1	// SPDX-License-Identifier: GPL-2.0
2	/* IEEE 802.11 SoftMAC layer
3	* Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
4	*
5	* Mostly extracted from the rtl8180-sa2400 driver for the
6	* in-kernel generic ieee802.11 stack.
7	*
8	* Few lines might be stolen from other part of the rtllib
9	* stack. Copyright who own it's copyright
10	*
11	* WPA code stolen from the ipw2200 driver.
12	* Copyright who own it's copyright.
13	*/
14	#include "rtllib.h"
15
16	#include <linux/random.h>
17	#include <linux/delay.h>
18	#include <linux/uaccess.h>
19	#include <linux/etherdevice.h>
20	#include <linux/ieee80211.h>
21
22	static void rtllib_sta_wakeup(struct rtllib_device *ieee, short nl);
23
24	static short rtllib_is_54g(struct rtllib_network *net)
25	{
26	return (net->rates_ex_len > 0) || (net->rates_len > 4);
27	}
28
29	/* returns the total length needed for placing the RATE MFIE
30	* tag and the EXTENDED RATE MFIE tag if needed.
31	* It encludes two bytes per tag for the tag itself and its len
32	*/
33	static unsigned int rtllib_MFIE_rate_len(struct rtllib_device *ieee)
34	{
35	unsigned int rate_len = 0;
36
37	rate_len = RTLLIB_CCK_RATE_LEN + 2;
38	rate_len += RTLLIB_OFDM_RATE_LEN + 2;
39
40	return rate_len;
41	}
42
43	/* place the MFIE rate, tag to the memory (double) pointed.
44	* Then it updates the pointer so that
45	* it points after the new MFIE tag added.
46	*/
47	static void rtllib_mfie_brate(struct rtllib_device *ieee, u8 **tag_p)
48	{
49	u8 *tag = *tag_p;
50
51	*tag++ = MFIE_TYPE_RATES;
52	*tag++ = 4;
53	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_CCK_RATE_1MB;
54	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_CCK_RATE_2MB;
55	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_CCK_RATE_5MB;
56	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_CCK_RATE_11MB;
57
58	/* We may add an option for custom rates that specific HW
59	* might support
60	*/
61	*tag_p = tag;
62	}
63
64	static void rtllib_mfie_grate(struct rtllib_device *ieee, u8 **tag_p)
65	{
66	u8 *tag = *tag_p;
67
68	*tag++ = MFIE_TYPE_RATES_EX;
69	*tag++ = 8;
70	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_6MB;
71	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_9MB;
72	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_12MB;
73	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_18MB;
74	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_24MB;
75	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_36MB;
76	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_48MB;
77	*tag++ = RTLLIB_BASIC_RATE_MASK | RTLLIB_OFDM_RATE_54MB;
78
79	/* We may add an option for custom rates that specific HW might
80	* support
81	*/
82	*tag_p = tag;
83	}
84
85	static void rtllib_wmm_info(struct rtllib_device *ieee, u8 **tag_p)
86	{
87	u8 *tag = *tag_p;
88
89	*tag++ = MFIE_TYPE_GENERIC;
90	*tag++ = 7;
91	*tag++ = 0x00;
92	*tag++ = 0x50;
93	*tag++ = 0xf2;
94	*tag++ = 0x02;
95	*tag++ = 0x00;
96	*tag++ = 0x01;
97	*tag++ = MAX_SP_Len;
98	*tag_p = tag;
99	}
100
101	static void rtllib_turbo_info(struct rtllib_device *ieee, u8 **tag_p)
102	{
103	u8 *tag = *tag_p;
104
105	*tag++ = MFIE_TYPE_GENERIC;
106	*tag++ = 7;
107	*tag++ = 0x00;
108	*tag++ = 0xe0;
109	*tag++ = 0x4c;
110	*tag++ = 0x01;
111	*tag++ = 0x02;
112	*tag++ = 0x11;
113	*tag++ = 0x00;
114
115	*tag_p = tag;
116	netdev_alert(dev: ieee->dev, format: "This is enable turbo mode IE process\n");
117	}
118
119	static void enqueue_mgmt(struct rtllib_device *ieee, struct sk_buff *skb)
120	{
121	int nh;
122
123	nh = (ieee->mgmt_queue_head + 1) % MGMT_QUEUE_NUM;
124
125	/* if the queue is full but we have newer frames then
126	* just overwrites the oldest.
127	*
128	* if (nh == ieee->mgmt_queue_tail)
129	* return -1;
130	*/
131	ieee->mgmt_queue_head = nh;
132	ieee->mgmt_queue_ring[nh] = skb;
133	}
134
135	static void init_mgmt_queue(struct rtllib_device *ieee)
136	{
137	ieee->mgmt_queue_tail = 0;
138	ieee->mgmt_queue_head = 0;
139	}
140
141	u8 mgnt_query_tx_rate_exclude_cck_rates(struct rtllib_device *ieee)
142	{
143	u16 i;
144	u8 query_rate = 0;
145	u8 basic_rate;
146
147	for (i = 0; i < ieee->current_network.rates_len; i++) {
148	basic_rate = ieee->current_network.rates[i] & 0x7F;
149	if (!rtllib_is_cck_rate(rate: basic_rate)) {
150	if (query_rate == 0) {
151	query_rate = basic_rate;
152	} else {
153	if (basic_rate < query_rate)
154	query_rate = basic_rate;
155	}
156	}
157	}
158
159	if (query_rate == 0) {
160	query_rate = 12;
161	netdev_info(dev: ieee->dev, format: "No basic_rate found!!\n");
162	}
163	return query_rate;
164	}
165
166	static u8 mgnt_query_mgnt_frame_tx_rate(struct rtllib_device *ieee)
167	{
168	struct rt_hi_throughput *ht_info = ieee->ht_info;
169	u8 rate;
170
171	if (ht_info->iot_action & HT_IOT_ACT_MGNT_USE_CCK_6M)
172	rate = 0x0c;
173	else
174	rate = ieee->basic_rate & 0x7f;
175
176	if (rate == 0)
177	rate = 0x02;
178
179	return rate;
180	}
181
182	inline void softmac_mgmt_xmit(struct sk_buff *skb, struct rtllib_device *ieee)
183	{
184	unsigned long flags;
185	short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
186	struct ieee80211_hdr_3addr *header =
187	(struct ieee80211_hdr_3addr *)skb->data;
188
189	struct cb_desc *tcb_desc = (struct cb_desc *)(skb->cb + 8);
190
191	spin_lock_irqsave(&ieee->lock, flags);
192
193	/* called with 2nd param 0, no mgmt lock required */
194	rtllib_sta_wakeup(ieee, nl: 0);
195
196	if (ieee80211_is_beacon(fc: header->frame_control))
197	tcb_desc->queue_index = BEACON_QUEUE;
198	else
199	tcb_desc->queue_index = MGNT_QUEUE;
200
201	if (ieee->disable_mgnt_queue)
202	tcb_desc->queue_index = HIGH_QUEUE;
203
204	tcb_desc->data_rate = mgnt_query_mgnt_frame_tx_rate(ieee);
205	tcb_desc->ratr_index = 7;
206	tcb_desc->tx_dis_rate_fallback = 1;
207	tcb_desc->tx_use_drv_assinged_rate = 1;
208	if (single) {
209	if (ieee->queue_stop) {
210	enqueue_mgmt(ieee, skb);
211	} else {
212	header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
213
214	if (ieee->seq_ctrl[0] == 0xFFF)
215	ieee->seq_ctrl[0] = 0;
216	else
217	ieee->seq_ctrl[0]++;
218
219	/* avoid watchdog triggers */
220	ieee->softmac_data_hard_start_xmit(skb, ieee->dev,
221	ieee->basic_rate);
222	}
223
224	spin_unlock_irqrestore(lock: &ieee->lock, flags);
225	} else {
226	spin_unlock_irqrestore(lock: &ieee->lock, flags);
227	spin_lock_irqsave(&ieee->mgmt_tx_lock, flags);
228
229	header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
230
231	if (ieee->seq_ctrl[0] == 0xFFF)
232	ieee->seq_ctrl[0] = 0;
233	else
234	ieee->seq_ctrl[0]++;
235
236	/* check whether the managed packet queued greater than 5 */
237	if (!ieee->check_nic_enough_desc(ieee->dev,
238	tcb_desc->queue_index) ||
239	skb_queue_len(list_: &ieee->skb_waitq[tcb_desc->queue_index]) ||
240	ieee->queue_stop) {
241	/* insert the skb packet to the management queue
242	*
243	* as for the completion function, it does not need
244	* to check it any more.
245	*/
246	netdev_info(dev: ieee->dev,
247	format: "%s():insert to waitqueue, queue_index:%d!\n",
248	__func__, tcb_desc->queue_index);
249	skb_queue_tail(list: &ieee->skb_waitq[tcb_desc->queue_index],
250	newsk: skb);
251	} else {
252	ieee->softmac_hard_start_xmit(skb, ieee->dev);
253	}
254	spin_unlock_irqrestore(lock: &ieee->mgmt_tx_lock, flags);
255	}
256	}
257
258	static inline void
259	softmac_ps_mgmt_xmit(struct sk_buff *skb,
260	struct rtllib_device *ieee)
261	{
262	short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
263	struct ieee80211_hdr_3addr *header =
264	(struct ieee80211_hdr_3addr *)skb->data;
265	u16 fc, type, stype;
266	struct cb_desc *tcb_desc = (struct cb_desc *)(skb->cb + 8);
267
268	fc = le16_to_cpu(header->frame_control);
269	type = WLAN_FC_GET_TYPE(fc);
270	stype = WLAN_FC_GET_STYPE(fc);
271
272	if (stype != IEEE80211_STYPE_PSPOLL)
273	tcb_desc->queue_index = MGNT_QUEUE;
274	else
275	tcb_desc->queue_index = HIGH_QUEUE;
276
277	if (ieee->disable_mgnt_queue)
278	tcb_desc->queue_index = HIGH_QUEUE;
279
280	tcb_desc->data_rate = mgnt_query_mgnt_frame_tx_rate(ieee);
281	tcb_desc->ratr_index = 7;
282	tcb_desc->tx_dis_rate_fallback = 1;
283	tcb_desc->tx_use_drv_assinged_rate = 1;
284	if (single) {
285	if (type != RTLLIB_FTYPE_CTL) {
286	header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
287
288	if (ieee->seq_ctrl[0] == 0xFFF)
289	ieee->seq_ctrl[0] = 0;
290	else
291	ieee->seq_ctrl[0]++;
292	}
293	/* avoid watchdog triggers */
294	ieee->softmac_data_hard_start_xmit(skb, ieee->dev,
295	ieee->basic_rate);
296
297	} else {
298	if (type != RTLLIB_FTYPE_CTL) {
299	header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
300
301	if (ieee->seq_ctrl[0] == 0xFFF)
302	ieee->seq_ctrl[0] = 0;
303	else
304	ieee->seq_ctrl[0]++;
305	}
306	ieee->softmac_hard_start_xmit(skb, ieee->dev);
307	}
308	}
309
310	static inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee)
311	{
312	unsigned int len, rate_len;
313	u8 *tag;
314	struct sk_buff *skb;
315	struct rtllib_probe_request *req;
316
317	len = ieee->current_network.ssid_len;
318
319	rate_len = rtllib_MFIE_rate_len(ieee);
320
321	skb = dev_alloc_skb(length: sizeof(struct rtllib_probe_request) +
322	2 + len + rate_len + ieee->tx_headroom);
323
324	if (!skb)
325	return NULL;
326
327	skb_reserve(skb, len: ieee->tx_headroom);
328
329	req = skb_put(skb, len: sizeof(struct rtllib_probe_request));
330	req->header.frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
331	req->header.duration_id = 0;
332
333	eth_broadcast_addr(addr: req->header.addr1);
334	ether_addr_copy(dst: req->header.addr2, src: ieee->dev->dev_addr);
335	eth_broadcast_addr(addr: req->header.addr3);
336
337	tag = skb_put(skb, len: len + 2 + rate_len);
338
339	*tag++ = MFIE_TYPE_SSID;
340	*tag++ = len;
341	memcpy(tag, ieee->current_network.ssid, len);
342	tag += len;
343
344	rtllib_mfie_brate(ieee, tag_p: &tag);
345	rtllib_mfie_grate(ieee, tag_p: &tag);
346
347	return skb;
348	}
349
350	/* Enables network monitor mode, all rx packets will be received. */
351	void rtllib_enable_net_monitor_mode(struct net_device *dev,
352	bool init_state)
353	{
354	struct rtllib_device *ieee = netdev_priv_rsl(dev);
355
356	netdev_info(dev, format: "========>Enter Monitor Mode\n");
357
358	ieee->allow_all_dest_addr_handler(dev, true, !init_state);
359	}
360
361	/* Disables network monitor mode. Only packets destinated to
362	* us will be received.
