1 /*
2  *   Driver for KeyStream wireless LAN cards.
3  *
4  *   Copyright (C) 2005-2008 KeyStream Corp.
5  *   Copyright (C) 2009 Renesas Technology Corp.
6  *
7  *   This program is free software; you can redistribute it and/or modify
8  *   it under the terms of the GNU General Public License version 2 as
9  *   published by the Free Software Foundation.
10  */
11 
12 #include "ks_wlan.h"
13 #include "ks_hostif.h"
14 #include "eap_packet.h"
15 #include "michael_mic.h"
16 
17 #include <linux/etherdevice.h>
18 #include <linux/if_ether.h>
19 #include <linux/if_arp.h>
20 
21 /* Include Wireless Extension definition and check version */
22 #include <net/iw_handler.h>	/* New driver API */
23 
24 /* macro */
25 #define inc_smeqhead(priv) \
26 	(priv->sme_i.qhead = (priv->sme_i.qhead + 1) % SME_EVENT_BUFF_SIZE)
27 #define inc_smeqtail(priv) \
28 	(priv->sme_i.qtail = (priv->sme_i.qtail + 1) % SME_EVENT_BUFF_SIZE)
29 #define cnt_smeqbody(priv) \
30 	(((priv->sme_i.qtail + SME_EVENT_BUFF_SIZE) - (priv->sme_i.qhead)) % SME_EVENT_BUFF_SIZE)
31 
32 #define KS_WLAN_MEM_FLAG (GFP_ATOMIC)
33 
34 static
35 inline u8 get_BYTE(struct ks_wlan_private *priv)
36 {
37 	u8 data;
38 
39 	data = *(priv->rxp)++;
40 	/* length check in advance ! */
41 	--(priv->rx_size);
42 	return data;
43 }
44 
45 static
46 inline u16 get_WORD(struct ks_wlan_private *priv)
47 {
48 	u16 data;
49 
50 	data = (get_BYTE(priv) & 0xff);
51 	data |= ((get_BYTE(priv) << 8) & 0xff00);
52 	return data;
53 }
54 
55 static
56 inline u32 get_DWORD(struct ks_wlan_private *priv)
57 {
58 	u32 data;
59 
60 	data = (get_BYTE(priv) & 0xff);
61 	data |= ((get_BYTE(priv) << 8) & 0x0000ff00);
62 	data |= ((get_BYTE(priv) << 16) & 0x00ff0000);
63 	data |= ((get_BYTE(priv) << 24) & 0xff000000);
64 	return data;
65 }
66 
67 static void ks_wlan_hw_wakeup_task(struct work_struct *work)
68 {
69 	struct ks_wlan_private *priv;
70 	int ps_status;
71 	long time_left;
72 
73 	priv = container_of(work, struct ks_wlan_private, wakeup_work);
74 	ps_status = atomic_read(&priv->psstatus.status);
75 
76 	if (ps_status == PS_SNOOZE) {
77 		ks_wlan_hw_wakeup_request(priv);
78 		time_left = wait_for_completion_interruptible_timeout(
79 				&priv->psstatus.wakeup_wait,
80 				msecs_to_jiffies(20));
81 		if (time_left <= 0) {
82 			DPRINTK(1, "wake up timeout or interrupted !!!\n");
83 			schedule_work(&priv->wakeup_work);
84 			return;
85 		}
86 	} else {
87 		DPRINTK(1, "ps_status=%d\n", ps_status);
88 	}
89 
90 	/* power save */
91 	if (atomic_read(&priv->sme_task.count) > 0) {
92 		DPRINTK(4, "sme task enable.\n");
93 		tasklet_enable(&priv->sme_task);
94 	}
95 }
96 
97 static
98 int ks_wlan_do_power_save(struct ks_wlan_private *priv)
99 {
100 	DPRINTK(4, "psstatus.status=%d\n", atomic_read(&priv->psstatus.status));
101 
102 	if (is_connect_status(priv->connect_status))
103 		hostif_sme_enqueue(priv, SME_POW_MNGMT_REQUEST);
104 	else
105 		priv->dev_state = DEVICE_STATE_READY;
106 	return 0;
107 }
108 
109 static
110 int get_current_ap(struct ks_wlan_private *priv, struct link_ap_info_t *ap_info)
111 {
112 	struct local_ap_t *ap;
113 	union iwreq_data wrqu;
114 	struct net_device *netdev = priv->net_dev;
115 
116 	DPRINTK(3, "\n");
117 	ap = &priv->current_ap;
118 
119 	if (is_disconnect_status(priv->connect_status)) {
120 		memset(ap, 0, sizeof(struct local_ap_t));
121 		return -EPERM;
122 	}
123 
124 	/* bssid */
125 	memcpy(ap->bssid, ap_info->bssid, ETH_ALEN);
126 	/* essid */
127 	memcpy(ap->ssid.body, priv->reg.ssid.body,
128 	       priv->reg.ssid.size);
129 	ap->ssid.size = priv->reg.ssid.size;
130 	/* rate_set */
131 	memcpy(ap->rate_set.body, ap_info->rate_set.body,
132 	       ap_info->rate_set.size);
133 	ap->rate_set.size = ap_info->rate_set.size;
134 	if (ap_info->ext_rate_set.size != 0) {
135 		/* rate_set */
136 		memcpy(&ap->rate_set.body[ap->rate_set.size],
137 		       ap_info->ext_rate_set.body,
138 		       ap_info->ext_rate_set.size);
139 		ap->rate_set.size += ap_info->ext_rate_set.size;
140 	}
141 	/* channel */
142 	ap->channel = ap_info->ds_parameter.channel;
143 	/* rssi */
144 	ap->rssi = ap_info->rssi;
145 	/* sq */
146 	ap->sq = ap_info->sq;
147 	/* noise */
148 	ap->noise = ap_info->noise;
149 	/* capability */
150 	ap->capability = ap_info->capability;
151 	/* rsn */
152 	if ((ap_info->rsn_mode & RSN_MODE_WPA2) &&
153 	    (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)) {
154 		ap->rsn_ie.id = 0x30;
155 		if (ap_info->rsn.size <= RSN_IE_BODY_MAX) {
156 			ap->rsn_ie.size = ap_info->rsn.size;
157 			memcpy(ap->rsn_ie.body, ap_info->rsn.body,
158 			       ap_info->rsn.size);
159 		} else {
160 			ap->rsn_ie.size = RSN_IE_BODY_MAX;
161 			memcpy(ap->rsn_ie.body, ap_info->rsn.body,
162 			       RSN_IE_BODY_MAX);
163 		}
164 	} else if ((ap_info->rsn_mode & RSN_MODE_WPA) &&
165 		   (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA)) {
166 		ap->wpa_ie.id = 0xdd;
167 		if (ap_info->rsn.size <= RSN_IE_BODY_MAX) {
168 			ap->wpa_ie.size = ap_info->rsn.size;
169 			memcpy(ap->wpa_ie.body, ap_info->rsn.body,
170 			       ap_info->rsn.size);
171 		} else {
172 			ap->wpa_ie.size = RSN_IE_BODY_MAX;
173 			memcpy(ap->wpa_ie.body, ap_info->rsn.body,
174 			       RSN_IE_BODY_MAX);
175 		}
176 	} else {
177 		ap->rsn_ie.id = 0;
178 		ap->rsn_ie.size = 0;
179 		ap->wpa_ie.id = 0;
180 		ap->wpa_ie.size = 0;
181 	}
182 
183 	wrqu.data.length = 0;
184 	wrqu.data.flags = 0;
185 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
186 	if (is_connect_status(priv->connect_status)) {
187 		memcpy(wrqu.ap_addr.sa_data,
188 		       priv->current_ap.bssid, ETH_ALEN);
189 		DPRINTK(3,
190 			"IWEVENT: connect bssid=%pM\n", wrqu.ap_addr.sa_data);
191 		wireless_send_event(netdev, SIOCGIWAP, &wrqu, NULL);
192 	}
193 	DPRINTK(4, "\n    Link AP\n");
194 	DPRINTK(4, "    bssid=%02X:%02X:%02X:%02X:%02X:%02X\n"
195 		   "    essid=%s\n"
196 		   "    rate_set=%02X,%02X,%02X,%02X,%02X,%02X,%02X,%02X\n"
197 		   "    channel=%d\n"
198 		   "    rssi=%d\n"
199 		   "    sq=%d\n"
200 		   "    capability=%04X\n",
201 		ap->bssid[0], ap->bssid[1], ap->bssid[2],
202 		ap->bssid[3], ap->bssid[4], ap->bssid[5],
203 		&(ap->ssid.body[0]),
204 		ap->rate_set.body[0], ap->rate_set.body[1],
205 		ap->rate_set.body[2], ap->rate_set.body[3],
206 		ap->rate_set.body[4], ap->rate_set.body[5],
207 		ap->rate_set.body[6], ap->rate_set.body[7],
208 		ap->channel, ap->rssi, ap->sq, ap->capability);
209 	DPRINTK(4, "\n    Link AP\n    rsn.mode=%d\n    rsn.size=%d\n",
210 		ap_info->rsn_mode, ap_info->rsn.size);
211 	DPRINTK(4, "\n    ext_rate_set_size=%d\n    rate_set_size=%d\n",
212 		ap_info->ext_rate_set.size, ap_info->rate_set.size);
213 
214 	return 0;
215 }
216 
217 static
218 int get_ap_information(struct ks_wlan_private *priv, struct ap_info_t *ap_info,
219 		       struct local_ap_t *ap)
220 {
221 	unsigned char *bp;
222 	int bsize, offset;
223 
224 	DPRINTK(3, "\n");
225 	memset(ap, 0, sizeof(struct local_ap_t));
226 
227 	/* bssid */
228 	memcpy(ap->bssid, ap_info->bssid, ETH_ALEN);
229 	/* rssi */
230 	ap->rssi = ap_info->rssi;
231 	/* sq */
232 	ap->sq = ap_info->sq;
233 	/* noise */
234 	ap->noise = ap_info->noise;
235 	/* capability */
236 	ap->capability = ap_info->capability;
237 	/* channel */
238 	ap->channel = ap_info->ch_info;
239 
240 	bp = ap_info->body;
241 	bsize = ap_info->body_size;
242 	offset = 0;
243 
244 	while (bsize > offset) {
245 		/* DPRINTK(4, "Element ID=%d\n",*bp); */
246 		switch (*bp) {
247 		case 0:	/* ssid */
248 			if (*(bp + 1) <= SSID_MAX_SIZE) {
249 				ap->ssid.size = *(bp + 1);
250 			} else {
251 				DPRINTK(1, "size over :: ssid size=%d\n",
252 					*(bp + 1));
253 				ap->ssid.size = SSID_MAX_SIZE;
254 			}
255 			memcpy(ap->ssid.body, bp + 2, ap->ssid.size);
256 			break;
257 		case 1:	/* rate */
258 		case 50:	/* ext rate */
259 			if ((*(bp + 1) + ap->rate_set.size) <=
260 			    RATE_SET_MAX_SIZE) {
261 				memcpy(&ap->rate_set.body[ap->rate_set.size],
262 				       bp + 2, *(bp + 1));
263 				ap->rate_set.size += *(bp + 1);
264 			} else {
265 				DPRINTK(1, "size over :: rate size=%d\n",
266 					(*(bp + 1) + ap->rate_set.size));
267 				memcpy(&ap->rate_set.body[ap->rate_set.size],
268 				       bp + 2,
269 				       RATE_SET_MAX_SIZE - ap->rate_set.size);
270 				ap->rate_set.size +=
271 				    (RATE_SET_MAX_SIZE - ap->rate_set.size);
272 			}
273 			break;
274 		case 3:	/* DS parameter */
275 			break;
276 		case 48:	/* RSN(WPA2) */
277 			ap->rsn_ie.id = *bp;
278 			if (*(bp + 1) <= RSN_IE_BODY_MAX) {
279 				ap->rsn_ie.size = *(bp + 1);
280 			} else {
281 				DPRINTK(1, "size over :: rsn size=%d\n",
282 					*(bp + 1));
283 				ap->rsn_ie.size = RSN_IE_BODY_MAX;
284 			}
285 			memcpy(ap->rsn_ie.body, bp + 2, ap->rsn_ie.size);
286 			break;
287 		case 221:	/* WPA */
