git.oblomov.eu Git - linux-2.6/blob - drivers/staging/rt2870/sta/assoc.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         assoc.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John            2004-9-3                porting from RT2500
  36 */
  37 #include "../rt_config.h"
  38
  39 UCHAR   CipherWpaTemplate[] = {
  40                 0xdd,                                   // WPA IE
  41                 0x16,                                   // Length
  42                 0x00, 0x50, 0xf2, 0x01, // oui
  43                 0x01, 0x00,                             // Version
  44                 0x00, 0x50, 0xf2, 0x02, // Multicast
  45                 0x01, 0x00,                             // Number of unicast
  46                 0x00, 0x50, 0xf2, 0x02, // unicast
  47                 0x01, 0x00,                             // number of authentication method
  48                 0x00, 0x50, 0xf2, 0x01  // authentication
  49                 };
  50
  51 UCHAR   CipherWpa2Template[] = {
  52                 0x30,                                   // RSN IE
  53                 0x14,                                   // Length
  54                 0x01, 0x00,                             // Version
  55                 0x00, 0x0f, 0xac, 0x02, // group cipher, TKIP
  56                 0x01, 0x00,                             // number of pairwise
  57                 0x00, 0x0f, 0xac, 0x02, // unicast
  58                 0x01, 0x00,                             // number of authentication method
  59                 0x00, 0x0f, 0xac, 0x02, // authentication
  60                 0x00, 0x00,                             // RSN capability
  61                 };
  62
  63 UCHAR   Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02};
  64
  65 /*
  66         ==========================================================================
  67         Description:
  68                 association state machine init, including state transition and timer init
  69         Parameters:
  70                 S - pointer to the association state machine
  71
  72         IRQL = PASSIVE_LEVEL
  73
  74         ==========================================================================
  75  */
  76 VOID AssocStateMachineInit(
  77         IN      PRTMP_ADAPTER   pAd,
  78         IN  STATE_MACHINE *S,
  79         OUT STATE_MACHINE_FUNC Trans[])
  80 {
  81         StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG, (STATE_MACHINE_FUNC)Drop, ASSOC_IDLE, ASSOC_MACHINE_BASE);
  82
  83         // first column
  84         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)MlmeAssocReqAction);
  85         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)MlmeReassocReqAction);
  86         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)MlmeDisassocReqAction);
  87         StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
  88
  89         // second column
  90         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
  91         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
  92         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
  93         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
  94         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
  95         //
  96         // Patch 3Com AP MOde:3CRWE454G72
  97         // We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp.
  98         //
  99         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
 100         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT, (STATE_MACHINE_FUNC)AssocTimeoutAction);
 101
 102         // third column
 103         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
 104         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
 105         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
 106         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
 107         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
 108         //
 109         // Patch, AP doesn't send Reassociate Rsp frame to Station.
 110         //
 111         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
 112         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT, (STATE_MACHINE_FUNC)ReassocTimeoutAction);
 113
 114         // fourth column
 115         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
 116         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
 117         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
 118         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
 119         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT, (STATE_MACHINE_FUNC)DisassocTimeoutAction);
 120
 121         // initialize the timer
 122         RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer, GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
 123         RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer, GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
 124         RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer, GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
 125 }
 126
 127 /*
 128         ==========================================================================
 129         Description:
 130                 Association timeout procedure. After association timeout, this function
 131                 will be called and it will put a message into the MLME queue
 132         Parameters:
 133                 Standard timer parameters
 134
 135         IRQL = DISPATCH_LEVEL
 136
 137         ==========================================================================
 138  */
 139 VOID AssocTimeout(IN PVOID SystemSpecific1,
 140                                  IN PVOID FunctionContext,
 141                                  IN PVOID SystemSpecific2,
 142                                  IN PVOID SystemSpecific3)
 143 {
 144         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 145
 146         // Do nothing if the driver is starting halt state.
 147         // This might happen when timer already been fired before cancel timer with mlmehalt
 148         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 149                 return;
 150
 151         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
 152         RT28XX_MLME_HANDLER(pAd);
 153 }
 154
 155 /*
 156         ==========================================================================
 157         Description:
 158                 Reassociation timeout procedure. After reassociation timeout, this
 159                 function will be called and put a message into the MLME queue
 160         Parameters:
 161                 Standard timer parameters
 162
 163         IRQL = DISPATCH_LEVEL
 164
 165         ==========================================================================
 166  */
 167 VOID ReassocTimeout(IN PVOID SystemSpecific1,
 168                                         IN PVOID FunctionContext,
 169                                         IN PVOID SystemSpecific2,
 170                                         IN PVOID SystemSpecific3)
 171 {
 172         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 173
 174         // Do nothing if the driver is starting halt state.
 175         // This might happen when timer already been fired before cancel timer with mlmehalt
 176         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 177                 return;
 178
 179         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
 180         RT28XX_MLME_HANDLER(pAd);
 181 }
 182
 183 /*
 184         ==========================================================================
 185         Description:
 186                 Disassociation timeout procedure. After disassociation timeout, this
 187                 function will be called and put a message into the MLME queue
 188         Parameters:
 189                 Standard timer parameters
 190
 191         IRQL = DISPATCH_LEVEL
 192
 193         ==========================================================================
 194  */
 195 VOID DisassocTimeout(IN PVOID SystemSpecific1,
 196                                         IN PVOID FunctionContext,
 197                                         IN PVOID SystemSpecific2,
 198                                         IN PVOID SystemSpecific3)
 199 {
 200         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 201
 202         // Do nothing if the driver is starting halt state.
 203         // This might happen when timer already been fired before cancel timer with mlmehalt
 204         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 205                 return;
 206
 207         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
 208         RT28XX_MLME_HANDLER(pAd);
 209 }
 210
 211 /*
 212         ==========================================================================
 213         Description:
 214                 mlme assoc req handling procedure
 215         Parameters:
 216                 Adapter - Adapter pointer
 217                 Elem - MLME Queue Element
 218         Pre:
 219                 the station has been authenticated and the following information is stored in the config
 220                         -# SSID
 221                         -# supported rates and their length
 222                         -# listen interval (Adapter->StaCfg.default_listen_count)
 223                         -# Transmit power  (Adapter->StaCfg.tx_power)
 224         Post  :
 225                 -# An association request frame is generated and sent to the air
 226                 -# Association timer starts
 227                 -# Association state -> ASSOC_WAIT_RSP
 228
 229         IRQL = DISPATCH_LEVEL
 230
 231         ==========================================================================
 232  */
 233 VOID MlmeAssocReqAction(
 234         IN PRTMP_ADAPTER pAd,
 235         IN MLME_QUEUE_ELEM *Elem)
 236 {
 237         UCHAR                   ApAddr[6];
 238         HEADER_802_11   AssocHdr;
 239         UCHAR                   Ccx2Len = 5;
 240         UCHAR                   WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
 241         USHORT                  ListenIntv;
 242         ULONG                   Timeout;
 243         USHORT                  CapabilityInfo;
 244         BOOLEAN                 TimerCancelled;
 245         PUCHAR                  pOutBuffer = NULL;
 246         NDIS_STATUS             NStatus;
 247         ULONG                   FrameLen = 0;
 248         ULONG                   tmp;
 249         USHORT                  VarIesOffset;
 250         UCHAR                   CkipFlag;
 251         UCHAR                   CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH];
 252         UCHAR                   AironetCkipIe = IE_AIRONET_CKIP;
 253         UCHAR                   AironetCkipLen = CKIP_NEGOTIATION_LENGTH;
 254         UCHAR                   AironetIPAddressIE = IE_AIRONET_IPADDRESS;
 255         UCHAR                   AironetIPAddressLen = AIRONET_IPADDRESS_LENGTH;
 256         UCHAR                   AironetIPAddressBuffer[AIRONET_IPADDRESS_LENGTH] = {0x00, 0x40, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
 257         USHORT                  Status;
 258
 259         // Block all authentication request durning WPA block period
 260         if (pAd->StaCfg.bBlockAssoc == TRUE)
 261         {
 262                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block Assoc request durning WPA block period!\n"));
 263                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 264                 Status = MLME_STATE_MACHINE_REJECT;
 265                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 266         }
 267         // check sanity first
 268         else if (MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
 269         {
 270                 RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
 271                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 272
 273                 // Get an unused nonpaged memory
 274                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
 275                 if (NStatus != NDIS_STATUS_SUCCESS)
 276                 {
 277                         DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
 278                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 279                         Status = MLME_FAIL_NO_RESOURCE;
 280                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 281                         return;
 282                 }
 283
 284                 // Add by James 03/06/27
 285                 pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 286                 // Association don't need to report MAC address
 287                 pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
 288                         NDIS_802_11_AI_REQFI_CAPABILITIES | NDIS_802_11_AI_REQFI_LISTENINTERVAL;
 289                 pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities = CapabilityInfo;
 290                 pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval = ListenIntv;
 291                 // Only reassociate need this
 292                 //COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr);
 293                 pAd->StaCfg.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 294
 295         NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
 296                 // First add SSID
 297                 VarIesOffset = 0;
 298                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe, 1);
 299                 VarIesOffset += 1;
 300                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SsidLen, 1);
 301                 VarIesOffset += 1;
 302                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
 303                 VarIesOffset += pAd->MlmeAux.SsidLen;
 304
 305                 // Second add Supported rates
 306                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe, 1);
 307                 VarIesOffset += 1;
 308                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SupRateLen, 1);
 309                 VarIesOffset += 1;
 310                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
 311                 VarIesOffset += pAd->MlmeAux.SupRateLen;
 312                 // End Add by James
 313
 314         if ((pAd->CommonCfg.Channel > 14) &&
 315             (pAd->CommonCfg.bIEEE80211H == TRUE))
 316             CapabilityInfo |= 0x0100;
 317
 318                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
 319                 MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr, ApAddr);
 320
 321                 // Build basic frame first
 322                 MakeOutgoingFrame(pOutBuffer,                           &FrameLen,