363	*/
364	void rtllib_disable_net_monitor_mode(struct net_device *dev, bool init_state)
365	{
366	struct rtllib_device *ieee = netdev_priv_rsl(dev);
367
368	netdev_info(dev, format: "========>Exit Monitor Mode\n");
369
370	ieee->allow_all_dest_addr_handler(dev, false, !init_state);
371	}
372
373	static void rtllib_send_probe(struct rtllib_device *ieee)
374	{
375	struct sk_buff *skb;
376
377	skb = rtllib_probe_req(ieee);
378	if (skb) {
379	softmac_mgmt_xmit(skb, ieee);
380	ieee->softmac_stats.tx_probe_rq++;
381	}
382	}
383
384	static void rtllib_send_probe_requests(struct rtllib_device *ieee)
385	{
386	if (ieee->softmac_features & IEEE_SOFTMAC_PROBERQ) {
387	rtllib_send_probe(ieee);
388	rtllib_send_probe(ieee);
389	}
390	}
391
392	/* this performs syncro scan blocking the caller until all channels
393	* in the allowed channel map has been checked.
394	*/
395	static void rtllib_softmac_scan_syncro(struct rtllib_device *ieee)
396	{
397	union iwreq_data wrqu;
398	short ch = 0;
399
400	ieee->be_scan_inprogress = true;
401
402	mutex_lock(&ieee->scan_mutex);
403
404	while (1) {
405	do {
406	ch++;
407	if (ch > MAX_CHANNEL_NUMBER)
408	goto out; /* scan completed */
409	} while (!ieee->active_channel_map[ch]);
410
411	/* this function can be called in two situations
412	* 1- We have switched to ad-hoc mode and we are
413	* performing a complete syncro scan before conclude
414	* there are no interesting cell and to create a
415	* new one. In this case the link state is
416	* MAC80211_NOLINK until we found an interesting cell.
417	* If so the ieee8021_new_net, called by the RX path
418	* will set the state to MAC80211_LINKED, so we stop
419	* scanning
420	* 2- We are linked and the root uses run iwlist scan.
421	* So we switch to MAC80211_LINKED_SCANNING to remember
422	* that we are still logically linked (not interested in
423	* new network events, despite for updating the net list,
424	* but we are temporarly 'unlinked' as the driver shall
425	* not filter RX frames and the channel is changing.
426	* So the only situation in which are interested is to check
427	* if the state become LINKED because of the #1 situation
428	*/
429
430	if (ieee->link_state == MAC80211_LINKED)
431	goto out;
432	if (ieee->sync_scan_hurryup) {
433	netdev_info(dev: ieee->dev,
434	format: "============>sync_scan_hurryup out\n");
435	goto out;
436	}
437
438	ieee->set_chan(ieee->dev, ch);
439	if (ieee->active_channel_map[ch] == 1)
440	rtllib_send_probe_requests(ieee);
441
442	/* this prevent excessive time wait when we
443	* need to wait for a syncro scan to end..
444	*/
445	msleep_interruptible_rsl(RTLLIB_SOFTMAC_SCAN_TIME);
446	}
447	out:
448	ieee->actscanning = false;
449	ieee->sync_scan_hurryup = 0;
450
451	mutex_unlock(lock: &ieee->scan_mutex);
452
453	ieee->be_scan_inprogress = false;
454
455	memset(&wrqu, 0, sizeof(wrqu));
456	wireless_send_event(dev: ieee->dev, SIOCGIWSCAN, wrqu: &wrqu, NULL);
457	}
458
459	static void rtllib_softmac_scan_wq(void *data)
460	{
461	struct rtllib_device *ieee = container_of_dwork_rsl(data,
462	struct rtllib_device, softmac_scan_wq);
463	u8 last_channel = ieee->current_network.channel;
464
465	if (!ieee->ieee_up)
466	return;
467	if (rtllib_act_scanning(ieee, sync_scan: true))
468	return;
469
470	mutex_lock(&ieee->scan_mutex);
471
472	if (ieee->rf_power_state == rf_off) {
473	netdev_info(dev: ieee->dev,
474	format: "======>%s():rf state is rf_off, return\n",
475	__func__);
476	goto out1;
477	}
478
479	do {
480	ieee->current_network.channel =
481	(ieee->current_network.channel + 1) %
482	MAX_CHANNEL_NUMBER;
483	if (ieee->scan_watch_dog++ > MAX_CHANNEL_NUMBER) {
484	if (!ieee->active_channel_map[ieee->current_network.channel])
485	ieee->current_network.channel = 6;
486	goto out; /* no good chans */
487	}
488	} while (!ieee->active_channel_map[ieee->current_network.channel]);
489
490	if (ieee->scanning_continue == 0)
491	goto out;
492
493	ieee->set_chan(ieee->dev, ieee->current_network.channel);
494
495	if (ieee->active_channel_map[ieee->current_network.channel] == 1)
496	rtllib_send_probe_requests(ieee);
497
498	schedule_delayed_work(dwork: &ieee->softmac_scan_wq,
499	delay: msecs_to_jiffies(RTLLIB_SOFTMAC_SCAN_TIME));
500
501	mutex_unlock(lock: &ieee->scan_mutex);
502	return;
503
504	out:
505	ieee->current_network.channel = last_channel;
506
507	out1:
508	ieee->actscanning = false;
509	ieee->scan_watch_dog = 0;
510	ieee->scanning_continue = 0;
511	mutex_unlock(lock: &ieee->scan_mutex);
512	}
513
514	static void rtllib_softmac_stop_scan(struct rtllib_device *ieee)
515	{
516	mutex_lock(&ieee->scan_mutex);
517	ieee->scan_watch_dog = 0;
518	if (ieee->scanning_continue == 1) {
519	ieee->scanning_continue = 0;
520	ieee->actscanning = false;
521	mutex_unlock(lock: &ieee->scan_mutex);
522	cancel_delayed_work_sync(dwork: &ieee->softmac_scan_wq);
523	} else {
524	mutex_unlock(lock: &ieee->scan_mutex);
525	}
526	}
527
528	void rtllib_stop_scan(struct rtllib_device *ieee)
529	{
530	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
531	rtllib_softmac_stop_scan(ieee);
532	}
533	EXPORT_SYMBOL(rtllib_stop_scan);
534
535	void rtllib_stop_scan_syncro(struct rtllib_device *ieee)
536	{
537	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
538	ieee->sync_scan_hurryup = 1;
539	}
540	EXPORT_SYMBOL(rtllib_stop_scan_syncro);
541
542	bool rtllib_act_scanning(struct rtllib_device *ieee, bool sync_scan)
543	{
544	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN) {
545	if (sync_scan)
546	return ieee->be_scan_inprogress;
547	else
548	return ieee->actscanning || ieee->be_scan_inprogress;
549	} else {
550	return test_bit(STATUS_SCANNING, &ieee->status);
551	}
552	}
553	EXPORT_SYMBOL(rtllib_act_scanning);
554
555	/* called with ieee->lock held */
556	static void rtllib_start_scan(struct rtllib_device *ieee)
557	{
558	ieee->rtllib_ips_leave_wq(ieee->dev);
559
560	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN) {
561	if (ieee->scanning_continue == 0) {
562	ieee->actscanning = true;
563	ieee->scanning_continue = 1;
564	schedule_delayed_work(dwork: &ieee->softmac_scan_wq, delay: 0);
565	}
566	}
567	}
568
569	/* called with wx_mutex held */
570	void rtllib_start_scan_syncro(struct rtllib_device *ieee)
571	{
572	ieee->sync_scan_hurryup = 0;
573	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
574	rtllib_softmac_scan_syncro(ieee);
575	}
576	EXPORT_SYMBOL(rtllib_start_scan_syncro);
577
578	static inline struct sk_buff *
579	rtllib_authentication_req(struct rtllib_network *beacon,
580	struct rtllib_device *ieee,
581	int challengelen, u8 *daddr)
582	{
583	struct sk_buff *skb;
584	struct rtllib_authentication *auth;
585	int len;
586
587	len = sizeof(struct rtllib_authentication) + challengelen +
588	ieee->tx_headroom + 4;
589	skb = dev_alloc_skb(length: len);
590
591	if (!skb)
592	return NULL;
593
594	skb_reserve(skb, len: ieee->tx_headroom);
595
596	auth = skb_put(skb, len: sizeof(struct rtllib_authentication));
597
598	auth->header.frame_control = cpu_to_le16(IEEE80211_STYPE_AUTH);
599	if (challengelen)
600	auth->header.frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
601
602	auth->header.duration_id = cpu_to_le16(0x013a);
603	ether_addr_copy(dst: auth->header.addr1, src: beacon->bssid);
604	ether_addr_copy(dst: auth->header.addr2, src: ieee->dev->dev_addr);
605	ether_addr_copy(dst: auth->header.addr3, src: beacon->bssid);
606	if (ieee->auth_mode == 0)
607	auth->algorithm = WLAN_AUTH_OPEN;
608	else if (ieee->auth_mode == 1)
609	auth->algorithm = cpu_to_le16(WLAN_AUTH_SHARED_KEY);
610	else if (ieee->auth_mode == 2)
611	auth->algorithm = WLAN_AUTH_OPEN;
612	auth->transaction = cpu_to_le16(ieee->associate_seq);
613	ieee->associate_seq++;
614
615	auth->status = cpu_to_le16(WLAN_STATUS_SUCCESS);
616
617	return skb;
618	}
619
620	static struct sk_buff *rtllib_null_func(struct rtllib_device *ieee, short pwr)
621	{
622	struct sk_buff *skb;
623	struct ieee80211_hdr_3addr *hdr;
624
625	skb = dev_alloc_skb(length: sizeof(struct ieee80211_hdr_3addr) + ieee->tx_headroom);
626	if (!skb)
627	return NULL;
628
629	skb_reserve(skb, len: ieee->tx_headroom);
630
631	hdr = skb_put(skb, len: sizeof(struct ieee80211_hdr_3addr));
632
633	ether_addr_copy(dst: hdr->addr1, src: ieee->current_network.bssid);
634	ether_addr_copy(dst: hdr->addr2, src: ieee->dev->dev_addr);
635	ether_addr_copy(dst: hdr->addr3, src: ieee->current_network.bssid);
636
637	hdr->frame_control = cpu_to_le16(RTLLIB_FTYPE_DATA |
638	IEEE80211_STYPE_NULLFUNC | IEEE80211_FCTL_TODS |
639	(pwr ? IEEE80211_FCTL_PM : 0));
640
641	return skb;
642	}
643
644	static struct sk_buff *rtllib_pspoll_func(struct rtllib_device *ieee)
645	{
646	struct sk_buff *skb;
647	struct ieee80211_pspoll *hdr;
648
649	skb = dev_alloc_skb(length: sizeof(struct ieee80211_pspoll) + ieee->tx_headroom);
650	if (!skb)
651	return NULL;
652
653	skb_reserve(skb, len: ieee->tx_headroom);
654
655	hdr = skb_put(skb, len: sizeof(struct ieee80211_pspoll));
656
657	ether_addr_copy(dst: hdr->bssid, src: ieee->current_network.bssid);
658	ether_addr_copy(dst: hdr->ta, src: ieee->dev->dev_addr);
659
660	hdr->aid = cpu_to_le16(ieee->assoc_id | 0xc000);
661	hdr->frame_control = cpu_to_le16(RTLLIB_FTYPE_CTL | IEEE80211_STYPE_PSPOLL |
662	IEEE80211_FCTL_PM);
663
664	return skb;
665	}
666
667	static inline int sec_is_in_pmkid_list(struct rtllib_device *ieee, u8 *bssid)
668	{
669	int i = 0;
670
671	do {
672	if ((ieee->pmkid_list[i].used) &&
673	(memcmp(p: ieee->pmkid_list[i].bssid, q: bssid, ETH_ALEN) == 0))
674	break;
675	i++;
676	} while (i < NUM_PMKID_CACHE);
677
678	if (i == NUM_PMKID_CACHE)
679	i = -1;
680	return i;
681	}
682
683	static inline struct sk_buff *
684	rtllib_association_req(struct rtllib_network *beacon,
685	struct rtllib_device *ieee)
686	{
687	struct sk_buff *skb;
688	struct rtllib_assoc_request_frame *hdr;
689	u8 *tag, *ies;
690	int i;
691	u8 *ht_cap_buf = NULL;
692	u8 ht_cap_len = 0;
693	u8 *realtek_ie_buf = NULL;
694	u8 realtek_ie_len = 0;
695	int wpa_ie_len = ieee->wpa_ie_len;
696	int wps_ie_len = ieee->wps_ie_len;
697	unsigned int ckip_ie_len = 0;
698	unsigned int ccxrm_ie_len = 0;
699	unsigned int cxvernum_ie_len = 0;
700	struct lib80211_crypt_data *crypt;
701	int encrypt;
702	int pmk_cache_idx;
703
704	unsigned int rate_len = (beacon->rates_len ?