288 			if (memcmp(bp + 2, "\x00\x50\xf2\x01", 4) == 0) {	/* WPA OUI check */
289 				ap->wpa_ie.id = *bp;
290 				if (*(bp + 1) <= RSN_IE_BODY_MAX) {
291 					ap->wpa_ie.size = *(bp + 1);
292 				} else {
293 					DPRINTK(1,
294 						"size over :: wpa size=%d\n",
295 						*(bp + 1));
296 					ap->wpa_ie.size = RSN_IE_BODY_MAX;
297 				}
298 				memcpy(ap->wpa_ie.body, bp + 2,
299 				       ap->wpa_ie.size);
300 			}
301 			break;
302 
303 		case 2:	/* FH parameter */
304 		case 4:	/* CF parameter */
305 		case 5:	/* TIM */
306 		case 6:	/* IBSS parameter */
307 		case 7:	/* Country */
308 		case 42:	/* ERP information */
309 		case 47:	/* Reserve ID 47 Broadcom AP */
310 			break;
311 		default:
312 			DPRINTK(4, "unknown Element ID=%d\n", *bp);
313 			break;
314 		}
315 		offset += 2;	/* id & size field */
316 		offset += *(bp + 1);	/* +size offset */
317 		bp += (*(bp + 1) + 2);	/* pointer update */
318 	}
319 
320 	return 0;
321 }
322 
323 static
324 int hostif_data_indication_wpa(struct ks_wlan_private *priv,
325 			       unsigned short auth_type)
326 {
327 	struct ether_hdr *eth_hdr;
328 	unsigned short eth_proto;
329 	unsigned char recv_mic[8];
330 	char buf[128];
331 	unsigned long now;
332 	struct mic_failure_t *mic_failure;
333 	struct michael_mic_t michael_mic;
334 	union iwreq_data wrqu;
335 	unsigned int key_index = auth_type - 1;
336 	struct wpa_key_t *key = &priv->wpa.key[key_index];
337 
338 	eth_hdr = (struct ether_hdr *)(priv->rxp);
339 	eth_proto = ntohs(eth_hdr->h_proto);
340 
341 	if (eth_hdr->h_dest_snap != eth_hdr->h_source_snap) {
342 		DPRINTK(1, "invalid data format\n");
343 		priv->nstats.rx_errors++;
344 		return -EINVAL;
345 	}
346 	if (((auth_type == TYPE_PMK1 &&
347 	      priv->wpa.pairwise_suite == IW_AUTH_CIPHER_TKIP) ||
348 	     (auth_type == TYPE_GMK1 &&
349 	      priv->wpa.group_suite == IW_AUTH_CIPHER_TKIP) ||
350 	     (auth_type == TYPE_GMK2 &&
351 	      priv->wpa.group_suite == IW_AUTH_CIPHER_TKIP)) &&
352 	    key->key_len) {
353 		DPRINTK(4, "TKIP: protocol=%04X: size=%u\n",
354 			eth_proto, priv->rx_size);
355 		/* MIC save */
356 		memcpy(&recv_mic[0], (priv->rxp) + ((priv->rx_size) - 8), 8);
357 		priv->rx_size = priv->rx_size - 8;
358 		if (auth_type > 0 && auth_type < 4) {	/* auth_type check */
359 			MichaelMICFunction(&michael_mic,
360 					   (uint8_t *)key->rx_mic_key,
361 					   (uint8_t *)priv->rxp,
362 					   (int)priv->rx_size,
363 					   (uint8_t)0,	/* priority */
364 					   (uint8_t *)michael_mic.Result);
365 		}
366 		if (memcmp(michael_mic.Result, recv_mic, 8) != 0) {
367 			now = jiffies;
368 			mic_failure = &priv->wpa.mic_failure;
369 			/* MIC FAILURE */
370 			if (mic_failure->last_failure_time &&
371 			    (now - mic_failure->last_failure_time) / HZ >= 60) {
372 				mic_failure->failure = 0;
373 			}
374 			DPRINTK(4, "MIC FAILURE\n");
375 			if (mic_failure->failure == 0) {
376 				mic_failure->failure = 1;
377 				mic_failure->counter = 0;
378 			} else if (mic_failure->failure == 1) {
379 				mic_failure->failure = 2;
380 				mic_failure->counter =
381 					(uint16_t)((now - mic_failure->last_failure_time) / HZ);
382 				if (!mic_failure->counter)	/*  range 1-60 */
383 					mic_failure->counter = 1;
384 			}
385 			priv->wpa.mic_failure.last_failure_time = now;
386 
387 			/*  needed parameters: count, keyid, key type, TSC */
388 			sprintf(buf,
389 				"MLME-MICHAELMICFAILURE.indication(keyid=%d %scast addr=%pM)",
390 				key_index,
391 				eth_hdr->h_dest[0] & 0x01 ? "broad" : "uni",
392 				eth_hdr->h_source);
393 			memset(&wrqu, 0, sizeof(wrqu));
394 			wrqu.data.length = strlen(buf);
395 			DPRINTK(4, "IWEVENT:MICHAELMICFAILURE\n");
396 			wireless_send_event(priv->net_dev, IWEVCUSTOM, &wrqu,
397 					    buf);
398 			return -EINVAL;
399 		}
400 	}
401 	return 0;
402 }
403 
404 static
405 void hostif_data_indication(struct ks_wlan_private *priv)
406 {
407 	unsigned int rx_ind_size;	/* indicate data size */
408 	struct sk_buff *skb;
409 	unsigned short auth_type;
410 	unsigned char temp[256];
411 	struct ether_hdr *eth_hdr;
412 	unsigned short eth_proto;
413 	struct ieee802_1x_hdr *aa1x_hdr;
414 	size_t size;
415 	int ret;
416 
417 	DPRINTK(3, "\n");
418 
419 	/* min length check */
420 	if (priv->rx_size <= ETH_HLEN) {
421 		DPRINTK(3, "rx_size = %d\n", priv->rx_size);
422 		priv->nstats.rx_errors++;
423 		return;
424 	}
425 
426 	auth_type = get_WORD(priv);	/* AuthType */
427 	get_WORD(priv);	/* Reserve Area */
428 
429 	eth_hdr = (struct ether_hdr *)(priv->rxp);
430 	eth_proto = ntohs(eth_hdr->h_proto);
431 	DPRINTK(3, "ether protocol = %04X\n", eth_proto);
432 
433 	/* source address check */
434 	if (memcmp(&priv->eth_addr[0], eth_hdr->h_source, ETH_ALEN) == 0) {
435 		DPRINTK(1, "invalid : source is own mac address !!\n");
436 		DPRINTK(1,
437 			"eth_hdrernet->h_dest=%02X:%02X:%02X:%02X:%02X:%02X\n",
438 			eth_hdr->h_source[0], eth_hdr->h_source[1],
439 			eth_hdr->h_source[2], eth_hdr->h_source[3],
440 			eth_hdr->h_source[4], eth_hdr->h_source[5]);
441 		priv->nstats.rx_errors++;
442 		return;
443 	}
444 
445 	/*  for WPA */
446 	if (auth_type != TYPE_DATA && priv->wpa.rsn_enabled) {
447 		ret = hostif_data_indication_wpa(priv, auth_type);
448 		if (ret)
449 			return;
450 	}
451 
452 	if ((priv->connect_status & FORCE_DISCONNECT) ||
453 	    priv->wpa.mic_failure.failure == 2) {
454 		return;
455 	}
456 
457 	/* check 13th byte at rx data */
458 	switch (*(priv->rxp + 12)) {
459 	case 0xAA:	/* SNAP */
460 		rx_ind_size = priv->rx_size - 6;
461 		skb = dev_alloc_skb(rx_ind_size);
462 		if (!skb) {
463 			priv->nstats.rx_dropped++;
464 			return;
465 		}
466 		DPRINTK(4, "SNAP, rx_ind_size = %d\n", rx_ind_size);
467 
468 		size = ETH_ALEN * 2;
469 		memcpy(skb_put(skb, size), priv->rxp, size);
470 
471 		/* (SNAP+UI..) skip */
472 
473 		size = rx_ind_size - (ETH_ALEN * 2);
474 		memcpy(skb_put(skb, size), &eth_hdr->h_proto, size);
475 
476 		aa1x_hdr = (struct ieee802_1x_hdr *)(priv->rxp + ETHER_HDR_SIZE);
477 		break;
478 	case 0xF0:	/* NETBEUI/NetBIOS */
479 		rx_ind_size = (priv->rx_size + 2);
480 		skb = dev_alloc_skb(rx_ind_size);
481 		if (!skb) {
482 			priv->nstats.rx_dropped++;
483 			return;
484 		}
485 		DPRINTK(3, "NETBEUI/NetBIOS rx_ind_size=%d\n", rx_ind_size);
486 
487 		memcpy(skb_put(skb, 12), priv->rxp, 12);	/* 8802/FDDI MAC copy */
488 
489 		temp[0] = (((rx_ind_size - 12) >> 8) & 0xff);	/* NETBEUI size add */
490 		temp[1] = ((rx_ind_size - 12) & 0xff);
491 		memcpy(skb_put(skb, 2), temp, 2);
492 
493 		memcpy(skb_put(skb, rx_ind_size - 14), priv->rxp + 12,
494 		       rx_ind_size - 14);	/* copy after Type */
495 
496 		aa1x_hdr = (struct ieee802_1x_hdr *)(priv->rxp + 14);
497 		break;
498 	default:	/* other rx data */
499 		DPRINTK(2, "invalid data format\n");
500 		priv->nstats.rx_errors++;
501 		return;
502 	}
503 
504 	if (aa1x_hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
505 	    priv->wpa.rsn_enabled)
506 		atomic_set(&priv->psstatus.snooze_guard, 1);
507 
508 	/* rx indication */
509 	skb->dev = priv->net_dev;
510 	skb->protocol = eth_type_trans(skb, skb->dev);
511 	priv->nstats.rx_packets++;
512 	priv->nstats.rx_bytes += rx_ind_size;
513 	netif_rx(skb);
514 }
515 
516 static
517 void hostif_mib_get_confirm(struct ks_wlan_private *priv)
518 {
519 	struct net_device *dev = priv->net_dev;
520 	u32 mib_status;
521 	u32 mib_attribute;
522 	u16 mib_val_size;
523 	u16 mib_val_type;
524 
525 	DPRINTK(3, "\n");
526 
527 	mib_status = get_DWORD(priv);	/* MIB status */
528 	mib_attribute = get_DWORD(priv);	/* MIB atttibute */
529 	mib_val_size = get_WORD(priv);	/* MIB value size */
530 	mib_val_type = get_WORD(priv);	/* MIB value type */
531 
532 	if (mib_status) {
533 		/* in case of error */
534 		DPRINTK(1, "attribute=%08X, status=%08X\n", mib_attribute,
535 			mib_status);
536 		return;
537 	}
538 
539 	switch (mib_attribute) {
540 	case DOT11_MAC_ADDRESS:
541 		/* MAC address */
542 		DPRINTK(3, " mib_attribute=DOT11_MAC_ADDRESS\n");
543 		hostif_sme_enqueue(priv, SME_GET_MAC_ADDRESS);
544 		memcpy(priv->eth_addr, priv->rxp, ETH_ALEN);
545 		priv->mac_address_valid = 1;
546 		dev->dev_addr[0] = priv->eth_addr[0];
547 		dev->dev_addr[1] = priv->eth_addr[1];
548 		dev->dev_addr[2] = priv->eth_addr[2];
549 		dev->dev_addr[3] = priv->eth_addr[3];
550 		dev->dev_addr[4] = priv->eth_addr[4];
551 		dev->dev_addr[5] = priv->eth_addr[5];
552 		dev->dev_addr[6] = 0x00;
553 		dev->dev_addr[7] = 0x00;
554 		netdev_info(dev, "MAC ADDRESS = %pM\n", priv->eth_addr);
555 		break;
556 	case DOT11_PRODUCT_VERSION:
557 		/* firmware version */
558 		DPRINTK(3, " mib_attribute=DOT11_PRODUCT_VERSION\n");
559 		priv->version_size = priv->rx_size;
560 		memcpy(priv->firmware_version, priv->rxp, priv->rx_size);
561 		priv->firmware_version[priv->rx_size] = '\0';
562 		netdev_info(dev, "firmware ver. = %s\n",
