmeIe[8] |= *(PUCHAR)&QosInfo;
 442                         }
 443                         else
 444                         {
 445                 // The Parameter Set Count is set to ¡§0¡¨ in the association request frames
 446                 // WmeIe[8] |= (pAd->MlmeAux.APEdcaParm.EdcaUpdateCount & 0x0f);
 447                         }
 448
 449                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 450                                                           9,                        &WmeIe[0],
 451                                                           END_OF_ARGS);
 452                         FrameLen += tmp;
 453                 }
 454
 455                 //
 456                 // Let WPA(#221) Element ID on the end of this association frame.
 457                 // Otherwise some AP will fail on parsing Element ID and set status fail on Assoc Rsp.
 458                 // For example: Put Vendor Specific IE on the front of WPA IE.
 459                 // This happens on AP (Model No:Linksys WRK54G)
 460                 //
 461                 if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
 462             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
 463             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
 464             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
 465                         )
 466             )
 467                 {
 468                         UCHAR RSNIe = IE_WPA;
 469
 470                         if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
 471                 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
 472                         {
 473                                 RSNIe = IE_WPA2;
 474                         }
 475
 476                 RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
 477
 478             // Check for WPA PMK cache list
 479                         if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
 480                         {
 481                             INT     idx;
 482                 BOOLEAN FoundPMK = FALSE;
 483                                 // Search chched PMKID, append it if existed
 484                                 for (idx = 0; idx < PMKID_NO; idx++)
 485                                 {
 486                                         if (NdisEqualMemory(ApAddr, &pAd->StaCfg.SavedPMK[idx].BSSID, 6))
 487                                         {
 488                                                 FoundPMK = TRUE;
 489                                                 break;
 490                                         }
 491                                 }
 492
 493                                 if (FoundPMK)
 494                                 {
 495                                         // Set PMK number
 496                                         *(PUSHORT) &pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len] = 1;
 497                                         NdisMoveMemory(&pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len + 2], &pAd->StaCfg.SavedPMK[idx].PMKID, 16);
 498                     pAd->StaCfg.RSNIE_Len += 18;
 499                                 }
 500                         }
 501
 502                         {
 503                                 MakeOutgoingFrame(pOutBuffer + FrameLen,                &tmp,
 504                                                         1,                              &RSNIe,
 505                                                 1,                              &pAd->StaCfg.RSNIE_Len,
 506                                                 pAd->StaCfg.RSNIE_Len,                  pAd->StaCfg.RSN_IE,
 507                                                 END_OF_ARGS);
 508                         }
 509
 510                         FrameLen += tmp;
 511
 512                         {
 513                     // Append Variable IE
 514                     NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &RSNIe, 1);
 515                     VarIesOffset += 1;
 516                     NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->StaCfg.RSNIE_Len, 1);
 517                     VarIesOffset += 1;
 518                         }
 519                         NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
 520                         VarIesOffset += pAd->StaCfg.RSNIE_Len;
 521
 522                         // Set Variable IEs Length
 523                         pAd->StaCfg.ReqVarIELen = VarIesOffset;
 524                 }
 525
 526                 // We have update that at PeerBeaconAtJoinRequest()
 527                 CkipFlag = pAd->StaCfg.CkipFlag;
 528                 if (CkipFlag != 0)
 529                 {
 530                         NdisZeroMemory(CkipNegotiationBuffer, CKIP_NEGOTIATION_LENGTH);
 531                         CkipNegotiationBuffer[2] = 0x66;
 532                         // Make it try KP & MIC, since we have to follow the result from AssocRsp
 533                         CkipNegotiationBuffer[8] = 0x18;
 534                         CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH - 1] = 0x22;
 535                         CkipFlag = 0x18;
 536
 537                         MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 538                                                 1,                                                              &AironetCkipIe,
 539                                                 1,                                                              &AironetCkipLen,
 540                                                 AironetCkipLen,                                 CkipNegotiationBuffer,
 541                                                 END_OF_ARGS);
 542                         FrameLen += tmp;
 543                 }
 544
 545                 // Add CCX v2 request if CCX2 admin state is on
 546                 if (pAd->StaCfg.CCXControl.field.Enable == 1)
 547                 {
 548
 549                         //
 550                         // Add AironetIPAddressIE for Cisco CCX 2.X
 551                         // Add CCX Version
 552                         //
 553                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 554                                                 1,                                                      &AironetIPAddressIE,
 555                                                 1,                                                      &AironetIPAddressLen,
 556                                                 AironetIPAddressLen,            AironetIPAddressBuffer,
 557                                                 1,                                                      &Ccx2Ie,
 558                                                 1,                                                      &Ccx2Len,
 559                                                 Ccx2Len,                                    Ccx2IeInfo,
 560                                                 END_OF_ARGS);
 561                         FrameLen += tmp;
 562
 563                         //
 564                         // Add CipherSuite CCKM or LeapTkip if setting.
 565                         //
 566 #ifdef LEAP_SUPPORT
 567                         if (LEAP_CCKM_ON(pAd))
 568                         {
 569                                 MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 570                                                 CipherSuiteCiscoCCKMLen,                CipherSuiteCiscoCCKM,
 571                                                 END_OF_ARGS);
 572                                 FrameLen += tmp;
 573
 574                                 // Third add RSN
 575                                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, CipherSuiteCiscoCCKM, CipherSuiteCiscoCCKMLen); //Save CipherSuite
 576                                 VarIesOffset += CipherSuiteCiscoCCKMLen;
 577                         }
 578                         else if ((pAd->StaCfg.LeapAuthMode == CISCO_AuthModeLEAP) && (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled))
 579                         {
 580                                 MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 581                                                 CipherSuiteCCXTkipLen,      CipherSuiteCCXTkip,
 582                                                 END_OF_ARGS);
 583                                 FrameLen += tmp;
 584
 585                                 // Third add RSN
 586                                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, CipherSuiteCCXTkip, CipherSuiteCCXTkipLen);
 587                                 VarIesOffset += CipherSuiteCCXTkipLen;
 588                         }
 589 #endif // LEAP_SUPPORT //
 590
 591                         // Add by James 03/06/27
 592                         // Set Variable IEs Length
 593                         pAd->StaCfg.ReqVarIELen = VarIesOffset;
 594                         pAd->StaCfg.AssocInfo.RequestIELength = VarIesOffset;
 595
 596                         // OffsetResponseIEs follow ReqVarIE
 597                         pAd->StaCfg.AssocInfo.OffsetResponseIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION) + pAd->StaCfg.ReqVarIELen;
 598                         // End Add by James
 599                 }
 600
 601
 602                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 603                 MlmeFreeMemory(pAd, pOutBuffer);
 604
 605                 RTMPSetTimer(&pAd->MlmeAux.AssocTimer, Timeout);
 606                 pAd->Mlme.AssocMachine.CurrState = ASSOC_WAIT_RSP;
 607         }
 608         else
 609         {
 610                 DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() sanity check failed. BUG!!!!!! \n"));
 611                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 612                 Status = MLME_INVALID_FORMAT;
 613                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 614         }
 615
 616 }
 617
 618 /*
 619         ==========================================================================
 620         Description:
 621                 mlme reassoc req handling procedure
 622         Parameters:
 623                 Elem -
 624         Pre:
 625                 -# SSID  (Adapter->StaCfg.ssid[])
 626                 -# BSSID (AP address, Adapter->StaCfg.bssid)
 627                 -# Supported rates (Adapter->StaCfg.supported_rates[])
 628                 -# Supported rates length (Adapter->StaCfg.supported_rates_len)
 629                 -# Tx power (Adapter->StaCfg.tx_power)
 630
 631         IRQL = DISPATCH_LEVEL
 632
 633         ==========================================================================
 634  */
 635 VOID MlmeReassocReqAction(
 636         IN PRTMP_ADAPTER pAd,
 637         IN MLME_QUEUE_ELEM *Elem)
 638 {
 639         UCHAR                   ApAddr[6];
 640         HEADER_802_11   ReassocHdr;
 641         UCHAR                   Ccx2Len = 5;
 642         UCHAR                   WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
 643         USHORT                  CapabilityInfo, ListenIntv;
 644         ULONG                   Timeout;
 645         ULONG                   FrameLen = 0;
 646         BOOLEAN                 TimerCancelled;
 647         NDIS_STATUS             NStatus;
 648         ULONG                   tmp;
 649         PUCHAR                  pOutBuffer = NULL;
 650 //CCX 2.X
 651 #ifdef LEAP_SUPPORT
 652         UCHAR                   CkipFlag;
 653         UCHAR                   CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH];
 654         UCHAR                   AironetCkipIe = IE_AIRONET_CKIP;
 655         UCHAR                   AironetCkipLen = CKIP_NEGOTIATION_LENGTH;