705	(beacon->rates_len + 2) : 0) +
706	(beacon->rates_ex_len ? (beacon->rates_ex_len) +
707	2 : 0);
708
709	unsigned int wmm_info_len = beacon->qos_data.supported ? 9 : 0;
710	unsigned int turbo_info_len = beacon->turbo_enable ? 9 : 0;
711
712	int len = 0;
713
714	crypt = ieee->crypt_info.crypt[ieee->crypt_info.tx_keyidx];
715	if (crypt)
716	encrypt = crypt && crypt->ops &&
717	((strcmp(crypt->ops->name, "R-WEP") == 0 ||
718	wpa_ie_len));
719	else
720	encrypt = 0;
721
722	if ((ieee->rtllib_ap_sec_type &&
723	(ieee->rtllib_ap_sec_type(ieee) & SEC_ALG_TKIP)) ||
724	ieee->forced_bg_mode) {
725	ieee->ht_info->enable_ht = 0;
726	ieee->mode = WIRELESS_MODE_G;
727	}
728
729	if (ieee->ht_info->current_ht_support && ieee->ht_info->enable_ht) {
730	ht_cap_buf = (u8 *)&ieee->ht_info->self_ht_cap;
731	ht_cap_len = sizeof(ieee->ht_info->self_ht_cap);
732	ht_construct_capability_element(ieee, posHTCap: ht_cap_buf, len: &ht_cap_len,
733	isEncrypt: encrypt, bAssoc: true);
734	if (ieee->ht_info->current_rt2rt_aggregation) {
735	realtek_ie_buf = ieee->ht_info->sz_rt2rt_agg_buf;
736	realtek_ie_len =
737	sizeof(ieee->ht_info->sz_rt2rt_agg_buf);
738	ht_construct_rt2rt_agg_element(ieee, posRT2RTAgg: realtek_ie_buf,
739	len: &realtek_ie_len);
740	}
741	}
742
743	if (beacon->ckip_supported)
744	ckip_ie_len = 30 + 2;
745	if (beacon->ccx_rm_enable)
746	ccxrm_ie_len = 6 + 2;
747	if (beacon->bss_ccx_ver_number >= 2)
748	cxvernum_ie_len = 5 + 2;
749
750	pmk_cache_idx = sec_is_in_pmkid_list(ieee, bssid: ieee->current_network.bssid);
751	if (pmk_cache_idx >= 0) {
752	wpa_ie_len += 18;
753	netdev_info(dev: ieee->dev, format: "[PMK cache]: WPA2 IE length: %x\n",
754	wpa_ie_len);
755	}
756	len = sizeof(struct rtllib_assoc_request_frame) + 2
757	+ beacon->ssid_len
758	+ rate_len
759	+ wpa_ie_len
760	+ wps_ie_len
761	+ wmm_info_len
762	+ turbo_info_len
763	+ ht_cap_len
764	+ realtek_ie_len
765	+ ckip_ie_len
766	+ ccxrm_ie_len
767	+ cxvernum_ie_len
768	+ ieee->tx_headroom;
769
770	skb = dev_alloc_skb(length: len);
771
772	if (!skb)
773	return NULL;
774
775	skb_reserve(skb, len: ieee->tx_headroom);
776
777	hdr = skb_put(skb, len: sizeof(struct rtllib_assoc_request_frame) + 2);
778
779	hdr->header.frame_control = cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ);
780	hdr->header.duration_id = cpu_to_le16(37);
781	ether_addr_copy(dst: hdr->header.addr1, src: beacon->bssid);
782	ether_addr_copy(dst: hdr->header.addr2, src: ieee->dev->dev_addr);
783	ether_addr_copy(dst: hdr->header.addr3, src: beacon->bssid);
784
785	ether_addr_copy(dst: ieee->ap_mac_addr, src: beacon->bssid);
786
787	hdr->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
788	if (beacon->capability & WLAN_CAPABILITY_PRIVACY)
789	hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
790
791	if (beacon->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
792	hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
793
794	if (beacon->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
795	hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME);
796
797	hdr->listen_interval = cpu_to_le16(beacon->listen_interval);
798
799	hdr->info_element[0].id = MFIE_TYPE_SSID;
800
801	hdr->info_element[0].len = beacon->ssid_len;
802	skb_put_data(skb, data: beacon->ssid, len: beacon->ssid_len);
803
804	tag = skb_put(skb, len: rate_len);
805
806	if (beacon->rates_len) {
807	*tag++ = MFIE_TYPE_RATES;
808	*tag++ = beacon->rates_len;
809	for (i = 0; i < beacon->rates_len; i++)
810	*tag++ = beacon->rates[i];
811	}
812
813	if (beacon->rates_ex_len) {
814	*tag++ = MFIE_TYPE_RATES_EX;
815	*tag++ = beacon->rates_ex_len;
816	for (i = 0; i < beacon->rates_ex_len; i++)
817	*tag++ = beacon->rates_ex[i];
818	}
819
820	if (beacon->ckip_supported) {
821	static const u8 aironet_ie_oui[] = {0x00, 0x01, 0x66};
822	u8 ccx_aironet_buf[30];
823	struct octet_string os_ccx_aironet_ie;
824
825	memset(ccx_aironet_buf, 0, 30);
826	os_ccx_aironet_ie.octet = ccx_aironet_buf;
827	os_ccx_aironet_ie.Length = sizeof(ccx_aironet_buf);
828	memcpy(os_ccx_aironet_ie.octet, aironet_ie_oui,
829	sizeof(aironet_ie_oui));
830
831	os_ccx_aironet_ie.octet[IE_CISCO_FLAG_POSITION] |=
832	(SUPPORT_CKIP_PK | SUPPORT_CKIP_MIC);
833	tag = skb_put(skb, len: ckip_ie_len);
834	*tag++ = MFIE_TYPE_AIRONET;
835	*tag++ = os_ccx_aironet_ie.Length;
836	memcpy(tag, os_ccx_aironet_ie.octet, os_ccx_aironet_ie.Length);
837	tag += os_ccx_aironet_ie.Length;
838	}
839
840	if (beacon->ccx_rm_enable) {
841	static const u8 ccx_rm_cap_buf[] = {0x00, 0x40, 0x96, 0x01, 0x01,
842	0x00};
843	struct octet_string os_ccx_rm_cap;
844
845	os_ccx_rm_cap.octet = (u8 *)ccx_rm_cap_buf;
846	os_ccx_rm_cap.Length = sizeof(ccx_rm_cap_buf);
847	tag = skb_put(skb, len: ccxrm_ie_len);
848	*tag++ = MFIE_TYPE_GENERIC;
849	*tag++ = os_ccx_rm_cap.Length;
850	memcpy(tag, os_ccx_rm_cap.octet, os_ccx_rm_cap.Length);
851	tag += os_ccx_rm_cap.Length;
852	}
853
854	if (beacon->bss_ccx_ver_number >= 2) {
855	u8 ccx_ver_num_buf[] = {0x00, 0x40, 0x96, 0x03, 0x00};
856	struct octet_string os_ccx_ver_num;
857
858	ccx_ver_num_buf[4] = beacon->bss_ccx_ver_number;
859	os_ccx_ver_num.octet = ccx_ver_num_buf;
860	os_ccx_ver_num.Length = sizeof(ccx_ver_num_buf);
861	tag = skb_put(skb, len: cxvernum_ie_len);
862	*tag++ = MFIE_TYPE_GENERIC;
863	*tag++ = os_ccx_ver_num.Length;
864	memcpy(tag, os_ccx_ver_num.octet, os_ccx_ver_num.Length);
865	tag += os_ccx_ver_num.Length;
866	}
867	if (ieee->ht_info->current_ht_support && ieee->ht_info->enable_ht) {
868	if (ieee->ht_info->peer_ht_spec_ver != HT_SPEC_VER_EWC) {
869	tag = skb_put(skb, len: ht_cap_len);
870	*tag++ = MFIE_TYPE_HT_CAP;
871	*tag++ = ht_cap_len - 2;
872	memcpy(tag, ht_cap_buf, ht_cap_len - 2);
873	tag += ht_cap_len - 2;
874	}
875	}
876
877	if (wpa_ie_len) {
878	skb_put_data(skb, data: ieee->wpa_ie, len: ieee->wpa_ie_len);
879
880	if (pmk_cache_idx >= 0) {
881	tag = skb_put(skb, len: 18);
882	*tag = 1;
883	*(tag + 1) = 0;
884	memcpy((tag + 2), &ieee->pmkid_list[pmk_cache_idx].PMKID,
885	16);
886	}
887	}
888	if (wmm_info_len) {
889	tag = skb_put(skb, len: wmm_info_len);
890	rtllib_wmm_info(ieee, tag_p: &tag);
891	}
892
893	if (wps_ie_len && ieee->wps_ie)
894	skb_put_data(skb, data: ieee->wps_ie, len: wps_ie_len);
895
896	if (turbo_info_len) {
897	tag = skb_put(skb, len: turbo_info_len);
898	rtllib_turbo_info(ieee, tag_p: &tag);
899	}
900
901	if (ieee->ht_info->current_ht_support && ieee->ht_info->enable_ht) {
902	if (ieee->ht_info->peer_ht_spec_ver == HT_SPEC_VER_EWC) {
903	tag = skb_put(skb, len: ht_cap_len);
904	*tag++ = MFIE_TYPE_GENERIC;
905	*tag++ = ht_cap_len - 2;
906	memcpy(tag, ht_cap_buf, ht_cap_len - 2);
907	tag += ht_cap_len - 2;
908	}
909
910	if (ieee->ht_info->current_rt2rt_aggregation) {
911	tag = skb_put(skb, len: realtek_ie_len);
912	*tag++ = MFIE_TYPE_GENERIC;
913	*tag++ = realtek_ie_len - 2;
914	memcpy(tag, realtek_ie_buf, realtek_ie_len - 2);
915	}
916	}
917
918	kfree(objp: ieee->assocreq_ies);
919	ieee->assocreq_ies = NULL;
920	ies = &hdr->info_element[0].id;
921	ieee->assocreq_ies_len = (skb->data + skb->len) - ies;
922	ieee->assocreq_ies = kmemdup(p: ies, size: ieee->assocreq_ies_len, GFP_ATOMIC);
923	if (!ieee->assocreq_ies)
924	ieee->assocreq_ies_len = 0;
925
926	return skb;
927	}
928
929	static void rtllib_associate_abort(struct rtllib_device *ieee)
930	{
931	unsigned long flags;
932
933	spin_lock_irqsave(&ieee->lock, flags);
934
935	ieee->associate_seq++;
936
937	/* don't scan, and avoid to have the RX path possibily
938	* try again to associate. Even do not react to AUTH or
939	* ASSOC response. Just wait for the retry wq to be scheduled.