563 			    priv->firmware_version);
564 		hostif_sme_enqueue(priv, SME_GET_PRODUCT_VERSION);
565 		/* wake_up_interruptible_all(&priv->confirm_wait); */
566 		complete(&priv->confirm_wait);
567 		break;
568 	case LOCAL_GAIN:
569 		memcpy(&priv->gain, priv->rxp, sizeof(priv->gain));
570 		DPRINTK(3, "TxMode=%d, RxMode=%d, TxGain=%d, RxGain=%d\n",
571 			priv->gain.TxMode, priv->gain.RxMode, priv->gain.TxGain,
572 			priv->gain.RxGain);
573 		break;
574 	case LOCAL_EEPROM_SUM:
575 		memcpy(&priv->eeprom_sum, priv->rxp, sizeof(priv->eeprom_sum));
576 		DPRINTK(1, "eeprom_sum.type=%x, eeprom_sum.result=%x\n",
577 			priv->eeprom_sum.type, priv->eeprom_sum.result);
578 		if (priv->eeprom_sum.type == 0) {
579 			priv->eeprom_checksum = EEPROM_CHECKSUM_NONE;
580 		} else if (priv->eeprom_sum.type == 1) {
581 			if (priv->eeprom_sum.result == 0) {
582 				priv->eeprom_checksum = EEPROM_NG;
583 				netdev_info(dev, "LOCAL_EEPROM_SUM NG\n");
584 			} else if (priv->eeprom_sum.result == 1) {
585 				priv->eeprom_checksum = EEPROM_OK;
586 			}
587 		} else {
588 			netdev_err(dev, "LOCAL_EEPROM_SUM error!\n");
589 		}
590 		break;
591 	default:
592 		DPRINTK(1, "mib_attribute=%08x\n", (unsigned int)mib_attribute);
593 		break;
594 	}
595 }
596 
597 static
598 void hostif_mib_set_confirm(struct ks_wlan_private *priv)
599 {
600 	u32 mib_status;	/* +04 MIB Status */
601 	u32 mib_attribute;	/* +08 MIB attribute */
602 
603 	DPRINTK(3, "\n");
604 
605 	mib_status = get_DWORD(priv);	/* MIB Status */
606 	mib_attribute = get_DWORD(priv);	/* MIB attribute */
607 
608 	if (mib_status) {
609 		/* in case of error */
610 		DPRINTK(1, "error :: attribute=%08X, status=%08X\n",
611 			mib_attribute, mib_status);
612 	}
613 
614 	switch (mib_attribute) {
615 	case DOT11_RTS_THRESHOLD:
616 		hostif_sme_enqueue(priv, SME_RTS_THRESHOLD_CONFIRM);
617 		break;
618 	case DOT11_FRAGMENTATION_THRESHOLD:
619 		hostif_sme_enqueue(priv, SME_FRAGMENTATION_THRESHOLD_CONFIRM);
620 		break;
621 	case DOT11_WEP_DEFAULT_KEY_ID:
622 		if (!priv->wpa.wpa_enabled)
623 			hostif_sme_enqueue(priv, SME_WEP_INDEX_CONFIRM);
624 		break;
625 	case DOT11_WEP_DEFAULT_KEY_VALUE1:
626 		DPRINTK(2, "DOT11_WEP_DEFAULT_KEY_VALUE1:mib_status=%d\n",
627 			(int)mib_status);
628 		if (priv->wpa.rsn_enabled)
629 			hostif_sme_enqueue(priv, SME_SET_PMK_TSC);
630 		else
631 			hostif_sme_enqueue(priv, SME_WEP_KEY1_CONFIRM);
632 		break;
633 	case DOT11_WEP_DEFAULT_KEY_VALUE2:
634 		DPRINTK(2, "DOT11_WEP_DEFAULT_KEY_VALUE2:mib_status=%d\n",
635 			(int)mib_status);
636 		if (priv->wpa.rsn_enabled)
637 			hostif_sme_enqueue(priv, SME_SET_GMK1_TSC);
638 		else
639 			hostif_sme_enqueue(priv, SME_WEP_KEY2_CONFIRM);
640 		break;
641 	case DOT11_WEP_DEFAULT_KEY_VALUE3:
642 		DPRINTK(2, "DOT11_WEP_DEFAULT_KEY_VALUE3:mib_status=%d\n",
643 			(int)mib_status);
644 		if (priv->wpa.rsn_enabled)
645 			hostif_sme_enqueue(priv, SME_SET_GMK2_TSC);
646 		else
647 			hostif_sme_enqueue(priv, SME_WEP_KEY3_CONFIRM);
648 		break;
649 	case DOT11_WEP_DEFAULT_KEY_VALUE4:
650 		DPRINTK(2, "DOT11_WEP_DEFAULT_KEY_VALUE4:mib_status=%d\n",
651 			(int)mib_status);
652 		if (!priv->wpa.rsn_enabled)
653 			hostif_sme_enqueue(priv, SME_WEP_KEY4_CONFIRM);
654 		break;
655 	case DOT11_PRIVACY_INVOKED:
656 		if (!priv->wpa.rsn_enabled)
657 			hostif_sme_enqueue(priv, SME_WEP_FLAG_CONFIRM);
658 		break;
659 	case DOT11_RSN_ENABLED:
660 		DPRINTK(2, "DOT11_RSN_ENABLED:mib_status=%d\n",
661 			(int)mib_status);
662 		hostif_sme_enqueue(priv, SME_RSN_ENABLED_CONFIRM);
663 		break;
664 	case LOCAL_RSN_MODE:
665 		hostif_sme_enqueue(priv, SME_RSN_MODE_CONFIRM);
666 		break;
667 	case LOCAL_MULTICAST_ADDRESS:
668 		hostif_sme_enqueue(priv, SME_MULTICAST_REQUEST);
669 		break;
670 	case LOCAL_MULTICAST_FILTER:
671 		hostif_sme_enqueue(priv, SME_MULTICAST_CONFIRM);
672 		break;
673 	case LOCAL_CURRENTADDRESS:
674 		priv->mac_address_valid = 1;
675 		break;
676 	case DOT11_RSN_CONFIG_MULTICAST_CIPHER:
677 		DPRINTK(2, "DOT11_RSN_CONFIG_MULTICAST_CIPHER:mib_status=%d\n",
678 			(int)mib_status);
679 		hostif_sme_enqueue(priv, SME_RSN_MCAST_CONFIRM);
680 		break;
681 	case DOT11_RSN_CONFIG_UNICAST_CIPHER:
682 		DPRINTK(2, "DOT11_RSN_CONFIG_UNICAST_CIPHER:mib_status=%d\n",
683 			(int)mib_status);
684 		hostif_sme_enqueue(priv, SME_RSN_UCAST_CONFIRM);
685 		break;
686 	case DOT11_RSN_CONFIG_AUTH_SUITE:
687 		DPRINTK(2, "DOT11_RSN_CONFIG_AUTH_SUITE:mib_status=%d\n",
688 			(int)mib_status);
689 		hostif_sme_enqueue(priv, SME_RSN_AUTH_CONFIRM);
690 		break;
691 	case DOT11_PMK_TSC:
692 		DPRINTK(2, "DOT11_PMK_TSC:mib_status=%d\n", (int)mib_status);
693 		break;
694 	case DOT11_GMK1_TSC:
695 		DPRINTK(2, "DOT11_GMK1_TSC:mib_status=%d\n", (int)mib_status);
696 		if (atomic_read(&priv->psstatus.snooze_guard))
697 			atomic_set(&priv->psstatus.snooze_guard, 0);
698 		break;
699 	case DOT11_GMK2_TSC:
700 		DPRINTK(2, "DOT11_GMK2_TSC:mib_status=%d\n", (int)mib_status);
701 		if (atomic_read(&priv->psstatus.snooze_guard))
702 			atomic_set(&priv->psstatus.snooze_guard, 0);
703 		break;
704 	case LOCAL_PMK:
705 		DPRINTK(2, "LOCAL_PMK:mib_status=%d\n", (int)mib_status);
706 		break;
707 	case LOCAL_GAIN:
708 		DPRINTK(2, "LOCAL_GAIN:mib_status=%d\n", (int)mib_status);
709 		break;
710 #ifdef WPS
711 	case LOCAL_WPS_ENABLE:
712 		DPRINTK(2, "LOCAL_WPS_ENABLE:mib_status=%d\n", (int)mib_status);
713 		break;
714 	case LOCAL_WPS_PROBE_REQ:
715 		DPRINTK(2, "LOCAL_WPS_PROBE_REQ:mib_status=%d\n",
716 			(int)mib_status);
717 		break;
718 #endif /* WPS */
719 	case LOCAL_REGION:
720 		DPRINTK(2, "LOCAL_REGION:mib_status=%d\n", (int)mib_status);
721 	default:
722 		break;
723 	}
724 }
725 
726 static
727 void hostif_power_mgmt_confirm(struct ks_wlan_private *priv)
728 {
729 	DPRINTK(3, "\n");
730 
731 	if (priv->reg.power_mgmt > POWER_MGMT_ACTIVE &&
732 	    priv->reg.operation_mode == MODE_INFRASTRUCTURE) {
733 		atomic_set(&priv->psstatus.confirm_wait, 0);
734 		priv->dev_state = DEVICE_STATE_SLEEP;
735 		ks_wlan_hw_power_save(priv);
736 	} else {
737 		priv->dev_state = DEVICE_STATE_READY;
738 	}
739 }
740 
741 static
742 void hostif_sleep_confirm(struct ks_wlan_private *priv)
743 {
744 	DPRINTK(3, "\n");
745 
746 	atomic_set(&priv->sleepstatus.doze_request, 1);
747 	queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
748 }
749 
750 static
751 void hostif_start_confirm(struct ks_wlan_private *priv)
752 {
753 #ifdef WPS
754 	union iwreq_data wrqu;
755 
756 	wrqu.data.length = 0;
757 	wrqu.data.flags = 0;
758 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
759 	if (is_connect_status(priv->connect_status)) {
760 		eth_zero_addr(wrqu.ap_addr.sa_data);
761 		DPRINTK(3, "IWEVENT: disconnect\n");
762 		wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
763 	}
764 #endif
765 	DPRINTK(3, " scan_ind_count=%d\n", priv->scan_ind_count);
766 	hostif_sme_enqueue(priv, SME_START_CONFIRM);
767 }
768 
769 static
770 void hostif_connect_indication(struct ks_wlan_private *priv)
771 {
772 	unsigned short connect_code;
773 	unsigned int tmp = 0;
774 	unsigned int old_status = priv->connect_status;
775 	struct net_device *netdev = priv->net_dev;
776 	union iwreq_data wrqu0;
777 
778 	connect_code = get_WORD(priv);
779 
780 	switch (connect_code) {
781 	case RESULT_CONNECT:	/* connect */
782 		DPRINTK(3, "connect :: scan_ind_count=%d\n",
783 			priv->scan_ind_count);
784 		if (!(priv->connect_status & FORCE_DISCONNECT))
785 			netif_carrier_on(netdev);
786 		tmp = FORCE_DISCONNECT & priv->connect_status;
787 		priv->connect_status = tmp + CONNECT_STATUS;
788 		break;
789 	case RESULT_DISCONNECT:	/* disconnect */
790 		DPRINTK(3, "disconnect :: scan_ind_count=%d\n",
791 			priv->scan_ind_count);
792 		netif_carrier_off(netdev);
793 		tmp = FORCE_DISCONNECT & priv->connect_status;
794 		priv->connect_status = tmp + DISCONNECT_STATUS;
795 		break;
796 	default:
797 		DPRINTK(1, "unknown connect_code=%d :: scan_ind_count=%d\n",
798 			connect_code, priv->scan_ind_count);
799 		netif_carrier_off(netdev);
800 		tmp = FORCE_DISCONNECT & priv->connect_status;
801 		priv->connect_status = tmp + DISCONNECT_STATUS;
802 		break;
803 	}
804 
805 	get_current_ap(priv, (struct link_ap_info_t *)priv->rxp);
806 	if (is_connect_status(priv->connect_status) &&
807 	    is_disconnect_status(old_status)) {
808 		/* for power save */
809 		atomic_set(&priv->psstatus.snooze_guard, 0);
810 		atomic_set(&priv->psstatus.confirm_wait, 0);
811 	}
812 	ks_wlan_do_power_save(priv);
813 
814 	wrqu0.data.length = 0;
815 	wrqu0.data.flags = 0;
816 	wrqu0.ap_addr.sa_family = ARPHRD_ETHER;
817 	if (is_disconnect_status(priv->connect_status) &&
818 	    is_connect_status(old_status)) {
819 		eth_zero_addr(wrqu0.ap_addr.sa_data);
820 		DPRINTK(3, "IWEVENT: disconnect\n");
821 		DPRINTK(3, "disconnect :: scan_ind_count=%d\n",