 323                                                   sizeof(HEADER_802_11),        &AssocHdr,
 324                                                   2,                                            &CapabilityInfo,
 325                                                   2,                                            &ListenIntv,
 326                                                   1,                                            &SsidIe,
 327                                                   1,                                            &pAd->MlmeAux.SsidLen,
 328                                                   pAd->MlmeAux.SsidLen,         pAd->MlmeAux.Ssid,
 329                                                   1,                                            &SupRateIe,
 330                                                   1,                                            &pAd->MlmeAux.SupRateLen,
 331                                                   pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
 332                                                   END_OF_ARGS);
 333
 334                 if (pAd->MlmeAux.ExtRateLen != 0)
 335                 {
 336                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 337                                                           1,                        &ExtRateIe,
 338                                                           1,                        &pAd->MlmeAux.ExtRateLen,
 339                                                           pAd->MlmeAux.ExtRateLen,  pAd->MlmeAux.ExtRate,
 340                                                           END_OF_ARGS);
 341                         FrameLen += tmp;
 342                 }
 343
 344 #ifdef DOT11_N_SUPPORT
 345                 // HT
 346                 if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
 347                 {
 348                         ULONG TmpLen;
 349                         UCHAR HtLen;
 350                         UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
 351                         if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
 352                         {
 353                                 HtLen = SIZE_HT_CAP_IE + 4;
 354                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 355                                                           1,                                &WpaIe,
 356                                                           1,                                &HtLen,
 357                                                           4,                                &BROADCOM[0],
 358                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 359                                                           END_OF_ARGS);
 360                         }
 361                         else
 362                         {
 363 #ifdef RT_BIG_ENDIAN
 364                         HT_CAPABILITY_IE HtCapabilityTmp;
 365 #endif
 366
 367 #ifndef RT_BIG_ENDIAN
 368                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 369                                                           1,                                &HtCapIe,
 370                                                           1,                                &pAd->MlmeAux.HtCapabilityLen,
 371                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 372                                                           END_OF_ARGS);
 373 #else
 374                 NdisZeroMemory(&HtCapabilityTmp, sizeof(HT_CAPABILITY_IE));
 375                 NdisMoveMemory(&HtCapabilityTmp, &pAd->MlmeAux.HtCapability, pAd->MlmeAux.HtCapabilityLen);
 376                         *(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
 377                         *(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
 378
 379                         MakeOutgoingFrame(pOutBuffer + FrameLen,         &TmpLen,
 380                                                                 1,                           &HtCapIe,
 381                                                                 1,                           &pAd->MlmeAux.HtCapabilityLen,
 382                                                                 pAd->MlmeAux.HtCapabilityLen,&HtCapabilityTmp,
 383                                                                 END_OF_ARGS);
 384 #endif
 385                         }
 386                         FrameLen += TmpLen;
 387                 }
 388 #endif // DOT11_N_SUPPORT //
 389
 390                 // add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
 391                 // Case I: (Aggregation + Piggy-Back)
 392                 // 1. user enable aggregation, AND
 393                 // 2. Mac support piggy-back
 394                 // 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
 395                 // Case II: (Aggregation)
 396                 // 1. user enable aggregation, AND
 397                 // 2. AP annouces it's AGGREGATION-capable in BEACON
 398                 if (pAd->CommonCfg.bAggregationCapable)
 399                 {
 400                         if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
 401                         {
 402                                 ULONG TmpLen;
 403                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
 404                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 405                                                                   9,                             RalinkIe,
 406                                                                   END_OF_ARGS);
 407                                 FrameLen += TmpLen;
 408                         }
 409                         else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
 410                         {
 411                                 ULONG TmpLen;
 412                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
 413                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 414                                                                   9,                             RalinkIe,
 415                                                                   END_OF_ARGS);
 416                                 FrameLen += TmpLen;
 417                         }
 418                 }
 419                 else
 420                 {
 421                         ULONG TmpLen;
 422                         UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06, 0x00, 0x00, 0x00};
 423                         MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 424                                                           9,                                             RalinkIe,
 425                                                           END_OF_ARGS);
 426                         FrameLen += TmpLen;
 427                 }
 428
 429                 if (pAd->MlmeAux.APEdcaParm.bValid)
 430                 {
 431                         if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
 432                         {
 433                                 QBSS_STA_INFO_PARM QosInfo;
 434
 435                                 NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
 436                                 QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 437                                 QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 438                                 QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 439                                 QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
 440                                 QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
 441                                 WmeIe[8] |= *(PUCHAR)&QosInfo;
 442                         }
 443                         else
 444                         {
 445                 // The Parameter Set Count is set to ¡§0¡¨ in the association request frames
 446                 // WmeIe[8] |= (pAd->MlmeAux.APEdcaParm.EdcaUpdateCount & 0x0f);
 447                         }
 448
 449                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 450                                                           9,                        &WmeIe[0],
 451                                                           END_OF_ARGS);
 452                         FrameLen += tmp;
 453                 }
 454
 455                 //
 456                 // Let WPA(#221) Element ID on the end of this association frame.
 457                 // Otherwise some AP will fail on parsing Element ID and set status fail on Assoc Rsp.
 458                 // For example: Put Vendor Specific IE on the front of WPA IE.
 459                 // This happens on AP (Model No:Linksys WRK54G)
 460                 //
 461                 if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
 462             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
 463             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
 464             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
 465                         )
 466             )
 467                 {
 468                         UCHAR RSNIe = IE_WPA;
 469
 470                         if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
 471                 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
 472                         {
 473                                 RSNIe = IE_WPA2;
 474                         }
 475
 476                 RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
 477
 478             // Check for WPA PMK cache list
 479                         if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
 480                         {
 481                             INT     idx;
 482                 BOOLEAN FoundPMK = FALSE;
 483                                 // Search chched PMKID, append it if existed
 484                                 for (idx = 0; idx < PMKID_NO; idx++)
 485                                 {
 486                                         if (NdisEqualMemory(ApAddr, &pAd->StaCfg.SavedPMK[idx].BSSID, 6))
 487                                         {
 488                                                 FoundPMK = TRUE;
 489                                                 break;
 490                                         }
 491                                 }
 492
 493                                 if (FoundPMK)
 494                                 {
 495                                         // Set PMK number
 496                                         *(PUSHORT) &pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len] = 1;
 497                                         NdisMoveMemory(&pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len + 2], &pAd->StaCfg.SavedPMK[idx].PMKID, 16);
 498                     pAd->StaCfg.RSNIE_Len += 18;
 499                                 }
 500                         }
 501
 502                         {
 503                                 MakeOutgoingFrame(pOutBuffer + FrameLen,                &tmp,
 504                                                         1,                              &RSNIe,
 505                                                 1,                              &pAd->StaCfg.RSNIE_Len,
 506                                                 pAd->StaCfg.RSNIE_Len,                  pAd->StaCfg.RSN_IE,
 507                                                 END_OF_ARGS);
 508                         }
 509
 510                         FrameLen += tmp;
 511
 512                         {
 513                     // Append Variable IE
 514                     NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &RSNIe, 1);
 515                     VarIesOffset += 1;
 516                     NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->StaCfg.RSNIE_Len, 1);
 517                     VarIesOffset += 1;
 518                         }
 519                         NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
 520                         VarIesOffset += pAd->StaCfg.RSNIE_Len;
 521
 522                         // Set Variable IEs Length
 523                         pAd->StaCfg.ReqVarIELen = VarIesOffset;
 524                 }
 525
 526                 // We have update that at PeerBeaconAtJoinRequest()
 527                 CkipFlag = pAd->StaCfg.CkipFlag;
 528                 if (CkipFlag != 0)
 529                 {
 530                         NdisZeroMemory(CkipNegotiationBuffer, CKIP_NEGOTIATION_LENGTH);
 531                         CkipNegotiationBuffer[2] = 0x66;
 532                         // Make it try KP & MIC, since we have to follow the result from AssocRsp
 533                         CkipNegotiationBuffer[8] = 0x18;
 534                         CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH - 1] = 0x22;
 535                         CkipFlag = 0x18;
 536
 537                         MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 538                                                 1,                                                              &AironetCkipIe,
 539                                                 1,                                                              &AironetCkipLen,
 540                                                 AironetCkipLen,                                 CkipNegotiationBuffer,
 541                                                 END_OF_ARGS);
 542                         FrameLen += tmp;
 543                 }
 544
 545                 // Add CCX v2 request if CCX2 admin state is on
 546                 if (pAd->StaCfg.CCXControl.field.Enable == 1)
 547                 {
 548
 549                         //
 550                         // Add AironetIPAddressIE for Cisco CCX 2.X
 551                         // Add CCX Version
 552                         //
 553                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 554                                                 1,                                                      &AironetIPAddressIE,
 555                                                 1,                                                      &AironetIPAddressLen,
 556                                                 AironetIPAddressLen,            AironetIPAddressBuffer,
 557                                                 1,                                                      &Ccx2Ie,
 558                                                 1,                                                      &Ccx2Len,
 559                                                 Ccx2Len,                                    Ccx2IeInfo,
 560                                                 END_OF_ARGS);
 561                         FrameLen += tmp;
 562
 563                         //
 564                         // Add CipherSuite CCKM or LeapTkip if setting.