 656         UCHAR                   AironetIPAddressIE = IE_AIRONET_IPADDRESS;
 657         UCHAR                   AironetIPAddressLen = AIRONET_IPADDRESS_LENGTH;
 658         UCHAR                   AironetIPAddressBuffer[AIRONET_IPADDRESS_LENGTH] = {0x00, 0x40, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
 659         UCHAR                   AironetCCKMReassocIE = IE_AIRONET_CCKMREASSOC;
 660         UCHAR                   AironetCCKMReassocLen = AIRONET_CCKMREASSOC_LENGTH;
 661         UCHAR                   AironetCCKMReassocBuffer[AIRONET_CCKMREASSOC_LENGTH];
 662         UCHAR                   AironetOUI[] = {0x00, 0x40, 0x96, 0x00};
 663         UCHAR                   MICMN[16];
 664         UCHAR                   CalcMicBuffer[80];
 665         ULONG                   CalcMicBufferLen = 0;
 666 #endif // LEAP_SUPPORT //
 667         USHORT                  Status;
 668
 669         // Block all authentication request durning WPA block period
 670         if (pAd->StaCfg.bBlockAssoc == TRUE)
 671         {
 672                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block ReAssoc request durning WPA block period!\n"));
 673                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 674                 Status = MLME_STATE_MACHINE_REJECT;
 675                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 676         }
 677         // the parameters are the same as the association
 678         else if(MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
 679         {
 680                 RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
 681
 682                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
 683                 if(NStatus != NDIS_STATUS_SUCCESS)
 684                 {
 685                         DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() allocate memory failed \n"));
 686                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 687                         Status = MLME_FAIL_NO_RESOURCE;
 688                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 689                         return;
 690                 }
 691
 692                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 693
 694                 // make frame, use bssid as the AP address??
 695                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send RE-ASSOC request...\n"));
 696                 MgtMacHeaderInit(pAd, &ReassocHdr, SUBTYPE_REASSOC_REQ, 0, ApAddr, ApAddr);
 697                 MakeOutgoingFrame(pOutBuffer,               &FrameLen,
 698                                                   sizeof(HEADER_802_11),    &ReassocHdr,
 699                                                   2,                        &CapabilityInfo,
 700                                                   2,                        &ListenIntv,
 701                                                   MAC_ADDR_LEN,             ApAddr,
 702                                                   1,                        &SsidIe,
 703                                                   1,                        &pAd->MlmeAux.SsidLen,
 704                                                   pAd->MlmeAux.SsidLen,     pAd->MlmeAux.Ssid,
 705                                                   1,                        &SupRateIe,
 706                                                   1,                                            &pAd->MlmeAux.SupRateLen,
 707                                                   pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
 708                                                   END_OF_ARGS);
 709
 710                 if (pAd->MlmeAux.ExtRateLen != 0)
 711                 {
 712                         MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 713                                                           1,                            &ExtRateIe,
 714                                                           1,                            &pAd->MlmeAux.ExtRateLen,
 715                                                           pAd->MlmeAux.ExtRateLen,          pAd->MlmeAux.ExtRate,
 716                                                           END_OF_ARGS);
 717                         FrameLen += tmp;
 718                 }
 719
 720                 if (pAd->MlmeAux.APEdcaParm.bValid)
 721                 {
 722                         if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
 723                         {
 724                                 QBSS_STA_INFO_PARM QosInfo;
 725
 726                                 NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
 727                                 QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 728                                 QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 729                                 QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 730                                 QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
 731                                 QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
 732                                 WmeIe[8] |= *(PUCHAR)&QosInfo;
 733                         }
 734
 735                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 736                                                           9,                        &WmeIe[0],
 737                                                           END_OF_ARGS);
 738                         FrameLen += tmp;
 739                 }
 740
 741 #ifdef DOT11_N_SUPPORT
 742                 // HT
 743                 if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
 744                 {
 745                         ULONG TmpLen;
 746                         UCHAR HtLen;
 747                         UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
 748                         if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
 749                         {
 750                                 HtLen = SIZE_HT_CAP_IE + 4;
 751                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 752                                                           1,                                &WpaIe,
 753                                                           1,                                &HtLen,
 754                                                           4,                                &BROADCOM[0],
 755                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 756                                                           END_OF_ARGS);
 757                         }
 758                         else
 759                         {
 760                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 761                                                           1,                                &HtCapIe,
 762                                                           1,                                &pAd->MlmeAux.HtCapabilityLen,
 763                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 764                                                           END_OF_ARGS);
 765                         }
 766                         FrameLen += TmpLen;
 767                 }
 768 #endif // DOT11_N_SUPPORT //
 769
 770                 // add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
 771                 // Case I: (Aggregation + Piggy-Back)
 772                 // 1. user enable aggregation, AND
 773                 // 2. Mac support piggy-back
 774                 // 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
 775                 // Case II: (Aggregation)
 776                 // 1. user enable aggregation, AND
 777                 // 2. AP annouces it's AGGREGATION-capable in BEACON
 778                 if (pAd->CommonCfg.bAggregationCapable)
 779                 {
 780                         if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
 781                         {
 782                                 ULONG TmpLen;
 783                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
 784                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 785                                                                   9,                             RalinkIe,
 786                                                                   END_OF_ARGS);
 787                                 FrameLen += TmpLen;
 788                         }
 789                         else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
 790                         {
 791                                 ULONG TmpLen;
 792                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
 793                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 794                                                                   9,                             RalinkIe,
 795                                                                   END_OF_ARGS);
 796                                 FrameLen += TmpLen;
 797                         }
 798                 }
 799                 else
 800                 {
 801                         ULONG TmpLen;
 802                         UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x04, 0x00, 0x00, 0x00};
 803                         MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 804                                                           9,                                             RalinkIe,
 805                                                           END_OF_ARGS);
 806                         FrameLen += TmpLen;
 807                 }
 808 #ifdef LEAP_SUPPORT
 809                 if (LEAP_CCKM_ON(pAd) && (pAd->StaCfg.CCKMLinkUpFlag == TRUE))
 810                 {
 811                         CkipFlag = pAd->StaCfg.CkipFlag;        // We have update that at PeerBeaconAtJoinRequest()
 812                         if (CkipFlag != 0)
 813                         {
 814                                 NdisZeroMemory(CkipNegotiationBuffer, CKIP_NEGOTIATION_LENGTH);
 815                                 CkipNegotiationBuffer[2] = 0x66;
 816                                 // Make it try KP & MIC, since we have to follow the result from AssocRsp
 817                                 CkipNegotiationBuffer[8] = 0x18;
 818                                 CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH - 1] = 0x22;
 819
 820                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &tmp,
 821                                                                         1,                              &AironetCkipIe,
 822                                                                         1,                              &AironetCkipLen,
 823                                                                         AironetCkipLen,                 CkipNegotiationBuffer,
 824                                                                         END_OF_ARGS);
 825                                 FrameLen += tmp;
 826                         }
 827
 828                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 829                                                         1,                              &AironetIPAddressIE,
 830                                                         1,                              &AironetIPAddressLen,
 831                                                         AironetIPAddressLen,            AironetIPAddressBuffer,
 832                                                         END_OF_ARGS);
 833                         FrameLen += tmp;
 834
 835                         //
 836                         // The RN is incremented before each reassociation request.