822 			priv->scan_ind_count);
823 		wireless_send_event(netdev, SIOCGIWAP, &wrqu0, NULL);
824 	}
825 	priv->scan_ind_count = 0;
826 }
827 
828 static
829 void hostif_scan_indication(struct ks_wlan_private *priv)
830 {
831 	int i;
832 	struct ap_info_t *ap_info;
833 
834 	DPRINTK(3, "scan_ind_count = %d\n", priv->scan_ind_count);
835 	ap_info = (struct ap_info_t *)(priv->rxp);
836 
837 	if (priv->scan_ind_count) {
838 		for (i = 0; i < priv->aplist.size; i++) {	/* bssid check */
839 			if (memcmp(ap_info->bssid,
840 				   priv->aplist.ap[i].bssid, ETH_ALEN) != 0)
841 				continue;
842 
843 			if (ap_info->frame_type == FRAME_TYPE_PROBE_RESP)
844 				get_ap_information(priv, ap_info,
845 						   &priv->aplist.ap[i]);
846 			return;
847 		}
848 	}
849 	priv->scan_ind_count++;
850 	if (priv->scan_ind_count < LOCAL_APLIST_MAX + 1) {
851 		DPRINTK(4, " scan_ind_count=%d :: aplist.size=%d\n",
852 			priv->scan_ind_count, priv->aplist.size);
853 		get_ap_information(priv, (struct ap_info_t *)(priv->rxp),
854 				   &(priv->aplist.ap[priv->scan_ind_count - 1]));
855 		priv->aplist.size = priv->scan_ind_count;
856 	} else {
857 		DPRINTK(4, " count over :: scan_ind_count=%d\n",
858 			priv->scan_ind_count);
859 	}
860 }
861 
862 static
863 void hostif_stop_confirm(struct ks_wlan_private *priv)
864 {
865 	unsigned int tmp = 0;
866 	unsigned int old_status = priv->connect_status;
867 	struct net_device *netdev = priv->net_dev;
868 	union iwreq_data wrqu0;
869 
870 	DPRINTK(3, "\n");
871 	if (priv->dev_state == DEVICE_STATE_SLEEP)
872 		priv->dev_state = DEVICE_STATE_READY;
873 
874 	/* disconnect indication */
875 	if (is_connect_status(priv->connect_status)) {
876 		netif_carrier_off(netdev);
877 		tmp = FORCE_DISCONNECT & priv->connect_status;
878 		priv->connect_status = tmp | DISCONNECT_STATUS;
879 		netdev_info(netdev, "IWEVENT: disconnect\n");
880 
881 		wrqu0.data.length = 0;
882 		wrqu0.data.flags = 0;
883 		wrqu0.ap_addr.sa_family = ARPHRD_ETHER;
884 		if (is_disconnect_status(priv->connect_status) &&
885 		    is_connect_status(old_status)) {
886 			eth_zero_addr(wrqu0.ap_addr.sa_data);
887 			DPRINTK(3, "IWEVENT: disconnect\n");
888 			netdev_info(netdev, "IWEVENT: disconnect\n");
889 			DPRINTK(3, "disconnect :: scan_ind_count=%d\n",
890 				priv->scan_ind_count);
891 			wireless_send_event(netdev, SIOCGIWAP, &wrqu0, NULL);
892 		}
893 		priv->scan_ind_count = 0;
894 	}
895 
896 	hostif_sme_enqueue(priv, SME_STOP_CONFIRM);
897 }
898 
899 static
900 void hostif_ps_adhoc_set_confirm(struct ks_wlan_private *priv)
901 {
902 	DPRINTK(3, "\n");
903 	priv->infra_status = 0;	/* infrastructure mode cancel */
904 	hostif_sme_enqueue(priv, SME_MODE_SET_CONFIRM);
905 }
906 
907 static
908 void hostif_infrastructure_set_confirm(struct ks_wlan_private *priv)
909 {
910 	u16 result_code;
911 
912 	DPRINTK(3, "\n");
913 	result_code = get_WORD(priv);
914 	DPRINTK(3, "result code = %d\n", result_code);
915 	priv->infra_status = 1;	/* infrastructure mode set */
916 	hostif_sme_enqueue(priv, SME_MODE_SET_CONFIRM);
917 }
918 
919 static
920 void hostif_adhoc_set_confirm(struct ks_wlan_private *priv)
921 {
922 	DPRINTK(3, "\n");
923 	priv->infra_status = 1;	/* infrastructure mode set */
924 	hostif_sme_enqueue(priv, SME_MODE_SET_CONFIRM);
925 }
926 
927 static
928 void hostif_associate_indication(struct ks_wlan_private *priv)
929 {
930 	struct association_request_t *assoc_req;
931 	struct association_response_t *assoc_resp;
932 	unsigned char *pb;
933 	union iwreq_data wrqu;
934 	char buf[IW_CUSTOM_MAX];
935 	char *pbuf = &buf[0];
936 	int i;
937 
938 	static const char associnfo_leader0[] = "ASSOCINFO(ReqIEs=";
939 	static const char associnfo_leader1[] = " RespIEs=";
940 
941 	DPRINTK(3, "\n");
942 	assoc_req = (struct association_request_t *)(priv->rxp);
943 	assoc_resp = (struct association_response_t *)(assoc_req + 1);
944 	pb = (unsigned char *)(assoc_resp + 1);
945 
946 	memset(&wrqu, 0, sizeof(wrqu));
947 	memcpy(pbuf, associnfo_leader0, sizeof(associnfo_leader0) - 1);
948 	wrqu.data.length += sizeof(associnfo_leader0) - 1;
949 	pbuf += sizeof(associnfo_leader0) - 1;
950 
951 	for (i = 0; i < assoc_req->reqIEs_size; i++)
952 		pbuf += sprintf(pbuf, "%02x", *(pb + i));
953 	wrqu.data.length += (assoc_req->reqIEs_size) * 2;
954 
955 	memcpy(pbuf, associnfo_leader1, sizeof(associnfo_leader1) - 1);
956 	wrqu.data.length += sizeof(associnfo_leader1) - 1;
957 	pbuf += sizeof(associnfo_leader1) - 1;
958 
959 	pb += assoc_req->reqIEs_size;
960 	for (i = 0; i < assoc_resp->respIEs_size; i++)
961 		pbuf += sprintf(pbuf, "%02x", *(pb + i));
962 	wrqu.data.length += (assoc_resp->respIEs_size) * 2;
963 
964 	pbuf += sprintf(pbuf, ")");
965 	wrqu.data.length += 1;
966 
967 	DPRINTK(3, "IWEVENT:ASSOCINFO\n");
968 	wireless_send_event(priv->net_dev, IWEVCUSTOM, &wrqu, buf);
969 }
970 
971 static
972 void hostif_bss_scan_confirm(struct ks_wlan_private *priv)
973 {
974 	unsigned int result_code;
975 	struct net_device *dev = priv->net_dev;
976 	union iwreq_data wrqu;
977 
978 	result_code = get_DWORD(priv);
979 	DPRINTK(2, "result=%d :: scan_ind_count=%d\n", result_code,
980 		priv->scan_ind_count);
981 
982 	priv->sme_i.sme_flag &= ~SME_AP_SCAN;
983 	hostif_sme_enqueue(priv, SME_BSS_SCAN_CONFIRM);
984 
985 	wrqu.data.length = 0;
986 	wrqu.data.flags = 0;
987 	DPRINTK(3, "IWEVENT: SCAN CONFIRM\n");
988 	wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
989 	priv->scan_ind_count = 0;
990 }
991 
992 static
993 void hostif_phy_information_confirm(struct ks_wlan_private *priv)
994 {
995 	struct iw_statistics *wstats = &priv->wstats;
996 	unsigned char rssi, signal, noise;
997 	unsigned char LinkSpeed;
998 	unsigned int TransmittedFrameCount, ReceivedFragmentCount;
999 	unsigned int FailedCount, FCSErrorCount;
1000 
1001 	DPRINTK(3, "\n");
1002 	rssi = get_BYTE(priv);
1003 	signal = get_BYTE(priv);
1004 	noise = get_BYTE(priv);
1005 	LinkSpeed = get_BYTE(priv);
1006 	TransmittedFrameCount = get_DWORD(priv);
1007 	ReceivedFragmentCount = get_DWORD(priv);
1008 	FailedCount = get_DWORD(priv);
1009 	FCSErrorCount = get_DWORD(priv);
1010 
1011 	DPRINTK(4, "phyinfo confirm rssi=%d signal=%d\n", rssi, signal);
1012 	priv->current_rate = (LinkSpeed & RATE_MASK);
1013 	wstats->qual.qual = signal;
1014 	wstats->qual.level = 256 - rssi;
1015 	wstats->qual.noise = 0;	/* invalid noise value */
1016 	wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
1017 
1018 	DPRINTK(3, "\n    rssi=%u\n"
1019 		   "    signal=%u\n"
1020 		   "    LinkSpeed=%ux500Kbps\n"
1021 		   "    TransmittedFrameCount=%u\n"
1022 		   "    ReceivedFragmentCount=%u\n"
1023 		   "    FailedCount=%u\n"
1024 		   "    FCSErrorCount=%u\n",
1025 		rssi, signal, LinkSpeed, TransmittedFrameCount,
1026 		ReceivedFragmentCount, FailedCount, FCSErrorCount);
1027 
1028 	/* wake_up_interruptible_all(&priv->confirm_wait); */
1029 	complete(&priv->confirm_wait);
1030 }
1031 
1032 static
1033 void hostif_mic_failure_confirm(struct ks_wlan_private *priv)
1034 {
1035 	DPRINTK(3, "mic_failure=%u\n", priv->wpa.mic_failure.failure);
1036 	hostif_sme_enqueue(priv, SME_MIC_FAILURE_CONFIRM);
1037 }
1038 
1039 static
1040 void hostif_event_check(struct ks_wlan_private *priv)
1041 {
1042 	unsigned short event;
1043 
1044 	DPRINTK(4, "\n");
1045 	event = get_WORD(priv);	/* get event */
1046 	switch (event) {
1047 	case HIF_DATA_IND:
1048 		hostif_data_indication(priv);
1049 		break;
1050 	case HIF_MIB_GET_CONF:
1051 		hostif_mib_get_confirm(priv);
1052 		break;
1053 	case HIF_MIB_SET_CONF:
1054 		hostif_mib_set_confirm(priv);
1055 		break;
1056 	case HIF_POWER_MGMT_CONF:
1057 		hostif_power_mgmt_confirm(priv);
1058 		break;
1059 	case HIF_SLEEP_CONF:
1060 		hostif_sleep_confirm(priv);
1061 		break;
1062 	case HIF_START_CONF:
1063 		hostif_start_confirm(priv);
1064 		break;
1065 	case HIF_CONNECT_IND:
1066 		hostif_connect_indication(priv);
1067 		break;
1068 	case HIF_STOP_CONF:
1069 		hostif_stop_confirm(priv);
1070 		break;
1071 	case HIF_PS_ADH_SET_CONF:
1072 		hostif_ps_adhoc_set_confirm(priv);
1073 		break;
1074 	case HIF_INFRA_SET_CONF:
1075 	case HIF_INFRA_SET2_CONF:
1076 		hostif_infrastructure_set_confirm(priv);
1077 		break;
1078 	case HIF_ADH_SET_CONF:
1079 	case HIF_ADH_SET2_CONF:
1080 		hostif_adhoc_set_confirm(priv);
1081 		break;
1082 	case HIF_ASSOC_INFO_IND:
1083 		hostif_associate_indication(priv);
1084 		break;
1085 	case HIF_MIC_FAILURE_CONF:
1086 		hostif_mic_failure_confirm(priv);
1087 		break;
1088 	case HIF_SCAN_CONF:
1089 		hostif_bss_scan_confirm(priv);
1090 		break;
1091 	case HIF_PHY_INFO_CONF:
1092 	case HIF_PHY_INFO_IND:
1093 		hostif_phy_information_confirm(priv);
1094 		break;
1095 	case HIF_SCAN_IND:
1096 		hostif_scan_indication(priv);
1097 		break;
1098 	case HIF_AP_SET_CONF:
1099 	default:
1100 		//DPRINTK(1, "undefined event[%04X]\n", event);
