drivers/staging/rt2860/sta/assoc.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         assoc.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John            2004-9-3                porting from RT2500
  36 */
  37 #include "../rt_config.h"
  38
  39 UCHAR   CipherWpaTemplate[] = {
  40                 0xdd,                                   // WPA IE
  41                 0x16,                                   // Length
  42                 0x00, 0x50, 0xf2, 0x01, // oui
  43                 0x01, 0x00,                             // Version
  44                 0x00, 0x50, 0xf2, 0x02, // Multicast
  45                 0x01, 0x00,                             // Number of unicast
  46                 0x00, 0x50, 0xf2, 0x02, // unicast
  47                 0x01, 0x00,                             // number of authentication method
  48                 0x00, 0x50, 0xf2, 0x01  // authentication
  49                 };
  50
  51 UCHAR   CipherWpa2Template[] = {
  52                 0x30,                                   // RSN IE
  53                 0x14,                                   // Length
  54                 0x01, 0x00,                             // Version
  55                 0x00, 0x0f, 0xac, 0x02, // group cipher, TKIP
  56                 0x01, 0x00,                             // number of pairwise
  57                 0x00, 0x0f, 0xac, 0x02, // unicast
  58                 0x01, 0x00,                             // number of authentication method
  59                 0x00, 0x0f, 0xac, 0x02, // authentication
  60                 0x00, 0x00,                             // RSN capability
  61                 };
  62
  63 UCHAR   Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02};
  64
  65 /*
  66         ==========================================================================
  67         Description:
  68                 association state machine init, including state transition and timer init
  69         Parameters:
  70                 S - pointer to the association state machine
  71
  72         IRQL = PASSIVE_LEVEL
  73
  74         ==========================================================================
  75  */
  76 VOID AssocStateMachineInit(
  77         IN      PRTMP_ADAPTER   pAd,
  78         IN  STATE_MACHINE *S,
  79         OUT STATE_MACHINE_FUNC Trans[])
  80 {
  81         StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG, (STATE_MACHINE_FUNC)Drop, ASSOC_IDLE, ASSOC_MACHINE_BASE);
  82
  83         // first column
  84         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)MlmeAssocReqAction);
  85         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)MlmeReassocReqAction);
  86         StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)MlmeDisassocReqAction);
  87         StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
  88
  89         // second column
  90         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
  91         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
  92         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
  93         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
  94         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
  95         //
  96         // Patch 3Com AP MOde:3CRWE454G72
  97         // We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp.
  98         //
  99         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
 100         StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT, (STATE_MACHINE_FUNC)AssocTimeoutAction);
 101
 102         // third column
 103         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
 104         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
 105         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
 106         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
 107         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
 108         //
 109         // Patch, AP doesn't send Reassociate Rsp frame to Station.
 110         //
 111         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
 112         StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT, (STATE_MACHINE_FUNC)ReassocTimeoutAction);
 113
 114         // fourth column
 115         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
 116         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
 117         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
 118         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
 119         StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT, (STATE_MACHINE_FUNC)DisassocTimeoutAction);
 120
 121         // initialize the timer
 122         RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer, GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
 123         RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer, GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
 124         RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer, GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
 125 }
 126
 127 /*
 128         ==========================================================================
 129         Description:
 130                 Association timeout procedure. After association timeout, this function
 131                 will be called and it will put a message into the MLME queue
 132         Parameters:
 133                 Standard timer parameters
 134
 135         IRQL = DISPATCH_LEVEL
 136
 137         ==========================================================================
 138  */
 139 VOID AssocTimeout(IN PVOID SystemSpecific1,
 140                                  IN PVOID FunctionContext,
 141                                  IN PVOID SystemSpecific2,
 142                                  IN PVOID SystemSpecific3)
 143 {
 144         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 145
 146         // Do nothing if the driver is starting halt state.
 147         // This might happen when timer already been fired before cancel timer with mlmehalt
 148         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 149                 return;
 150
 151         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
 152         RT28XX_MLME_HANDLER(pAd);
 153 }
 154
 155 /*
 156         ==========================================================================
 157         Description:
 158                 Reassociation timeout procedure. After reassociation timeout, this
 159                 function will be called and put a message into the MLME queue
 160         Parameters:
 161                 Standard timer parameters
 162
 163         IRQL = DISPATCH_LEVEL
 164
 165         ==========================================================================
 166  */
 167 VOID ReassocTimeout(IN PVOID SystemSpecific1,
 168                                         IN PVOID FunctionContext,
 169                                         IN PVOID SystemSpecific2,
 170                                         IN PVOID SystemSpecific3)
 171 {
 172         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 173
 174         // Do nothing if the driver is starting halt state.
 175         // This might happen when timer already been fired before cancel timer with mlmehalt
 176         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 177                 return;
 178
 179         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
 180         RT28XX_MLME_HANDLER(pAd);
 181 }
 182
 183 /*
 184         ==========================================================================
 185         Description:
 186                 Disassociation timeout procedure. After disassociation timeout, this
 187                 function will be called and put a message into the MLME queue
 188         Parameters:
 189                 Standard timer parameters
 190
 191         IRQL = DISPATCH_LEVEL
 192
 193         ==========================================================================
 194  */
 195 VOID DisassocTimeout(IN PVOID SystemSpecific1,
 196                                         IN PVOID FunctionContext,
 197                                         IN PVOID SystemSpecific2,
 198                                         IN PVOID SystemSpecific3)
 199 {
 200         RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
 201
 202         // Do nothing if the driver is starting halt state.