 565                         //
 566 #ifdef LEAP_SUPPORT
 567                         if (LEAP_CCKM_ON(pAd))
 568                         {
 569                                 MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 570                                                 CipherSuiteCiscoCCKMLen,                CipherSuiteCiscoCCKM,
 571                                                 END_OF_ARGS);
 572                                 FrameLen += tmp;
 573
 574                                 // Third add RSN
 575                                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, CipherSuiteCiscoCCKM, CipherSuiteCiscoCCKMLen); //Save CipherSuite
 576                                 VarIesOffset += CipherSuiteCiscoCCKMLen;
 577                         }
 578                         else if ((pAd->StaCfg.LeapAuthMode == CISCO_AuthModeLEAP) && (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled))
 579                         {
 580                                 MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 581                                                 CipherSuiteCCXTkipLen,      CipherSuiteCCXTkip,
 582                                                 END_OF_ARGS);
 583                                 FrameLen += tmp;
 584
 585                                 // Third add RSN
 586                                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, CipherSuiteCCXTkip, CipherSuiteCCXTkipLen);
 587                                 VarIesOffset += CipherSuiteCCXTkipLen;
 588                         }
 589 #endif // LEAP_SUPPORT //
 590
 591                         // Add by James 03/06/27
 592                         // Set Variable IEs Length
 593                         pAd->StaCfg.ReqVarIELen = VarIesOffset;
 594                         pAd->StaCfg.AssocInfo.RequestIELength = VarIesOffset;
 595
 596                         // OffsetResponseIEs follow ReqVarIE
 597                         pAd->StaCfg.AssocInfo.OffsetResponseIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION) + pAd->StaCfg.ReqVarIELen;
 598                         // End Add by James
 599                 }
 600
 601
 602                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 603                 MlmeFreeMemory(pAd, pOutBuffer);
 604
 605                 RTMPSetTimer(&pAd->MlmeAux.AssocTimer, Timeout);
 606                 pAd->Mlme.AssocMachine.CurrState = ASSOC_WAIT_RSP;
 607         }
 608         else
 609         {
 610                 DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() sanity check failed. BUG!!!!!! \n"));
 611                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 612                 Status = MLME_INVALID_FORMAT;
 613                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 614         }
 615
 616 }
 617
 618 /*
 619         ==========================================================================
 620         Description:
 621                 mlme reassoc req handling procedure
 622         Parameters:
 623                 Elem -
 624         Pre:
 625                 -# SSID  (Adapter->StaCfg.ssid[])
 626                 -# BSSID (AP address, Adapter->StaCfg.bssid)
 627                 -# Supported rates (Adapter->StaCfg.supported_rates[])
 628                 -# Supported rates length (Adapter->StaCfg.supported_rates_len)
 629                 -# Tx power (Adapter->StaCfg.tx_power)
 630
 631         IRQL = DISPATCH_LEVEL
 632
 633         ==========================================================================
 634  */
 635 VOID MlmeReassocReqAction(
 636         IN PRTMP_ADAPTER pAd,
 637         IN MLME_QUEUE_ELEM *Elem)
 638 {
 639         UCHAR                   ApAddr[6];
 640         HEADER_802_11   ReassocHdr;
 641         UCHAR                   Ccx2Len = 5;
 642         UCHAR                   WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
 643         USHORT                  CapabilityInfo, ListenIntv;
 644         ULONG                   Timeout;
 645         ULONG                   FrameLen = 0;
 646         BOOLEAN                 TimerCancelled;
 647         NDIS_STATUS             NStatus;
 648         ULONG                   tmp;
 649         PUCHAR                  pOutBuffer = NULL;
 650 //CCX 2.X
 651 #ifdef LEAP_SUPPORT
 652         UCHAR                   CkipFlag;
 653         UCHAR                   CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH];
 654         UCHAR                   AironetCkipIe = IE_AIRONET_CKIP;
 655         UCHAR                   AironetCkipLen = CKIP_NEGOTIATION_LENGTH;
 656         UCHAR                   AironetIPAddressIE = IE_AIRONET_IPADDRESS;
 657         UCHAR                   AironetIPAddressLen = AIRONET_IPADDRESS_LENGTH;
 658         UCHAR                   AironetIPAddressBuffer[AIRONET_IPADDRESS_LENGTH] = {0x00, 0x40, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
 659         UCHAR                   AironetCCKMReassocIE = IE_AIRONET_CCKMREASSOC;
 660         UCHAR                   AironetCCKMReassocLen = AIRONET_CCKMREASSOC_LENGTH;
 661         UCHAR                   AironetCCKMReassocBuffer[AIRONET_CCKMREASSOC_LENGTH];
 662         UCHAR                   AironetOUI[] = {0x00, 0x40, 0x96, 0x00};
 663         UCHAR                   MICMN[16];
 664         UCHAR                   CalcMicBuffer[80];
 665         ULONG                   CalcMicBufferLen = 0;
 666 #endif // LEAP_SUPPORT //
 667         USHORT                  Status;
 668
 669         // Block all authentication request durning WPA block period
 670         if (pAd->StaCfg.bBlockAssoc == TRUE)
 671         {
 672                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block ReAssoc request durning WPA block period!\n"));
 673                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 674                 Status = MLME_STATE_MACHINE_REJECT;
 675                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 676         }
 677         // the parameters are the same as the association
 678         else if(MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
 679         {
 680                 RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
 681
 682                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
 683                 if(NStatus != NDIS_STATUS_SUCCESS)
 684                 {
 685                         DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() allocate memory failed \n"));
 686                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 687                         Status = MLME_FAIL_NO_RESOURCE;
 688                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 689                         return;
 690                 }
 691
 692                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 693
 694                 // make frame, use bssid as the AP address??
 695                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send RE-ASSOC request...\n"));
 696                 MgtMacHeaderInit(pAd, &ReassocHdr, SUBTYPE_REASSOC_REQ, 0, ApAddr, ApAddr);
 697                 MakeOutgoingFrame(pOutBuffer,               &FrameLen,
 698                                                   sizeof(HEADER_802_11),    &ReassocHdr,
 699                                                   2,                        &CapabilityInfo,
 700                                                   2,                        &ListenIntv,
 701                                                   MAC_ADDR_LEN,             ApAddr,
 702                                                   1,                        &SsidIe,
 703                                                   1,                        &pAd->MlmeAux.SsidLen,
 704                                                   pAd->MlmeAux.SsidLen,     pAd->MlmeAux.Ssid,
 705                                                   1,                        &SupRateIe,
 706                                                   1,                                            &pAd->MlmeAux.SupRateLen,
 707                                                   pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
 708                                                   END_OF_ARGS);
 709
 710                 if (pAd->MlmeAux.ExtRateLen != 0)
 711                 {
 712                         MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 713                                                           1,                            &ExtRateIe,
 714                                                           1,                            &pAd->MlmeAux.ExtRateLen,
 715                                                           pAd->MlmeAux.ExtRateLen,          pAd->MlmeAux.ExtRate,
 716                                                           END_OF_ARGS);
 717                         FrameLen += tmp;
 718                 }
 719
 720                 if (pAd->MlmeAux.APEdcaParm.bValid)
 721                 {
 722                         if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
 723                         {
 724                                 QBSS_STA_INFO_PARM QosInfo;
 725
 726                                 NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
 727                                 QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 728                                 QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 729                                 QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 730                                 QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
 731                                 QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
 732                                 WmeIe[8] |= *(PUCHAR)&QosInfo;
 733                         }
 734
 735                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 736                                                           9,                        &WmeIe[0],
 737                                                           END_OF_ARGS);
 738                         FrameLen += tmp;
 739                 }
 740
 741 #ifdef DOT11_N_SUPPORT
 742                 // HT
 743                 if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
 744                 {
 745                         ULONG TmpLen;
 746                         UCHAR HtLen;
 747                         UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
 748                         if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
 749                         {
 750                                 HtLen = SIZE_HT_CAP_IE + 4;
 751                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 752                                                           1,                                &WpaIe,
 753                                                           1,                                &HtLen,
 754                                                           4,                                &BROADCOM[0],
 755                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 756                                                           END_OF_ARGS);
 757                         }
 758                         else
 759                         {
 760                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 761                                                           1,                                &HtCapIe,
 762                                                           1,                                &pAd->MlmeAux.HtCapabilityLen,
 763                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 764                                                           END_OF_ARGS);
 765                         }
 766                         FrameLen += TmpLen;
 767                 }
 768 #endif // DOT11_N_SUPPORT //
 769
 770                 // add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
 771                 // Case I: (Aggregation + Piggy-Back)
 772                 // 1. user enable aggregation, AND
 773                 // 2. Mac support piggy-back
 774                 // 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
 775                 // Case II: (Aggregation)
 776                 // 1. user enable aggregation, AND
 777                 // 2. AP annouces it's AGGREGATION-capable in BEACON
 778                 if (pAd->CommonCfg.bAggregationCapable)
 779                 {
 780                         if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
 781                         {
 782                                 ULONG TmpLen;
 783                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
 784                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 785                                                                   9,                             RalinkIe,
 786                                                                   END_OF_ARGS);
 787                                 FrameLen += TmpLen;
 788                         }
 789                         else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
 790                         {
 791                                 ULONG TmpLen;
 792                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
 793                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 794                                                                   9,                             RalinkIe,
 795                                                                   END_OF_ARGS);
 796                                 FrameLen += TmpLen;
 797                         }
 798                 }
 799                 else
 800                 {
 801                         ULONG TmpLen;
 802                         UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x04, 0x00, 0x00, 0x00};
 803                         MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 804                                                           9,                                             RalinkIe,
 805                                                           END_OF_ARGS);
 806                         FrameLen += TmpLen;
 807                 }
 808 #ifdef LEAP_SUPPORT
 809                 if (LEAP_CCKM_ON(pAd) && (pAd->StaCfg.CCKMLinkUpFlag == TRUE))
 810                 {
 811                         CkipFlag = pAd->StaCfg.CkipFlag;        // We have update that at PeerBeaconAtJoinRequest()
 812                         if (CkipFlag != 0)
 813                         {
 814                                 NdisZeroMemory(CkipNegotiationBuffer, CKIP_NEGOTIATION_LENGTH);
 815                                 CkipNegotiationBuffer[2] = 0x66;
 816                                 // Make it try KP & MIC, since we have to follow the result from AssocRsp
 817                                 CkipNegotiationBuffer[8] = 0x18;
 818                                 CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH - 1] = 0x22;
 819
 820                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &tmp,
 821                                                                         1,                              &AironetCkipIe,
 822                                                                         1,                              &AironetCkipLen,
 823                                                                         AironetCkipLen,                 CkipNegotiationBuffer,
 824                                                                         END_OF_ARGS);
 825                                 FrameLen += tmp;
 826                         }
 827
 828                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 829                                                         1,                              &AironetIPAddressIE,
 830                                                         1,                              &AironetIPAddressLen,
 831                                                         AironetIPAddressLen,            AironetIPAddressBuffer,
 832                                                         END_OF_ARGS);
 833                         FrameLen += tmp;
 834
 835                         //
 836                         // The RN is incremented before each reassociation request.