 837                         //
 838                         pAd->StaCfg.CCKMRN++;
 839                         //
 840                         // Calculate MIC = hmac-md5(krk, STA-ID|BSSID|RSNIE|TSF|RN);
 841                         //
 842                         COPY_MAC_ADDR(CalcMicBuffer, pAd->CurrentAddress);
 843                         CalcMicBufferLen = MAC_ADDR_LEN;
 844                         COPY_MAC_ADDR(CalcMicBuffer + CalcMicBufferLen, pAd->MlmeAux.Bssid);
 845                         CalcMicBufferLen += MAC_ADDR_LEN;
 846                         NdisMoveMemory(CalcMicBuffer + CalcMicBufferLen, CipherSuiteCiscoCCKM, CipherSuiteCiscoCCKMLen);
 847                         CalcMicBufferLen += CipherSuiteCiscoCCKMLen;
 848                         NdisMoveMemory(CalcMicBuffer + CalcMicBufferLen, (PUCHAR) &pAd->StaCfg.CCKMBeaconAtJoinTimeStamp, sizeof(pAd->StaCfg.CCKMBeaconAtJoinTimeStamp));
 849                         CalcMicBufferLen += sizeof(pAd->StaCfg.CCKMBeaconAtJoinTimeStamp);
 850                         NdisMoveMemory(CalcMicBuffer + CalcMicBufferLen, (PUCHAR)&pAd->StaCfg.CCKMRN, sizeof(pAd->StaCfg.CCKMRN));
 851                         CalcMicBufferLen += sizeof(pAd->StaCfg.CCKMRN);
 852                         hmac_md5(pAd->StaCfg.KRK, LEN_EAP_MICK, CalcMicBuffer, CalcMicBufferLen, MICMN);
 853
 854                         //
 855                         // fill up CCKM reassociation request element
 856                         //
 857                         NdisMoveMemory(AironetCCKMReassocBuffer, AironetOUI, 4);
 858                         NdisMoveMemory(AironetCCKMReassocBuffer + 4, (PUCHAR)&pAd->StaCfg.CCKMBeaconAtJoinTimeStamp, 8);
 859                         NdisMoveMemory(AironetCCKMReassocBuffer + 12, (PUCHAR) &pAd->StaCfg.CCKMRN, 4);
 860                         NdisMoveMemory(AironetCCKMReassocBuffer +16, MICMN, 8);
 861
 862                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 863                                                         1,                      &AironetCCKMReassocIE,
 864                                                         1,                      &AironetCCKMReassocLen,
 865                                                         AironetCCKMReassocLen,  AironetCCKMReassocBuffer,
 866                                                         END_OF_ARGS);
 867                         FrameLen += tmp;
 868
 869                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 870                                                         CipherSuiteCiscoCCKMLen,CipherSuiteCiscoCCKM,
 871                                                         END_OF_ARGS);
 872                         FrameLen += tmp;
 873                 }
 874 #endif // LEAP_SUPPORT //
 875
 876                 // Add CCX v2 request if CCX2 admin state is on
 877                 if (pAd->StaCfg.CCXControl.field.Enable == 1)
 878                 {
 879                         //
 880                         // Add CCX Version
 881                         //
 882                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 883                                                 1,                                                      &Ccx2Ie,
 884                                                 1,                                                      &Ccx2Len,
 885                                                 Ccx2Len,                                    Ccx2IeInfo,
 886                                                 END_OF_ARGS);
 887                         FrameLen += tmp;
 888                 }
 889
 890                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 891                 MlmeFreeMemory(pAd, pOutBuffer);
 892
 893                 RTMPSetTimer(&pAd->MlmeAux.ReassocTimer, Timeout); /* in mSec */
 894                 pAd->Mlme.AssocMachine.CurrState = REASSOC_WAIT_RSP;
 895         }
 896         else
 897         {
 898                 DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() sanity check failed. BUG!!!! \n"));
 899                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 900                 Status = MLME_INVALID_FORMAT;
 901                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 902         }
 903 }
 904
 905 /*
 906         ==========================================================================
 907         Description:
 908                 Upper layer issues disassoc request
 909         Parameters:
 910                 Elem -
 911
 912         IRQL = PASSIVE_LEVEL
 913
 914         ==========================================================================
 915  */
 916 VOID MlmeDisassocReqAction(
 917         IN PRTMP_ADAPTER pAd,
 918         IN MLME_QUEUE_ELEM *Elem)
 919 {
 920         PMLME_DISASSOC_REQ_STRUCT pDisassocReq;
 921         HEADER_802_11         DisassocHdr;
 922         PHEADER_802_11        pDisassocHdr;
 923         PUCHAR                pOutBuffer = NULL;
 924         ULONG                 FrameLen = 0;
 925         NDIS_STATUS           NStatus;
 926         BOOLEAN               TimerCancelled;
 927         ULONG                 Timeout = 0;
 928         USHORT                Status;
 929
 930 #ifdef QOS_DLS_SUPPORT
 931         // send DLS-TEAR_DOWN message,
 932         if (pAd->CommonCfg.bDLSCapable)
 933         {
 934                 UCHAR i;
 935
 936                 // tear down local dls table entry
 937                 for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
 938                 {
 939                         if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
 940                         {
 941                                 RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
 942                                 pAd->StaCfg.DLSEntry[i].Status  = DLS_NONE;
 943                                 pAd->StaCfg.DLSEntry[i].Valid   = FALSE;
 944                         }
 945                 }
 946
 947                 // tear down peer dls table entry
 948                 for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
 949                 {
 950                         if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
 951                         {
 952                                 RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
 953                                 pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
 954                                 pAd->StaCfg.DLSEntry[i].Valid   = FALSE;
 955                         }
 956                 }
 957         }
 958 #endif // QOS_DLS_SUPPORT //
 959
 960         // skip sanity check
 961         pDisassocReq = (PMLME_DISASSOC_REQ_STRUCT)(Elem->Msg);
 962
 963         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
 964         if (NStatus != NDIS_STATUS_SUCCESS)
 965         {
 966                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - MlmeDisassocReqAction() allocate memory failed\n"));
 967                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 968                 Status = MLME_FAIL_NO_RESOURCE;
 969                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
 970                 return;
 971         }
 972
 973
 974
 975         RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &TimerCancelled);
 976
 977         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send DISASSOC request[BSSID::%02x:%02x:%02x:%02x:%02x:%02x (Reason=%d)\n",
 978                                 pDisassocReq->Addr[0], pDisassocReq->Addr[1], pDisassocReq->Addr[2],
 979                                 pDisassocReq->Addr[3], pDisassocReq->Addr[4], pDisassocReq->Addr[5], pDisassocReq->Reason));
 980         MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pDisassocReq->Addr, pDisassocReq->Addr);       // patch peap ttls switching issue
 981         MakeOutgoingFrame(pOutBuffer,           &FrameLen,
 982                                           sizeof(HEADER_802_11),&DisassocHdr,
 983                                           2,                    &pDisassocReq->Reason,
 984                                           END_OF_ARGS);
 985         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 986
 987         // To patch Instance and Buffalo(N) AP
 988         // Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
 989         // Therefore, we send both of them.