 203         // This might happen when timer already been fired before cancel timer with mlmehalt
 204         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 205                 return;
 206
 207         MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
 208         RT28XX_MLME_HANDLER(pAd);
 209 }
 210
 211 /*
 212         ==========================================================================
 213         Description:
 214                 mlme assoc req handling procedure
 215         Parameters:
 216                 Adapter - Adapter pointer
 217                 Elem - MLME Queue Element
 218         Pre:
 219                 the station has been authenticated and the following information is stored in the config
 220                         -# SSID
 221                         -# supported rates and their length
 222                         -# listen interval (Adapter->StaCfg.default_listen_count)
 223                         -# Transmit power  (Adapter->StaCfg.tx_power)
 224         Post  :
 225                 -# An association request frame is generated and sent to the air
 226                 -# Association timer starts
 227                 -# Association state -> ASSOC_WAIT_RSP
 228
 229         IRQL = DISPATCH_LEVEL
 230
 231         ==========================================================================
 232  */
 233 VOID MlmeAssocReqAction(
 234         IN PRTMP_ADAPTER pAd,
 235         IN MLME_QUEUE_ELEM *Elem)
 236 {
 237         UCHAR                   ApAddr[6];
 238         HEADER_802_11   AssocHdr;
 239         UCHAR                   Ccx2Len = 5;
 240         UCHAR                   WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
 241         USHORT                  ListenIntv;
 242         ULONG                   Timeout;
 243         USHORT                  CapabilityInfo;
 244         BOOLEAN                 TimerCancelled;
 245         PUCHAR                  pOutBuffer = NULL;
 246         NDIS_STATUS             NStatus;
 247         ULONG                   FrameLen = 0;
 248         ULONG                   tmp;
 249         USHORT                  VarIesOffset;
 250         UCHAR                   CkipFlag;
 251         UCHAR                   CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH];
 252         UCHAR                   AironetCkipIe = IE_AIRONET_CKIP;
 253         UCHAR                   AironetCkipLen = CKIP_NEGOTIATION_LENGTH;
 254         UCHAR                   AironetIPAddressIE = IE_AIRONET_IPADDRESS;
 255         UCHAR                   AironetIPAddressLen = AIRONET_IPADDRESS_LENGTH;
 256         UCHAR                   AironetIPAddressBuffer[AIRONET_IPADDRESS_LENGTH] = {0x00, 0x40, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
 257         USHORT                  Status;
 258
 259         // Block all authentication request durning WPA block period
 260         if (pAd->StaCfg.bBlockAssoc == TRUE)
 261         {
 262                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block Assoc request durning WPA block period!\n"));
 263                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 264                 Status = MLME_STATE_MACHINE_REJECT;
 265                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 266         }
 267         // check sanity first
 268         else if (MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
 269         {
 270                 RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
 271                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 272
 273                 // Get an unused nonpaged memory
 274                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
 275                 if (NStatus != NDIS_STATUS_SUCCESS)
 276                 {
 277                         DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
 278                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 279                         Status = MLME_FAIL_NO_RESOURCE;
 280                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 281                         return;
 282                 }
 283
 284                 // Add by James 03/06/27
 285                 pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 286                 // Association don't need to report MAC address
 287                 pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
 288                         NDIS_802_11_AI_REQFI_CAPABILITIES | NDIS_802_11_AI_REQFI_LISTENINTERVAL;
 289                 pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities = CapabilityInfo;
 290                 pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval = ListenIntv;
 291                 // Only reassociate need this
 292                 //COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr);
 293                 pAd->StaCfg.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
 294
 295         NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
 296                 // First add SSID
 297                 VarIesOffset = 0;
 298                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe, 1);
 299                 VarIesOffset += 1;
 300                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SsidLen, 1);
 301                 VarIesOffset += 1;
 302                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
 303                 VarIesOffset += pAd->MlmeAux.SsidLen;
 304
 305                 // Second add Supported rates
 306                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe, 1);
 307                 VarIesOffset += 1;
 308                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SupRateLen, 1);
 309                 VarIesOffset += 1;
 310                 NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
 311                 VarIesOffset += pAd->MlmeAux.SupRateLen;
 312                 // End Add by James
 313
 314         if ((pAd->CommonCfg.Channel > 14) &&
 315             (pAd->CommonCfg.bIEEE80211H == TRUE))
 316             CapabilityInfo |= 0x0100;
 317
 318                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
 319                 MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr, ApAddr);
 320
 321                 // Build basic frame first
 322                 MakeOutgoingFrame(pOutBuffer,                           &FrameLen,
 323                                                   sizeof(HEADER_802_11),        &AssocHdr,
 324                                                   2,                                            &CapabilityInfo,
 325                                                   2,                                            &ListenIntv,
 326                                                   1,                                            &SsidIe,
 327                                                   1,                                            &pAd->MlmeAux.SsidLen,
 328                                                   pAd->MlmeAux.SsidLen,         pAd->MlmeAux.Ssid,
 329                                                   1,                                            &SupRateIe,
 330                                                   1,                                            &pAd->MlmeAux.SupRateLen,
 331                                                   pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
 332                                                   END_OF_ARGS);
 333
 334                 if (pAd->MlmeAux.ExtRateLen != 0)
 335                 {
 336                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 337                                                           1,                        &ExtRateIe,
 338                                                           1,                        &pAd->MlmeAux.ExtRateLen,
 339                                                           pAd->MlmeAux.ExtRateLen,  pAd->MlmeAux.ExtRate,
 340                                                           END_OF_ARGS);
 341                         FrameLen += tmp;
 342                 }
 343
 344 #ifdef DOT11_N_SUPPORT
 345                 // HT
 346                 if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
 347                 {
 348                         ULONG TmpLen;
 349                         UCHAR HtLen;
 350                         UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
 351                         if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
 352                         {
 353                                 HtLen = SIZE_HT_CAP_IE + 4;
 354                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 355                                                           1,                                &WpaIe,
 356                                                           1,                                &HtLen,
 357                                                           4,                                &BROADCOM[0],
 358                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 359                                                           END_OF_ARGS);
 360                         }
 361                         else
 362                         {
 363                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 364                                                           1,                                &HtCapIe,
 365                                                           1,                                &pAd->MlmeAux.HtCapabilityLen,
 366                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 367                                                           END_OF_ARGS);
 368                         }
 369                         FrameLen += TmpLen;
 370                 }
 371 #endif // DOT11_N_SUPPORT //
 372
 373                 // add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
 374                 // Case I: (Aggregation + Piggy-Back)
 375                 // 1. user enable aggregation, AND
 376                 // 2. Mac support piggy-back
 377                 // 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
 378                 // Case II: (Aggregation)
 379                 // 1. user enable aggregation, AND
 380                 // 2. AP annouces it's AGGREGATION-capable in BEACON
 381                 if (pAd->CommonCfg.bAggregationCapable)
 382                 {
 383                         if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
 384                         {
 385                                 ULONG TmpLen;
 386                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
 387                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 388                                                                   9,                             RalinkIe,
 389                                                                   END_OF_ARGS);
 390                                 FrameLen += TmpLen;
 391                         }
 392                         else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
 393                         {
 394                                 ULONG TmpLen;
 395                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
 396                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 397                                                                   9,                             RalinkIe,
 398                                                                   END_OF_ARGS);
 399                                 FrameLen += TmpLen;
 400                         }
 401                 }
 402                 else
 403                 {
 404                         ULONG TmpLen;
 405                         UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06, 0x00, 0x00, 0x00};
 406                         MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 407                                                           9,                                             RalinkIe,
 408                                                           END_OF_ARGS);
 409                         FrameLen += TmpLen;
 410                 }
 411
 412                 if (pAd->MlmeAux.APEdcaParm.bValid)
 413                 {
 414                         if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
 415                         {
 416                                 QBSS_STA_INFO_PARM QosInfo;
 417
 418                                 NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
 419                                 QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 420                                 QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 421                                 QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 422                                 QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
 423                                 QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
 424                                 WmeIe[8] |= *(PUCHAR)&QosInfo;
 425                         }
 426                         else
 427                         {
 428                 // The Parameter Set Count is set to ¡§0¡¨ in the association request frames
 429                 // WmeIe[8] |= (pAd->MlmeAux.APEdcaParm.EdcaUpdateCount & 0x0f);
 430                         }
 431
 432                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 433                                                           9,                        &WmeIe[0],
 434                                                           END_OF_ARGS);
 435                         FrameLen += tmp;
 436                 }
 437
 438                 //
 439                 // Let WPA(#221) Element ID on the end of this association frame.