 837                         //
 838                         pAd->StaCfg.CCKMRN++;
 839                         //
 840                         // Calculate MIC = hmac-md5(krk, STA-ID|BSSID|RSNIE|TSF|RN);
 841                         //
 842                         COPY_MAC_ADDR(CalcMicBuffer, pAd->CurrentAddress);
 843                         CalcMicBufferLen = MAC_ADDR_LEN;
 844                         COPY_MAC_ADDR(CalcMicBuffer + CalcMicBufferLen, pAd->MlmeAux.Bssid);
 845                         CalcMicBufferLen += MAC_ADDR_LEN;
 846                         NdisMoveMemory(CalcMicBuffer + CalcMicBufferLen, CipherSuiteCiscoCCKM, CipherSuiteCiscoCCKMLen);
 847                         CalcMicBufferLen += CipherSuiteCiscoCCKMLen;
 848                         NdisMoveMemory(CalcMicBuffer + CalcMicBufferLen, (PUCHAR) &pAd->StaCfg.CCKMBeaconAtJoinTimeStamp, sizeof(pAd->StaCfg.CCKMBeaconAtJoinTimeStamp));
 849                         CalcMicBufferLen += sizeof(pAd->StaCfg.CCKMBeaconAtJoinTimeStamp);
 850                         NdisMoveMemory(CalcMicBuffer + CalcMicBufferLen, (PUCHAR)&pAd->StaCfg.CCKMRN, sizeof(pAd->StaCfg.CCKMRN));
 851                         CalcMicBufferLen += sizeof(pAd->StaCfg.CCKMRN);
 852                         hmac_md5(pAd->StaCfg.KRK, LEN_EAP_MICK, CalcMicBuffer, CalcMicBufferLen, MICMN);
 853
 854                         //
 855                         // fill up CCKM reassociation request element
 856                         //
 857                         NdisMoveMemory(AironetCCKMReassocBuffer, AironetOUI, 4);
 858                         NdisMoveMemory(AironetCCKMReassocBuffer + 4, (PUCHAR)&pAd->StaCfg.CCKMBeaconAtJoinTimeStamp, 8);
 859                         NdisMoveMemory(AironetCCKMReassocBuffer + 12, (PUCHAR) &pAd->StaCfg.CCKMRN, 4);
 860                         NdisMoveMemory(AironetCCKMReassocBuffer +16, MICMN, 8);
 861
 862                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 863                                                         1,                      &AironetCCKMReassocIE,
 864                                                         1,                      &AironetCCKMReassocLen,
 865                                                         AironetCCKMReassocLen,  AironetCCKMReassocBuffer,
 866                                                         END_OF_ARGS);
 867                         FrameLen += tmp;
 868
 869                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 870                                                         CipherSuiteCiscoCCKMLen,CipherSuiteCiscoCCKM,
 871                                                         END_OF_ARGS);
 872                         FrameLen += tmp;
 873                 }
 874 #endif // LEAP_SUPPORT //
 875
 876                 // Add CCX v2 request if CCX2 admin state is on
 877                 if (pAd->StaCfg.CCXControl.field.Enable == 1)
 878                 {
 879                         //
 880                         // Add CCX Version
 881                         //
 882                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 883                                                 1,                                                      &Ccx2Ie,
 884                                                 1,                                                      &Ccx2Len,
 885                                                 Ccx2Len,                                    Ccx2IeInfo,
 886                                                 END_OF_ARGS);
 887                         FrameLen += tmp;
 888                 }
 889
 890                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 891                 MlmeFreeMemory(pAd, pOutBuffer);
 892
 893                 RTMPSetTimer(&pAd->MlmeAux.ReassocTimer, Timeout); /* in mSec */
 894                 pAd->Mlme.AssocMachine.CurrState = REASSOC_WAIT_RSP;
 895         }
 896         else
 897         {
 898                 DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() sanity check failed. BUG!!!! \n"));
 899                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 900                 Status = MLME_INVALID_FORMAT;
 901                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 902         }
 903 }
 904
 905 /*
 906         ==========================================================================
 907         Description:
 908                 Upper layer issues disassoc request
 909         Parameters:
 910                 Elem -
 911
 912         IRQL = PASSIVE_LEVEL
 913
 914         ==========================================================================
 915  */
 916 VOID MlmeDisassocReqAction(
 917         IN PRTMP_ADAPTER pAd,
 918         IN MLME_QUEUE_ELEM *Elem)
 919 {
 920         PMLME_DISASSOC_REQ_STRUCT pDisassocReq;
 921         HEADER_802_11         DisassocHdr;
 922         PHEADER_802_11        pDisassocHdr;
 923         PUCHAR                pOutBuffer = NULL;
 924         ULONG                 FrameLen = 0;
 925         NDIS_STATUS           NStatus;
 926         BOOLEAN               TimerCancelled;
 927         ULONG                 Timeout = 0;
 928         USHORT                Status;
 929
 930         // skip sanity check
 931         pDisassocReq = (PMLME_DISASSOC_REQ_STRUCT)(Elem->Msg);
 932
 933         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
 934         if (NStatus != NDIS_STATUS_SUCCESS)
 935         {
 936                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - MlmeDisassocReqAction() allocate memory failed\n"));
 937                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 938                 Status = MLME_FAIL_NO_RESOURCE;
 939                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
 940                 return;
 941         }
 942
 943
 944
 945         RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &TimerCancelled);
 946
 947         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send DISASSOC request[BSSID::%02x:%02x:%02x:%02x:%02x:%02x (Reason=%d)\n",
 948                                 pDisassocReq->Addr[0], pDisassocReq->Addr[1], pDisassocReq->Addr[2],
 949                                 pDisassocReq->Addr[3], pDisassocReq->Addr[4], pDisassocReq->Addr[5], pDisassocReq->Reason));
 950         MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pDisassocReq->Addr, pDisassocReq->Addr);       // patch peap ttls switching issue
 951         MakeOutgoingFrame(pOutBuffer,           &FrameLen,
 952                                           sizeof(HEADER_802_11),&DisassocHdr,
 953                                           2,                    &pDisassocReq->Reason,
 954                                           END_OF_ARGS);
 955         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 956
 957         // To patch Instance and Buffalo(N) AP
 958         // Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
 959         // Therefore, we send both of them.
 960         pDisassocHdr = (PHEADER_802_11)pOutBuffer;
 961         pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
 962         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 963
 964         MlmeFreeMemory(pAd, pOutBuffer);
 965
 966         pAd->StaCfg.DisassocReason = REASON_DISASSOC_STA_LEAVING;
 967         COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pDisassocReq->Addr);
 968
 969         RTMPSetTimer(&pAd->MlmeAux.DisassocTimer, Timeout); /* in mSec */
 970         pAd->Mlme.AssocMachine.CurrState = DISASSOC_WAIT_RSP;
 971
 972 #ifdef WPA_SUPPLICANT_SUPPORT
 973 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
 974     if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
 975         {
 976         union iwreq_data    wrqu;
 977         //send disassociate event to wpa_supplicant
 978         memset(&wrqu, 0, sizeof(wrqu));
 979         wrqu.data.flags = RT_DISASSOC_EVENT_FLAG;
 980         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
 981     }
 982 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
 983 #endif // WPA_SUPPLICANT_SUPPORT //
 984
 985 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
 986     {
 987         union iwreq_data    wrqu;
 988         memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
 989         wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
 990     }
 991 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
 992
 993 }
 994
 995 /*
 996         ==========================================================================
 997         Description:
 998                 peer sends assoc rsp back
 999         Parameters:
1000                 Elme - MLME message containing the received frame
1001
1002         IRQL = DISPATCH_LEVEL
1003
1004         ==========================================================================
1005  */
1006 VOID PeerAssocRspAction(
1007         IN PRTMP_ADAPTER pAd,
1008         IN MLME_QUEUE_ELEM *Elem)
1009 {
1010         USHORT        CapabilityInfo, Status, Aid;
1011         UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
1012         UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
1013         UCHAR         Addr2[MAC_ADDR_LEN];
1014         BOOLEAN       TimerCancelled;
1015         UCHAR         CkipFlag;
1016         EDCA_PARM     EdcaParm;
1017         HT_CAPABILITY_IE                HtCapability;
1018         ADD_HT_INFO_IE          AddHtInfo;      // AP might use this additional ht info IE
1019         UCHAR                   HtCapabilityLen;
1020         UCHAR                   AddHtInfoLen;
1021         UCHAR                   NewExtChannelOffset = 0xff;
1022
1023         if (PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
1024                 &HtCapability,&AddHtInfo, &HtCapabilityLen,&AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
1025         {
1026                 // The frame is for me ?