 990         pDisassocHdr = (PHEADER_802_11)pOutBuffer;
 991         pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
 992         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 993
 994         MlmeFreeMemory(pAd, pOutBuffer);
 995
 996         pAd->StaCfg.DisassocReason = REASON_DISASSOC_STA_LEAVING;
 997         COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pDisassocReq->Addr);
 998
 999         RTMPSetTimer(&pAd->MlmeAux.DisassocTimer, Timeout); /* in mSec */
1000         pAd->Mlme.AssocMachine.CurrState = DISASSOC_WAIT_RSP;
1001
1002 #ifdef WPA_SUPPLICANT_SUPPORT
1003 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1004     if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
1005         {
1006         union iwreq_data    wrqu;
1007         //send disassociate event to wpa_supplicant
1008         memset(&wrqu, 0, sizeof(wrqu));
1009         wrqu.data.flags = RT_DISASSOC_EVENT_FLAG;
1010         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1011     }
1012 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1013 #endif // WPA_SUPPLICANT_SUPPORT //
1014
1015 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1016     {
1017         union iwreq_data    wrqu;
1018         memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
1019         wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
1020     }
1021 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1022
1023 }
1024
1025 /*
1026         ==========================================================================
1027         Description:
1028                 peer sends assoc rsp back
1029         Parameters:
1030                 Elme - MLME message containing the received frame
1031
1032         IRQL = DISPATCH_LEVEL
1033
1034         ==========================================================================
1035  */
1036 VOID PeerAssocRspAction(
1037         IN PRTMP_ADAPTER pAd,
1038         IN MLME_QUEUE_ELEM *Elem)
1039 {
1040         USHORT        CapabilityInfo, Status, Aid;
1041         UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
1042         UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
1043         UCHAR         Addr2[MAC_ADDR_LEN];
1044         BOOLEAN       TimerCancelled;
1045         UCHAR         CkipFlag;
1046         EDCA_PARM     EdcaParm;
1047         HT_CAPABILITY_IE                HtCapability;
1048         ADD_HT_INFO_IE          AddHtInfo;      // AP might use this additional ht info IE
1049         UCHAR                   HtCapabilityLen;
1050         UCHAR                   AddHtInfoLen;
1051         UCHAR                   NewExtChannelOffset = 0xff;
1052
1053         if (PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
1054                 &HtCapability,&AddHtInfo, &HtCapabilityLen,&AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
1055         {
1056                 // The frame is for me ?
1057                 if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid))
1058                 {
1059                         DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():ASSOC - receive ASSOC_RSP to me (status=%d)\n", Status));
1060 #ifdef DOT11_N_SUPPORT
1061                         DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():MacTable [%d].AMsduSize = %d. ClientStatusFlags = 0x%lx \n",Elem->Wcid, pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
1062 #endif // DOT11_N_SUPPORT //
1063                         RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
1064                         if(Status == MLME_SUCCESS)
1065                         {
1066                                 UCHAR                   MaxSupportedRateIn500Kbps = 0;
1067                                 UCHAR                   idx;
1068
1069                                 // supported rates array may not be sorted. sort it and find the maximum rate
1070                             for (idx=0; idx<SupRateLen; idx++)
1071                             {
1072                                 if (MaxSupportedRateIn500Kbps < (SupRate[idx] & 0x7f))
1073                                     MaxSupportedRateIn500Kbps = SupRate[idx] & 0x7f;
1074                             }
1075
1076                                 for (idx=0; idx<ExtRateLen; idx++)
1077                             {
1078                                 if (MaxSupportedRateIn500Kbps < (ExtRate[idx] & 0x7f))
1079                                     MaxSupportedRateIn500Kbps = ExtRate[idx] & 0x7f;
1080                             }
1081                                 // go to procedure listed on page 376
1082                                 AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
1083                                         &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
1084
1085                                 StaAddMacTableEntry(pAd, &pAd->MacTab.Content[BSSID_WCID], MaxSupportedRateIn500Kbps, &HtCapability, HtCapabilityLen, CapabilityInfo);
1086
1087                                 pAd->StaCfg.CkipFlag = CkipFlag;
1088                                 if (CkipFlag & 0x18)
1089                                 {
1090                                         NdisZeroMemory(pAd->StaCfg.TxSEQ, 4);
1091                                         NdisZeroMemory(pAd->StaCfg.RxSEQ, 4);
1092                                         NdisZeroMemory(pAd->StaCfg.CKIPMIC, 4);
1093                                         pAd->StaCfg.GIV[0] = RandomByte(pAd);
1094                                         pAd->StaCfg.GIV[1] = RandomByte(pAd);
1095                                         pAd->StaCfg.GIV[2] = RandomByte(pAd);
1096                                         pAd->StaCfg.bCkipOn = TRUE;
1097                                         DBGPRINT(RT_DEBUG_TRACE, ("<CCX> pAd->StaCfg.CkipFlag = 0x%02x\n", pAd->StaCfg.CkipFlag));
1098                                 }
1099                         }
1100                         else
1101                         {
1102                                 // Faile on Association, we need to check the status code
1103                                 // Is that a Rogue AP?
1104 #ifdef LEAP_SUPPORT
1105                                 if ((pAd->StaCfg.LeapAuthMode == CISCO_AuthModeLEAP) && (Status == MLME_ALG_NOT_SUPPORT))
1106                                 { //Possibly Rogue AP
1107                                         RogueApTableSetEntry(pAd, &pAd->StaCfg.RogueApTab, pAd->MlmeAux.Bssid, LEAP_REASON_INVALID_AUTH);
1108                                 }
1109 #endif // LEAP_SUPPORT //
1110                         }
1111                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1112                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1113                 }
1114         }
1115         else
1116         {
1117                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerAssocRspAction() sanity check fail\n"));
1118         }
1119 }
1120
1121 /*
1122         ==========================================================================
1123         Description:
1124                 peer sends reassoc rsp
1125         Parametrs:
1126                 Elem - MLME message cntaining the received frame
1127
1128         IRQL = DISPATCH_LEVEL
1129
1130         ==========================================================================
1131  */
1132 VOID PeerReassocRspAction(
1133         IN PRTMP_ADAPTER pAd,
1134         IN MLME_QUEUE_ELEM *Elem)
1135 {
1136         USHORT      CapabilityInfo;
1137         USHORT      Status;
1138         USHORT      Aid;
1139         UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
1140         UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
1141         UCHAR       Addr2[MAC_ADDR_LEN];
1142         UCHAR       CkipFlag;
1143         BOOLEAN     TimerCancelled;
1144         EDCA_PARM   EdcaParm;
1145         HT_CAPABILITY_IE                HtCapability;
1146         ADD_HT_INFO_IE          AddHtInfo;      // AP might use this additional ht info IE
1147         UCHAR                   HtCapabilityLen;
1148         UCHAR                   AddHtInfoLen;
1149         UCHAR                   NewExtChannelOffset = 0xff;
1150
1151         if(PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
1152                                                                 &HtCapability,  &AddHtInfo, &HtCapabilityLen, &AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
1153         {
1154                 if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid)) // The frame is for me ?
1155                 {
1156                         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - receive REASSOC_RSP to me (status=%d)\n", Status));
1157                         RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
1158
1159                         if(Status == MLME_SUCCESS)
1160                         {
1161                                 // go to procedure listed on page 376
1162                                 AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
1163                                          &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
1164
1165 #ifdef WPA_SUPPLICANT_SUPPORT
1166 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1167                 if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
1168                 {
1169                     union iwreq_data    wrqu;
1170
1171                     SendAssocIEsToWpaSupplicant(pAd);
1172                     memset(&wrqu, 0, sizeof(wrqu));
1173                     wrqu.data.flags = RT_ASSOC_EVENT_FLAG;
1174                     wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1175                 }
1176 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1177 #endif // WPA_SUPPLICANT_SUPPORT //
1178
1179 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1180                 {
1181                     union iwreq_data    wrqu;
1182                     wext_notify_event_assoc(pAd);
1183
1184                     memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
1185                     memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
1186                     wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
1187
1188                 }
1189 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1190
1191                         }
1192
1193                         //
1194                         // Cisco Leap CCKM supported Re-association.