 440                 // Otherwise some AP will fail on parsing Element ID and set status fail on Assoc Rsp.
 441                 // For example: Put Vendor Specific IE on the front of WPA IE.
 442                 // This happens on AP (Model No:Linksys WRK54G)
 443                 //
 444                 if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
 445             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
 446             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
 447             (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
 448                         )
 449             )
 450                 {
 451                         UCHAR RSNIe = IE_WPA;
 452
 453                         if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
 454                 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
 455                         {
 456                                 RSNIe = IE_WPA2;
 457                         }
 458
 459             RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
 460
 461             // Check for WPA PMK cache list
 462                         if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
 463                         {
 464                             INT     idx;
 465                 BOOLEAN FoundPMK = FALSE;
 466                                 // Search chched PMKID, append it if existed
 467                                 for (idx = 0; idx < PMKID_NO; idx++)
 468                                 {
 469                                         if (NdisEqualMemory(ApAddr, &pAd->StaCfg.SavedPMK[idx].BSSID, 6))
 470                                         {
 471                                                 FoundPMK = TRUE;
 472                                                 break;
 473                                         }
 474                                 }
 475
 476                                 if (FoundPMK)
 477                                 {
 478                                         // Set PMK number
 479                                         *(PUSHORT) &pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len] = 1;
 480                                         NdisMoveMemory(&pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len + 2], &pAd->StaCfg.SavedPMK[idx].PMKID, 16);
 481                     pAd->StaCfg.RSNIE_Len += 18;
 482                                 }
 483                         }
 484
 485                         {
 486                                 MakeOutgoingFrame(pOutBuffer + FrameLen,                &tmp,
 487                                                         1,                              &RSNIe,
 488                                                 1,                              &pAd->StaCfg.RSNIE_Len,
 489                                                 pAd->StaCfg.RSNIE_Len,                  pAd->StaCfg.RSN_IE,
 490                                                 END_OF_ARGS);
 491                         }
 492
 493                         FrameLen += tmp;
 494
 495                         {
 496                     // Append Variable IE
 497                     NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &RSNIe, 1);
 498                     VarIesOffset += 1;
 499                     NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->StaCfg.RSNIE_Len, 1);
 500                     VarIesOffset += 1;
 501                         }
 502                         NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
 503                         VarIesOffset += pAd->StaCfg.RSNIE_Len;
 504
 505                         // Set Variable IEs Length
 506                         pAd->StaCfg.ReqVarIELen = VarIesOffset;
 507                 }
 508
 509                 // We have update that at PeerBeaconAtJoinRequest()
 510                 CkipFlag = pAd->StaCfg.CkipFlag;
 511                 if (CkipFlag != 0)
 512                 {
 513                         NdisZeroMemory(CkipNegotiationBuffer, CKIP_NEGOTIATION_LENGTH);
 514                         CkipNegotiationBuffer[2] = 0x66;
 515                         // Make it try KP & MIC, since we have to follow the result from AssocRsp
 516                         CkipNegotiationBuffer[8] = 0x18;
 517                         CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH - 1] = 0x22;
 518                         CkipFlag = 0x18;
 519
 520                         MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 521                                                 1,                                                              &AironetCkipIe,
 522                                                 1,                                                              &AironetCkipLen,
 523                                                 AironetCkipLen,                                 CkipNegotiationBuffer,
 524                                                 END_OF_ARGS);
 525                         FrameLen += tmp;
 526                 }
 527
 528                 // Add CCX v2 request if CCX2 admin state is on
 529                 if (pAd->StaCfg.CCXControl.field.Enable == 1)
 530                 {
 531
 532                         //
 533                         // Add AironetIPAddressIE for Cisco CCX 2.X
 534                         // Add CCX Version
 535                         //
 536                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 537                                                 1,                                                      &AironetIPAddressIE,
 538                                                 1,                                                      &AironetIPAddressLen,
 539                                                 AironetIPAddressLen,            AironetIPAddressBuffer,
 540                                                 1,                                                      &Ccx2Ie,
 541                                                 1,                                                      &Ccx2Len,
 542                                                 Ccx2Len,                                    Ccx2IeInfo,
 543                                                 END_OF_ARGS);
 544                         FrameLen += tmp;
 545
 546                         // Add by James 03/06/27
 547                         // Set Variable IEs Length
 548                         pAd->StaCfg.ReqVarIELen = VarIesOffset;
 549                         pAd->StaCfg.AssocInfo.RequestIELength = VarIesOffset;
 550
 551                         // OffsetResponseIEs follow ReqVarIE
 552                         pAd->StaCfg.AssocInfo.OffsetResponseIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION) + pAd->StaCfg.ReqVarIELen;
 553                         // End Add by James
 554                 }
 555
 556
 557                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 558                 MlmeFreeMemory(pAd, pOutBuffer);
 559
 560                 RTMPSetTimer(&pAd->MlmeAux.AssocTimer, Timeout);
 561                 pAd->Mlme.AssocMachine.CurrState = ASSOC_WAIT_RSP;
 562         }
 563         else
 564         {
 565                 DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() sanity check failed. BUG!!!!!! \n"));
 566                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 567                 Status = MLME_INVALID_FORMAT;
 568                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 569         }
 570
 571 }
 572
 573 /*
 574         ==========================================================================
 575         Description:
 576                 mlme reassoc req handling procedure
 577         Parameters:
 578                 Elem -
 579         Pre:
 580                 -# SSID  (Adapter->StaCfg.ssid[])
 581                 -# BSSID (AP address, Adapter->StaCfg.bssid)
 582                 -# Supported rates (Adapter->StaCfg.supported_rates[])
 583                 -# Supported rates length (Adapter->StaCfg.supported_rates_len)
 584                 -# Tx power (Adapter->StaCfg.tx_power)
 585
 586         IRQL = DISPATCH_LEVEL
 587
 588         ==========================================================================
 589  */
 590 VOID MlmeReassocReqAction(
 591         IN PRTMP_ADAPTER pAd,
 592         IN MLME_QUEUE_ELEM *Elem)
 593 {
 594         UCHAR                   ApAddr[6];
 595         HEADER_802_11   ReassocHdr;
 596         UCHAR                   Ccx2Len = 5;
 597         UCHAR                   WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
 598         USHORT                  CapabilityInfo, ListenIntv;
 599         ULONG                   Timeout;
 600         ULONG                   FrameLen = 0;
 601         BOOLEAN                 TimerCancelled;
 602         NDIS_STATUS             NStatus;
 603         ULONG                   tmp;
 604         PUCHAR                  pOutBuffer = NULL;
 605         USHORT                  Status;
 606
 607         // Block all authentication request durning WPA block period
 608         if (pAd->StaCfg.bBlockAssoc == TRUE)
 609         {
 610                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block ReAssoc request durning WPA block period!\n"));
 611                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 612                 Status = MLME_STATE_MACHINE_REJECT;
 613                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 614         }
 615         // the parameters are the same as the association
 616         else if(MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
 617         {
 618                 RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
 619
 620                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
 621                 if(NStatus != NDIS_STATUS_SUCCESS)
 622                 {
 623                         DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() allocate memory failed \n"));
 624                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 625                         Status = MLME_FAIL_NO_RESOURCE;
 626                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 627                         return;
 628                 }
 629
 630                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 631
 632                 // make frame, use bssid as the AP address??