1027                 if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid))
1028                 {
1029                         DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():ASSOC - receive ASSOC_RSP to me (status=%d)\n", Status));
1030 #ifdef DOT11_N_SUPPORT
1031                         DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():MacTable [%d].AMsduSize = %d. ClientStatusFlags = 0x%lx \n",Elem->Wcid, pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
1032 #endif // DOT11_N_SUPPORT //
1033                         RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
1034                         if(Status == MLME_SUCCESS)
1035                         {
1036                                 UCHAR                   MaxSupportedRateIn500Kbps = 0;
1037                                 UCHAR                   idx;
1038
1039                                 // supported rates array may not be sorted. sort it and find the maximum rate
1040                             for (idx=0; idx<SupRateLen; idx++)
1041                             {
1042                                 if (MaxSupportedRateIn500Kbps < (SupRate[idx] & 0x7f))
1043                                     MaxSupportedRateIn500Kbps = SupRate[idx] & 0x7f;
1044                             }
1045
1046                                 for (idx=0; idx<ExtRateLen; idx++)
1047                             {
1048                                 if (MaxSupportedRateIn500Kbps < (ExtRate[idx] & 0x7f))
1049                                     MaxSupportedRateIn500Kbps = ExtRate[idx] & 0x7f;
1050                             }
1051                                 // go to procedure listed on page 376
1052                                 AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
1053                                         &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
1054
1055                                 StaAddMacTableEntry(pAd, &pAd->MacTab.Content[BSSID_WCID], MaxSupportedRateIn500Kbps, &HtCapability, HtCapabilityLen, CapabilityInfo);
1056
1057                                 pAd->StaCfg.CkipFlag = CkipFlag;
1058                                 if (CkipFlag & 0x18)
1059                                 {
1060                                         NdisZeroMemory(pAd->StaCfg.TxSEQ, 4);
1061                                         NdisZeroMemory(pAd->StaCfg.RxSEQ, 4);
1062                                         NdisZeroMemory(pAd->StaCfg.CKIPMIC, 4);
1063                                         pAd->StaCfg.GIV[0] = RandomByte(pAd);
1064                                         pAd->StaCfg.GIV[1] = RandomByte(pAd);
1065                                         pAd->StaCfg.GIV[2] = RandomByte(pAd);
1066                                         pAd->StaCfg.bCkipOn = TRUE;
1067                                         DBGPRINT(RT_DEBUG_TRACE, ("<CCX> pAd->StaCfg.CkipFlag = 0x%02x\n", pAd->StaCfg.CkipFlag));
1068                                 }
1069                         }
1070                         else
1071                         {
1072                                 // Faile on Association, we need to check the status code
1073                                 // Is that a Rogue AP?
1074 #ifdef LEAP_SUPPORT
1075                                 if ((pAd->StaCfg.LeapAuthMode == CISCO_AuthModeLEAP) && (Status == MLME_ALG_NOT_SUPPORT))
1076                                 { //Possibly Rogue AP
1077                                         RogueApTableSetEntry(pAd, &pAd->StaCfg.RogueApTab, pAd->MlmeAux.Bssid, LEAP_REASON_INVALID_AUTH);
1078                                 }
1079 #endif // LEAP_SUPPORT //
1080                         }
1081                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1082                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1083                 }
1084         }
1085         else
1086         {
1087                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerAssocRspAction() sanity check fail\n"));
1088         }
1089 }
1090
1091 /*
1092         ==========================================================================
1093         Description:
1094                 peer sends reassoc rsp
1095         Parametrs:
1096                 Elem - MLME message cntaining the received frame
1097
1098         IRQL = DISPATCH_LEVEL
1099
1100         ==========================================================================
1101  */
1102 VOID PeerReassocRspAction(
1103         IN PRTMP_ADAPTER pAd,
1104         IN MLME_QUEUE_ELEM *Elem)
1105 {
1106         USHORT      CapabilityInfo;
1107         USHORT      Status;
1108         USHORT      Aid;
1109         UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
1110         UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
1111         UCHAR       Addr2[MAC_ADDR_LEN];
1112         UCHAR       CkipFlag;
1113         BOOLEAN     TimerCancelled;
1114         EDCA_PARM   EdcaParm;
1115         HT_CAPABILITY_IE                HtCapability;
1116         ADD_HT_INFO_IE          AddHtInfo;      // AP might use this additional ht info IE
1117         UCHAR                   HtCapabilityLen;
1118         UCHAR                   AddHtInfoLen;
1119         UCHAR                   NewExtChannelOffset = 0xff;
1120
1121         if(PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
1122                                                                 &HtCapability,  &AddHtInfo, &HtCapabilityLen, &AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
1123         {
1124                 if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid)) // The frame is for me ?
1125                 {
1126                         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - receive REASSOC_RSP to me (status=%d)\n", Status));
1127                         RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
1128
1129                         if(Status == MLME_SUCCESS)
1130                         {
1131                                 // go to procedure listed on page 376
1132                                 AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
1133                                          &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
1134
1135 #ifdef WPA_SUPPLICANT_SUPPORT
1136 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1137                 if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
1138                 {
1139                     union iwreq_data    wrqu;
1140
1141                     SendAssocIEsToWpaSupplicant(pAd);
1142                     memset(&wrqu, 0, sizeof(wrqu));
1143                     wrqu.data.flags = RT_ASSOC_EVENT_FLAG;
1144                     wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1145                 }
1146 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1147 #endif // WPA_SUPPLICANT_SUPPORT //
1148
1149 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1150                 {
1151                     union iwreq_data    wrqu;
1152                     wext_notify_event_assoc(pAd);
1153
1154                     memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
1155                     memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
1156                     wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
1157
1158                 }
1159 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1160
1161                         }
1162
1163                         //
1164                         // Cisco Leap CCKM supported Re-association.
1165                         //
1166 #ifdef LEAP_SUPPORT
1167                         if (LEAP_CCKM_ON(pAd) && (pAd->StaCfg.CCKMLinkUpFlag == TRUE))
1168                         {
1169                                 if (CCKMAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen) == TRUE)
1170                                 {
1171                                         pAd->StaCfg.CkipFlag = CkipFlag;
1172                                         if (CkipFlag & 0x18)
1173                                         {
1174                                                 NdisZeroMemory(pAd->StaCfg.TxSEQ, 4);
1175                                                 NdisZeroMemory(pAd->StaCfg.RxSEQ, 4);
1176                                                 NdisZeroMemory(pAd->StaCfg.CKIPMIC, 4);
1177                                                 pAd->StaCfg.GIV[0] = RandomByte(pAd);
1178                                                 pAd->StaCfg.GIV[1] = RandomByte(pAd);
1179                                                 pAd->StaCfg.GIV[2] = RandomByte(pAd);
1180                                                 pAd->StaCfg.bCkipOn = TRUE;
1181                                                 DBGPRINT(RT_DEBUG_TRACE, ("<CCX> pAd->StaCfg.CkipFlag = 0x%02x\n", pAd->StaCfg.CkipFlag));
1182                                         }
1183
1184                                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1185                                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1186                                 }
1187                                 else
1188                                 {
1189                                         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - CCKMAssocRspSanity() sanity check fail\n"));
1190                                 }
1191                         }
1192                         else
1193 #endif // LEAP_SUPPORT //
1194                         {
1195                                 // CkipFlag is no use for reassociate
1196                                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1197                                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1198                         }
1199                 }
1200         }
1201         else
1202         {
1203                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerReassocRspAction() sanity check fail\n"));
1204         }
1205
1206 }
1207
1208 /*
1209         ==========================================================================
1210         Description:
1211                 procedures on IEEE 802.11/1999 p.376
1212         Parametrs:
1213
1214         IRQL = DISPATCH_LEVEL
1215
1216         ==========================================================================
1217  */
1218 VOID AssocPostProc(
1219         IN PRTMP_ADAPTER pAd,
1220         IN PUCHAR pAddr2,
1221         IN USHORT CapabilityInfo,
1222         IN USHORT Aid,
1223         IN UCHAR SupRate[],
1224         IN UCHAR SupRateLen,
1225         IN UCHAR ExtRate[],
1226         IN UCHAR ExtRateLen,
1227         IN PEDCA_PARM pEdcaParm,
1228         IN HT_CAPABILITY_IE             *pHtCapability,
1229         IN UCHAR HtCapabilityLen,
1230         IN ADD_HT_INFO_IE               *pAddHtInfo)    // AP might use this additional ht info IE
1231 {
1232         ULONG Idx;
1233
1234         pAd->MlmeAux.BssType = BSS_INFRA;
1235         COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pAddr2);
1236         pAd->MlmeAux.Aid = Aid;
1237         pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
1238 #ifdef DOT11_N_SUPPORT
1239         // Some HT AP might lost WMM IE. We add WMM ourselves. beacuase HT requires QoS on.