1101 		netdev_err(priv->net_dev, "undefined event[%04X]\n", event);
1102 		/* wake_up_all(&priv->confirm_wait); */
1103 		complete(&priv->confirm_wait);
1104 		break;
1105 	}
1106 
1107 	/* add event to hostt buffer */
1108 	priv->hostt.buff[priv->hostt.qtail] = event;
1109 	priv->hostt.qtail = (priv->hostt.qtail + 1) % SME_EVENT_BUFF_SIZE;
1110 }
1111 
1112 /* allocate size bytes, set header size and event */
1113 static void *hostif_generic_request(size_t size, int event)
1114 {
1115 	struct hostif_hdr *p;
1116 
1117 	p = kzalloc(hif_align_size(size), KS_WLAN_MEM_FLAG);
1118 	if (!p)
1119 		return NULL;
1120 
1121 	p->size = cpu_to_le16((u16)(size - sizeof(p->size)));
1122 	p->event = cpu_to_le16(event);
1123 
1124 	return p;
1125 }
1126 
1127 int hostif_data_request(struct ks_wlan_private *priv, struct sk_buff *skb)
1128 {
1129 	unsigned int skb_len = 0;
1130 
1131 	unsigned char *buffer = NULL;
1132 	unsigned int length = 0;
1133 	struct hostif_data_request_t *pp;
1134 	unsigned char *p;
1135 	int result = 0;
1136 	unsigned short eth_proto;
1137 	struct ether_hdr *eth_hdr;
1138 	struct michael_mic_t michael_mic;
1139 	unsigned short keyinfo = 0;
1140 	struct ieee802_1x_hdr *aa1x_hdr;
1141 	struct wpa_eapol_key *eap_key;
1142 	struct ethhdr *eth;
1143 	size_t size;
1144 	int ret;
1145 
1146 	skb_len = skb->len;
1147 	if (skb_len > ETH_FRAME_LEN) {
1148 		DPRINTK(1, "bad length skb_len=%d\n", skb_len);
1149 		ret = -EOVERFLOW;
1150 		goto err_kfree_skb;
1151 	}
1152 
1153 	if (is_disconnect_status(priv->connect_status) ||
1154 	    (priv->connect_status & FORCE_DISCONNECT) ||
1155 	    priv->wpa.mic_failure.stop) {
1156 		DPRINTK(3, " DISCONNECT\n");
1157 		if (netif_queue_stopped(priv->net_dev))
1158 			netif_wake_queue(priv->net_dev);
1159 		if (skb)
1160 			dev_kfree_skb(skb);
1161 
1162 		return 0;
1163 	}
1164 
1165 	/* for PowerSave */
1166 	if (atomic_read(&priv->psstatus.status) == PS_SNOOZE) {	/* power save wakeup */
1167 		if (!netif_queue_stopped(priv->net_dev))
1168 			netif_stop_queue(priv->net_dev);
1169 	}
1170 
1171 	size = sizeof(*pp) + 6 + skb_len + 8;
1172 	pp = kmalloc(hif_align_size(size), KS_WLAN_MEM_FLAG);
1173 	if (!pp) {
1174 		ret = -ENOMEM;
1175 		goto err_kfree_skb;
1176 	}
1177 
1178 	p = (unsigned char *)pp->data;
1179 
1180 	buffer = skb->data;
1181 	length = skb->len;
1182 
1183 	/* skb check */
1184 	eth = (struct ethhdr *)skb->data;
1185 	if (memcmp(&priv->eth_addr[0], eth->h_source, ETH_ALEN) != 0) {
1186 		DPRINTK(1, "invalid mac address !!\n");
1187 		DPRINTK(1, "ethernet->h_source=%pM\n", eth->h_source);
1188 		ret = -ENXIO;
1189 		goto err_kfree;
1190 	}
1191 
1192 	/* dest and src MAC address copy */
1193 	size = ETH_ALEN * 2;
1194 	memcpy(p, buffer, size);
1195 	p += size;
1196 	buffer += size;
1197 	length -= size;
1198 
1199 	/* EtherType/Length check */
1200 	if (*(buffer + 1) + (*buffer << 8) > 1500) {
1201 		/* ProtocolEAP = *(buffer+1) + (*buffer << 8); */
1202 		/* DPRINTK(2, "Send [SNAP]Type %x\n",ProtocolEAP); */
1203 		/* SAP/CTL/OUI(6 byte) add */
1204 		*p++ = 0xAA;	/* DSAP */
1205 		*p++ = 0xAA;	/* SSAP */
1206 		*p++ = 0x03;	/* CTL */
1207 		*p++ = 0x00;	/* OUI ("000000") */
1208 		*p++ = 0x00;	/* OUI ("000000") */
1209 		*p++ = 0x00;	/* OUI ("000000") */
1210 		skb_len += 6;
1211 	} else {
1212 		DPRINTK(4, "DIX\n");
1213 		/* Length(2 byte) delete */
1214 		buffer += 2;
1215 		length -= 2;
1216 		skb_len -= 2;
1217 	}
1218 
1219 	/* pp->data copy */
1220 	memcpy(p, buffer, length);
1221 
1222 	p += length;
1223 
1224 	/* for WPA */
1225 	eth_hdr = (struct ether_hdr *)&pp->data[0];
1226 	eth_proto = ntohs(eth_hdr->h_proto);
1227 
1228 	/* for MIC FAILURE REPORT check */
1229 	if (eth_proto == ETHER_PROTOCOL_TYPE_EAP &&
1230 	    priv->wpa.mic_failure.failure > 0) {
1231 		aa1x_hdr = (struct ieee802_1x_hdr *)(eth_hdr + 1);
1232 		if (aa1x_hdr->type == IEEE802_1X_TYPE_EAPOL_KEY) {
1233 			eap_key = (struct wpa_eapol_key *)(aa1x_hdr + 1);
1234 			keyinfo = ntohs(eap_key->key_info);
1235 		}
1236 	}
1237 
1238 	if (priv->wpa.rsn_enabled && priv->wpa.key[0].key_len) {
1239 		if (eth_proto == ETHER_PROTOCOL_TYPE_EAP &&
1240 		    priv->wpa.key[1].key_len == 0 &&
1241 		    priv->wpa.key[2].key_len == 0 &&
1242 		    priv->wpa.key[3].key_len == 0) {
1243 			pp->auth_type = cpu_to_le16((uint16_t)TYPE_AUTH);	/* no encryption */
1244 		} else {
1245 			if (priv->wpa.pairwise_suite == IW_AUTH_CIPHER_TKIP) {
1246 				MichaelMICFunction(&michael_mic,
1247 						   (uint8_t *)priv->wpa.key[0].tx_mic_key,
1248 						   (uint8_t *)&pp->data[0],
1249 						   (int)skb_len,
1250 						   (uint8_t)0,	/* priority */
1251 						   (uint8_t *)michael_mic.Result);
1252 				memcpy(p, michael_mic.Result, 8);
1253 				length += 8;
1254 				skb_len += 8;
1255 				p += 8;
1256 				pp->auth_type =
1257 				    cpu_to_le16((uint16_t)TYPE_DATA);
1258 
1259 			} else if (priv->wpa.pairwise_suite ==
1260 				   IW_AUTH_CIPHER_CCMP) {
1261 				pp->auth_type =
1262 				    cpu_to_le16((uint16_t)TYPE_DATA);
1263 			}
1264 		}
1265 	} else {
1266 		if (eth_proto == ETHER_PROTOCOL_TYPE_EAP)
1267 			pp->auth_type = cpu_to_le16((uint16_t)TYPE_AUTH);
1268 		else
1269 			pp->auth_type = cpu_to_le16((uint16_t)TYPE_DATA);
1270 	}
1271 
1272 	/* header value set */
1273 	pp->header.size =
1274 	    cpu_to_le16((uint16_t)
1275 			(sizeof(*pp) - sizeof(pp->header.size) + skb_len));
1276 	pp->header.event = cpu_to_le16((uint16_t)HIF_DATA_REQ);
1277 
1278 	/* tx request */
1279 	result = ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp) + skb_len),
1280 			       send_packet_complete, skb);
1281 
1282 	/* MIC FAILURE REPORT check */
1283 	if (eth_proto == ETHER_PROTOCOL_TYPE_EAP &&
1284 	    priv->wpa.mic_failure.failure > 0) {
1285 		if (keyinfo & WPA_KEY_INFO_ERROR &&
1286 		    keyinfo & WPA_KEY_INFO_REQUEST) {
1287 			DPRINTK(3, " MIC ERROR Report SET : %04X\n", keyinfo);
1288 			hostif_sme_enqueue(priv, SME_MIC_FAILURE_REQUEST);
1289 		}
1290 		if (priv->wpa.mic_failure.failure == 2)
1291 			priv->wpa.mic_failure.stop = 1;
1292 	}
1293 
1294 	return result;
1295 
1296 err_kfree:
1297 	kfree(pp);
1298 err_kfree_skb:
1299 	dev_kfree_skb(skb);
1300 
1301 	return ret;
1302 }
1303 
1304 #define ps_confirm_wait_inc(priv)					 \
1305 	do {								 \
1306 		if (atomic_read(&priv->psstatus.status) > PS_ACTIVE_SET) \
1307 			atomic_inc(&priv->psstatus.confirm_wait);	 \
1308 	} while (0)
1309 
1310 static
1311 void hostif_mib_get_request(struct ks_wlan_private *priv,
1312 			    unsigned long mib_attribute)
1313 {
1314 	struct hostif_mib_get_request_t *pp;
1315 
1316 	DPRINTK(3, "\n");
1317 
1318 	pp = hostif_generic_request(sizeof(*pp), HIF_MIB_GET_REQ);
1319 	if (!pp)
1320 		return;
1321 
1322 	pp->mib_attribute = cpu_to_le32((uint32_t)mib_attribute);
1323 
1324 	/* send to device request */
1325 	ps_confirm_wait_inc(priv);
1326 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1327 }
1328 
1329 static
1330 void hostif_mib_set_request(struct ks_wlan_private *priv,
1331 			    unsigned long mib_attribute, unsigned short size,
1332 			    unsigned short type, void *vp)
1333 {
1334 	struct hostif_mib_set_request_t *pp;
1335 
1336 	DPRINTK(3, "\n");
1337 
1338 	if (priv->dev_state < DEVICE_STATE_BOOT) {
1339 		DPRINTK(3, "DeviceRemove\n");
1340 		return;
1341 	}
1342 
1343 	pp = hostif_generic_request(sizeof(*pp), HIF_MIB_SET_REQ);
1344 	if (!pp)
1345 		return;
1346 
1347 	pp->mib_attribute = cpu_to_le32((uint32_t)mib_attribute);
1348 	pp->mib_value.size = cpu_to_le16((uint16_t)size);
1349 	pp->mib_value.type = cpu_to_le16((uint16_t)type);
1350 	memcpy(&pp->mib_value.body, vp, size);
1351 
1352 	/* send to device request */
1353 	ps_confirm_wait_inc(priv);
1354 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp) + size), NULL, NULL);
1355 }
1356 
1357 static
1358 void hostif_start_request(struct ks_wlan_private *priv, unsigned char mode)
1359 {
1360 	struct hostif_start_request_t *pp;
1361 
1362 	DPRINTK(3, "\n");
1363 
1364 	pp = hostif_generic_request(sizeof(*pp), HIF_START_REQ);
1365 	if (!pp)
1366 		return;
1367 
1368 	pp->mode = cpu_to_le16((uint16_t)mode);
1369 
1370 	/* send to device request */
1371 	ps_confirm_wait_inc(priv);
1372 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1373 
1374 	priv->aplist.size = 0;
1375 	priv->scan_ind_count = 0;
1376 }
1377 
1378 static
1379 void hostif_ps_adhoc_set_request(struct ks_wlan_private *priv)
1380 {
1381 	struct hostif_ps_adhoc_set_request_t *pp;
1382 	u16 capability;
1383 
1384 	DPRINTK(3, "\n");
1385 
1386 	pp = hostif_generic_request(sizeof(*pp), HIF_PS_ADH_SET_REQ);
1387 	if (!pp)
1388 		return;
1389 
1390 	pp->phy_type = cpu_to_le16((uint16_t)(priv->reg.phy_type));
1391 	pp->cts_mode = cpu_to_le16((uint16_t)(priv->reg.cts_mode));
1392 	pp->scan_type = cpu_to_le16((uint16_t)(priv->reg.scan_type));