 633                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send RE-ASSOC request...\n"));
 634                 MgtMacHeaderInit(pAd, &ReassocHdr, SUBTYPE_REASSOC_REQ, 0, ApAddr, ApAddr);
 635                 MakeOutgoingFrame(pOutBuffer,               &FrameLen,
 636                                                   sizeof(HEADER_802_11),    &ReassocHdr,
 637                                                   2,                        &CapabilityInfo,
 638                                                   2,                        &ListenIntv,
 639                                                   MAC_ADDR_LEN,             ApAddr,
 640                                                   1,                        &SsidIe,
 641                                                   1,                        &pAd->MlmeAux.SsidLen,
 642                                                   pAd->MlmeAux.SsidLen,     pAd->MlmeAux.Ssid,
 643                                                   1,                        &SupRateIe,
 644                                                   1,                                            &pAd->MlmeAux.SupRateLen,
 645                                                   pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
 646                                                   END_OF_ARGS);
 647
 648                 if (pAd->MlmeAux.ExtRateLen != 0)
 649                 {
 650                         MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
 651                                                           1,                            &ExtRateIe,
 652                                                           1,                            &pAd->MlmeAux.ExtRateLen,
 653                                                           pAd->MlmeAux.ExtRateLen,          pAd->MlmeAux.ExtRate,
 654                                                           END_OF_ARGS);
 655                         FrameLen += tmp;
 656                 }
 657
 658                 if (pAd->MlmeAux.APEdcaParm.bValid)
 659                 {
 660                         if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
 661                         {
 662                                 QBSS_STA_INFO_PARM QosInfo;
 663
 664                                 NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
 665                                 QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 666                                 QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 667                                 QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 668                                 QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
 669                                 QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
 670                                 WmeIe[8] |= *(PUCHAR)&QosInfo;
 671                         }
 672
 673                         MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
 674                                                           9,                        &WmeIe[0],
 675                                                           END_OF_ARGS);
 676                         FrameLen += tmp;
 677                 }
 678
 679 #ifdef DOT11_N_SUPPORT
 680                 // HT
 681                 if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
 682                 {
 683                         ULONG TmpLen;
 684                         UCHAR HtLen;
 685                         UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
 686                         if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
 687                         {
 688                                 HtLen = SIZE_HT_CAP_IE + 4;
 689                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 690                                                           1,                                &WpaIe,
 691                                                           1,                                &HtLen,
 692                                                           4,                                &BROADCOM[0],
 693                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 694                                                           END_OF_ARGS);
 695                         }
 696                         else
 697                         {
 698                                 MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
 699                                                           1,                                &HtCapIe,
 700                                                           1,                                &pAd->MlmeAux.HtCapabilityLen,
 701                                                          pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
 702                                                           END_OF_ARGS);
 703                         }
 704                         FrameLen += TmpLen;
 705                 }
 706 #endif // DOT11_N_SUPPORT //
 707
 708                 // add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
 709                 // Case I: (Aggregation + Piggy-Back)
 710                 // 1. user enable aggregation, AND
 711                 // 2. Mac support piggy-back
 712                 // 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
 713                 // Case II: (Aggregation)
 714                 // 1. user enable aggregation, AND
 715                 // 2. AP annouces it's AGGREGATION-capable in BEACON
 716                 if (pAd->CommonCfg.bAggregationCapable)
 717                 {
 718                         if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
 719                         {
 720                                 ULONG TmpLen;
 721                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
 722                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 723                                                                   9,                             RalinkIe,
 724                                                                   END_OF_ARGS);
 725                                 FrameLen += TmpLen;
 726                         }
 727                         else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
 728                         {
 729                                 ULONG TmpLen;
 730                                 UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
 731                                 MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 732                                                                   9,                             RalinkIe,
 733                                                                   END_OF_ARGS);
 734                                 FrameLen += TmpLen;
 735                         }
 736                 }
 737                 else
 738                 {
 739                         ULONG TmpLen;
 740                         UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x04, 0x00, 0x00, 0x00};
 741                         MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
 742                                                           9,                                             RalinkIe,
 743                                                           END_OF_ARGS);
 744                         FrameLen += TmpLen;
 745                 }
 746
 747                 // Add CCX v2 request if CCX2 admin state is on
 748                 if (pAd->StaCfg.CCXControl.field.Enable == 1)
 749                 {
 750                         //
 751                         // Add CCX Version
 752                         //
 753                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 754                                                 1,                                                      &Ccx2Ie,
 755                                                 1,                                                      &Ccx2Len,
 756                                                 Ccx2Len,                                    Ccx2IeInfo,
 757                                                 END_OF_ARGS);
 758                         FrameLen += tmp;
 759                 }
 760
 761                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 762                 MlmeFreeMemory(pAd, pOutBuffer);
 763
 764                 RTMPSetTimer(&pAd->MlmeAux.ReassocTimer, Timeout); /* in mSec */
 765                 pAd->Mlme.AssocMachine.CurrState = REASSOC_WAIT_RSP;
 766         }
 767         else
 768         {
 769                 DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() sanity check failed. BUG!!!! \n"));
 770                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 771                 Status = MLME_INVALID_FORMAT;
 772                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 773         }
 774 }
 775
 776 /*
 777         ==========================================================================
 778         Description:
 779                 Upper layer issues disassoc request