1240         if ((HtCapabilityLen > 0) && (pEdcaParm->bValid == FALSE))
1241         {
1242                 pEdcaParm->bValid = TRUE;
1243                 pEdcaParm->Aifsn[0] = 3;
1244                 pEdcaParm->Aifsn[1] = 7;
1245                 pEdcaParm->Aifsn[2] = 2;
1246                 pEdcaParm->Aifsn[3] = 2;
1247
1248                 pEdcaParm->Cwmin[0] = 4;
1249                 pEdcaParm->Cwmin[1] = 4;
1250                 pEdcaParm->Cwmin[2] = 3;
1251                 pEdcaParm->Cwmin[3] = 2;
1252
1253                 pEdcaParm->Cwmax[0] = 10;
1254                 pEdcaParm->Cwmax[1] = 10;
1255                 pEdcaParm->Cwmax[2] = 4;
1256                 pEdcaParm->Cwmax[3] = 3;
1257
1258                 pEdcaParm->Txop[0]  = 0;
1259                 pEdcaParm->Txop[1]  = 0;
1260                 pEdcaParm->Txop[2]  = 96;
1261                 pEdcaParm->Txop[3]  = 48;
1262
1263         }
1264 #endif // DOT11_N_SUPPORT //
1265
1266         NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
1267
1268         // filter out un-supported rates
1269         pAd->MlmeAux.SupRateLen = SupRateLen;
1270         NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
1271         RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
1272
1273         // filter out un-supported rates
1274         pAd->MlmeAux.ExtRateLen = ExtRateLen;
1275         NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
1276         RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
1277
1278 #ifdef DOT11_N_SUPPORT
1279         if (HtCapabilityLen > 0)
1280         {
1281                 RTMPCheckHt(pAd, BSSID_WCID, pHtCapability, pAddHtInfo);
1282         }
1283         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>  AP.AMsduSize = %d. ClientStatusFlags = 0x%lx \n", pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
1284
1285         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>    (Mmps=%d, AmsduSize=%d, )\n",
1286                 pAd->MacTab.Content[BSSID_WCID].MmpsMode, pAd->MacTab.Content[BSSID_WCID].AMsduSize));
1287 #endif // DOT11_N_SUPPORT //
1288
1289         // Set New WPA information
1290         Idx = BssTableSearch(&pAd->ScanTab, pAddr2, pAd->MlmeAux.Channel);
1291         if (Idx == BSS_NOT_FOUND)
1292         {
1293                 DBGPRINT_ERR(("ASSOC - Can't find BSS after receiving Assoc response\n"));
1294         }
1295         else
1296         {
1297                 // Init variable
1298                 pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = 0;
1299                 NdisZeroMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, MAX_LEN_OF_RSNIE);
1300
1301                 // Store appropriate RSN_IE for WPA SM negotiation later
1302                 if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) && (pAd->ScanTab.BssEntry[Idx].VarIELen != 0))
1303                 {
1304                         PUCHAR              pVIE;
1305                         USHORT              len;
1306                         PEID_STRUCT         pEid;
1307
1308                         pVIE = pAd->ScanTab.BssEntry[Idx].VarIEs;
1309                         len      = pAd->ScanTab.BssEntry[Idx].VarIELen;
1310
1311                         while (len > 0)
1312                         {
1313                                 pEid = (PEID_STRUCT) pVIE;
1314                                 // For WPA/WPAPSK
1315                                 if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
1316                                         && (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
1317                                 {
1318                                         NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
1319                                         pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
1320                                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA SM negotiation \n"));
1321                                 }
1322                                 // For WPA2/WPA2PSK
1323                                 else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
1324                                         && (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2 || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
1325                                 {
1326                                         NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
1327                                         pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
1328                                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA2 SM negotiation \n"));
1329                                 }
1330
1331                                 pVIE += (pEid->Len + 2);
1332                                 len  -= (pEid->Len + 2);
1333                         }
1334                 }
1335
1336                 if (pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == 0)
1337                 {
1338                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> no RSN_IE \n"));
1339                 }
1340                 else
1341                 {
1342                         hex_dump("RSN_IE", pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
1343                 }
1344         }
1345 }
1346
1347 /*
1348         ==========================================================================
1349         Description:
1350                 left part of IEEE 802.11/1999 p.374
1351         Parameters:
1352                 Elem - MLME message containing the received frame
1353
1354         IRQL = DISPATCH_LEVEL
1355
1356         ==========================================================================
1357  */
1358 VOID PeerDisassocAction(
1359         IN PRTMP_ADAPTER pAd,
1360         IN MLME_QUEUE_ELEM *Elem)
1361 {
1362         UCHAR         Addr2[MAC_ADDR_LEN];
1363         USHORT        Reason;
1364
1365         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction()\n"));
1366         if(PeerDisassocSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
1367         {
1368                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() Reason = %d\n", Reason));
1369                 if (INFRA_ON(pAd) && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, Addr2))
1370                 {
1371
1372                         if (pAd->CommonCfg.bWirelessEvent)
1373                         {
1374                                 RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
1375                         }
1376
1377
1378 #ifdef LEAP_SUPPORT
1379                         if (pAd->StaCfg.LeapAuthMode == CISCO_AuthModeLEAP)
1380                         {
1381                                 // Cisco_LEAP has start a timer
1382                                 // We should cancel it if using LEAP
1383                                 RTMPCancelTimer(&pAd->StaCfg.LeapAuthTimer, &TimerCancelled);
1384                                 //Check is it mach the LEAP Authentication failed as possible a Rogue AP
1385                                 //on it's PortSecured not equal to WPA_802_1X_PORT_SECURED while process the Association.
1386                                 if ((pAd->Mlme.LeapMachine.CurrState != LEAP_IDLE) && (pAd->StaCfg.PortSecured != WPA_802_1X_PORT_SECURED))
1387                                 {
1388                                         RogueApTableSetEntry(pAd, &pAd->StaCfg.RogueApTab, Addr2, LEAP_REASON_AUTH_TIMEOUT);
1389                                 }
1390                         }
1391 #endif  // LEAP_SUPPORT //
1392                         //
1393                         // Get Current System time and Turn on AdjacentAPReport
1394                         //
1395                         NdisGetSystemUpTime(&pAd->StaCfg.CCXAdjacentAPLinkDownTime);
1396                         pAd->StaCfg.CCXAdjacentAPReportFlag = TRUE;
1397                         LinkDown(pAd, TRUE);
1398                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1399
1400 #ifdef WPA_SUPPLICANT_SUPPORT
1401 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1402             if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
1403                         {
1404                 union iwreq_data    wrqu;
1405                 //send disassociate event to wpa_supplicant
1406                 memset(&wrqu, 0, sizeof(wrqu));
1407                 wrqu.data.flags = RT_DISASSOC_EVENT_FLAG;
1408                 wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1409             }
1410 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1411 #endif // WPA_SUPPLICANT_SUPPORT //
1412
1413 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1414             {
1415                 union iwreq_data    wrqu;
1416                 memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
1417                 wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
1418             }
1419 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1420                 }
1421         }
1422         else
1423         {
1424                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() sanity check fail\n"));
1425         }
1426
1427 }
1428
1429 /*
1430         ==========================================================================
1431         Description:
1432                 what the state machine will do after assoc timeout
1433         Parameters:
1434                 Elme -
1435
1436         IRQL = DISPATCH_LEVEL
1437
1438         ==========================================================================
1439  */
1440 VOID AssocTimeoutAction(
1441         IN PRTMP_ADAPTER pAd,
1442         IN MLME_QUEUE_ELEM *Elem)
1443 {
1444         USHORT  Status;
1445         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - AssocTimeoutAction\n"));
1446         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1447         Status = MLME_REJ_TIMEOUT;
1448         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1449 }
1450
1451 /*
1452         ==========================================================================
1453         Description:
1454                 what the state machine will do after reassoc timeout
1455
1456         IRQL = DISPATCH_LEVEL
1457
1458         ==========================================================================
1459  */
1460 VOID ReassocTimeoutAction(
1461         IN PRTMP_ADAPTER pAd,
1462         IN MLME_QUEUE_ELEM *Elem)
1463 {
1464         USHORT  Status;
1465         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - ReassocTimeoutAction\n"));
1466         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1467         Status = MLME_REJ_TIMEOUT;
1468         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1469 }
1470
1471 /*
1472         ==========================================================================
1473         Description:
1474                 what the state machine will do after disassoc timeout
1475
1476         IRQL = DISPATCH_LEVEL
1477
1478         ==========================================================================
1479  */
1480 VOID DisassocTimeoutAction(
1481         IN PRTMP_ADAPTER pAd,
1482         IN MLME_QUEUE_ELEM *Elem)
1483 {
1484         USHORT  Status;
1485         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - DisassocTimeoutAction\n"));
1486         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1487         Status = MLME_SUCCESS;
1488         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
1489 }
1490
1491 VOID InvalidStateWhenAssoc(
1492         IN PRTMP_ADAPTER pAd,
1493         IN MLME_QUEUE_ELEM *Elem)
1494 {
1495         USHORT  Status;
1496         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenAssoc(state=%ld), reset ASSOC state machine\n",
1497                 pAd->Mlme.AssocMachine.CurrState));
1498         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1499         Status = MLME_STATE_MACHINE_REJECT;
1500         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1501 }
1502
1503 VOID InvalidStateWhenReassoc(
1504         IN PRTMP_ADAPTER pAd,
1505         IN MLME_QUEUE_ELEM *Elem)
1506 {
1507         USHORT Status;
1508         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenReassoc(state=%ld), reset ASSOC state machine\n",
1509                 pAd->Mlme.AssocMachine.CurrState));
1510         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1511         Status = MLME_STATE_MACHINE_REJECT;
1512         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1513 }
1514
1515 VOID InvalidStateWhenDisassociate(
1516         IN PRTMP_ADAPTER pAd,
1517         IN MLME_QUEUE_ELEM *Elem)
1518 {
1519         USHORT Status;
1520         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenDisassoc(state=%ld), reset ASSOC state machine\n",
1521                 pAd->Mlme.AssocMachine.CurrState));
1522         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1523         Status = MLME_STATE_MACHINE_REJECT;
1524         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
1525 }
1526
1527 /*
1528         ==========================================================================
1529         Description:
1530                 right part of IEEE 802.11/1999 page 374
1531         Note:
1532                 This event should never cause ASSOC state machine perform state
1533                 transition, and has no relationship with CNTL machine. So we separate
1534                 this routine as a service outside of ASSOC state transition table.