1195                         //
1196 #ifdef LEAP_SUPPORT
1197                         if (LEAP_CCKM_ON(pAd) && (pAd->StaCfg.CCKMLinkUpFlag == TRUE))
1198                         {
1199                                 if (CCKMAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen) == TRUE)
1200                                 {
1201                                         pAd->StaCfg.CkipFlag = CkipFlag;
1202                                         if (CkipFlag & 0x18)
1203                                         {
1204                                                 NdisZeroMemory(pAd->StaCfg.TxSEQ, 4);
1205                                                 NdisZeroMemory(pAd->StaCfg.RxSEQ, 4);
1206                                                 NdisZeroMemory(pAd->StaCfg.CKIPMIC, 4);
1207                                                 pAd->StaCfg.GIV[0] = RandomByte(pAd);
1208                                                 pAd->StaCfg.GIV[1] = RandomByte(pAd);
1209                                                 pAd->StaCfg.GIV[2] = RandomByte(pAd);
1210                                                 pAd->StaCfg.bCkipOn = TRUE;
1211                                                 DBGPRINT(RT_DEBUG_TRACE, ("<CCX> pAd->StaCfg.CkipFlag = 0x%02x\n", pAd->StaCfg.CkipFlag));
1212                                         }
1213
1214                                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1215                                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1216                                 }
1217                                 else
1218                                 {
1219                                         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - CCKMAssocRspSanity() sanity check fail\n"));
1220                                 }
1221                         }
1222                         else
1223 #endif // LEAP_SUPPORT //
1224                         {
1225                                 // CkipFlag is no use for reassociate
1226                                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1227                                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1228                         }
1229                 }
1230         }
1231         else
1232         {
1233                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerReassocRspAction() sanity check fail\n"));
1234         }
1235
1236 }
1237
1238 /*
1239         ==========================================================================
1240         Description:
1241                 procedures on IEEE 802.11/1999 p.376
1242         Parametrs:
1243
1244         IRQL = DISPATCH_LEVEL
1245
1246         ==========================================================================
1247  */
1248 VOID AssocPostProc(
1249         IN PRTMP_ADAPTER pAd,
1250         IN PUCHAR pAddr2,
1251         IN USHORT CapabilityInfo,
1252         IN USHORT Aid,
1253         IN UCHAR SupRate[],
1254         IN UCHAR SupRateLen,
1255         IN UCHAR ExtRate[],
1256         IN UCHAR ExtRateLen,
1257         IN PEDCA_PARM pEdcaParm,
1258         IN HT_CAPABILITY_IE             *pHtCapability,
1259         IN UCHAR HtCapabilityLen,
1260         IN ADD_HT_INFO_IE               *pAddHtInfo)    // AP might use this additional ht info IE
1261 {
1262         ULONG Idx;
1263
1264         pAd->MlmeAux.BssType = BSS_INFRA;
1265         COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pAddr2);
1266         pAd->MlmeAux.Aid = Aid;
1267         pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
1268 #ifdef DOT11_N_SUPPORT
1269         // Some HT AP might lost WMM IE. We add WMM ourselves. beacuase HT requires QoS on.
1270         if ((HtCapabilityLen > 0) && (pEdcaParm->bValid == FALSE))
1271         {
1272                 pEdcaParm->bValid = TRUE;
1273                 pEdcaParm->Aifsn[0] = 3;
1274                 pEdcaParm->Aifsn[1] = 7;
1275                 pEdcaParm->Aifsn[2] = 2;
1276                 pEdcaParm->Aifsn[3] = 2;
1277
1278                 pEdcaParm->Cwmin[0] = 4;
1279                 pEdcaParm->Cwmin[1] = 4;
1280                 pEdcaParm->Cwmin[2] = 3;
1281                 pEdcaParm->Cwmin[3] = 2;
1282
1283                 pEdcaParm->Cwmax[0] = 10;
1284                 pEdcaParm->Cwmax[1] = 10;
1285                 pEdcaParm->Cwmax[2] = 4;
1286                 pEdcaParm->Cwmax[3] = 3;
1287
1288                 pEdcaParm->Txop[0]  = 0;
1289                 pEdcaParm->Txop[1]  = 0;
1290                 pEdcaParm->Txop[2]  = 96;
1291                 pEdcaParm->Txop[3]  = 48;
1292
1293         }
1294 #endif // DOT11_N_SUPPORT //
1295
1296         NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
1297
1298         // filter out un-supported rates
1299         pAd->MlmeAux.SupRateLen = SupRateLen;
1300         NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
1301         RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
1302
1303         // filter out un-supported rates
1304         pAd->MlmeAux.ExtRateLen = ExtRateLen;
1305         NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
1306         RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
1307
1308 #ifdef DOT11_N_SUPPORT
1309         if (HtCapabilityLen > 0)
1310         {
1311                 RTMPCheckHt(pAd, BSSID_WCID, pHtCapability, pAddHtInfo);
1312         }
1313         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>  AP.AMsduSize = %d. ClientStatusFlags = 0x%lx \n", pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
1314
1315         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>    (Mmps=%d, AmsduSize=%d, )\n",
1316                 pAd->MacTab.Content[BSSID_WCID].MmpsMode, pAd->MacTab.Content[BSSID_WCID].AMsduSize));
1317 #endif // DOT11_N_SUPPORT //
1318
1319         // Set New WPA information
1320         Idx = BssTableSearch(&pAd->ScanTab, pAddr2, pAd->MlmeAux.Channel);
1321         if (Idx == BSS_NOT_FOUND)
1322         {
1323                 DBGPRINT_ERR(("ASSOC - Can't find BSS after receiving Assoc response\n"));
1324         }
1325         else
1326         {
1327                 // Init variable
1328                 pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = 0;
1329                 NdisZeroMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, MAX_LEN_OF_RSNIE);
1330
1331                 // Store appropriate RSN_IE for WPA SM negotiation later
1332                 if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) && (pAd->ScanTab.BssEntry[Idx].VarIELen != 0))
1333                 {
1334                         PUCHAR              pVIE;
1335                         USHORT              len;
1336                         PEID_STRUCT         pEid;
1337
1338                         pVIE = pAd->ScanTab.BssEntry[Idx].VarIEs;
1339                         len      = pAd->ScanTab.BssEntry[Idx].VarIELen;
1340
1341                         while (len > 0)
1342                         {
1343                                 pEid = (PEID_STRUCT) pVIE;
1344                                 // For WPA/WPAPSK
1345                                 if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
1346                                         && (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
1347                                 {
1348                                         NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
1349                                         pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
1350                                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA SM negotiation \n"));
1351                                 }
1352                                 // For WPA2/WPA2PSK
1353                                 else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
1354                                         && (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2 || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
1355                                 {
1356                                         NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
1357                                         pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
1358                                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA2 SM negotiation \n"));
1359                                 }
1360
1361                                 pVIE += (pEid->Len + 2);
1362                                 len  -= (pEid->Len + 2);
1363                         }
1364                 }
1365
1366                 if (pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == 0)
1367                 {
1368                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> no RSN_IE \n"));
1369                 }
1370                 else
1371                 {
1372                         hex_dump("RSN_IE", pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
1373                 }
1374         }
1375 }
1376
1377 /*
1378         ==========================================================================
1379         Description:
1380                 left part of IEEE 802.11/1999 p.374
1381         Parameters:
1382                 Elem - MLME message containing the received frame
1383
1384         IRQL = DISPATCH_LEVEL
1385
1386         ==========================================================================
1387  */
1388 VOID PeerDisassocAction(
1389         IN PRTMP_ADAPTER pAd,
1390         IN MLME_QUEUE_ELEM *Elem)
1391 {
1392         UCHAR         Addr2[MAC_ADDR_LEN];
1393         USHORT        Reason;
1394
1395         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction()\n"));
1396         if(PeerDisassocSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
1397         {
1398                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() Reason = %d\n", Reason));
1399                 if (INFRA_ON(pAd) && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, Addr2))
1400                 {
1401
1402                         if (pAd->CommonCfg.bWirelessEvent)
1403                         {
1404                                 RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
1405                         }
1406
1407
1408 #ifdef LEAP_SUPPORT
1409                         if (pAd->StaCfg.LeapAuthMode == CISCO_AuthModeLEAP)
1410                         {
1411                                 // Cisco_LEAP has start a timer
1412                                 // We should cancel it if using LEAP
1413                                 RTMPCancelTimer(&pAd->StaCfg.LeapAuthTimer, &TimerCancelled);
1414                                 //Check is it mach the LEAP Authentication failed as possible a Rogue AP
1415                                 //on it's PortSecured not equal to WPA_802_1X_PORT_SECURED while process the Association.