1393 	pp->channel = cpu_to_le16((uint16_t)(priv->reg.channel));
1394 	pp->rate_set.size = priv->reg.rate_set.size;
1395 	memcpy(&pp->rate_set.body[0], &priv->reg.rate_set.body[0],
1396 	       priv->reg.rate_set.size);
1397 
1398 	capability = 0x0000;
1399 	if (priv->reg.preamble == SHORT_PREAMBLE) {
1400 		/* short preamble */
1401 		capability |= BSS_CAP_SHORT_PREAMBLE;
1402 	}
1403 	capability &= ~(BSS_CAP_PBCC);	/* pbcc not support */
1404 	if (priv->reg.phy_type != D_11B_ONLY_MODE) {
1405 		capability |= BSS_CAP_SHORT_SLOT_TIME;	/* ShortSlotTime support */
1406 		capability &= ~(BSS_CAP_DSSS_OFDM);	/* DSSS OFDM */
1407 	}
1408 	pp->capability = cpu_to_le16((uint16_t)capability);
1409 
1410 	/* send to device request */
1411 	ps_confirm_wait_inc(priv);
1412 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1413 }
1414 
1415 static
1416 void hostif_infrastructure_set_request(struct ks_wlan_private *priv)
1417 {
1418 	struct hostif_infrastructure_set_request_t *pp;
1419 	u16 capability;
1420 
1421 	DPRINTK(3, "ssid.size=%d\n", priv->reg.ssid.size);
1422 
1423 	pp = hostif_generic_request(sizeof(*pp), HIF_INFRA_SET_REQ);
1424 	if (!pp)
1425 		return;
1426 
1427 	pp->phy_type = cpu_to_le16((uint16_t)(priv->reg.phy_type));
1428 	pp->cts_mode = cpu_to_le16((uint16_t)(priv->reg.cts_mode));
1429 	pp->scan_type = cpu_to_le16((uint16_t)(priv->reg.scan_type));
1430 
1431 	pp->rate_set.size = priv->reg.rate_set.size;
1432 	memcpy(&pp->rate_set.body[0], &priv->reg.rate_set.body[0],
1433 	       priv->reg.rate_set.size);
1434 	pp->ssid.size = priv->reg.ssid.size;
1435 	memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1436 
1437 	capability = 0x0000;
1438 	if (priv->reg.preamble == SHORT_PREAMBLE) {
1439 		/* short preamble */
1440 		capability |= BSS_CAP_SHORT_PREAMBLE;
1441 	}
1442 	capability &= ~(BSS_CAP_PBCC);	/* pbcc not support */
1443 	if (priv->reg.phy_type != D_11B_ONLY_MODE) {
1444 		capability |= BSS_CAP_SHORT_SLOT_TIME;	/* ShortSlotTime support */
1445 		capability &= ~(BSS_CAP_DSSS_OFDM);	/* DSSS OFDM not support */
1446 	}
1447 	pp->capability = cpu_to_le16((uint16_t)capability);
1448 	pp->beacon_lost_count =
1449 	    cpu_to_le16((uint16_t)(priv->reg.beacon_lost_count));
1450 	pp->auth_type = cpu_to_le16((uint16_t)(priv->reg.authenticate_type));
1451 
1452 	pp->channel_list.body[0] = 1;
1453 	pp->channel_list.body[1] = 8;
1454 	pp->channel_list.body[2] = 2;
1455 	pp->channel_list.body[3] = 9;
1456 	pp->channel_list.body[4] = 3;
1457 	pp->channel_list.body[5] = 10;
1458 	pp->channel_list.body[6] = 4;
1459 	pp->channel_list.body[7] = 11;
1460 	pp->channel_list.body[8] = 5;
1461 	pp->channel_list.body[9] = 12;
1462 	pp->channel_list.body[10] = 6;
1463 	pp->channel_list.body[11] = 13;
1464 	pp->channel_list.body[12] = 7;
1465 	if (priv->reg.phy_type == D_11G_ONLY_MODE) {
1466 		pp->channel_list.size = 13;
1467 	} else {
1468 		pp->channel_list.body[13] = 14;
1469 		pp->channel_list.size = 14;
1470 	}
1471 
1472 	/* send to device request */
1473 	ps_confirm_wait_inc(priv);
1474 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1475 }
1476 
1477 static void hostif_infrastructure_set2_request(struct ks_wlan_private *priv)
1478 {
1479 	struct hostif_infrastructure_set2_request_t *pp;
1480 	u16 capability;
1481 
1482 	DPRINTK(2, "ssid.size=%d\n", priv->reg.ssid.size);
1483 
1484 	pp = hostif_generic_request(sizeof(*pp), HIF_INFRA_SET2_REQ);
1485 	if (!pp)
1486 		return;
1487 
1488 	pp->phy_type = cpu_to_le16((uint16_t)(priv->reg.phy_type));
1489 	pp->cts_mode = cpu_to_le16((uint16_t)(priv->reg.cts_mode));
1490 	pp->scan_type = cpu_to_le16((uint16_t)(priv->reg.scan_type));
1491 
1492 	pp->rate_set.size = priv->reg.rate_set.size;
1493 	memcpy(&pp->rate_set.body[0], &priv->reg.rate_set.body[0],
1494 	       priv->reg.rate_set.size);
1495 	pp->ssid.size = priv->reg.ssid.size;
1496 	memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1497 
1498 	capability = 0x0000;
1499 	if (priv->reg.preamble == SHORT_PREAMBLE) {
1500 		/* short preamble */
1501 		capability |= BSS_CAP_SHORT_PREAMBLE;
1502 	}
1503 	capability &= ~(BSS_CAP_PBCC);	/* pbcc not support */
1504 	if (priv->reg.phy_type != D_11B_ONLY_MODE) {
1505 		capability |= BSS_CAP_SHORT_SLOT_TIME;	/* ShortSlotTime support */
1506 		capability &= ~(BSS_CAP_DSSS_OFDM);	/* DSSS OFDM not support */
1507 	}
1508 	pp->capability = cpu_to_le16((uint16_t)capability);
1509 	pp->beacon_lost_count =
1510 	    cpu_to_le16((uint16_t)(priv->reg.beacon_lost_count));
1511 	pp->auth_type = cpu_to_le16((uint16_t)(priv->reg.authenticate_type));
1512 
1513 	pp->channel_list.body[0] = 1;
1514 	pp->channel_list.body[1] = 8;
1515 	pp->channel_list.body[2] = 2;
1516 	pp->channel_list.body[3] = 9;
1517 	pp->channel_list.body[4] = 3;
1518 	pp->channel_list.body[5] = 10;
1519 	pp->channel_list.body[6] = 4;
1520 	pp->channel_list.body[7] = 11;
1521 	pp->channel_list.body[8] = 5;
1522 	pp->channel_list.body[9] = 12;
1523 	pp->channel_list.body[10] = 6;
1524 	pp->channel_list.body[11] = 13;
1525 	pp->channel_list.body[12] = 7;
1526 	if (priv->reg.phy_type == D_11G_ONLY_MODE) {
1527 		pp->channel_list.size = 13;
1528 	} else {
1529 		pp->channel_list.body[13] = 14;
1530 		pp->channel_list.size = 14;
1531 	}
1532 
1533 	memcpy(pp->bssid, priv->reg.bssid, ETH_ALEN);
1534 
1535 	/* send to device request */
1536 	ps_confirm_wait_inc(priv);
1537 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1538 }
1539 
1540 static
1541 void hostif_adhoc_set_request(struct ks_wlan_private *priv)
1542 {
1543 	struct hostif_adhoc_set_request_t *pp;
1544 	u16 capability;
1545 
1546 	DPRINTK(3, "\n");
1547 
1548 	pp = hostif_generic_request(sizeof(*pp), HIF_ADH_SET_REQ);
1549 	if (!pp)
1550 		return;
1551 
1552 	pp->phy_type = cpu_to_le16((uint16_t)(priv->reg.phy_type));
1553 	pp->cts_mode = cpu_to_le16((uint16_t)(priv->reg.cts_mode));
1554 	pp->scan_type = cpu_to_le16((uint16_t)(priv->reg.scan_type));
1555 	pp->channel = cpu_to_le16((uint16_t)(priv->reg.channel));
1556 	pp->rate_set.size = priv->reg.rate_set.size;
1557 	memcpy(&pp->rate_set.body[0], &priv->reg.rate_set.body[0],
1558 	       priv->reg.rate_set.size);
1559 	pp->ssid.size = priv->reg.ssid.size;
1560 	memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1561 
1562 	capability = 0x0000;
1563 	if (priv->reg.preamble == SHORT_PREAMBLE) {
1564 		/* short preamble */
1565 		capability |= BSS_CAP_SHORT_PREAMBLE;
1566 	}
1567 	capability &= ~(BSS_CAP_PBCC);	/* pbcc not support */
1568 	if (priv->reg.phy_type != D_11B_ONLY_MODE) {
1569 		capability |= BSS_CAP_SHORT_SLOT_TIME;	/* ShortSlotTime support */
1570 		capability &= ~(BSS_CAP_DSSS_OFDM);	/* DSSS OFDM not support */
1571 	}
1572 	pp->capability = cpu_to_le16((uint16_t)capability);
1573 
1574 	/* send to device request */
1575 	ps_confirm_wait_inc(priv);
1576 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1577 }
1578 
1579 static
1580 void hostif_adhoc_set2_request(struct ks_wlan_private *priv)
1581 {
1582 	struct hostif_adhoc_set2_request_t *pp;
1583 	u16 capability;
1584 
1585 	DPRINTK(3, "\n");
1586 
1587 	pp = hostif_generic_request(sizeof(*pp), HIF_ADH_SET_REQ);
1588 	if (!pp)
1589 		return;
1590 
1591 	pp->phy_type = cpu_to_le16((uint16_t)(priv->reg.phy_type));
1592 	pp->cts_mode = cpu_to_le16((uint16_t)(priv->reg.cts_mode));
1593 	pp->scan_type = cpu_to_le16((uint16_t)(priv->reg.scan_type));
1594 	pp->rate_set.size = priv->reg.rate_set.size;
1595 	memcpy(&pp->rate_set.body[0], &priv->reg.rate_set.body[0],
1596 	       priv->reg.rate_set.size);
1597 	pp->ssid.size = priv->reg.ssid.size;
1598 	memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1599 
1600 	capability = 0x0000;
1601 	if (priv->reg.preamble == SHORT_PREAMBLE) {
1602 		/* short preamble */
1603 		capability |= BSS_CAP_SHORT_PREAMBLE;
1604 	}
1605 	capability &= ~(BSS_CAP_PBCC);	/* pbcc not support */
1606 	if (priv->reg.phy_type != D_11B_ONLY_MODE) {
1607 		capability |= BSS_CAP_SHORT_SLOT_TIME;	/* ShortSlotTime support */
1608 		capability &= ~(BSS_CAP_DSSS_OFDM);	/* DSSS OFDM not support */
1609 	}
1610 	pp->capability = cpu_to_le16((uint16_t)capability);
1611 
1612 	pp->channel_list.body[0] = priv->reg.channel;
1613 	pp->channel_list.size = 1;
1614 	memcpy(pp->bssid, priv->reg.bssid, ETH_ALEN);
1615 
1616 	/* send to device request */
1617 	ps_confirm_wait_inc(priv);
1618 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1619 }
1620 
1621 static
1622 void hostif_stop_request(struct ks_wlan_private *priv)
1623 {
1624 	struct hostif_stop_request_t *pp;
1625 
1626 	DPRINTK(3, "\n");
1627 
1628 	pp = hostif_generic_request(sizeof(*pp), HIF_STOP_REQ);
1629 	if (!pp)
1630 		return;
1631 
1632 	/* send to device request */
1633 	ps_confirm_wait_inc(priv);
1634 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1635 }
1636 
1637 static