940	* Here we will check if there are good nets to associate
941	* with, so we retry or just get back to NO_LINK and scanning
942	*/
943	if (ieee->link_state == RTLLIB_ASSOCIATING_AUTHENTICATING) {
944	netdev_dbg(ieee->dev, "Authentication failed\n");
945	ieee->softmac_stats.no_auth_rs++;
946	} else {
947	netdev_dbg(ieee->dev, "Association failed\n");
948	ieee->softmac_stats.no_ass_rs++;
949	}
950
951	ieee->link_state = RTLLIB_ASSOCIATING_RETRY;
952
953	schedule_delayed_work(dwork: &ieee->associate_retry_wq,
954	RTLLIB_SOFTMAC_ASSOC_RETRY_TIME);
955
956	spin_unlock_irqrestore(lock: &ieee->lock, flags);
957	}
958
959	static void rtllib_associate_abort_cb(struct timer_list *t)
960	{
961	struct rtllib_device *dev = from_timer(dev, t, associate_timer);
962
963	rtllib_associate_abort(ieee: dev);
964	}
965
966	static void rtllib_associate_step1(struct rtllib_device *ieee, u8 *daddr)
967	{
968	struct rtllib_network *beacon = &ieee->current_network;
969	struct sk_buff *skb;
970
971	netdev_dbg(ieee->dev, "Stopping scan\n");
972
973	ieee->softmac_stats.tx_auth_rq++;
974
975	skb = rtllib_authentication_req(beacon, ieee, challengelen: 0, daddr);
976
977	if (!skb) {
978	rtllib_associate_abort(ieee);
979	} else {
980	ieee->link_state = RTLLIB_ASSOCIATING_AUTHENTICATING;
981	netdev_dbg(ieee->dev, "Sending authentication request\n");
982	softmac_mgmt_xmit(skb, ieee);
983	if (!timer_pending(timer: &ieee->associate_timer)) {
984	ieee->associate_timer.expires = jiffies + (HZ / 2);
985	add_timer(timer: &ieee->associate_timer);
986	}
987	}
988	}
989
990	static void rtllib_auth_challenge(struct rtllib_device *ieee, u8 *challenge,
991	int chlen)
992	{
993	u8 *c;
994	struct sk_buff *skb;
995	struct rtllib_network *beacon = &ieee->current_network;
996
997	ieee->associate_seq++;
998	ieee->softmac_stats.tx_auth_rq++;
999
1000	skb = rtllib_authentication_req(beacon, ieee, challengelen: chlen + 2, daddr: beacon->bssid);
1001
1002	if (!skb) {
1003	rtllib_associate_abort(ieee);
1004	} else {
1005	c = skb_put(skb, len: chlen + 2);
1006	*(c++) = MFIE_TYPE_CHALLENGE;
1007	*(c++) = chlen;
1008	memcpy(c, challenge, chlen);
1009
1010	netdev_dbg(ieee->dev,
1011	"Sending authentication challenge response\n");
1012
1013	rtllib_encrypt_fragment(ieee, frag: skb,
1014	hdr_len: sizeof(struct ieee80211_hdr_3addr));
1015
1016	softmac_mgmt_xmit(skb, ieee);
1017	mod_timer(timer: &ieee->associate_timer, expires: jiffies + (HZ / 2));
1018	}
1019	kfree(objp: challenge);
1020	}
1021
1022	static void rtllib_associate_step2(struct rtllib_device *ieee)
1023	{
1024	struct sk_buff *skb;
1025	struct rtllib_network *beacon = &ieee->current_network;
1026
1027	del_timer_sync(timer: &ieee->associate_timer);
1028
1029	netdev_dbg(ieee->dev, "Sending association request\n");
1030
1031	ieee->softmac_stats.tx_ass_rq++;
1032	skb = rtllib_association_req(beacon, ieee);
1033	if (!skb) {
1034	rtllib_associate_abort(ieee);
1035	} else {
1036	softmac_mgmt_xmit(skb, ieee);
1037	mod_timer(timer: &ieee->associate_timer, expires: jiffies + (HZ / 2));
1038	}
1039	}
1040
1041	static void rtllib_associate_complete_wq(void *data)
1042	{
1043	struct rtllib_device *ieee = (struct rtllib_device *)
1044	container_of(data,
1045	struct rtllib_device,
1046	associate_complete_wq);
1047	struct rt_pwr_save_ctrl *psc = &ieee->pwr_save_ctrl;
1048
1049	netdev_info(dev: ieee->dev, format: "Associated successfully with %pM\n",
1050	ieee->current_network.bssid);
1051	netdev_info(dev: ieee->dev, format: "normal associate\n");
1052	notify_wx_assoc_event(ieee);
1053
1054	netif_carrier_on(dev: ieee->dev);
1055	ieee->is_roaming = false;
1056	if (rtllib_is_54g(net: &ieee->current_network)) {
1057	ieee->rate = 108;
1058	netdev_info(dev: ieee->dev, format: "Using G rates:%d\n", ieee->rate);
1059	} else {
1060	ieee->rate = 22;
1061	ieee->set_wireless_mode(ieee->dev, WIRELESS_MODE_B);
1062	netdev_info(dev: ieee->dev, format: "Using B rates:%d\n", ieee->rate);
1063	}
1064	if (ieee->ht_info->current_ht_support && ieee->ht_info->enable_ht) {
1065	netdev_info(dev: ieee->dev, format: "Successfully associated, ht enabled\n");
1066	ht_on_assoc_rsp(ieee);
1067	} else {
1068	netdev_info(dev: ieee->dev,
1069	format: "Successfully associated, ht not enabled(%d, %d)\n",
1070	ieee->ht_info->current_ht_support,
1071	ieee->ht_info->enable_ht);
1072	memset(ieee->dot11ht_oper_rate_set, 0, 16);
1073	}
1074	ieee->link_detect_info.slot_num = 2 * (1 +
1075	ieee->current_network.beacon_interval /
1076	500);
1077	if (ieee->link_detect_info.num_recv_bcn_in_period == 0 ||
1078	ieee->link_detect_info.num_recv_data_in_period == 0) {
1079	ieee->link_detect_info.num_recv_bcn_in_period = 1;
1080	ieee->link_detect_info.num_recv_data_in_period = 1;
1081	}
1082	psc->lps_idle_count = 0;
1083	ieee->link_change(ieee->dev);
1084	}
1085
1086	static void rtllib_sta_send_associnfo(struct rtllib_device *ieee)
1087	{
1088	}
1089
1090	static void rtllib_associate_complete(struct rtllib_device *ieee)
1091	{
1092	del_timer_sync(timer: &ieee->associate_timer);
1093
1094	ieee->link_state = MAC80211_LINKED;
1095	rtllib_sta_send_associnfo(ieee);
1096
1097	schedule_work(work: &ieee->associate_complete_wq);
1098	}
1099
1100	static void rtllib_associate_procedure_wq(void *data)
1101	{
1102	struct rtllib_device *ieee = container_of_dwork_rsl(data,
1103	struct rtllib_device,
1104	associate_procedure_wq);
1105	rtllib_stop_scan_syncro(ieee);
1106	ieee->rtllib_ips_leave(ieee->dev);
1107	mutex_lock(&ieee->wx_mutex);
1108
1109	rtllib_stop_scan(ieee);
1110	ht_set_connect_bw_mode(ieee, bandwidth: HT_CHANNEL_WIDTH_20, Offset: HT_EXTCHNL_OFFSET_NO_EXT);
1111	if (ieee->rf_power_state == rf_off) {
1112	ieee->rtllib_ips_leave_wq(ieee->dev);
1113	mutex_unlock(lock: &ieee->wx_mutex);
1114	return;
1115	}
1116	ieee->associate_seq = 1;
1117
1118	rtllib_associate_step1(ieee, daddr: ieee->current_network.bssid);
1119
1120	mutex_unlock(lock: &ieee->wx_mutex);
1121	}
1122
1123	inline void rtllib_softmac_new_net(struct rtllib_device *ieee,
1124	struct rtllib_network *net)
1125	{
1126	u8 tmp_ssid[IW_ESSID_MAX_SIZE + 1];
1127	int tmp_ssid_len = 0;
1128
1129	short apset, ssidset, ssidbroad, apmatch, ssidmatch;
1130
1131	/* we are interested in new only if we are not associated
1132	* and we are not associating / authenticating
1133	*/
1134	if (ieee->link_state != MAC80211_NOLINK)
1135	return;
1136
1137	if ((ieee->iw_mode == IW_MODE_INFRA) && !(net->capability &
1138	WLAN_CAPABILITY_ESS))
1139	return;
1140
1141	if (ieee->iw_mode == IW_MODE_INFRA) {
1142	/* if the user specified the AP MAC, we need also the essid
1143	* This could be obtained by beacons or, if the network does not
1144	* broadcast it, it can be put manually.
1145	*/
1146	apset = ieee->wap_set;
1147	ssidset = ieee->ssid_set;
1148	ssidbroad = !(net->ssid_len == 0 || net->ssid[0] == '\0');
1149	apmatch = (memcmp(p: ieee->current_network.bssid, q: net->bssid,
1150	ETH_ALEN) == 0);
1151	if (!ssidbroad) {
1152	ssidmatch = (ieee->current_network.ssid_len ==
1153	net->hidden_ssid_len) &&
1154	(!strncmp(ieee->current_network.ssid,
1155	net->hidden_ssid, net->hidden_ssid_len));
1156	if (net->hidden_ssid_len > 0) {
1157	strncpy(p: net->ssid, q: net->hidden_ssid,
1158	size: net->hidden_ssid_len);
1159	net->ssid_len = net->hidden_ssid_len;
1160	ssidbroad = 1;
1161	}
1162	} else {
1163	ssidmatch =
1164	(ieee->current_network.ssid_len == net->ssid_len) &&
1165	(!strncmp(ieee->current_network.ssid, net->ssid,
1166	net->ssid_len));
1167	}
1168
1169	/* if the user set the AP check if match.
1170	* if the network does not broadcast essid we check the
1171	* user supplied ANY essid
1172	* if the network does broadcast and the user does not set
1173	* essid it is OK
1174	* if the network does broadcast and the user did set essid
1175	* check if essid match
1176	* if the ap is not set, check that the user set the bssid
1177	* and the network does broadcast and that those two bssid match
1178	*/
1179	if ((apset && apmatch &&
1180	((ssidset && ssidbroad && ssidmatch) ||
1181	(ssidbroad && !ssidset) || (!ssidbroad && ssidset))) ||
1182	(!apset && ssidset && ssidbroad && ssidmatch) ||
1183	(ieee->is_roaming && ssidset && ssidbroad && ssidmatch)) {
1184	/* Save the essid so that if it is hidden, it is
1185	* replaced with the essid provided by the user.