1416                                 if ((pAd->Mlme.LeapMachine.CurrState != LEAP_IDLE) && (pAd->StaCfg.PortSecured != WPA_802_1X_PORT_SECURED))
1417                                 {
1418                                         RogueApTableSetEntry(pAd, &pAd->StaCfg.RogueApTab, Addr2, LEAP_REASON_AUTH_TIMEOUT);
1419                                 }
1420                         }
1421 #endif  // LEAP_SUPPORT //
1422                         //
1423                         // Get Current System time and Turn on AdjacentAPReport
1424                         //
1425                         NdisGetSystemUpTime(&pAd->StaCfg.CCXAdjacentAPLinkDownTime);
1426                         pAd->StaCfg.CCXAdjacentAPReportFlag = TRUE;
1427                         LinkDown(pAd, TRUE);
1428                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1429
1430 #ifdef WPA_SUPPLICANT_SUPPORT
1431 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1432             if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
1433                         {
1434                 union iwreq_data    wrqu;
1435                 //send disassociate event to wpa_supplicant
1436                 memset(&wrqu, 0, sizeof(wrqu));
1437                 wrqu.data.flags = RT_DISASSOC_EVENT_FLAG;
1438                 wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1439             }
1440 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1441 #endif // WPA_SUPPLICANT_SUPPORT //
1442
1443 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1444             {
1445                 union iwreq_data    wrqu;
1446                 memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
1447                 wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
1448             }
1449 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1450                 }
1451         }
1452         else
1453         {
1454                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() sanity check fail\n"));
1455         }
1456
1457 }
1458
1459 /*
1460         ==========================================================================
1461         Description:
1462                 what the state machine will do after assoc timeout
1463         Parameters:
1464                 Elme -
1465
1466         IRQL = DISPATCH_LEVEL
1467
1468         ==========================================================================
1469  */
1470 VOID AssocTimeoutAction(
1471         IN PRTMP_ADAPTER pAd,
1472         IN MLME_QUEUE_ELEM *Elem)
1473 {
1474         USHORT  Status;
1475         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - AssocTimeoutAction\n"));
1476         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1477         Status = MLME_REJ_TIMEOUT;
1478         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1479 }
1480
1481 /*
1482         ==========================================================================
1483         Description:
1484                 what the state machine will do after reassoc timeout
1485
1486         IRQL = DISPATCH_LEVEL
1487
1488         ==========================================================================
1489  */
1490 VOID ReassocTimeoutAction(
1491         IN PRTMP_ADAPTER pAd,
1492         IN MLME_QUEUE_ELEM *Elem)
1493 {
1494         USHORT  Status;
1495         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - ReassocTimeoutAction\n"));
1496         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1497         Status = MLME_REJ_TIMEOUT;
1498         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1499 }
1500
1501 /*
1502         ==========================================================================
1503         Description:
1504                 what the state machine will do after disassoc timeout
1505
1506         IRQL = DISPATCH_LEVEL
1507
1508         ==========================================================================
1509  */
1510 VOID DisassocTimeoutAction(
1511         IN PRTMP_ADAPTER pAd,
1512         IN MLME_QUEUE_ELEM *Elem)
1513 {
1514         USHORT  Status;
1515         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - DisassocTimeoutAction\n"));
1516         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1517         Status = MLME_SUCCESS;
1518         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
1519 }
1520
1521 VOID InvalidStateWhenAssoc(
1522         IN PRTMP_ADAPTER pAd,
1523         IN MLME_QUEUE_ELEM *Elem)
1524 {
1525         USHORT  Status;
1526         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenAssoc(state=%ld), reset ASSOC state machine\n",
1527                 pAd->Mlme.AssocMachine.CurrState));
1528         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1529         Status = MLME_STATE_MACHINE_REJECT;
1530         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1531 }
1532
1533 VOID InvalidStateWhenReassoc(
1534         IN PRTMP_ADAPTER pAd,
1535         IN MLME_QUEUE_ELEM *Elem)
1536 {
1537         USHORT Status;
1538         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenReassoc(state=%ld), reset ASSOC state machine\n",
1539                 pAd->Mlme.AssocMachine.CurrState));
1540         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1541         Status = MLME_STATE_MACHINE_REJECT;
1542         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1543 }
1544
1545 VOID InvalidStateWhenDisassociate(
1546         IN PRTMP_ADAPTER pAd,
1547         IN MLME_QUEUE_ELEM *Elem)
1548 {
1549         USHORT Status;
1550         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenDisassoc(state=%ld), reset ASSOC state machine\n",
1551                 pAd->Mlme.AssocMachine.CurrState));
1552         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1553         Status = MLME_STATE_MACHINE_REJECT;
1554         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
1555 }
1556
1557 /*
1558         ==========================================================================
1559         Description:
1560                 right part of IEEE 802.11/1999 page 374
1561         Note:
1562                 This event should never cause ASSOC state machine perform state
1563                 transition, and has no relationship with CNTL machine. So we separate
1564                 this routine as a service outside of ASSOC state transition table.
1565
1566         IRQL = DISPATCH_LEVEL
1567
1568         ==========================================================================
1569  */
1570 VOID Cls3errAction(
1571         IN PRTMP_ADAPTER pAd,
1572         IN PUCHAR        pAddr)
1573 {
1574         HEADER_802_11         DisassocHdr;
1575         PHEADER_802_11        pDisassocHdr;
1576         PUCHAR                pOutBuffer = NULL;
1577         ULONG                 FrameLen = 0;
1578         NDIS_STATUS           NStatus;
1579         USHORT                Reason = REASON_CLS3ERR;
1580
1581         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
1582         if (NStatus != NDIS_STATUS_SUCCESS)
1583                 return;
1584
1585         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Class 3 Error, Send DISASSOC frame\n"));
1586         MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pAddr, pAd->CommonCfg.Bssid);  // patch peap ttls switching issue
1587         MakeOutgoingFrame(pOutBuffer,           &FrameLen,
1588                                           sizeof(HEADER_802_11),&DisassocHdr,
1589                                           2,                    &Reason,
1590                                           END_OF_ARGS);
1591         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
1592
1593         // To patch Instance and Buffalo(N) AP
1594         // Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
1595         // Therefore, we send both of them.
1596         pDisassocHdr = (PHEADER_802_11)pOutBuffer;
1597         pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
1598         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
1599
1600         MlmeFreeMemory(pAd, pOutBuffer);
1601
1602         pAd->StaCfg.DisassocReason = REASON_CLS3ERR;
1603         COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pAddr);
1604 }
1605
1606  /*
1607          ==========================================================================
1608          Description:
1609                  Switch between WEP and CKIP upon new association up.
1610          Parameters:
1611
1612          IRQL = DISPATCH_LEVEL
1613
1614          ==========================================================================
1615   */
1616 VOID SwitchBetweenWepAndCkip(
1617         IN PRTMP_ADAPTER pAd)
1618 {
1619         int            i;
1620         SHAREDKEY_MODE_STRUC  csr1;
1621
1622         // if KP is required. change the CipherAlg in hardware shard key table from WEP
1623         // to CKIP. else remain as WEP
1624         if (pAd->StaCfg.bCkipOn && (pAd->StaCfg.CkipFlag & 0x10))
1625         {
1626                 // modify hardware key table so that MAC use correct algorithm to decrypt RX
1627                 RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
1628                 if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP64)
1629                         csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP64;
1630                 else if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP128)
1631                         csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP128;
1632
1633                 if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP64)
1634                         csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP64;
1635                 else if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP128)
1636                         csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP128;
1637
1638                 if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP64)
1639                         csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP64;
1640                 else if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP128)
1641                         csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP128;
1642
1643                 if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP64)
1644                         csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP64;
1645                 else if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP128)
1646                         csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP128;
1647                 RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
1648                 DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
1649
1650                 // modify software key table so that driver can specify correct algorithm in TXD upon TX
1651                 for (i=0; i<SHARE_KEY_NUM; i++)
1652                 {
1653                         if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP64)
1654                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP64;
1655                         else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP128)
1656                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP128;
1657                 }
1658         }
1659
1660         // else if KP NOT inused. change the CipherAlg in hardware shard key table from CKIP
1661         // to WEP.