 780         Parameters:
 781                 Elem -
 782
 783         IRQL = PASSIVE_LEVEL
 784
 785         ==========================================================================
 786  */
 787 VOID MlmeDisassocReqAction(
 788         IN PRTMP_ADAPTER pAd,
 789         IN MLME_QUEUE_ELEM *Elem)
 790 {
 791         PMLME_DISASSOC_REQ_STRUCT pDisassocReq;
 792         HEADER_802_11         DisassocHdr;
 793         PHEADER_802_11        pDisassocHdr;
 794         PUCHAR                pOutBuffer = NULL;
 795         ULONG                 FrameLen = 0;
 796         NDIS_STATUS           NStatus;
 797         BOOLEAN               TimerCancelled;
 798         ULONG                 Timeout = 0;
 799         USHORT                Status;
 800
 801         // skip sanity check
 802         pDisassocReq = (PMLME_DISASSOC_REQ_STRUCT)(Elem->Msg);
 803
 804         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
 805         if (NStatus != NDIS_STATUS_SUCCESS)
 806         {
 807                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - MlmeDisassocReqAction() allocate memory failed\n"));
 808                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 809                 Status = MLME_FAIL_NO_RESOURCE;
 810                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
 811                 return;
 812         }
 813
 814
 815
 816         RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &TimerCancelled);
 817
 818         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send DISASSOC request[BSSID::%02x:%02x:%02x:%02x:%02x:%02x (Reason=%d)\n",
 819                                 pDisassocReq->Addr[0], pDisassocReq->Addr[1], pDisassocReq->Addr[2],
 820                                 pDisassocReq->Addr[3], pDisassocReq->Addr[4], pDisassocReq->Addr[5], pDisassocReq->Reason));
 821         MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pDisassocReq->Addr, pDisassocReq->Addr);       // patch peap ttls switching issue
 822         MakeOutgoingFrame(pOutBuffer,           &FrameLen,
 823                                           sizeof(HEADER_802_11),&DisassocHdr,
 824                                           2,                    &pDisassocReq->Reason,
 825                                           END_OF_ARGS);
 826         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 827
 828         // To patch Instance and Buffalo(N) AP
 829         // Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
 830         // Therefore, we send both of them.
 831         pDisassocHdr = (PHEADER_802_11)pOutBuffer;
 832         pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
 833         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 834
 835         MlmeFreeMemory(pAd, pOutBuffer);
 836
 837         pAd->StaCfg.DisassocReason = REASON_DISASSOC_STA_LEAVING;
 838         COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pDisassocReq->Addr);
 839
 840         RTMPSetTimer(&pAd->MlmeAux.DisassocTimer, Timeout); /* in mSec */
 841         pAd->Mlme.AssocMachine.CurrState = DISASSOC_WAIT_RSP;
 842
 843     {
 844         union iwreq_data    wrqu;
 845         memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
 846         wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
 847     }
 848 }
 849
 850 /*
 851         ==========================================================================
 852         Description:
 853                 peer sends assoc rsp back
 854         Parameters:
 855                 Elme - MLME message containing the received frame
 856
 857         IRQL = DISPATCH_LEVEL
 858
 859         ==========================================================================
 860  */
 861 VOID PeerAssocRspAction(
 862         IN PRTMP_ADAPTER pAd,
 863         IN MLME_QUEUE_ELEM *Elem)
 864 {
 865         USHORT        CapabilityInfo, Status, Aid;
 866         UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
 867         UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
 868         UCHAR         Addr2[MAC_ADDR_LEN];
 869         BOOLEAN       TimerCancelled;
 870         UCHAR         CkipFlag;
 871         EDCA_PARM     EdcaParm;
 872         HT_CAPABILITY_IE                HtCapability;
 873         ADD_HT_INFO_IE          AddHtInfo;      // AP might use this additional ht info IE
 874         UCHAR                   HtCapabilityLen;
 875         UCHAR                   AddHtInfoLen;
 876         UCHAR                   NewExtChannelOffset = 0xff;
 877
 878         if (PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
 879                 &HtCapability,&AddHtInfo, &HtCapabilityLen,&AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
 880         {
 881                 // The frame is for me ?
 882                 if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid))
 883                 {
 884                         DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():ASSOC - receive ASSOC_RSP to me (status=%d)\n", Status));
 885 #ifdef DOT11_N_SUPPORT
 886                         DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():MacTable [%d].AMsduSize = %d. ClientStatusFlags = 0x%lx \n",Elem->Wcid, pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
 887 #endif // DOT11_N_SUPPORT //
 888                         RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
 889                         if(Status == MLME_SUCCESS)
 890                         {
 891                                 // go to procedure listed on page 376
 892                                 AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
 893                                         &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
 894
 895                 {
 896                     union iwreq_data    wrqu;
 897                     wext_notify_event_assoc(pAd);
 898
 899                     memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
 900                     memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
 901                     wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
 902
 903                 }
 904
 905                                 pAd->StaCfg.CkipFlag = CkipFlag;
 906                                 if (CkipFlag & 0x18)
 907                                 {
 908                                         NdisZeroMemory(pAd->StaCfg.TxSEQ, 4);
 909                                         NdisZeroMemory(pAd->StaCfg.RxSEQ, 4);
 910                                         NdisZeroMemory(pAd->StaCfg.CKIPMIC, 4);
 911                                         pAd->StaCfg.GIV[0] = RandomByte(pAd);
 912                                         pAd->StaCfg.GIV[1] = RandomByte(pAd);
 913                                         pAd->StaCfg.GIV[2] = RandomByte(pAd);
 914                                         pAd->StaCfg.bCkipOn = TRUE;
 915                                         DBGPRINT(RT_DEBUG_TRACE, ("<CCX> pAd->StaCfg.CkipFlag = 0x%02x\n", pAd->StaCfg.CkipFlag));
 916                                 }
 917                         }
 918                         else
 919                         {
 920                         }
 921                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 922                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 923                 }
 924         }
 925         else
 926         {
 927                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerAssocRspAction() sanity check fail\n"));
 928         }
 929 }
 930
 931 /*
 932         ==========================================================================
 933         Description:
 934                 peer sends reassoc rsp
 935         Parametrs:
 936                 Elem - MLME message cntaining the received frame
 937
 938         IRQL = DISPATCH_LEVEL
 939
 940         ==========================================================================
 941  */
 942 VOID PeerReassocRspAction(
 943         IN PRTMP_ADAPTER pAd,
 944         IN MLME_QUEUE_ELEM *Elem)
 945 {
 946         USHORT      CapabilityInfo;
 947         USHORT      Status;
 948         USHORT      Aid;
 949         UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
 950         UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
 951         UCHAR       Addr2[MAC_ADDR_LEN];
 952         UCHAR       CkipFlag;
 953         BOOLEAN     TimerCancelled;
 954         EDCA_PARM   EdcaParm;
 955         HT_CAPABILITY_IE                HtCapability;
 956         ADD_HT_INFO_IE          AddHtInfo;      // AP might use this additional ht info IE
 957         UCHAR                   HtCapabilityLen;
 958         UCHAR                   AddHtInfoLen;
 959         UCHAR                   NewExtChannelOffset = 0xff;
 960
 961         if(PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
 962                                                                 &HtCapability,  &AddHtInfo, &HtCapabilityLen, &AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
 963         {
 964                 if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid)) // The frame is for me ?