1535
1536         IRQL = DISPATCH_LEVEL
1537
1538         ==========================================================================
1539  */
1540 VOID Cls3errAction(
1541         IN PRTMP_ADAPTER pAd,
1542         IN PUCHAR        pAddr)
1543 {
1544         HEADER_802_11         DisassocHdr;
1545         PHEADER_802_11        pDisassocHdr;
1546         PUCHAR                pOutBuffer = NULL;
1547         ULONG                 FrameLen = 0;
1548         NDIS_STATUS           NStatus;
1549         USHORT                Reason = REASON_CLS3ERR;
1550
1551         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
1552         if (NStatus != NDIS_STATUS_SUCCESS)
1553                 return;
1554
1555         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Class 3 Error, Send DISASSOC frame\n"));
1556         MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pAddr, pAd->CommonCfg.Bssid);  // patch peap ttls switching issue
1557         MakeOutgoingFrame(pOutBuffer,           &FrameLen,
1558                                           sizeof(HEADER_802_11),&DisassocHdr,
1559                                           2,                    &Reason,
1560                                           END_OF_ARGS);
1561         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
1562
1563         // To patch Instance and Buffalo(N) AP
1564         // Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
1565         // Therefore, we send both of them.
1566         pDisassocHdr = (PHEADER_802_11)pOutBuffer;
1567         pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
1568         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
1569
1570         MlmeFreeMemory(pAd, pOutBuffer);
1571
1572         pAd->StaCfg.DisassocReason = REASON_CLS3ERR;
1573         COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pAddr);
1574 }
1575
1576  /*
1577          ==========================================================================
1578          Description:
1579                  Switch between WEP and CKIP upon new association up.
1580          Parameters:
1581
1582          IRQL = DISPATCH_LEVEL
1583
1584          ==========================================================================
1585   */
1586 VOID SwitchBetweenWepAndCkip(
1587         IN PRTMP_ADAPTER pAd)
1588 {
1589         int            i;
1590         SHAREDKEY_MODE_STRUC  csr1;
1591
1592         // if KP is required. change the CipherAlg in hardware shard key table from WEP
1593         // to CKIP. else remain as WEP
1594         if (pAd->StaCfg.bCkipOn && (pAd->StaCfg.CkipFlag & 0x10))
1595         {
1596                 // modify hardware key table so that MAC use correct algorithm to decrypt RX
1597                 RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
1598                 if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP64)
1599                         csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP64;
1600                 else if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP128)
1601                         csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP128;
1602
1603                 if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP64)
1604                         csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP64;
1605                 else if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP128)
1606                         csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP128;
1607
1608                 if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP64)
1609                         csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP64;
1610                 else if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP128)
1611                         csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP128;
1612
1613                 if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP64)
1614                         csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP64;
1615                 else if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP128)
1616                         csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP128;
1617                 RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
1618                 DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
1619
1620                 // modify software key table so that driver can specify correct algorithm in TXD upon TX
1621                 for (i=0; i<SHARE_KEY_NUM; i++)
1622                 {
1623                         if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP64)
1624                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP64;
1625                         else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP128)
1626                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP128;
1627                 }
1628         }
1629
1630         // else if KP NOT inused. change the CipherAlg in hardware shard key table from CKIP
1631         // to WEP.
1632         else
1633         {
1634                 // modify hardware key table so that MAC use correct algorithm to decrypt RX
1635                 RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
1636                 if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP64)
1637                         csr1.field.Bss0Key0CipherAlg = CIPHER_WEP64;
1638                 else if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP128)
1639                         csr1.field.Bss0Key0CipherAlg = CIPHER_WEP128;
1640
1641                 if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP64)
1642                         csr1.field.Bss0Key1CipherAlg = CIPHER_WEP64;
1643                 else if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP128)
1644                         csr1.field.Bss0Key1CipherAlg = CIPHER_WEP128;
1645
1646                 if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP64)
1647                         csr1.field.Bss0Key2CipherAlg = CIPHER_WEP64;
1648                 else if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP128)
1649                         csr1.field.Bss0Key2CipherAlg = CIPHER_WEP128;
1650
1651                 if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP64)
1652                         csr1.field.Bss0Key3CipherAlg = CIPHER_WEP64;
1653                 else if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP128)
1654                         csr1.field.Bss0Key3CipherAlg = CIPHER_WEP128;
1655
1656                 // modify software key table so that driver can specify correct algorithm in TXD upon TX
1657                 for (i=0; i<SHARE_KEY_NUM; i++)
1658                 {
1659                         if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP64)
1660                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP64;
1661                         else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP128)
1662                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP128;
1663                 }
1664
1665                 //
1666                 // On WPA-NONE, must update CipherAlg.
1667                 // Because the OID_802_11_WEP_STATUS was been set after OID_802_11_ADD_KEY
1668                 // and CipherAlg will be CIPHER_NONE by Windows ZeroConfig.
1669                 // So we need to update CipherAlg after connect.
1670                 //
1671                 if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
1672                 {
1673                         for (i = 0; i < SHARE_KEY_NUM; i++)
1674                         {
1675                                 if (pAd->SharedKey[BSS0][i].KeyLen != 0)
1676                                 {
1677                                         if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
1678                                         {
1679                                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_TKIP;
1680                                         }
1681                                         else if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
1682                                         {
1683                                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_AES;
1684                                         }
1685                                 }
1686                                 else
1687                                 {
1688                                         pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_NONE;
1689                                 }
1690                         }
1691
1692                         csr1.field.Bss0Key0CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
1693                         csr1.field.Bss0Key1CipherAlg = pAd->SharedKey[BSS0][1].CipherAlg;
1694                         csr1.field.Bss0Key2CipherAlg = pAd->SharedKey[BSS0][2].CipherAlg;
1695                         csr1.field.Bss0Key3CipherAlg = pAd->SharedKey[BSS0][3].CipherAlg;
1696                 }
1697                 RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
1698                 DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
1699         }
1700 }
1701
1702 #ifdef WPA_SUPPLICANT_SUPPORT
1703 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1704 VOID    SendAssocIEsToWpaSupplicant(
1705     IN  PRTMP_ADAPTER pAd)
1706 {
1707     union iwreq_data    wrqu;
1708     unsigned char custom[IW_CUSTOM_MAX] = {0};
1709
1710     if ((pAd->StaCfg.ReqVarIELen + 17) <= IW_CUSTOM_MAX)
1711     {
1712         sprintf(custom, "ASSOCINFO_ReqIEs=");
1713             NdisMoveMemory(custom+17, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
1714             memset(&wrqu, 0, sizeof(wrqu));
1715         wrqu.data.length = pAd->StaCfg.ReqVarIELen + 17;
1716         wrqu.data.flags = RT_REQIE_EVENT_FLAG;
1717         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, custom);
1718
1719         memset(&wrqu, 0, sizeof(wrqu));
1720         wrqu.data.flags = RT_ASSOCINFO_EVENT_FLAG;
1721         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1722     }
1723     else
1724         DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen + 17 > MAX_CUSTOM_LEN\n"));
1725
1726     return;
1727 }
1728 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1729 #endif // WPA_SUPPLICANT_SUPPORT //
1730
1731 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1732 int wext_notify_event_assoc(
1733         IN  RTMP_ADAPTER *pAd)
1734 {
1735     union iwreq_data    wrqu;
1736     char custom[IW_CUSTOM_MAX] = {0};
1737
1738 #if WIRELESS_EXT > 17
1739     if (pAd->StaCfg.ReqVarIELen <= IW_CUSTOM_MAX)
1740     {
1741         wrqu.data.length = pAd->StaCfg.ReqVarIELen;
1742         memcpy(custom, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
1743         wireless_send_event(pAd->net_dev, IWEVASSOCREQIE, &wrqu, custom);
1744     }
1745     else
1746         DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen > MAX_CUSTOM_LEN\n"));
1747 #else
1748     if (((pAd->StaCfg.ReqVarIELen*2) + 17) <= IW_CUSTOM_MAX)
1749     {
1750         UCHAR   idx;
1751         wrqu.data.length = (pAd->StaCfg.ReqVarIELen*2) + 17;
1752         sprintf(custom, "ASSOCINFO(ReqIEs=");
1753         for (idx=0; idx<pAd->StaCfg.ReqVarIELen; idx++)
1754                 sprintf(custom + strlen(custom), "%02x", pAd->StaCfg.ReqVarIEs[idx]);
1755         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, custom);
1756     }
1757     else
1758         DBGPRINT(RT_DEBUG_TRACE, ("(pAd->StaCfg.ReqVarIELen*2) + 17 > MAX_CUSTOM_LEN\n"));
1759 #endif
1760
1761         return 0;
1762
1763 }
1764 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1765
1766
1767 BOOLEAN StaAddMacTableEntry(
1768         IN  PRTMP_ADAPTER               pAd,
1769         IN  PMAC_TABLE_ENTRY    pEntry,