1662         else
1663         {
1664                 // modify hardware key table so that MAC use correct algorithm to decrypt RX
1665                 RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
1666                 if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP64)
1667                         csr1.field.Bss0Key0CipherAlg = CIPHER_WEP64;
1668                 else if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP128)
1669                         csr1.field.Bss0Key0CipherAlg = CIPHER_WEP128;
1670
1671                 if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP64)
1672                         csr1.field.Bss0Key1CipherAlg = CIPHER_WEP64;
1673                 else if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP128)
1674                         csr1.field.Bss0Key1CipherAlg = CIPHER_WEP128;
1675
1676                 if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP64)
1677                         csr1.field.Bss0Key2CipherAlg = CIPHER_WEP64;
1678                 else if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP128)
1679                         csr1.field.Bss0Key2CipherAlg = CIPHER_WEP128;
1680
1681                 if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP64)
1682                         csr1.field.Bss0Key3CipherAlg = CIPHER_WEP64;
1683                 else if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP128)
1684                         csr1.field.Bss0Key3CipherAlg = CIPHER_WEP128;
1685
1686                 // modify software key table so that driver can specify correct algorithm in TXD upon TX
1687                 for (i=0; i<SHARE_KEY_NUM; i++)
1688                 {
1689                         if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP64)
1690                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP64;
1691                         else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP128)
1692                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP128;
1693                 }
1694
1695                 //
1696                 // On WPA-NONE, must update CipherAlg.
1697                 // Because the OID_802_11_WEP_STATUS was been set after OID_802_11_ADD_KEY
1698                 // and CipherAlg will be CIPHER_NONE by Windows ZeroConfig.
1699                 // So we need to update CipherAlg after connect.
1700                 //
1701                 if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
1702                 {
1703                         for (i = 0; i < SHARE_KEY_NUM; i++)
1704                         {
1705                                 if (pAd->SharedKey[BSS0][i].KeyLen != 0)
1706                                 {
1707                                         if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
1708                                         {
1709                                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_TKIP;
1710                                         }
1711                                         else if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
1712                                         {
1713                                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_AES;
1714                                         }
1715                                 }
1716                                 else
1717                                 {
1718                                         pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_NONE;
1719                                 }
1720                         }
1721
1722                         csr1.field.Bss0Key0CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
1723                         csr1.field.Bss0Key1CipherAlg = pAd->SharedKey[BSS0][1].CipherAlg;
1724                         csr1.field.Bss0Key2CipherAlg = pAd->SharedKey[BSS0][2].CipherAlg;
1725                         csr1.field.Bss0Key3CipherAlg = pAd->SharedKey[BSS0][3].CipherAlg;
1726                 }
1727                 RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
1728                 DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
1729         }
1730 }
1731
1732 #ifdef WPA_SUPPLICANT_SUPPORT
1733 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1734 VOID    SendAssocIEsToWpaSupplicant(
1735     IN  PRTMP_ADAPTER pAd)
1736 {
1737     union iwreq_data    wrqu;
1738     unsigned char custom[IW_CUSTOM_MAX] = {0};
1739
1740     if ((pAd->StaCfg.ReqVarIELen + 17) <= IW_CUSTOM_MAX)
1741     {
1742         sprintf(custom, "ASSOCINFO_ReqIEs=");
1743             NdisMoveMemory(custom+17, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
1744             memset(&wrqu, 0, sizeof(wrqu));
1745         wrqu.data.length = pAd->StaCfg.ReqVarIELen + 17;
1746         wrqu.data.flags = RT_REQIE_EVENT_FLAG;
1747         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, custom);
1748
1749         memset(&wrqu, 0, sizeof(wrqu));
1750         wrqu.data.flags = RT_ASSOCINFO_EVENT_FLAG;
1751         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1752     }
1753     else
1754         DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen + 17 > MAX_CUSTOM_LEN\n"));
1755
1756     return;
1757 }
1758 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1759 #endif // WPA_SUPPLICANT_SUPPORT //
1760
1761 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1762 int wext_notify_event_assoc(
1763         IN  RTMP_ADAPTER *pAd)
1764 {
1765     union iwreq_data    wrqu;
1766     char custom[IW_CUSTOM_MAX] = {0};
1767
1768 #if WIRELESS_EXT > 17
1769     if (pAd->StaCfg.ReqVarIELen <= IW_CUSTOM_MAX)
1770     {
1771         wrqu.data.length = pAd->StaCfg.ReqVarIELen;
1772         memcpy(custom, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
1773         wireless_send_event(pAd->net_dev, IWEVASSOCREQIE, &wrqu, custom);
1774     }
1775     else
1776         DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen > MAX_CUSTOM_LEN\n"));
1777 #else
1778     if (((pAd->StaCfg.ReqVarIELen*2) + 17) <= IW_CUSTOM_MAX)
1779     {
1780         UCHAR   idx;
1781         wrqu.data.length = (pAd->StaCfg.ReqVarIELen*2) + 17;
1782         sprintf(custom, "ASSOCINFO(ReqIEs=");
1783         for (idx=0; idx<pAd->StaCfg.ReqVarIELen; idx++)
1784                 sprintf(custom, "%s%02x", custom, pAd->StaCfg.ReqVarIEs[idx]);
1785         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, custom);
1786     }
1787     else
1788         DBGPRINT(RT_DEBUG_TRACE, ("(pAd->StaCfg.ReqVarIELen*2) + 17 > MAX_CUSTOM_LEN\n"));
1789 #endif
1790
1791         return 0;
1792
1793 }
1794 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1795
1796
1797 BOOLEAN StaAddMacTableEntry(
1798         IN  PRTMP_ADAPTER               pAd,
1799         IN  PMAC_TABLE_ENTRY    pEntry,
1800         IN  UCHAR                               MaxSupportedRateIn500Kbps,
1801         IN  HT_CAPABILITY_IE    *pHtCapability,
1802         IN  UCHAR                               HtCapabilityLen,
1803         IN  USHORT                      CapabilityInfo)
1804 {
1805         UCHAR            MaxSupportedRate = RATE_11;
1806
1807         if (ADHOC_ON(pAd))
1808                 CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
1809
1810         switch (MaxSupportedRateIn500Kbps)
1811     {
1812         case 108: MaxSupportedRate = RATE_54;   break;
1813         case 96:  MaxSupportedRate = RATE_48;   break;
1814         case 72:  MaxSupportedRate = RATE_36;   break;
1815         case 48:  MaxSupportedRate = RATE_24;   break;
1816         case 36:  MaxSupportedRate = RATE_18;   break;
1817         case 24:  MaxSupportedRate = RATE_12;   break;
1818         case 18:  MaxSupportedRate = RATE_9;    break;
1819         case 12:  MaxSupportedRate = RATE_6;    break;
1820         case 22:  MaxSupportedRate = RATE_11;   break;
1821         case 11:  MaxSupportedRate = RATE_5_5;  break;
1822         case 4:   MaxSupportedRate = RATE_2;    break;
1823         case 2:   MaxSupportedRate = RATE_1;    break;
1824         default:  MaxSupportedRate = RATE_11;   break;
1825     }
1826
1827     if ((pAd->CommonCfg.PhyMode == PHY_11G) && (MaxSupportedRate < RATE_FIRST_OFDM_RATE))
1828         return FALSE;
1829
1830 #ifdef DOT11_N_SUPPORT
1831         // 11n only
1832         if (((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G))&& (HtCapabilityLen == 0))
1833                 return FALSE;
1834 #endif // DOT11_N_SUPPORT //
1835
1836         if (!pEntry)
1837         return FALSE;
1838
1839         NdisAcquireSpinLock(&pAd->MacTabLock);
1840         if (pEntry)
1841         {
1842                 pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
1843                 if ((MaxSupportedRate < RATE_FIRST_OFDM_RATE) ||
1844                         (pAd->CommonCfg.PhyMode == PHY_11B))
1845                 {
1846                         pEntry->RateLen = 4;
1847                         if (MaxSupportedRate >= RATE_FIRST_OFDM_RATE)
1848                                 MaxSupportedRate = RATE_11;
1849                 }
1850                 else
1851                         pEntry->RateLen = 12;
1852
1853                 pEntry->MaxHTPhyMode.word = 0;
1854                 pEntry->MinHTPhyMode.word = 0;
1855                 pEntry->HTPhyMode.word = 0;
1856                 pEntry->MaxSupportedRate = MaxSupportedRate;
1857                 if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
1858                 {
1859                         pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
1860                         pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
1861                         pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
1862                         pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
1863                         pEntry->HTPhyMode.field.MODE = MODE_CCK;
1864                         pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
1865                 }
1866                 else
1867                 {
1868                         pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
1869                         pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
1870                         pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
1871                         pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
1872                         pEntry->HTPhyMode.field.MODE = MODE_OFDM;
1873                         pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
1874                 }
1875                 pEntry->CapabilityInfo = CapabilityInfo;
1876                 CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE);
1877                 CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE);
1878         }
1879
1880 #ifdef DOT11_N_SUPPORT
1881         // If this Entry supports 802.11n, upgrade to HT rate.