1186	*/
1187	if (!ssidbroad) {
1188	memcpy(tmp_ssid, ieee->current_network.ssid,
1189	ieee->current_network.ssid_len);
1190	tmp_ssid_len = ieee->current_network.ssid_len;
1191	}
1192	memcpy(&ieee->current_network, net,
1193	sizeof(ieee->current_network));
1194	if (!ssidbroad) {
1195	memcpy(ieee->current_network.ssid, tmp_ssid,
1196	tmp_ssid_len);
1197	ieee->current_network.ssid_len = tmp_ssid_len;
1198	}
1199	netdev_info(dev: ieee->dev,
1200	format: "Linking with %s,channel:%d, qos:%d, myHT:%d, networkHT:%d, mode:%x cur_net.flags:0x%x\n",
1201	ieee->current_network.ssid,
1202	ieee->current_network.channel,
1203	ieee->current_network.qos_data.supported,
1204	ieee->ht_info->enable_ht,
1205	ieee->current_network.bssht.bd_support_ht,
1206	ieee->current_network.mode,
1207	ieee->current_network.flags);
1208
1209	if ((rtllib_act_scanning(ieee, false)) &&
1210	!(ieee->softmac_features & IEEE_SOFTMAC_SCAN))
1211	rtllib_stop_scan_syncro(ieee);
1212
1213	ht_reset_iot_setting(ht_info: ieee->ht_info);
1214	ieee->wmm_acm = 0;
1215	if (ieee->iw_mode == IW_MODE_INFRA) {
1216	/* Join the network for the first time */
1217	ieee->asoc_retry_count = 0;
1218	if ((ieee->current_network.qos_data.supported == 1) &&
1219	ieee->current_network.bssht.bd_support_ht)
1220	ht_reset_self_and_save_peer_setting(ieee,
1221	pNetwork: &ieee->current_network);
1222	else
1223	ieee->ht_info->current_ht_support = false;
1224
1225	ieee->link_state = RTLLIB_ASSOCIATING;
1226	schedule_delayed_work(dwork: &ieee->associate_procedure_wq, delay: 0);
1227	} else {
1228	if (rtllib_is_54g(net: &ieee->current_network)) {
1229	ieee->rate = 108;
1230	ieee->set_wireless_mode(ieee->dev, WIRELESS_MODE_G);
1231	netdev_info(dev: ieee->dev,
1232	format: "Using G rates\n");
1233	} else {
1234	ieee->rate = 22;
1235	ieee->set_wireless_mode(ieee->dev, WIRELESS_MODE_B);
1236	netdev_info(dev: ieee->dev,
1237	format: "Using B rates\n");
1238	}
1239	memset(ieee->dot11ht_oper_rate_set, 0, 16);
1240	ieee->link_state = MAC80211_LINKED;
1241	}
1242	}
1243	}
1244	}
1245
1246	static void rtllib_softmac_check_all_nets(struct rtllib_device *ieee)
1247	{
1248	unsigned long flags;
1249	struct rtllib_network *target;
1250
1251	spin_lock_irqsave(&ieee->lock, flags);
1252
1253	list_for_each_entry(target, &ieee->network_list, list) {
1254	/* if the state become different that NOLINK means
1255	* we had found what we are searching for
1256	*/
1257
1258	if (ieee->link_state != MAC80211_NOLINK)
1259	break;
1260
1261	if (ieee->scan_age == 0 || time_after(target->last_scanned +
1262	ieee->scan_age, jiffies))
1263	rtllib_softmac_new_net(ieee, net: target);
1264	}
1265	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1266	}
1267
1268	static inline int auth_parse(struct net_device *dev, struct sk_buff *skb,
1269	u8 **challenge, int *chlen)
1270	{
1271	struct rtllib_authentication *a;
1272	u8 *t;
1273
1274	if (skb->len < (sizeof(struct rtllib_authentication) -
1275	sizeof(struct rtllib_info_element))) {
1276	netdev_dbg(dev, "invalid len in auth resp: %d\n", skb->len);
1277	return -EINVAL;
1278	}
1279	*challenge = NULL;
1280	a = (struct rtllib_authentication *)skb->data;
1281	if (skb->len > (sizeof(struct rtllib_authentication) + 3)) {
1282	t = skb->data + sizeof(struct rtllib_authentication);
1283
1284	if (*(t++) == MFIE_TYPE_CHALLENGE) {
1285	*chlen = *(t++);
1286	*challenge = kmemdup(p: t, size: *chlen, GFP_ATOMIC);
1287	if (!*challenge)
1288	return -ENOMEM;
1289	}
1290	}
1291
1292	if (a->status) {
1293	netdev_dbg(dev, "auth_parse() failed\n");
1294	return -EINVAL;
1295	}
1296
1297	return 0;
1298	}
1299
1300	static inline u16 assoc_parse(struct rtllib_device *ieee, struct sk_buff *skb,
1301	int *aid)
1302	{
1303	struct rtllib_assoc_response_frame *response_head;
1304	u16 status_code;
1305
1306	if (skb->len < sizeof(struct rtllib_assoc_response_frame)) {
1307	netdev_dbg(ieee->dev, "Invalid len in auth resp: %d\n",
1308	skb->len);
1309	return 0xcafe;
1310	}
1311
1312	response_head = (struct rtllib_assoc_response_frame *)skb->data;
1313	*aid = le16_to_cpu(response_head->aid) & 0x3fff;
1314
1315	status_code = le16_to_cpu(response_head->status);
1316	if ((status_code == WLAN_STATUS_ASSOC_DENIED_RATES ||
1317	status_code == WLAN_STATUS_CAPS_UNSUPPORTED) &&
1318	((ieee->mode == WIRELESS_MODE_G) &&
1319	(ieee->current_network.mode == WIRELESS_MODE_N_24G) &&
1320	(ieee->asoc_retry_count++ < (RT_ASOC_RETRY_LIMIT - 1)))) {
1321	ieee->ht_info->iot_action |= HT_IOT_ACT_PURE_N_MODE;
1322	} else {
1323	ieee->asoc_retry_count = 0;
1324	}
1325
1326	return le16_to_cpu(response_head->status);
1327	}
1328
1329	void rtllib_sta_ps_send_null_frame(struct rtllib_device *ieee, short pwr)
1330	{
1331	struct sk_buff *buf = rtllib_null_func(ieee, pwr);
1332
1333	if (buf)
1334	softmac_ps_mgmt_xmit(skb: buf, ieee);
1335	}
1336	EXPORT_SYMBOL(rtllib_sta_ps_send_null_frame);
1337
1338	void rtllib_sta_ps_send_pspoll_frame(struct rtllib_device *ieee)
1339	{
1340	struct sk_buff *buf = rtllib_pspoll_func(ieee);
1341
1342	if (buf)
1343	softmac_ps_mgmt_xmit(skb: buf, ieee);
1344	}
1345
1346	static short rtllib_sta_ps_sleep(struct rtllib_device *ieee, u64 *time)
1347	{
1348	int timeout;
1349	u8 dtim;
1350	struct rt_pwr_save_ctrl *psc = &ieee->pwr_save_ctrl;
1351
1352	if (ieee->lps_delay_cnt) {
1353	ieee->lps_delay_cnt--;
1354	return 0;
1355	}
1356
1357	dtim = ieee->current_network.dtim_data;
1358	if (!(dtim & RTLLIB_DTIM_VALID))
1359	return 0;
1360	timeout = ieee->current_network.beacon_interval;
1361	ieee->current_network.dtim_data = RTLLIB_DTIM_INVALID;
1362	/* there's no need to nofity AP that I find you buffered
1363	* with broadcast packet
1364	*/
1365	if (dtim & (RTLLIB_DTIM_UCAST & ieee->ps))
1366	return 2;
1367
1368	if (!time_after(jiffies,
1369	dev_trans_start(ieee->dev) + msecs_to_jiffies(timeout)))
1370	return 0;
1371	if (!time_after(jiffies,
1372	ieee->last_rx_ps_time + msecs_to_jiffies(timeout)))
1373	return 0;
1374	if ((ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE) &&
1375	(ieee->mgmt_queue_tail != ieee->mgmt_queue_head))
1376	return 0;
1377
1378	if (time) {
1379	if (ieee->awake_pkt_sent) {
1380	psc->lps_awake_intvl = 1;
1381	} else {
1382	u8 max_period = 5;
1383
1384	if (psc->lps_awake_intvl == 0)
1385	psc->lps_awake_intvl = 1;
1386	psc->lps_awake_intvl = (psc->lps_awake_intvl >=
1387	max_period) ? max_period :
1388	(psc->lps_awake_intvl + 1);
1389	}
1390	{
1391	u8 lps_awake_intvl_tmp = 0;
1392	u8 period = ieee->current_network.dtim_period;
1393	u8 count = ieee->current_network.tim.tim_count;
1394
1395	if (count == 0) {
1396	if (psc->lps_awake_intvl > period)
1397	lps_awake_intvl_tmp = period +
1398	(psc->lps_awake_intvl -
1399	period) -
1400	((psc->lps_awake_intvl - period) %
1401	period);
1402	else
1403	lps_awake_intvl_tmp = psc->lps_awake_intvl;
1404
1405	} else {
1406	if (psc->lps_awake_intvl >
1407	ieee->current_network.tim.tim_count)
1408	lps_awake_intvl_tmp = count +
1409	(psc->lps_awake_intvl - count) -
1410	((psc->lps_awake_intvl - count) % period);
1411	else
1412	lps_awake_intvl_tmp = psc->lps_awake_intvl;
1413	}
1414
1415	*time = ieee->current_network.last_dtim_sta_time
1416	+ msecs_to_jiffies(m: ieee->current_network.beacon_interval *
1417	lps_awake_intvl_tmp);
1418	}
1419	}
1420
1421	return 1;
1422	}
1423
1424	static inline void rtllib_sta_ps(struct work_struct *work)
1425	{
1426	struct rtllib_device *ieee;
1427	u64 time;
1428	short sleep;
1429	unsigned long flags, flags2;
1430
1431	ieee = container_of(work, struct rtllib_device, ps_task);
1432
1433	spin_lock_irqsave(&ieee->lock, flags);
1434
1435	if ((ieee->ps == RTLLIB_PS_DISABLED ||
1436	ieee->iw_mode != IW_MODE_INFRA ||
1437	ieee->link_state != MAC80211_LINKED)) {
1438	spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
1439	rtllib_sta_wakeup(ieee, nl: 1);
1440
1441	spin_unlock_irqrestore(lock: &ieee->mgmt_tx_lock, flags: flags2);
1442	}
1443	sleep = rtllib_sta_ps_sleep(ieee, time: &time);
1444	/* 2 wake, 1 sleep, 0 do nothing */
1445	if (sleep == 0)
1446	goto out;
1447	if (sleep == 1) {
1448	if (ieee->sta_sleep == LPS_IS_SLEEP) {
1449	ieee->enter_sleep_state(ieee->dev, time);
1450	} else if (ieee->sta_sleep == LPS_IS_WAKE) {
1451	spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
1452
1453	if (ieee->ps_is_queue_empty(ieee->dev)) {
1454	ieee->sta_sleep = LPS_WAIT_NULL_DATA_SEND;
1455	ieee->ack_tx_to_ieee = 1;
1456	rtllib_sta_ps_send_null_frame(ieee, 1);
1457	ieee->ps_time = time;
1458	}
1459	spin_unlock_irqrestore(lock: &ieee->mgmt_tx_lock, flags: flags2);
1460	}
1461
1462	ieee->awake_pkt_sent = false;
1463
1464	} else if (sleep == 2) {
1465	spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
1466
1467	rtllib_sta_wakeup(ieee, nl: 1);
1468
1469	spin_unlock_irqrestore(lock: &ieee->mgmt_tx_lock, flags: flags2);
1470	}
1471
1472	out:
1473	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1474	}
1475
1476	static void rtllib_sta_wakeup(struct rtllib_device *ieee, short nl)
1477	{
1478	if (ieee->sta_sleep == LPS_IS_WAKE) {
1479	if (nl) {
1480	if (ieee->ht_info->iot_action &
1481	HT_IOT_ACT_NULL_DATA_POWER_SAVING) {
1482	ieee->ack_tx_to_ieee = 1;
1483	rtllib_sta_ps_send_null_frame(ieee, 0);
1484	} else {
1485	ieee->ack_tx_to_ieee = 1;