1770         IN  UCHAR                               MaxSupportedRateIn500Kbps,
1771         IN  HT_CAPABILITY_IE    *pHtCapability,
1772         IN  UCHAR                               HtCapabilityLen,
1773         IN  USHORT                      CapabilityInfo)
1774 {
1775         UCHAR            MaxSupportedRate = RATE_11;
1776
1777         if (ADHOC_ON(pAd))
1778                 CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
1779
1780         switch (MaxSupportedRateIn500Kbps)
1781     {
1782         case 108: MaxSupportedRate = RATE_54;   break;
1783         case 96:  MaxSupportedRate = RATE_48;   break;
1784         case 72:  MaxSupportedRate = RATE_36;   break;
1785         case 48:  MaxSupportedRate = RATE_24;   break;
1786         case 36:  MaxSupportedRate = RATE_18;   break;
1787         case 24:  MaxSupportedRate = RATE_12;   break;
1788         case 18:  MaxSupportedRate = RATE_9;    break;
1789         case 12:  MaxSupportedRate = RATE_6;    break;
1790         case 22:  MaxSupportedRate = RATE_11;   break;
1791         case 11:  MaxSupportedRate = RATE_5_5;  break;
1792         case 4:   MaxSupportedRate = RATE_2;    break;
1793         case 2:   MaxSupportedRate = RATE_1;    break;
1794         default:  MaxSupportedRate = RATE_11;   break;
1795     }
1796
1797     if ((pAd->CommonCfg.PhyMode == PHY_11G) && (MaxSupportedRate < RATE_FIRST_OFDM_RATE))
1798         return FALSE;
1799
1800 #ifdef DOT11_N_SUPPORT
1801         // 11n only
1802         if (((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G))&& (HtCapabilityLen == 0))
1803                 return FALSE;
1804 #endif // DOT11_N_SUPPORT //
1805
1806         if (!pEntry)
1807         return FALSE;
1808
1809         NdisAcquireSpinLock(&pAd->MacTabLock);
1810         if (pEntry)
1811         {
1812                 pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
1813                 if ((MaxSupportedRate < RATE_FIRST_OFDM_RATE) ||
1814                         (pAd->CommonCfg.PhyMode == PHY_11B))
1815                 {
1816                         pEntry->RateLen = 4;
1817                         if (MaxSupportedRate >= RATE_FIRST_OFDM_RATE)
1818                                 MaxSupportedRate = RATE_11;
1819                 }
1820                 else
1821                         pEntry->RateLen = 12;
1822
1823                 pEntry->MaxHTPhyMode.word = 0;
1824                 pEntry->MinHTPhyMode.word = 0;
1825                 pEntry->HTPhyMode.word = 0;
1826                 pEntry->MaxSupportedRate = MaxSupportedRate;
1827                 if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
1828                 {
1829                         pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
1830                         pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
1831                         pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
1832                         pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
1833                         pEntry->HTPhyMode.field.MODE = MODE_CCK;
1834                         pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
1835                 }
1836                 else
1837                 {
1838                         pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
1839                         pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
1840                         pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
1841                         pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
1842                         pEntry->HTPhyMode.field.MODE = MODE_OFDM;
1843                         pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
1844                 }
1845                 pEntry->CapabilityInfo = CapabilityInfo;
1846                 CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE);
1847                 CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE);
1848         }
1849
1850 #ifdef DOT11_N_SUPPORT
1851         // If this Entry supports 802.11n, upgrade to HT rate.
1852         if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
1853         {
1854                 UCHAR   j, bitmask; //k,bitmask;
1855                 CHAR    i;
1856
1857                 if (ADHOC_ON(pAd))
1858                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
1859                 if ((pHtCapability->HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
1860                 {
1861                         pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
1862                 }
1863                 else
1864                 {
1865                         pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
1866                         pAd->MacTab.fAnyStationNonGF = TRUE;
1867                         pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
1868                 }
1869
1870                 if ((pHtCapability->HtCapInfo.ChannelWidth) && (pAd->CommonCfg.DesiredHtPhy.ChannelWidth))
1871                 {
1872                         pEntry->MaxHTPhyMode.field.BW= BW_40;
1873                         pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(pHtCapability->HtCapInfo.ShortGIfor40));
1874                 }
1875                 else
1876                 {
1877                         pEntry->MaxHTPhyMode.field.BW = BW_20;
1878                         pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(pHtCapability->HtCapInfo.ShortGIfor20));
1879                         pAd->MacTab.fAnyStation20Only = TRUE;
1880                 }
1881
1882                 // 3*3
1883                 if (pAd->MACVersion >= RALINK_2883_VERSION && pAd->MACVersion < RALINK_3070_VERSION)
1884                         pEntry->MaxHTPhyMode.field.TxBF = pAd->CommonCfg.RegTransmitSetting.field.TxBF;
1885
1886                 // find max fixed rate
1887                 for (i=23; i>=0; i--) // 3*3
1888                 {
1889                         j = i/8;
1890                         bitmask = (1<<(i-(j*8)));
1891                         if ((pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j] & bitmask) && (pHtCapability->MCSSet[j] & bitmask))
1892                         {
1893                                 pEntry->MaxHTPhyMode.field.MCS = i;
1894                                 break;
1895                         }
1896                         if (i==0)
1897                                 break;
1898                 }
1899
1900
1901                 if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
1902                 {
1903                         if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
1904                         {
1905                                 // Fix MCS as HT Duplicated Mode
1906                                 pEntry->MaxHTPhyMode.field.BW = 1;
1907                                 pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
1908                                 pEntry->MaxHTPhyMode.field.STBC = 0;
1909                                 pEntry->MaxHTPhyMode.field.ShortGI = 0;
1910                                 pEntry->MaxHTPhyMode.field.MCS = 32;
1911                         }
1912                         else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
1913                         {
1914                                 // STA supports fixed MCS
1915                                 pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
1916                         }
1917                 }
1918
1919                 pEntry->MaxHTPhyMode.field.STBC = (pHtCapability->HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
1920                 pEntry->MpduDensity = pHtCapability->HtCapParm.MpduDensity;
1921                 pEntry->MaxRAmpduFactor = pHtCapability->HtCapParm.MaxRAmpduFactor;
1922                 pEntry->MmpsMode = (UCHAR)pHtCapability->HtCapInfo.MimoPs;
1923                 pEntry->AMsduSize = (UCHAR)pHtCapability->HtCapInfo.AMsduSize;
1924                 pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
1925
1926                 if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable && (pAd->CommonCfg.REGBACapability.field.AutoBA == FALSE))
1927                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_AMSDU_INUSED);
1928                 if (pHtCapability->HtCapInfo.ShortGIfor20)
1929                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
1930                 if (pHtCapability->HtCapInfo.ShortGIfor40)
1931                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
1932                 if (pHtCapability->HtCapInfo.TxSTBC)
1933                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
1934                 if (pHtCapability->HtCapInfo.RxSTBC)
1935                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
1936                 if (pHtCapability->ExtHtCapInfo.PlusHTC)
1937                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
1938                 if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport)
1939                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
1940                 if (pHtCapability->ExtHtCapInfo.MCSFeedback == 0x03)
1941                         CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
1942         }
1943         else
1944         {
1945                 pAd->MacTab.fAnyStationIsLegacy = TRUE;
1946         }
1947
1948         NdisMoveMemory(&pEntry->HTCapability, pHtCapability, sizeof(HT_CAPABILITY_IE));
1949 #endif // DOT11_N_SUPPORT //
1950
1951         pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
1952         pEntry->CurrTxRate = pEntry->MaxSupportedRate;
1953
1954         // Set asic auto fall back
1955         if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
1956         {
1957                 PUCHAR                                  pTable;
1958                 UCHAR                                   TableSize = 0;
1959
1960                 MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
1961                 pEntry->bAutoTxRateSwitch = TRUE;
1962         }
1963         else
1964         {
1965                 pEntry->HTPhyMode.field.MODE    = pAd->StaCfg.HTPhyMode.field.MODE;
1966                 pEntry->HTPhyMode.field.MCS     = pAd->StaCfg.HTPhyMode.field.MCS;
1967                 pEntry->bAutoTxRateSwitch = FALSE;
1968
1969                 // If the legacy mode is set, overwrite the transmit setting of this entry.
1970                 RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
1971         }
1972
1973         pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
1974         pEntry->Sst = SST_ASSOC;
1975         pEntry->AuthState = AS_AUTH_OPEN;
1976         pEntry->AuthMode = pAd->StaCfg.AuthMode;
1977         pEntry->WepStatus = pAd->StaCfg.WepStatus;
1978
1979         NdisReleaseSpinLock(&pAd->MacTabLock);
1980
1981 #ifdef WPA_SUPPLICANT_SUPPORT
1982 #ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
1983     if (pAd->StaCfg.WpaSupplicantUP)
1984     {
1985         union iwreq_data    wrqu;
1986
1987         SendAssocIEsToWpaSupplicant(pAd);
1988         memset(&wrqu, 0, sizeof(wrqu));
1989         wrqu.data.flags = RT_ASSOC_EVENT_FLAG;
1990         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
1991     }
1992 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
1993 #endif // WPA_SUPPLICANT_SUPPORT //
1994
1995 #ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
1996     {
1997         union iwreq_data    wrqu;
1998         wext_notify_event_assoc(pAd);
1999
2000         memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
2001         memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
2002         wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
2003
2004     }
2005 #endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
2006         return TRUE;
2007 }
2008
2009