1638 void hostif_phy_information_request(struct ks_wlan_private *priv)
1639 {
1640 	struct hostif_phy_information_request_t *pp;
1641 
1642 	DPRINTK(3, "\n");
1643 
1644 	pp = hostif_generic_request(sizeof(*pp), HIF_PHY_INFO_REQ);
1645 	if (!pp)
1646 		return;
1647 
1648 	if (priv->reg.phy_info_timer) {
1649 		pp->type = cpu_to_le16((uint16_t)TIME_TYPE);
1650 		pp->time = cpu_to_le16((uint16_t)(priv->reg.phy_info_timer));
1651 	} else {
1652 		pp->type = cpu_to_le16((uint16_t)NORMAL_TYPE);
1653 		pp->time = cpu_to_le16((uint16_t)0);
1654 	}
1655 
1656 	/* send to device request */
1657 	ps_confirm_wait_inc(priv);
1658 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1659 }
1660 
1661 static
1662 void hostif_power_mgmt_request(struct ks_wlan_private *priv,
1663 			       unsigned long mode, unsigned long wake_up,
1664 			       unsigned long receiveDTIMs)
1665 {
1666 	struct hostif_power_mgmt_request_t *pp;
1667 
1668 	DPRINTK(3, "mode=%lu wake_up=%lu receiveDTIMs=%lu\n", mode, wake_up,
1669 		receiveDTIMs);
1670 
1671 	pp = hostif_generic_request(sizeof(*pp), HIF_POWER_MGMT_REQ);
1672 	if (!pp)
1673 		return;
1674 
1675 	pp->mode = cpu_to_le32((uint32_t)mode);
1676 	pp->wake_up = cpu_to_le32((uint32_t)wake_up);
1677 	pp->receiveDTIMs = cpu_to_le32((uint32_t)receiveDTIMs);
1678 
1679 	/* send to device request */
1680 	ps_confirm_wait_inc(priv);
1681 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1682 }
1683 
1684 static
1685 void hostif_sleep_request(struct ks_wlan_private *priv,
1686 			  enum sleep_mode_type mode)
1687 {
1688 	struct hostif_sleep_request_t *pp;
1689 
1690 	DPRINTK(3, "mode=%lu\n", (long)mode);
1691 
1692 	if (mode == SLP_SLEEP) {
1693 		pp = hostif_generic_request(sizeof(*pp), HIF_SLEEP_REQ);
1694 		if (!pp)
1695 			return;
1696 
1697 		/* send to device request */
1698 		ps_confirm_wait_inc(priv);
1699 		ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL,
1700 			      NULL);
1701 	} else if (mode == SLP_ACTIVE) {
1702 		atomic_set(&priv->sleepstatus.wakeup_request, 1);
1703 		queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
1704 	} else {
1705 		DPRINTK(3, "invalid mode %ld\n", (long)mode);
1706 		return;
1707 	}
1708 }
1709 
1710 static
1711 void hostif_bss_scan_request(struct ks_wlan_private *priv,
1712 			     unsigned long scan_type, uint8_t *scan_ssid,
1713 			     uint8_t scan_ssid_len)
1714 {
1715 	struct hostif_bss_scan_request_t *pp;
1716 
1717 	DPRINTK(2, "\n");
1718 
1719 	pp = hostif_generic_request(sizeof(*pp), HIF_SCAN_REQ);
1720 	if (!pp)
1721 		return;
1722 
1723 	pp->scan_type = scan_type;
1724 
1725 	pp->ch_time_min = cpu_to_le32((uint32_t)110);	/* default value */
1726 	pp->ch_time_max = cpu_to_le32((uint32_t)130);	/* default value */
1727 	pp->channel_list.body[0] = 1;
1728 	pp->channel_list.body[1] = 8;
1729 	pp->channel_list.body[2] = 2;
1730 	pp->channel_list.body[3] = 9;
1731 	pp->channel_list.body[4] = 3;
1732 	pp->channel_list.body[5] = 10;
1733 	pp->channel_list.body[6] = 4;
1734 	pp->channel_list.body[7] = 11;
1735 	pp->channel_list.body[8] = 5;
1736 	pp->channel_list.body[9] = 12;
1737 	pp->channel_list.body[10] = 6;
1738 	pp->channel_list.body[11] = 13;
1739 	pp->channel_list.body[12] = 7;
1740 	if (priv->reg.phy_type == D_11G_ONLY_MODE) {
1741 		pp->channel_list.size = 13;
1742 	} else {
1743 		pp->channel_list.body[13] = 14;
1744 		pp->channel_list.size = 14;
1745 	}
1746 	pp->ssid.size = 0;
1747 
1748 	/* specified SSID SCAN */
1749 	if (scan_ssid_len > 0 && scan_ssid_len <= 32) {
1750 		pp->ssid.size = scan_ssid_len;
1751 		memcpy(&pp->ssid.body[0], scan_ssid, scan_ssid_len);
1752 	}
1753 
1754 	/* send to device request */
1755 	ps_confirm_wait_inc(priv);
1756 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1757 
1758 	priv->aplist.size = 0;
1759 	priv->scan_ind_count = 0;
1760 }
1761 
1762 static
1763 void hostif_mic_failure_request(struct ks_wlan_private *priv,
1764 				unsigned short failure_count,
1765 				unsigned short timer)
1766 {
1767 	struct hostif_mic_failure_request_t *pp;
1768 
1769 	DPRINTK(3, "count=%d :: timer=%d\n", failure_count, timer);
1770 
1771 	pp = hostif_generic_request(sizeof(*pp), HIF_MIC_FAILURE_REQ);
1772 	if (!pp)
1773 		return;
1774 
1775 	pp->failure_count = cpu_to_le16((uint16_t)failure_count);
1776 	pp->timer = cpu_to_le16((uint16_t)timer);
1777 
1778 	/* send to device request */
1779 	ps_confirm_wait_inc(priv);
1780 	ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL);
1781 }
1782 
1783 /* Device I/O Receive indicate */
1784 static void devio_rec_ind(struct ks_wlan_private *priv, unsigned char *p,
1785 			  unsigned int size)
1786 {
1787 	if (priv->device_open_status) {
1788 		spin_lock(&priv->dev_read_lock);	/* request spin lock */
1789 		priv->dev_data[atomic_read(&priv->rec_count)] = p;
1790 		priv->dev_size[atomic_read(&priv->rec_count)] = size;
1791 
1792 		if (atomic_read(&priv->event_count) != DEVICE_STOCK_COUNT) {
1793 			/* rx event count inc */
1794 			atomic_inc(&priv->event_count);
1795 		}
1796 		atomic_inc(&priv->rec_count);
1797 		if (atomic_read(&priv->rec_count) == DEVICE_STOCK_COUNT)
1798 			atomic_set(&priv->rec_count, 0);
1799 
1800 		wake_up_interruptible_all(&priv->devread_wait);
1801 
1802 		/* release spin lock */
1803 		spin_unlock(&priv->dev_read_lock);
1804 	}
1805 }
1806 
1807 void hostif_receive(struct ks_wlan_private *priv, unsigned char *p,
1808 		    unsigned int size)
1809 {
1810 	DPRINTK(4, "\n");
1811 
1812 	devio_rec_ind(priv, p, size);
1813 
1814 	priv->rxp = p;
1815 	priv->rx_size = size;
1816 
1817 	if (get_WORD(priv) == priv->rx_size) {	/* length check !! */
1818 		hostif_event_check(priv);	/* event check */
1819 	}
1820 }
1821 
1822 static
1823 void hostif_sme_set_wep(struct ks_wlan_private *priv, int type)
1824 {
1825 	u32 val;
1826 
1827 	switch (type) {
1828 	case SME_WEP_INDEX_REQUEST:
1829 		val = cpu_to_le32((uint32_t)(priv->reg.wep_index));
1830 		hostif_mib_set_request(priv, DOT11_WEP_DEFAULT_KEY_ID,
1831 				       sizeof(val), MIB_VALUE_TYPE_INT, &val);
1832 		break;
1833 	case SME_WEP_KEY1_REQUEST:
1834 		if (!priv->wpa.wpa_enabled)
1835 			hostif_mib_set_request(priv,
1836 					       DOT11_WEP_DEFAULT_KEY_VALUE1,
1837 					       priv->reg.wep_key[0].size,
1838 					       MIB_VALUE_TYPE_OSTRING,
1839 					       &priv->reg.wep_key[0].val[0]);
1840 		break;
1841 	case SME_WEP_KEY2_REQUEST:
1842 		if (!priv->wpa.wpa_enabled)
1843 			hostif_mib_set_request(priv,
1844 					       DOT11_WEP_DEFAULT_KEY_VALUE2,
1845 					       priv->reg.wep_key[1].size,
1846 					       MIB_VALUE_TYPE_OSTRING,
1847 					       &priv->reg.wep_key[1].val[0]);
1848 		break;
1849 	case SME_WEP_KEY3_REQUEST:
1850 		if (!priv->wpa.wpa_enabled)
1851 			hostif_mib_set_request(priv,
1852 					       DOT11_WEP_DEFAULT_KEY_VALUE3,
1853 					       priv->reg.wep_key[2].size,
1854 					       MIB_VALUE_TYPE_OSTRING,
1855 					       &priv->reg.wep_key[2].val[0]);
1856 		break;
1857 	case SME_WEP_KEY4_REQUEST:
1858 		if (!priv->wpa.wpa_enabled)
1859 			hostif_mib_set_request(priv,
1860 					       DOT11_WEP_DEFAULT_KEY_VALUE4,
1861 					       priv->reg.wep_key[3].size,
1862 					       MIB_VALUE_TYPE_OSTRING,
1863 					       &priv->reg.wep_key[3].val[0]);
1864 		break;
1865 	case SME_WEP_FLAG_REQUEST:
1866 		val = cpu_to_le32((uint32_t)(priv->reg.privacy_invoked));
1867 		hostif_mib_set_request(priv, DOT11_PRIVACY_INVOKED,
1868 				       sizeof(val), MIB_VALUE_TYPE_BOOL, &val);
1869 		break;
1870 	}
1871 }
1872 
1873 struct wpa_suite_t {
1874 	unsigned short size;
1875 	unsigned char suite[4][CIPHER_ID_LEN];
1876 } __packed;
1877 
1878 struct rsn_mode_t {
1879 	u32 rsn_mode;
1880 	u16 rsn_capability;
1881 } __packed;
1882 
1883 static
1884 void hostif_sme_set_rsn(struct ks_wlan_private *priv, int type)
1885 {
1886 	struct wpa_suite_t wpa_suite;
1887 	struct rsn_mode_t rsn_mode;
1888 	u32 val;
1889 
1890 	memset(&wpa_suite, 0, sizeof(wpa_suite));
1891 
1892 	switch (type) {
1893 	case SME_RSN_UCAST_REQUEST:
1894 		wpa_suite.size = cpu_to_le16((uint16_t)1);
1895 		switch (priv->wpa.pairwise_suite) {
1896 		case IW_AUTH_CIPHER_NONE:
1897 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1898 				memcpy(&wpa_suite.suite[0][0],
1899 				       CIPHER_ID_WPA2_NONE, CIPHER_ID_LEN);
1900 			else
1901 				memcpy(&wpa_suite.suite[0][0],
1902 				       CIPHER_ID_WPA_NONE, CIPHER_ID_LEN);
1903 			break;
1904 		case IW_AUTH_CIPHER_WEP40:
1905 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1906 				memcpy(&wpa_suite.suite[0][0],
1907 				       CIPHER_ID_WPA2_WEP40, CIPHER_ID_LEN);
1908 			else
1909 				memcpy(&wpa_suite.suite[0][0],
1910 				       CIPHER_ID_WPA_WEP40, CIPHER_ID_LEN);
1911 			break;
1912 		case IW_AUTH_CIPHER_TKIP:
1913 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1914 				memcpy(&wpa_suite.suite[0][0],
1915 				       CIPHER_ID_WPA2_TKIP, CIPHER_ID_LEN);