1486	rtllib_sta_ps_send_pspoll_frame(ieee);
1487	}
1488	}
1489	return;
1490	}
1491
1492	if (ieee->sta_sleep == LPS_IS_SLEEP)
1493	ieee->sta_wake_up(ieee->dev);
1494	if (nl) {
1495	if (ieee->ht_info->iot_action &
1496	HT_IOT_ACT_NULL_DATA_POWER_SAVING) {
1497	ieee->ack_tx_to_ieee = 1;
1498	rtllib_sta_ps_send_null_frame(ieee, 0);
1499	} else {
1500	ieee->ack_tx_to_ieee = 1;
1501	ieee->polling = true;
1502	rtllib_sta_ps_send_pspoll_frame(ieee);
1503	}
1504
1505	} else {
1506	ieee->sta_sleep = LPS_IS_WAKE;
1507	ieee->polling = false;
1508	}
1509	}
1510
1511	void rtllib_ps_tx_ack(struct rtllib_device *ieee, short success)
1512	{
1513	unsigned long flags, flags2;
1514
1515	spin_lock_irqsave(&ieee->lock, flags);
1516
1517	if (ieee->sta_sleep == LPS_WAIT_NULL_DATA_SEND) {
1518	/* Null frame with PS bit set */
1519	if (success) {
1520	ieee->sta_sleep = LPS_IS_SLEEP;
1521	ieee->enter_sleep_state(ieee->dev, ieee->ps_time);
1522	}
1523	/* if the card report not success we can't be sure the AP
1524	* has not RXed so we can't assume the AP believe us awake
1525	*/
1526	} else {/* 21112005 - tx again null without PS bit if lost */
1527
1528	if ((ieee->sta_sleep == LPS_IS_WAKE) && !success) {
1529	spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
1530	if (ieee->ht_info->iot_action &
1531	HT_IOT_ACT_NULL_DATA_POWER_SAVING)
1532	rtllib_sta_ps_send_null_frame(ieee, 0);
1533	else
1534	rtllib_sta_ps_send_pspoll_frame(ieee);
1535	spin_unlock_irqrestore(lock: &ieee->mgmt_tx_lock, flags: flags2);
1536	}
1537	}
1538	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1539	}
1540	EXPORT_SYMBOL(rtllib_ps_tx_ack);
1541
1542	static void rtllib_process_action(struct rtllib_device *ieee,
1543	struct sk_buff *skb)
1544	{
1545	u8 *act = skb->data + RTLLIB_3ADDR_LEN;
1546	u8 category = 0;
1547
1548	category = *act;
1549	act++;
1550	switch (category) {
1551	case ACT_CAT_BA:
1552	switch (*act) {
1553	case ACT_ADDBAREQ:
1554	rtllib_rx_add_ba_req(ieee, skb);
1555	break;
1556	case ACT_ADDBARSP:
1557	rtllib_rx_add_ba_rsp(ieee, skb);
1558	break;
1559	case ACT_DELBA:
1560	rtllib_rx_DELBA(ieee, skb);
1561	break;
1562	}
1563	break;
1564	default:
1565	break;
1566	}
1567	}
1568
1569	static inline int
1570	rtllib_rx_assoc_resp(struct rtllib_device *ieee, struct sk_buff *skb,
1571	struct rtllib_rx_stats *rx_stats)
1572	{
1573	u16 errcode;
1574	int aid;
1575	u8 *ies;
1576	struct rtllib_assoc_response_frame *assoc_resp;
1577	struct ieee80211_hdr_3addr *header = (struct ieee80211_hdr_3addr *)skb->data;
1578	u16 frame_ctl = le16_to_cpu(header->frame_control);
1579
1580	netdev_dbg(ieee->dev, "received [RE]ASSOCIATION RESPONSE (%d)\n",
1581	WLAN_FC_GET_STYPE(frame_ctl));
1582
1583	if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
1584	ieee->link_state == RTLLIB_ASSOCIATING_AUTHENTICATED &&
1585	(ieee->iw_mode == IW_MODE_INFRA)) {
1586	errcode = assoc_parse(ieee, skb, aid: &aid);
1587	if (!errcode) {
1588	struct rtllib_network *network =
1589	kzalloc(size: sizeof(struct rtllib_network),
1590	GFP_ATOMIC);
1591
1592	if (!network)
1593	return 1;
1594	ieee->link_state = MAC80211_LINKED;
1595	ieee->assoc_id = aid;
1596	ieee->softmac_stats.rx_ass_ok++;
1597	/* station support qos */
1598	/* Let the register setting default with Legacy station */
1599	assoc_resp = (struct rtllib_assoc_response_frame *)skb->data;
1600	if (ieee->current_network.qos_data.supported == 1) {
1601	if (rtllib_parse_info_param(ieee, info_element: assoc_resp->info_element,
1602	length: rx_stats->len - sizeof(*assoc_resp),
1603	network, stats: rx_stats)) {
1604	kfree(objp: network);
1605	return 1;
1606	}
1607	memcpy(ieee->ht_info->peer_ht_cap_buf,
1608	network->bssht.bd_ht_cap_buf,
1609	network->bssht.bd_ht_cap_len);
1610	memcpy(ieee->ht_info->peer_ht_info_buf,
1611	network->bssht.bd_ht_info_buf,
1612	network->bssht.bd_ht_info_len);
1613	ieee->handle_assoc_response(ieee->dev,
1614	(struct rtllib_assoc_response_frame *)header, network);
1615	}
1616	kfree(objp: network);
1617
1618	kfree(objp: ieee->assocresp_ies);
1619	ieee->assocresp_ies = NULL;
1620	ies = &assoc_resp->info_element[0].id;
1621	ieee->assocresp_ies_len = (skb->data + skb->len) - ies;
1622	ieee->assocresp_ies = kmemdup(p: ies,
1623	size: ieee->assocresp_ies_len,
1624	GFP_ATOMIC);
1625	if (!ieee->assocresp_ies)
1626	ieee->assocresp_ies_len = 0;
1627
1628	rtllib_associate_complete(ieee);
1629	} else {
1630	/* aid could not been allocated */
1631	ieee->softmac_stats.rx_ass_err++;
1632	netdev_info(dev: ieee->dev,
1633	format: "Association response status code 0x%x\n",
1634	errcode);
1635	if (ieee->asoc_retry_count < RT_ASOC_RETRY_LIMIT)
1636	schedule_delayed_work(dwork: &ieee->associate_procedure_wq, delay: 0);
1637	else
1638	rtllib_associate_abort(ieee);
1639	}
1640	}
1641	return 0;
1642	}
1643
1644	static void rtllib_rx_auth_resp(struct rtllib_device *ieee, struct sk_buff *skb)
1645	{
1646	int errcode;
1647	u8 *challenge;
1648	int chlen = 0;
1649	bool support_nmode = true, half_support_nmode = false;
1650
1651	errcode = auth_parse(dev: ieee->dev, skb, challenge: &challenge, chlen: &chlen);
1652
1653	if (errcode) {
1654	ieee->softmac_stats.rx_auth_rs_err++;
1655	netdev_info(dev: ieee->dev,
1656	format: "Authentication response status code %d", errcode);
1657	rtllib_associate_abort(ieee);
1658	return;
1659	}
1660
1661	if (ieee->open_wep || !challenge) {
1662	ieee->link_state = RTLLIB_ASSOCIATING_AUTHENTICATED;
1663	ieee->softmac_stats.rx_auth_rs_ok++;
1664	if (!(ieee->ht_info->iot_action & HT_IOT_ACT_PURE_N_MODE)) {
1665	if (!ieee->get_nmode_support_by_sec_cfg(ieee->dev)) {
1666	if (is_ht_half_nmode_aps(ieee)) {
1667	support_nmode = true;
1668	half_support_nmode = true;
1669	} else {
1670	support_nmode = false;
1671	half_support_nmode = false;
1672	}
1673	}
1674	}
1675	/* Dummy wirless mode setting to avoid encryption issue */
1676	if (support_nmode) {
1677	ieee->set_wireless_mode(ieee->dev,
1678	ieee->current_network.mode);
1679	} else {
1680	/*TODO*/
1681	ieee->set_wireless_mode(ieee->dev, WIRELESS_MODE_G);
1682	}
1683
1684	if ((ieee->current_network.mode == WIRELESS_MODE_N_24G) &&
1685	half_support_nmode) {
1686	netdev_info(dev: ieee->dev, format: "======>enter half N mode\n");
1687	ieee->half_wireless_n24g_mode = true;
1688	} else {
1689	ieee->half_wireless_n24g_mode = false;
1690	}
1691	rtllib_associate_step2(ieee);
1692	} else {
1693	rtllib_auth_challenge(ieee, challenge, chlen);
1694	}
1695	}
1696
1697	static inline int
1698	rtllib_rx_auth(struct rtllib_device *ieee, struct sk_buff *skb,
1699	struct rtllib_rx_stats *rx_stats)
1700	{
1701	if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) {
1702	if (ieee->link_state == RTLLIB_ASSOCIATING_AUTHENTICATING &&
1703	(ieee->iw_mode == IW_MODE_INFRA)) {
1704	netdev_dbg(ieee->dev,
1705	"Received authentication response");
1706	rtllib_rx_auth_resp(ieee, skb);
1707	}
1708	}
1709	return 0;
1710	}
1711
1712	static inline int
1713	rtllib_rx_deauth(struct rtllib_device *ieee, struct sk_buff *skb)
1714	{
1715	struct ieee80211_hdr_3addr *header = (struct ieee80211_hdr_3addr *)skb->data;
1716	u16 frame_ctl;
1717
1718	if (memcmp(p: header->addr3, q: ieee->current_network.bssid, ETH_ALEN) != 0)
1719	return 0;
1720
1721	/* FIXME for now repeat all the association procedure
1722	* both for disassociation and deauthentication
1723	*/
1724	if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
1725	ieee->link_state == MAC80211_LINKED &&
1726	(ieee->iw_mode == IW_MODE_INFRA)) {
1727	frame_ctl = le16_to_cpu(header->frame_control);
1728	netdev_info(dev: ieee->dev,
1729	format: "==========>received disassoc/deauth(%x) frame, reason code:%x\n",
1730	WLAN_FC_GET_STYPE(frame_ctl),
1731	((struct rtllib_disassoc *)skb->data)->reason);
1732	ieee->link_state = RTLLIB_ASSOCIATING;
1733	ieee->softmac_stats.reassoc++;
1734	ieee->is_roaming = true;
1735	ieee->link_detect_info.busy_traffic = false;
1736	rtllib_disassociate(ieee);
1737	remove_peer_ts(ieee, addr: header->addr2);
1738	if (!(ieee->rtllib_ap_sec_type(ieee) & (SEC_ALG_CCMP | SEC_ALG_TKIP)))
1739	schedule_delayed_work(dwork: &ieee->associate_procedure_wq, delay: 5);
1740	}
1741	return 0;
1742	}
1743
1744	inline int rtllib_rx_frame_softmac(struct rtllib_device *ieee,
1745	struct sk_buff *skb,
1746	struct rtllib_rx_stats *rx_stats, u16 type,
1747	u16 stype)
1748	{
1749	struct ieee80211_hdr_3addr *header = (struct ieee80211_hdr_3addr *)skb->data;
1750	u16 frame_ctl;
1751
1752	if (!ieee->proto_started)
1753	return 0;
1754
1755	frame_ctl = le16_to_cpu(header->frame_control);
1756	switch (WLAN_FC_GET_STYPE(frame_ctl)) {
1757	case IEEE80211_STYPE_ASSOC_RESP:
1758	case IEEE80211_STYPE_REASSOC_RESP:
1759	if (rtllib_rx_assoc_resp(ieee, skb, rx_stats) == 1)
1760	return 1;
1761	break;
1762	case IEEE80211_STYPE_ASSOC_REQ:
1763	case IEEE80211_STYPE_REASSOC_REQ:
1764	break;
1765	case IEEE80211_STYPE_AUTH:
1766	rtllib_rx_auth(ieee, skb, rx_stats);
1767	break;
1768	case IEEE80211_STYPE_DISASSOC:
1769	case IEEE80211_STYPE_DEAUTH:
1770	rtllib_rx_deauth(ieee, skb);
1771	break;
1772	case IEEE80211_STYPE_ACTION:
1773	rtllib_process_action(ieee, skb);
1774	break;
1775	default:
1776	return -1;
1777	}
1778	return 0;
1779	}
1780
1781	/* following are for a simpler TX queue management.