 965                 {
 966                         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - receive REASSOC_RSP to me (status=%d)\n", Status));
 967                         RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
 968
 969                         if(Status == MLME_SUCCESS)
 970                         {
 971                                 // go to procedure listed on page 376
 972                                 AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
 973                                          &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
 974
 975                 {
 976                     union iwreq_data    wrqu;
 977                     wext_notify_event_assoc(pAd);
 978
 979                     memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
 980                     memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
 981                     wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
 982
 983                 }
 984
 985                         }
 986
 987                         {
 988                                 // CkipFlag is no use for reassociate
 989                                 pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 990                                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 991                         }
 992                 }
 993         }
 994         else
 995         {
 996                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerReassocRspAction() sanity check fail\n"));
 997         }
 998
 999 }
1000
1001 /*
1002         ==========================================================================
1003         Description:
1004                 procedures on IEEE 802.11/1999 p.376
1005         Parametrs:
1006
1007         IRQL = DISPATCH_LEVEL
1008
1009         ==========================================================================
1010  */
1011 VOID AssocPostProc(
1012         IN PRTMP_ADAPTER pAd,
1013         IN PUCHAR pAddr2,
1014         IN USHORT CapabilityInfo,
1015         IN USHORT Aid,
1016         IN UCHAR SupRate[],
1017         IN UCHAR SupRateLen,
1018         IN UCHAR ExtRate[],
1019         IN UCHAR ExtRateLen,
1020         IN PEDCA_PARM pEdcaParm,
1021         IN HT_CAPABILITY_IE             *pHtCapability,
1022         IN UCHAR HtCapabilityLen,
1023         IN ADD_HT_INFO_IE               *pAddHtInfo)    // AP might use this additional ht info IE
1024 {
1025         ULONG Idx;
1026
1027         pAd->MlmeAux.BssType = BSS_INFRA;
1028         COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pAddr2);
1029         pAd->MlmeAux.Aid = Aid;
1030         pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
1031 #ifdef DOT11_N_SUPPORT
1032         // Some HT AP might lost WMM IE. We add WMM ourselves. beacuase HT requires QoS on.
1033         if ((HtCapabilityLen > 0) && (pEdcaParm->bValid == FALSE))
1034         {
1035                 pEdcaParm->bValid = TRUE;
1036                 pEdcaParm->Aifsn[0] = 3;
1037                 pEdcaParm->Aifsn[1] = 7;
1038                 pEdcaParm->Aifsn[2] = 2;
1039                 pEdcaParm->Aifsn[3] = 2;
1040
1041                 pEdcaParm->Cwmin[0] = 4;
1042                 pEdcaParm->Cwmin[1] = 4;
1043                 pEdcaParm->Cwmin[2] = 3;
1044                 pEdcaParm->Cwmin[3] = 2;
1045
1046                 pEdcaParm->Cwmax[0] = 10;
1047                 pEdcaParm->Cwmax[1] = 10;
1048                 pEdcaParm->Cwmax[2] = 4;
1049                 pEdcaParm->Cwmax[3] = 3;
1050
1051                 pEdcaParm->Txop[0]  = 0;
1052                 pEdcaParm->Txop[1]  = 0;
1053                 pEdcaParm->Txop[2]  = 96;
1054                 pEdcaParm->Txop[3]  = 48;
1055
1056         }
1057 #endif // DOT11_N_SUPPORT //
1058
1059         NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
1060
1061         // filter out un-supported rates
1062         pAd->MlmeAux.SupRateLen = SupRateLen;
1063         NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
1064         RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
1065
1066         // filter out un-supported rates
1067         pAd->MlmeAux.ExtRateLen = ExtRateLen;
1068         NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
1069         RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
1070
1071 #ifdef DOT11_N_SUPPORT
1072         if (HtCapabilityLen > 0)
1073         {
1074                 RTMPCheckHt(pAd, BSSID_WCID, pHtCapability, pAddHtInfo);
1075         }
1076         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>  AP.AMsduSize = %d. ClientStatusFlags = 0x%lx \n", pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
1077
1078         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>    (Mmps=%d, AmsduSize=%d, )\n",
1079                 pAd->MacTab.Content[BSSID_WCID].MmpsMode, pAd->MacTab.Content[BSSID_WCID].AMsduSize));
1080 #endif // DOT11_N_SUPPORT //
1081
1082         // Set New WPA information
1083         Idx = BssTableSearch(&pAd->ScanTab, pAddr2, pAd->MlmeAux.Channel);
1084         if (Idx == BSS_NOT_FOUND)
1085         {
1086                 DBGPRINT_ERR(("ASSOC - Can't find BSS after receiving Assoc response\n"));
1087         }
1088         else
1089         {
1090                 // Init variable
1091                 pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = 0;
1092                 NdisZeroMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, MAX_LEN_OF_RSNIE);
1093
1094                 // Store appropriate RSN_IE for WPA SM negotiation later
1095                 if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) && (pAd->ScanTab.BssEntry[Idx].VarIELen != 0))
1096                 {
1097                         PUCHAR              pVIE;
1098                         USHORT              len;
1099                         PEID_STRUCT         pEid;
1100
1101                         pVIE = pAd->ScanTab.BssEntry[Idx].VarIEs;
1102                         len      = pAd->ScanTab.BssEntry[Idx].VarIELen;
1103
1104                         while (len > 0)
1105                         {
1106                                 pEid = (PEID_STRUCT) pVIE;
1107                                 // For WPA/WPAPSK
1108                                 if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
1109                                         && (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
1110                                 {
1111                                         NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
1112                                         pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
1113                                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA SM negotiation \n"));
1114                                 }
1115                                 // For WPA2/WPA2PSK
1116                                 else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
1117                                         && (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2 || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
1118                                 {
1119                                         NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
1120                                         pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
1121                                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA2 SM negotiation \n"));
1122                                 }
1123
1124                                 pVIE += (pEid->Len + 2);
1125                                 len  -= (pEid->Len + 2);
1126                         }
1127                 }
1128
1129                 if (pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == 0)
1130                 {
1131                         DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> no RSN_IE \n"));
1132                 }
1133                 else
1134                 {