1882         if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
1883         {
1884                 UCHAR   j, bitmask; //k,bitmask;
1885                 CHAR    i;
1886
1887                 if (ADHOC_ON(pAd))
1888                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
1889                 if ((pHtCapability->HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
1890                 {
1891                         pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
1892                 }
1893                 else
1894                 {
1895                         pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
1896                         pAd->MacTab.fAnyStationNonGF = TRUE;
1897                         pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
1898                 }
1899
1900                 if ((pHtCapability->HtCapInfo.ChannelWidth) && (pAd->CommonCfg.DesiredHtPhy.ChannelWidth))
1901                 {
1902                         pEntry->MaxHTPhyMode.field.BW= BW_40;
1903                         pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(pHtCapability->HtCapInfo.ShortGIfor40));
1904                 }
1905                 else
1906                 {
1907                         pEntry->MaxHTPhyMode.field.BW = BW_20;
1908                         pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(pHtCapability->HtCapInfo.ShortGIfor20));
1909                         pAd->MacTab.fAnyStation20Only = TRUE;
1910                 }
1911
1912                 // 3*3
1913                 if (pAd->MACVersion >= RALINK_2883_VERSION && pAd->MACVersion < RALINK_3070_VERSION)
1914                         pEntry->MaxHTPhyMode.field.TxBF = pAd->CommonCfg.RegTransmitSetting.field.TxBF;
1915
1916                 // find max fixed rate
1917                 for (i=23; i>=0; i--) // 3*3
1918                 {
1919                         j = i/8;
1920                         bitmask = (1<<(i-(j*8)));
1921                         if ((pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j] & bitmask) && (pHtCapability->MCSSet[j] & bitmask))
1922                         {
1923                                 pEntry->MaxHTPhyMode.field.MCS = i;
1924                                 break;
1925                         }
1926                         if (i==0)
1927                                 break;
1928                 }
1929
1930
1931                 if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
1932                 {
1933                         if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
1934                         {
1935                                 // Fix MCS as HT Duplicated Mode
1936                                 pEntry->MaxHTPhyMode.field.BW = 1;
1937                                 pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
1938                                 pEntry->MaxHTPhyMode.field.STBC = 0;
1939                                 pEntry->MaxHTPhyMode.field.ShortGI = 0;
1940                                 pEntry->MaxHTPhyMode.field.MCS = 32;
1941                         }
1942                         else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
1943                         {
1944                                 // STA supports fixed MCS
1945                                 pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
1946                         }
1947                 }
1948
1949                 pEntry->MaxHTPhyMode.field.STBC = (pHtCapability->HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
1950                 pEntry->MpduDensity = pHtCapability->HtCapParm.MpduDensity;
1951                 pEntry->MaxRAmpduFactor = pHtCapability->HtCapParm.MaxRAmpduFactor;
1952                 pEntry->MmpsMode = (UCHAR)pHtCapability->HtCapInfo.MimoPs;
1953                 pEntry->AMsduSize = (UCHAR)pHtCapability->HtCapInfo.AMsduSize;
1954                 pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
1955
1956                 if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable && (pAd->CommonCfg.REGBACapability.field.AutoBA == FALSE))
1957                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_AMSDU_INUSED);
1958                 if (pHtCapability->HtCapInfo.ShortGIfor20)
1959                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
1960                 if (pHtCapability->HtCapInfo.ShortGIfor40)
1961                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
1962                 if (pHtCapability->HtCapInfo.TxSTBC)
1963                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
1964                 if (pHtCapability->HtCapInfo.RxSTBC)
1965                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
1966                 if (pHtCapability->ExtHtCapInfo.PlusHTC)
1967                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
1968                 if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport)
1969                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
1970                 if (pHtCapability->ExtHtCapInfo.MCSFeedback == 0x03)
1971                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
1972         }
1973         else
1974         {
1975                 pAd->MacTab.fAnyStationIsLegacy = TRUE;
1976         }
1977
1978         NdisMoveMemory(&pEntry->HTCapability, pHtCapability, sizeof(HT_CAPABILITY_IE));
1979 #endif // DOT11_N_SUPPORT //
1980
1981         pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
1982         pEntry->CurrTxRate = pEntry->MaxSupportedRate;
1983
1984         // Set asic auto fall back
1985         if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
1986         {
1987                 PUCHAR                                  pTable;
1988                 UCHAR                                   TableSize = 0;
1989
1990                 MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
1991                 pEntry->bAutoTxRateSwitch = TRUE;
1992         }
1993         else
1994         {
1995                 pEntry->HTPhyMode.field.MODE    = pAd->StaCfg.HTPhyMode.field.MODE;
1996                 pEntry->HTPhyMode.field.MCS     = pAd->StaCfg.HTPhyMode.field.MCS;
1997                 pEntry->bAutoTxRateSwitch = FALSE;
1998
1999                 // If the legacy mode is set, overwrite the transmit setting of this entry.
2000                 RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
2001         }
2002
2003         pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
2004         pEntry->Sst = SST_ASSOC;
2005         pEntry->AuthState = AS_AUTH_OPEN;
2006         pEntry->AuthMode = pAd->StaCfg.AuthMode;
2007         pEntry->WepStatus = pAd->StaCfg.WepStatus;
2008
2009         NdisReleaseSpinLock(&pAd->MacTabLock);
2010
2011 #ifdef WPA_SUPPLICANT_SUPPORT
2012 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
2013     if (pAd->StaCfg.WpaSupplicantUP)
2014     {
2015         union iwreq_data    wrqu;
2016
2017         SendAssocIEsToWpaSupplicant(pAd);
2018         memset(&wrqu, 0, sizeof(wrqu));
2019         wrqu.data.flags = RT_ASSOC_EVENT_FLAG;
2020         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
2021     }
2022 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
2023 #endif // WPA_SUPPLICANT_SUPPORT //
2024
2025 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
2026     {
2027         union iwreq_data    wrqu;
2028         wext_notify_event_assoc(pAd);
2029
2030         memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
2031         memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
2032         wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
2033
2034     }
2035 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
2036         return TRUE;
2037 }
2038
2039