1782	* Instead of using netif_[stop/wake]_queue the driver
1783	* will use these two functions (plus a reset one), that
1784	* will internally use the kernel netif_* and takes
1785	* care of the ieee802.11 fragmentation.
1786	* So the driver receives a fragment per time and might
1787	* call the stop function when it wants to not
1788	* have enough room to TX an entire packet.
1789	* This might be useful if each fragment needs it's own
1790	* descriptor, thus just keep a total free memory > than
1791	* the max fragmentation threshold is not enough.. If the
1792	* ieee802.11 stack passed a TXB struct then you need
1793	* to keep N free descriptors where
1794	* N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
1795	* In this way you need just one and the 802.11 stack
1796	* will take care of buffering fragments and pass them to
1797	* the driver later, when it wakes the queue.
1798	*/
1799	void rtllib_softmac_xmit(struct rtllib_txb *txb, struct rtllib_device *ieee)
1800	{
1801	unsigned int queue_index = txb->queue_index;
1802	unsigned long flags;
1803	int i;
1804	struct cb_desc *tcb_desc = NULL;
1805	unsigned long queue_len = 0;
1806
1807	spin_lock_irqsave(&ieee->lock, flags);
1808
1809	/* called with 2nd parm 0, no tx mgmt lock required */
1810	rtllib_sta_wakeup(ieee, nl: 0);
1811
1812	/* update the tx status */
1813	tcb_desc = (struct cb_desc *)(txb->fragments[0]->cb +
1814	MAX_DEV_ADDR_SIZE);
1815	if (tcb_desc->multicast)
1816	ieee->stats.multicast++;
1817
1818	/* if xmit available, just xmit it immediately, else just insert it to
1819	* the wait queue
1820	*/
1821	for (i = 0; i < txb->nr_frags; i++) {
1822	queue_len = skb_queue_len(list_: &ieee->skb_waitq[queue_index]);
1823	if ((queue_len != 0) ||
1824	(!ieee->check_nic_enough_desc(ieee->dev, queue_index)) ||
1825	(ieee->queue_stop)) {
1826	/* insert the skb packet to the wait queue
1827	* as for the completion function, it does not need
1828	* to check it any more.
1829	*/
1830	if (queue_len < 200)
1831	skb_queue_tail(list: &ieee->skb_waitq[queue_index],
1832	newsk: txb->fragments[i]);
1833	else
1834	kfree_skb(skb: txb->fragments[i]);
1835	} else {
1836	ieee->softmac_data_hard_start_xmit(txb->fragments[i],
1837	ieee->dev, ieee->rate);
1838	}
1839	}
1840
1841	rtllib_txb_free(txb);
1842
1843	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1844	}
1845
1846	void rtllib_reset_queue(struct rtllib_device *ieee)
1847	{
1848	unsigned long flags;
1849
1850	spin_lock_irqsave(&ieee->lock, flags);
1851	init_mgmt_queue(ieee);
1852	if (ieee->tx_pending.txb) {
1853	rtllib_txb_free(txb: ieee->tx_pending.txb);
1854	ieee->tx_pending.txb = NULL;
1855	}
1856	ieee->queue_stop = 0;
1857	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1858	}
1859	EXPORT_SYMBOL(rtllib_reset_queue);
1860
1861	void rtllib_stop_all_queues(struct rtllib_device *ieee)
1862	{
1863	unsigned int i;
1864
1865	for (i = 0; i < ieee->dev->num_tx_queues; i++)
1866	txq_trans_cond_update(txq: netdev_get_tx_queue(dev: ieee->dev, index: i));
1867
1868	netif_tx_stop_all_queues(dev: ieee->dev);
1869	}
1870
1871	void rtllib_wake_all_queues(struct rtllib_device *ieee)
1872	{
1873	netif_tx_wake_all_queues(dev: ieee->dev);
1874	}
1875
1876	/* this is called only in user context, with wx_mutex held */
1877	static void rtllib_start_bss(struct rtllib_device *ieee)
1878	{
1879	unsigned long flags;
1880
1881	/* check if we have already found the net we
1882	* are interested in (if any).
1883	* if not (we are disassociated and we are not
1884	* in associating / authenticating phase) start the background scanning.
1885	*/
1886	rtllib_softmac_check_all_nets(ieee);
1887
1888	/* ensure no-one start an associating process (thus setting
1889	* the ieee->link_state to rtllib_ASSOCIATING) while we
1890	* have just checked it and we are going to enable scan.
1891	* The rtllib_new_net function is always called with
1892	* lock held (from both rtllib_softmac_check_all_nets and
1893	* the rx path), so we cannot be in the middle of such function
1894	*/
1895	spin_lock_irqsave(&ieee->lock, flags);
1896
1897	if (ieee->link_state == MAC80211_NOLINK)
1898	rtllib_start_scan(ieee);
1899	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1900	}
1901
1902	static void rtllib_link_change_wq(void *data)
1903	{
1904	struct rtllib_device *ieee = container_of_dwork_rsl(data,
1905	struct rtllib_device, link_change_wq);
1906	ieee->link_change(ieee->dev);
1907	}
1908
1909	/* called only in userspace context */
1910	void rtllib_disassociate(struct rtllib_device *ieee)
1911	{
1912	netif_carrier_off(dev: ieee->dev);
1913	if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)
1914	rtllib_reset_queue(ieee);
1915
1916	ieee->link_state = MAC80211_NOLINK;
1917	ieee->is_set_key = false;
1918	ieee->wap_set = 0;
1919
1920	schedule_delayed_work(dwork: &ieee->link_change_wq, delay: 0);
1921
1922	notify_wx_assoc_event(ieee);
1923	}
1924
1925	static void rtllib_associate_retry_wq(void *data)
1926	{
1927	struct rtllib_device *ieee = container_of_dwork_rsl(data,
1928	struct rtllib_device, associate_retry_wq);
1929	unsigned long flags;
1930
1931	mutex_lock(&ieee->wx_mutex);
1932	if (!ieee->proto_started)
1933	goto exit;
1934
1935	if (ieee->link_state != RTLLIB_ASSOCIATING_RETRY)
1936	goto exit;
1937
1938	/* until we do not set the state to MAC80211_NOLINK
1939	* there are no possibility to have someone else trying
1940	* to start an association procedure (we get here with
1941	* ieee->link_state = RTLLIB_ASSOCIATING).
1942	* When we set the state to MAC80211_NOLINK it is possible
1943	* that the RX path run an attempt to associate, but
1944	* both rtllib_softmac_check_all_nets and the
1945	* RX path works with ieee->lock held so there are no
1946	* problems. If we are still disassociated then start a scan.
1947	* the lock here is necessary to ensure no one try to start
1948	* an association procedure when we have just checked the
1949	* state and we are going to start the scan.
1950	*/
1951	ieee->beinretry = true;
1952	ieee->link_state = MAC80211_NOLINK;
1953
1954	rtllib_softmac_check_all_nets(ieee);
1955
1956	spin_lock_irqsave(&ieee->lock, flags);
1957
1958	if (ieee->link_state == MAC80211_NOLINK)
1959	rtllib_start_scan(ieee);
1960	spin_unlock_irqrestore(lock: &ieee->lock, flags);
1961
1962	ieee->beinretry = false;
1963	exit:
1964	mutex_unlock(lock: &ieee->wx_mutex);
1965	}
1966
1967	void rtllib_softmac_stop_protocol(struct rtllib_device *ieee)
1968	{
1969	rtllib_stop_scan_syncro(ieee);
1970	mutex_lock(&ieee->wx_mutex);
1971	rtllib_stop_protocol(ieee);
1972	mutex_unlock(lock: &ieee->wx_mutex);
1973	}
1974	EXPORT_SYMBOL(rtllib_softmac_stop_protocol);
1975
1976	void rtllib_stop_protocol(struct rtllib_device *ieee)
1977	{
1978	if (!ieee->proto_started)
1979	return;
1980
1981	ieee->proto_started = 0;
1982	ieee->proto_stoppping = 1;
1983	ieee->rtllib_ips_leave(ieee->dev);
1984
1985	del_timer_sync(timer: &ieee->associate_timer);
1986	mutex_unlock(lock: &ieee->wx_mutex);
1987	cancel_delayed_work_sync(dwork: &ieee->associate_retry_wq);
1988	mutex_lock(&ieee->wx_mutex);
1989	cancel_delayed_work_sync(dwork: &ieee->link_change_wq);
1990	rtllib_stop_scan(ieee);
1991
1992	if (ieee->link_state <= RTLLIB_ASSOCIATING_AUTHENTICATED)
1993	ieee->link_state = MAC80211_NOLINK;
1994
1995	if (ieee->link_state == MAC80211_LINKED) {
1996	if (ieee->iw_mode == IW_MODE_INFRA)
1997	send_disassociation(ieee, deauth: 1, rsn: WLAN_REASON_DEAUTH_LEAVING);
1998	rtllib_disassociate(ieee);
1999	}
2000
2001	remove_all_ts(ieee);
2002	ieee->proto_stoppping = 0;
2003
2004	kfree(objp: ieee->assocreq_ies);
2005	ieee->assocreq_ies = NULL;
2006	ieee->assocreq_ies_len = 0;
2007	kfree(objp: ieee->assocresp_ies);
2008	ieee->assocresp_ies = NULL;
2009	ieee->assocresp_ies_len = 0;
2010	}
2011
2012	void rtllib_softmac_start_protocol(struct rtllib_device *ieee)
2013	{
2014	mutex_lock(&ieee->wx_mutex);
2015	rtllib_start_protocol(ieee);
2016	mutex_unlock(lock: &ieee->wx_mutex);
2017	}
2018	EXPORT_SYMBOL(rtllib_softmac_start_protocol);
2019
2020	void rtllib_start_protocol(struct rtllib_device *ieee)
2021	{
2022	short ch = 0;
2023	int i = 0;
2024
2025	if (ieee->proto_started)
2026	return;
2027
2028	ieee->proto_started = 1;
2029
2030	if (ieee->current_network.channel == 0) {
2031	do {
2032	ch++;
2033	if (ch > MAX_CHANNEL_NUMBER)
2034	return; /* no channel found */
2035	} while (!ieee->active_channel_map[ch]);
2036	ieee->current_network.channel = ch;
2037	}
2038
2039	if (ieee->current_network.beacon_interval == 0)
2040	ieee->current_network.beacon_interval = 100;
2041
2042	for (i = 0; i < 17; i++) {
2043	ieee->last_rxseq_num[i] = -1;
2044	ieee->last_rxfrag_num[i] = -1;
2045	ieee->last_packet_time[i] = 0;
2046	}
2047
2048	ieee->wmm_acm = 0;
2049	/* if the user set the MAC of the ad-hoc cell and then
2050	* switch to managed mode, shall we make sure that association
2051	* attempts does not fail just because the user provide the essid
2052	* and the nic is still checking for the AP MAC ??