1135                         hex_dump("RSN_IE", pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
1136                 }
1137         }
1138 }
1139
1140 /*
1141         ==========================================================================
1142         Description:
1143                 left part of IEEE 802.11/1999 p.374
1144         Parameters:
1145                 Elem - MLME message containing the received frame
1146
1147         IRQL = DISPATCH_LEVEL
1148
1149         ==========================================================================
1150  */
1151 VOID PeerDisassocAction(
1152         IN PRTMP_ADAPTER pAd,
1153         IN MLME_QUEUE_ELEM *Elem)
1154 {
1155         UCHAR         Addr2[MAC_ADDR_LEN];
1156         USHORT        Reason;
1157
1158         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction()\n"));
1159         if(PeerDisassocSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
1160         {
1161                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() Reason = %d\n", Reason));
1162                 if (INFRA_ON(pAd) && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, Addr2))
1163                 {
1164
1165                         if (pAd->CommonCfg.bWirelessEvent)
1166                         {
1167                                 RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
1168                         }
1169
1170                         //
1171                         // Get Current System time and Turn on AdjacentAPReport
1172                         //
1173                         NdisGetSystemUpTime(&pAd->StaCfg.CCXAdjacentAPLinkDownTime);
1174                         pAd->StaCfg.CCXAdjacentAPReportFlag = TRUE;
1175                         LinkDown(pAd, TRUE);
1176                         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1177
1178             {
1179                 union iwreq_data    wrqu;
1180                 memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
1181                 wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
1182             }
1183                 }
1184         }
1185         else
1186         {
1187                 DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() sanity check fail\n"));
1188         }
1189
1190 }
1191
1192 /*
1193         ==========================================================================
1194         Description:
1195                 what the state machine will do after assoc timeout
1196         Parameters:
1197                 Elme -
1198
1199         IRQL = DISPATCH_LEVEL
1200
1201         ==========================================================================
1202  */
1203 VOID AssocTimeoutAction(
1204         IN PRTMP_ADAPTER pAd,
1205         IN MLME_QUEUE_ELEM *Elem)
1206 {
1207         USHORT  Status;
1208         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - AssocTimeoutAction\n"));
1209         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1210         Status = MLME_REJ_TIMEOUT;
1211         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1212 }
1213
1214 /*
1215         ==========================================================================
1216         Description:
1217                 what the state machine will do after reassoc timeout
1218
1219         IRQL = DISPATCH_LEVEL
1220
1221         ==========================================================================
1222  */
1223 VOID ReassocTimeoutAction(
1224         IN PRTMP_ADAPTER pAd,
1225         IN MLME_QUEUE_ELEM *Elem)
1226 {
1227         USHORT  Status;
1228         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - ReassocTimeoutAction\n"));
1229         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1230         Status = MLME_REJ_TIMEOUT;
1231         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1232 }
1233
1234 /*
1235         ==========================================================================
1236         Description:
1237                 what the state machine will do after disassoc timeout
1238
1239         IRQL = DISPATCH_LEVEL
1240
1241         ==========================================================================
1242  */
1243 VOID DisassocTimeoutAction(
1244         IN PRTMP_ADAPTER pAd,
1245         IN MLME_QUEUE_ELEM *Elem)
1246 {
1247         USHORT  Status;
1248         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - DisassocTimeoutAction\n"));
1249         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1250         Status = MLME_SUCCESS;
1251         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
1252 }
1253
1254 VOID InvalidStateWhenAssoc(
1255         IN PRTMP_ADAPTER pAd,
1256         IN MLME_QUEUE_ELEM *Elem)
1257 {
1258         USHORT  Status;
1259         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenAssoc(state=%ld), reset ASSOC state machine\n",
1260                 pAd->Mlme.AssocMachine.CurrState));
1261         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1262         Status = MLME_STATE_MACHINE_REJECT;
1263         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
1264 }
1265
1266 VOID InvalidStateWhenReassoc(
1267         IN PRTMP_ADAPTER pAd,
1268         IN MLME_QUEUE_ELEM *Elem)
1269 {
1270         USHORT Status;
1271         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenReassoc(state=%ld), reset ASSOC state machine\n",
1272                 pAd->Mlme.AssocMachine.CurrState));
1273         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1274         Status = MLME_STATE_MACHINE_REJECT;
1275         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
1276 }
1277
1278 VOID InvalidStateWhenDisassociate(
1279         IN PRTMP_ADAPTER pAd,
1280         IN MLME_QUEUE_ELEM *Elem)
1281 {
1282         USHORT Status;
1283         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenDisassoc(state=%ld), reset ASSOC state machine\n",
1284                 pAd->Mlme.AssocMachine.CurrState));
1285         pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
1286         Status = MLME_STATE_MACHINE_REJECT;
1287         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
1288 }
1289
1290 /*
1291         ==========================================================================
1292         Description:
1293                 right part of IEEE 802.11/1999 page 374
1294         Note:
1295                 This event should never cause ASSOC state machine perform state
1296                 transition, and has no relationship with CNTL machine. So we separate
1297                 this routine as a service outside of ASSOC state transition table.
1298
1299         IRQL = DISPATCH_LEVEL
1300
1301         ==========================================================================
1302  */
1303 VOID Cls3errAction(
1304         IN PRTMP_ADAPTER pAd,
1305         IN PUCHAR        pAddr)
1306 {
1307         HEADER_802_11         DisassocHdr;
1308         PHEADER_802_11        pDisassocHdr;
1309         PUCHAR                pOutBuffer = NULL;
1310         ULONG                 FrameLen = 0;
1311         NDIS_STATUS           NStatus;
1312         USHORT                Reason = REASON_CLS3ERR;
1313
1314         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
1315         if (NStatus != NDIS_STATUS_SUCCESS)
1316                 return;
1317
1318         DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Class 3 Error, Send DISASSOC frame\n"));
1319         MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pAddr, pAd->CommonCfg.Bssid);  // patch peap ttls switching issue
1320         MakeOutgoingFrame(pOutBuffer,           &FrameLen,
1321                                           sizeof(HEADER_802_11),&DisassocHdr,
1322                                           2,                    &Reason,
1323                                           END_OF_ARGS);
1324         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
1325
1326         // To patch Instance and Buffalo(N) AP
1327         // Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
1328         // Therefore, we send both of them.
1329         pDisassocHdr = (PHEADER_802_11)pOutBuffer;
1330         pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
1331         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
1332
1333         MlmeFreeMemory(pAd, pOutBuffer);
1334
1335         pAd->StaCfg.DisassocReason = REASON_CLS3ERR;
1336         COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pAddr);
1337 }
1338
1339  /*
1340          ==========================================================================
1341          Description:
1342                  Switch between WEP and CKIP upon new association up.
1343          Parameters:
1344
1345          IRQL = DISPATCH_LEVEL
1346
1347          ==========================================================================
1348   */
1349 VOID SwitchBetweenWepAndCkip(
1350         IN PRTMP_ADAPTER pAd)
1351 {
1352         int            i;
1353         SHAREDKEY_MODE_STRUC  csr1;
1354
1355         // if KP is required. change the CipherAlg in hardware shard key table from WEP
1356         // to CKIP. else remain as WEP
1357         if (pAd->StaCfg.bCkipOn && (pAd->StaCfg.CkipFlag & 0x10))
1358         {
1359                 // modify hardware key table so that MAC use correct algorithm to decrypt RX
1360                 RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
1361                 if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP64)
1362                         csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP64;
1363                 else if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP128)
1364                         csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP128;
1365
1366                 if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP64)
1367                         csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP64;
1368                 else if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP128)
1369                         csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP128;
1370
1371                 if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP64)
1372                         csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP64;
1373                 else if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP128)
1374                         csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP128;
1375
1376                 if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP64)
1377                         csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP64;
1378                 else if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP128)
1379                         csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP128;
1380                 RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
1381                 DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
1382
1383                 // modify software key table so that driver can specify correct algorithm in TXD upon TX
1384                 for (i=0; i<SHARE_KEY_NUM; i++)
1385                 {
1386                         if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP64)
1387                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP64;
1388                         else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP128)
1389                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP128;
1390                 }
1391         }
1392
1393         // else if KP NOT inused. change the CipherAlg in hardware shard key table from CKIP
1394         // to WEP.
1395         else
1396         {
1397                 // modify hardware key table so that MAC use correct algorithm to decrypt RX
1398                 RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
1399                 if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP64)
1400                         csr1.field.Bss0Key0CipherAlg = CIPHER_WEP64;
1401                 else if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP128)
1402                         csr1.field.Bss0Key0CipherAlg = CIPHER_WEP128;
1403
1404                 if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP64)
1405                         csr1.field.Bss0Key1CipherAlg = CIPHER_WEP64;
1406                 else if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP128)
1407                         csr1.field.Bss0Key1CipherAlg = CIPHER_WEP128;
1408
1409                 if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP64)
1410                         csr1.field.Bss0Key2CipherAlg = CIPHER_WEP64;
1411                 else if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP128)
1412                         csr1.field.Bss0Key2CipherAlg = CIPHER_WEP128;
1413
1414                 if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP64)
1415                         csr1.field.Bss0Key3CipherAlg = CIPHER_WEP64;
1416                 else if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP128)
1417                         csr1.field.Bss0Key3CipherAlg = CIPHER_WEP128;
1418
1419                 // modify software key table so that driver can specify correct algorithm in TXD upon TX
1420                 for (i=0; i<SHARE_KEY_NUM; i++)
1421                 {
1422                         if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP64)
1423                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP64;
1424                         else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP128)
1425                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP128;
1426                 }
1427
1428                 //
1429                 // On WPA-NONE, must update CipherAlg.
1430                 // Because the OID_802_11_WEP_STATUS was been set after OID_802_11_ADD_KEY
1431                 // and CipherAlg will be CIPHER_NONE by Windows ZeroConfig.
1432                 // So we need to update CipherAlg after connect.
1433                 //
1434                 if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
1435                 {
1436                         for (i = 0; i < SHARE_KEY_NUM; i++)
1437                         {
1438                                 if (pAd->SharedKey[BSS0][i].KeyLen != 0)
1439                                 {
1440                                         if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
1441                                         {
1442                                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_TKIP;
1443                                         }
1444                                         else if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
1445                                         {
1446                                                 pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_AES;
1447                                         }
1448                                 }
1449                                 else
1450                                 {
1451                                         pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_NONE;
1452                                 }
1453                         }
1454
1455                         csr1.field.Bss0Key0CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
1456                         csr1.field.Bss0Key1CipherAlg = pAd->SharedKey[BSS0][1].CipherAlg;
1457                         csr1.field.Bss0Key2CipherAlg = pAd->SharedKey[BSS0][2].CipherAlg;
1458                         csr1.field.Bss0Key3CipherAlg = pAd->SharedKey[BSS0][3].CipherAlg;
1459                 }
1460                 RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
1461                 DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
1462         }
1463 }
1464
1465 int wext_notify_event_assoc(
1466         IN  RTMP_ADAPTER *pAd)
1467 {
1468     union iwreq_data    wrqu;
1469     char custom[IW_CUSTOM_MAX] = {0};
1470
1471 #if WIRELESS_EXT > 17
1472     if (pAd->StaCfg.ReqVarIELen <= IW_CUSTOM_MAX)
1473     {
1474         wrqu.data.length = pAd->StaCfg.ReqVarIELen;
1475         memcpy(custom, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
1476         wireless_send_event(pAd->net_dev, IWEVASSOCREQIE, &wrqu, custom);
1477     }
1478     else
1479         DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen > MAX_CUSTOM_LEN\n"));
1480 #else
1481     if (((pAd->StaCfg.ReqVarIELen*2) + 17) <= IW_CUSTOM_MAX)
1482     {
1483         UCHAR   idx;
1484         wrqu.data.length = (pAd->StaCfg.ReqVarIELen*2) + 17;
1485         sprintf(custom, "ASSOCINFO(ReqIEs=");
1486         for (idx=0; idx<pAd->StaCfg.ReqVarIELen; idx++)
1487                 sprintf(custom + strlen(custom), "%02x", pAd->StaCfg.ReqVarIEs[idx]);
1488         wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, custom);
1489     }
1490     else
1491         DBGPRINT(RT_DEBUG_TRACE, ("(pAd->StaCfg.ReqVarIELen*2) + 17 > MAX_CUSTOM_LEN\n"));
1492 #endif
1493
1494         return 0;
1495
1496 }