2053	*/
2054	switch (ieee->iw_mode) {
2055	case IW_MODE_INFRA:
2056	rtllib_start_bss(ieee);
2057	break;
2058	}
2059	}
2060
2061	int rtllib_softmac_init(struct rtllib_device *ieee)
2062	{
2063	int i;
2064
2065	memset(&ieee->current_network, 0, sizeof(struct rtllib_network));
2066
2067	ieee->link_state = MAC80211_NOLINK;
2068	for (i = 0; i < 5; i++)
2069	ieee->seq_ctrl[i] = 0;
2070
2071	ieee->link_detect_info.slot_index = 0;
2072	ieee->link_detect_info.slot_num = 2;
2073	ieee->link_detect_info.num_recv_bcn_in_period = 0;
2074	ieee->link_detect_info.num_recv_data_in_period = 0;
2075	ieee->link_detect_info.num_tx_ok_in_period = 0;
2076	ieee->link_detect_info.num_rx_ok_in_period = 0;
2077	ieee->link_detect_info.num_rx_unicast_ok_in_period = 0;
2078	ieee->is_aggregate_frame = false;
2079	ieee->assoc_id = 0;
2080	ieee->queue_stop = 0;
2081	ieee->scanning_continue = 0;
2082	ieee->softmac_features = 0;
2083	ieee->wap_set = 0;
2084	ieee->ssid_set = 0;
2085	ieee->proto_started = 0;
2086	ieee->proto_stoppping = 0;
2087	ieee->basic_rate = RTLLIB_DEFAULT_BASIC_RATE;
2088	ieee->rate = 22;
2089	ieee->ps = RTLLIB_PS_DISABLED;
2090	ieee->sta_sleep = LPS_IS_WAKE;
2091
2092	ieee->reg_dot11ht_oper_rate_set[0] = 0xff;
2093	ieee->reg_dot11ht_oper_rate_set[1] = 0xff;
2094	ieee->reg_dot11ht_oper_rate_set[4] = 0x01;
2095
2096	ieee->reg_dot11tx_ht_oper_rate_set[0] = 0xff;
2097	ieee->reg_dot11tx_ht_oper_rate_set[1] = 0xff;
2098	ieee->reg_dot11tx_ht_oper_rate_set[4] = 0x01;
2099
2100	ieee->first_ie_in_scan = false;
2101	ieee->actscanning = false;
2102	ieee->beinretry = false;
2103	ieee->is_set_key = false;
2104	init_mgmt_queue(ieee);
2105
2106	ieee->tx_pending.txb = NULL;
2107
2108	timer_setup(&ieee->associate_timer, rtllib_associate_abort_cb, 0);
2109
2110	INIT_DELAYED_WORK(&ieee->link_change_wq, (void *)rtllib_link_change_wq);
2111	INIT_WORK(&ieee->associate_complete_wq, (void *)rtllib_associate_complete_wq);
2112	INIT_DELAYED_WORK(&ieee->associate_procedure_wq, (void *)rtllib_associate_procedure_wq);
2113	INIT_DELAYED_WORK(&ieee->softmac_scan_wq, (void *)rtllib_softmac_scan_wq);
2114	INIT_DELAYED_WORK(&ieee->associate_retry_wq, (void *)rtllib_associate_retry_wq);
2115	INIT_WORK(&ieee->wx_sync_scan_wq, (void *)rtllib_wx_sync_scan_wq);
2116
2117	mutex_init(&ieee->wx_mutex);
2118	mutex_init(&ieee->scan_mutex);
2119	mutex_init(&ieee->ips_mutex);
2120
2121	spin_lock_init(&ieee->mgmt_tx_lock);
2122	spin_lock_init(&ieee->beacon_lock);
2123
2124	INIT_WORK(&ieee->ps_task, rtllib_sta_ps);
2125
2126	return 0;
2127	}
2128
2129	void rtllib_softmac_free(struct rtllib_device *ieee)
2130	{
2131	del_timer_sync(timer: &ieee->associate_timer);
2132
2133	cancel_delayed_work_sync(dwork: &ieee->associate_retry_wq);
2134	cancel_delayed_work_sync(dwork: &ieee->associate_procedure_wq);
2135	cancel_delayed_work_sync(dwork: &ieee->softmac_scan_wq);
2136	cancel_delayed_work_sync(dwork: &ieee->hw_wakeup_wq);
2137	cancel_delayed_work_sync(dwork: &ieee->hw_sleep_wq);
2138	cancel_delayed_work_sync(dwork: &ieee->link_change_wq);
2139	cancel_work_sync(work: &ieee->associate_complete_wq);
2140	cancel_work_sync(work: &ieee->ips_leave_wq);
2141	cancel_work_sync(work: &ieee->wx_sync_scan_wq);
2142	cancel_work_sync(work: &ieee->ps_task);
2143	}
2144
2145	static inline struct sk_buff *
2146	rtllib_disauth_skb(struct rtllib_network *beacon,
2147	struct rtllib_device *ieee, u16 rsn)
2148	{
2149	struct sk_buff *skb;
2150	struct rtllib_disauth *disauth;
2151	int len = sizeof(struct rtllib_disauth) + ieee->tx_headroom;
2152
2153	skb = dev_alloc_skb(length: len);
2154	if (!skb)
2155	return NULL;
2156
2157	skb_reserve(skb, len: ieee->tx_headroom);
2158
2159	disauth = skb_put(skb, len: sizeof(struct rtllib_disauth));
2160	disauth->header.frame_control = cpu_to_le16(IEEE80211_STYPE_DEAUTH);
2161	disauth->header.duration_id = 0;
2162
2163	ether_addr_copy(dst: disauth->header.addr1, src: beacon->bssid);
2164	ether_addr_copy(dst: disauth->header.addr2, src: ieee->dev->dev_addr);
2165	ether_addr_copy(dst: disauth->header.addr3, src: beacon->bssid);
2166
2167	disauth->reason = cpu_to_le16(rsn);
2168	return skb;
2169	}
2170
2171	static inline struct sk_buff *
2172	rtllib_disassociate_skb(struct rtllib_network *beacon,
2173	struct rtllib_device *ieee, u16 rsn)
2174	{
2175	struct sk_buff *skb;
2176	struct rtllib_disassoc *disass;
2177	int len = sizeof(struct rtllib_disassoc) + ieee->tx_headroom;
2178
2179	skb = dev_alloc_skb(length: len);
2180
2181	if (!skb)
2182	return NULL;
2183
2184	skb_reserve(skb, len: ieee->tx_headroom);
2185
2186	disass = skb_put(skb, len: sizeof(struct rtllib_disassoc));
2187	disass->header.frame_control = cpu_to_le16(IEEE80211_STYPE_DISASSOC);
2188	disass->header.duration_id = 0;
2189
2190	ether_addr_copy(dst: disass->header.addr1, src: beacon->bssid);
2191	ether_addr_copy(dst: disass->header.addr2, src: ieee->dev->dev_addr);
2192	ether_addr_copy(dst: disass->header.addr3, src: beacon->bssid);
2193
2194	disass->reason = cpu_to_le16(rsn);
2195	return skb;
2196	}
2197
2198	void send_disassociation(struct rtllib_device *ieee, bool deauth, u16 rsn)
2199	{
2200	struct rtllib_network *beacon = &ieee->current_network;
2201	struct sk_buff *skb;
2202
2203	if (deauth)
2204	skb = rtllib_disauth_skb(beacon, ieee, rsn);
2205	else
2206	skb = rtllib_disassociate_skb(beacon, ieee, rsn);
2207
2208	if (skb)
2209	softmac_mgmt_xmit(skb, ieee);
2210	}
2211
2212	u8 rtllib_ap_sec_type(struct rtllib_device *ieee)
2213	{
2214	static u8 ccmp_ie[4] = {0x00, 0x50, 0xf2, 0x04};
2215	static u8 ccmp_rsn_ie[4] = {0x00, 0x0f, 0xac, 0x04};
2216	int wpa_ie_len = ieee->wpa_ie_len;
2217	struct lib80211_crypt_data *crypt;
2218	int encrypt;
2219
2220	crypt = ieee->crypt_info.crypt[ieee->crypt_info.tx_keyidx];
2221	encrypt = (ieee->current_network.capability & WLAN_CAPABILITY_PRIVACY)
2222	|| (crypt && crypt->ops && (strcmp(crypt->ops->name, "R-WEP") == 0));
2223
2224	/* simply judge */
2225	if (encrypt && (wpa_ie_len == 0)) {
2226	return SEC_ALG_WEP;
2227	} else if ((wpa_ie_len != 0)) {
2228	if (((ieee->wpa_ie[0] == 0xdd) &&
2229	(!memcmp(p: &ieee->wpa_ie[14], q: ccmp_ie, size: 4))) ||
2230	((ieee->wpa_ie[0] == 0x30) &&
2231	(!memcmp(p: &ieee->wpa_ie[10], q: ccmp_rsn_ie, size: 4))))
2232	return SEC_ALG_CCMP;
2233	else
2234	return SEC_ALG_TKIP;
2235	} else {
2236	return SEC_ALG_NONE;
2237	}
2238	}
2239
2240	static void rtllib_mlme_disassociate_request(struct rtllib_device *rtllib,
2241	u8 *addr, u8 rsn)
2242	{
2243	u8 i;
2244	u8 op_mode;
2245
2246	remove_peer_ts(ieee: rtllib, addr);
2247
2248	if (memcmp(p: rtllib->current_network.bssid, q: addr, size: 6) == 0) {
2249	rtllib->link_state = MAC80211_NOLINK;
2250
2251	for (i = 0; i < 6; i++)
2252	rtllib->current_network.bssid[i] = 0x22;
2253	op_mode = RT_OP_MODE_NO_LINK;
2254	rtllib->op_mode = RT_OP_MODE_NO_LINK;
2255	rtllib->set_hw_reg_handler(rtllib->dev, HW_VAR_MEDIA_STATUS,
2256	(u8 *)(&op_mode));
2257	rtllib_disassociate(ieee: rtllib);
2258
2259	rtllib->set_hw_reg_handler(rtllib->dev, HW_VAR_BSSID,
2260	rtllib->current_network.bssid);
2261	}
2262	}
2263
2264	static void rtllib_mgnt_disconnect_ap(struct rtllib_device *rtllib, u8 rsn)
2265	{
2266	bool filter_out_nonassociated_bssid = false;
2267
2268	filter_out_nonassociated_bssid = false;
2269	rtllib->set_hw_reg_handler(rtllib->dev, HW_VAR_CECHK_BSSID,
2270	(u8 *)(&filter_out_nonassociated_bssid));
2271	rtllib_mlme_disassociate_request(rtllib, addr: rtllib->current_network.bssid,
2272	rsn);
2273
2274	rtllib->link_state = MAC80211_NOLINK;
2275	}
2276
2277	bool rtllib_mgnt_disconnect(struct rtllib_device *rtllib, u8 rsn)
2278	{
2279	if (rtllib->ps != RTLLIB_PS_DISABLED)
2280	rtllib->sta_wake_up(rtllib->dev);
2281
2282	if (rtllib->link_state == MAC80211_LINKED) {
2283	if (rtllib->iw_mode == IW_MODE_INFRA)
2284	rtllib_mgnt_disconnect_ap(rtllib, rsn);
2285	}
2286
2287	return true;
2288	}
2289	EXPORT_SYMBOL(rtllib_mgnt_disconnect);
2290
2291	void notify_wx_assoc_event(struct rtllib_device *ieee)
2292	{
2293	union iwreq_data wrqu;
2294
2295	if (ieee->cannot_notify)
2296	return;
2297
2298	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
2299	if (ieee->link_state == MAC80211_LINKED) {
2300	memcpy(wrqu.ap_addr.sa_data, ieee->current_network.bssid,
2301	ETH_ALEN);
2302	} else {
2303	netdev_info(dev: ieee->dev, format: "%s(): Tell user space disconnected\n",
2304	__func__);
2305	eth_zero_addr(addr: wrqu.ap_addr.sa_data);
2306	}
2307	wireless_send_event(dev: ieee->dev, SIOCGIWAP, wrqu: &wrqu, NULL);
2308	}
2309	EXPORT_SYMBOL(notify_wx_assoc_event);
2310