1916 			else
1917 				memcpy(&wpa_suite.suite[0][0],
1918 				       CIPHER_ID_WPA_TKIP, CIPHER_ID_LEN);
1919 			break;
1920 		case IW_AUTH_CIPHER_CCMP:
1921 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1922 				memcpy(&wpa_suite.suite[0][0],
1923 				       CIPHER_ID_WPA2_CCMP, CIPHER_ID_LEN);
1924 			else
1925 				memcpy(&wpa_suite.suite[0][0],
1926 				       CIPHER_ID_WPA_CCMP, CIPHER_ID_LEN);
1927 			break;
1928 		case IW_AUTH_CIPHER_WEP104:
1929 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1930 				memcpy(&wpa_suite.suite[0][0],
1931 				       CIPHER_ID_WPA2_WEP104, CIPHER_ID_LEN);
1932 			else
1933 				memcpy(&wpa_suite.suite[0][0],
1934 				       CIPHER_ID_WPA_WEP104, CIPHER_ID_LEN);
1935 			break;
1936 		}
1937 
1938 		hostif_mib_set_request(priv, DOT11_RSN_CONFIG_UNICAST_CIPHER,
1939 				       sizeof(wpa_suite.size) +
1940 				       CIPHER_ID_LEN * wpa_suite.size,
1941 				       MIB_VALUE_TYPE_OSTRING, &wpa_suite);
1942 		break;
1943 	case SME_RSN_MCAST_REQUEST:
1944 		switch (priv->wpa.group_suite) {
1945 		case IW_AUTH_CIPHER_NONE:
1946 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1947 				memcpy(&wpa_suite.suite[0][0],
1948 				       CIPHER_ID_WPA2_NONE, CIPHER_ID_LEN);
1949 			else
1950 				memcpy(&wpa_suite.suite[0][0],
1951 				       CIPHER_ID_WPA_NONE, CIPHER_ID_LEN);
1952 			break;
1953 		case IW_AUTH_CIPHER_WEP40:
1954 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1955 				memcpy(&wpa_suite.suite[0][0],
1956 				       CIPHER_ID_WPA2_WEP40, CIPHER_ID_LEN);
1957 			else
1958 				memcpy(&wpa_suite.suite[0][0],
1959 				       CIPHER_ID_WPA_WEP40, CIPHER_ID_LEN);
1960 			break;
1961 		case IW_AUTH_CIPHER_TKIP:
1962 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1963 				memcpy(&wpa_suite.suite[0][0],
1964 				       CIPHER_ID_WPA2_TKIP, CIPHER_ID_LEN);
1965 			else
1966 				memcpy(&wpa_suite.suite[0][0],
1967 				       CIPHER_ID_WPA_TKIP, CIPHER_ID_LEN);
1968 			break;
1969 		case IW_AUTH_CIPHER_CCMP:
1970 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1971 				memcpy(&wpa_suite.suite[0][0],
1972 				       CIPHER_ID_WPA2_CCMP, CIPHER_ID_LEN);
1973 			else
1974 				memcpy(&wpa_suite.suite[0][0],
1975 				       CIPHER_ID_WPA_CCMP, CIPHER_ID_LEN);
1976 			break;
1977 		case IW_AUTH_CIPHER_WEP104:
1978 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1979 				memcpy(&wpa_suite.suite[0][0],
1980 				       CIPHER_ID_WPA2_WEP104, CIPHER_ID_LEN);
1981 			else
1982 				memcpy(&wpa_suite.suite[0][0],
1983 				       CIPHER_ID_WPA_WEP104, CIPHER_ID_LEN);
1984 			break;
1985 		}
1986 
1987 		hostif_mib_set_request(priv, DOT11_RSN_CONFIG_MULTICAST_CIPHER,
1988 				       CIPHER_ID_LEN, MIB_VALUE_TYPE_OSTRING,
1989 				       &wpa_suite.suite[0][0]);
1990 		break;
1991 	case SME_RSN_AUTH_REQUEST:
1992 		wpa_suite.size = cpu_to_le16((uint16_t)1);
1993 		switch (priv->wpa.key_mgmt_suite) {
1994 		case IW_AUTH_KEY_MGMT_802_1X:
1995 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
1996 				memcpy(&wpa_suite.suite[0][0],
1997 				       KEY_MGMT_ID_WPA2_1X, KEY_MGMT_ID_LEN);
1998 			else
1999 				memcpy(&wpa_suite.suite[0][0],
2000 				       KEY_MGMT_ID_WPA_1X, KEY_MGMT_ID_LEN);
2001 			break;
2002 		case IW_AUTH_KEY_MGMT_PSK:
2003 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
2004 				memcpy(&wpa_suite.suite[0][0],
2005 				       KEY_MGMT_ID_WPA2_PSK, KEY_MGMT_ID_LEN);
2006 			else
2007 				memcpy(&wpa_suite.suite[0][0],
2008 				       KEY_MGMT_ID_WPA_PSK, KEY_MGMT_ID_LEN);
2009 			break;
2010 		case 0:
2011 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
2012 				memcpy(&wpa_suite.suite[0][0],
2013 				       KEY_MGMT_ID_WPA2_NONE, KEY_MGMT_ID_LEN);
2014 			else
2015 				memcpy(&wpa_suite.suite[0][0],
2016 				       KEY_MGMT_ID_WPA_NONE, KEY_MGMT_ID_LEN);
2017 			break;
2018 		case 4:
2019 			if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)
2020 				memcpy(&wpa_suite.suite[0][0],
2021 				       KEY_MGMT_ID_WPA2_WPANONE,
2022 				       KEY_MGMT_ID_LEN);
2023 			else
2024 				memcpy(&wpa_suite.suite[0][0],
2025 				       KEY_MGMT_ID_WPA_WPANONE,
2026 				       KEY_MGMT_ID_LEN);
2027 			break;
2028 		}
2029 
2030 		hostif_mib_set_request(priv, DOT11_RSN_CONFIG_AUTH_SUITE,
2031 				       sizeof(wpa_suite.size) +
2032 				       KEY_MGMT_ID_LEN * wpa_suite.size,
2033 				       MIB_VALUE_TYPE_OSTRING, &wpa_suite);
2034 		break;
2035 	case SME_RSN_ENABLED_REQUEST:
2036 		val = cpu_to_le32((uint32_t)(priv->wpa.rsn_enabled));
2037 		hostif_mib_set_request(priv, DOT11_RSN_ENABLED,
2038 				       sizeof(val), MIB_VALUE_TYPE_BOOL, &val);
2039 		break;
2040 	case SME_RSN_MODE_REQUEST:
2041 		if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) {
2042 			rsn_mode.rsn_mode =
2043 			    cpu_to_le32((uint32_t)RSN_MODE_WPA2);
2044 			rsn_mode.rsn_capability = cpu_to_le16((uint16_t)0);
2045 		} else if (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA) {
2046 			rsn_mode.rsn_mode =
2047 			    cpu_to_le32((uint32_t)RSN_MODE_WPA);
2048 			rsn_mode.rsn_capability = cpu_to_le16((uint16_t)0);
2049 		} else {
2050 			rsn_mode.rsn_mode =
2051 			    cpu_to_le32((uint32_t)RSN_MODE_NONE);
2052 			rsn_mode.rsn_capability = cpu_to_le16((uint16_t)0);
2053 		}
2054 		hostif_mib_set_request(priv, LOCAL_RSN_MODE, sizeof(rsn_mode),
2055 				       MIB_VALUE_TYPE_OSTRING, &rsn_mode);
2056 		break;
2057 	}
2058 }
2059 
2060 static
2061 void hostif_sme_mode_setup(struct ks_wlan_private *priv)
2062 {
2063 	unsigned char rate_size;
2064 	unsigned char rate_octet[RATE_SET_MAX_SIZE];
2065 	int i = 0;
2066 
2067 	/* rate setting if rate segging is auto for changing phy_type (#94) */
2068 	if (priv->reg.tx_rate == TX_RATE_FULL_AUTO) {
2069 		if (priv->reg.phy_type == D_11B_ONLY_MODE) {
2070 			priv->reg.rate_set.body[3] = TX_RATE_11M;
2071 			priv->reg.rate_set.body[2] = TX_RATE_5M;
2072 			priv->reg.rate_set.body[1] = TX_RATE_2M | BASIC_RATE;
2073 			priv->reg.rate_set.body[0] = TX_RATE_1M | BASIC_RATE;
2074 			priv->reg.rate_set.size = 4;
2075 		} else {	/* D_11G_ONLY_MODE or D_11BG_COMPATIBLE_MODE */
2076 			priv->reg.rate_set.body[11] = TX_RATE_54M;
2077 			priv->reg.rate_set.body[10] = TX_RATE_48M;
2078 			priv->reg.rate_set.body[9] = TX_RATE_36M;
2079 			priv->reg.rate_set.body[8] = TX_RATE_18M;
2080 			priv->reg.rate_set.body[7] = TX_RATE_9M;
2081 			priv->reg.rate_set.body[6] = TX_RATE_24M | BASIC_RATE;
2082 			priv->reg.rate_set.body[5] = TX_RATE_12M | BASIC_RATE;
2083 			priv->reg.rate_set.body[4] = TX_RATE_6M | BASIC_RATE;
2084 			priv->reg.rate_set.body[3] = TX_RATE_11M | BASIC_RATE;
2085 			priv->reg.rate_set.body[2] = TX_RATE_5M | BASIC_RATE;
2086 			priv->reg.rate_set.body[1] = TX_RATE_2M | BASIC_RATE;
2087 			priv->reg.rate_set.body[0] = TX_RATE_1M | BASIC_RATE;
2088 			priv->reg.rate_set.size = 12;
2089 		}
2090 	}
2091 
2092 	/* rate mask by phy setting */
2093 	if (priv->reg.phy_type == D_11B_ONLY_MODE) {
2094 		for (i = 0; i < priv->reg.rate_set.size; i++) {
2095 			if (!IS_11B_RATE(priv->reg.rate_set.body[i]))
2096 				break;
2097 
2098 			if ((priv->reg.rate_set.body[i] & RATE_MASK) >= TX_RATE_5M) {
2099 				rate_octet[i] = priv->reg.rate_set.body[i] &
2100 						RATE_MASK;
2101 			} else {
2102 				rate_octet[i] = priv->reg.rate_set.body[i];
2103 			}
2104 		}
2105 
2106 	} else {	/* D_11G_ONLY_MODE or D_11BG_COMPATIBLE_MODE */
2107 		for (i = 0; i < priv->reg.rate_set.size; i++) {
2108 			if (!IS_11BG_RATE(priv->reg.rate_set.body[i]))
2109 				break;
2110 
2111 			if (IS_OFDM_EXT_RATE(priv->reg.rate_set.body[i])) {
2112 				rate_octet[i] = priv->reg.rate_set.body[i] &
2113 						RATE_MASK;
2114 			} else {
2115 				rate_octet[i] = priv->reg.rate_set.body[i];
2116 			}
2117 		}
2118 	}
2119 	rate_size = i;
2120 	if (rate_size == 0) {
2121 		if (priv->reg.phy_type == D_11G_ONLY_MODE)
2122 			rate_octet[0] = TX_RATE_6M | BASIC_RATE;
2123 		else
2124 			rate_octet[0] = TX_RATE_2M | BASIC_RATE;
2125 		rate_size = 1;
2126 	}
2127 
2128 	/* rate set update */
2129 	priv->reg.rate_set.size = rate_size;
2130 	memcpy(&priv->reg.rate_set.body[0], &rate_octet[0], rate_size);
2131 
2132 	switch (priv->reg.operation_mode) {
2133 	case MODE_PSEUDO_ADHOC:
2134 		/* Pseudo Ad-Hoc mode */
2135 		hostif_ps_adhoc_set_request(priv);
2136 		break;
2137 	case MODE_INFRASTRUCTURE:
2138 		/* Infrastructure mode */
2139 		if (!is_valid_ether_addr((u8 *)priv->reg.bssid)) {
2140 			hostif_infrastructure_set_request(priv);
2141 		} else {
2142 			hostif_infrastructure_set2_request(priv);
2143 			DPRINTK(2,
2144 				"Infra bssid = %pM\n", priv->reg.bssid);
2145 		}
2146 		break;
2147 	case MODE_ADHOC:
2148 		/* IEEE802.11 Ad-Hoc mode */
2149 		if (!is_valid_ether_addr((u8 *)priv->reg.bssid)) {
2150 			hostif_adhoc_set_request(priv);
2151 		} else {
2152 			hostif_adhoc_set2_request(priv);
2153 			DPRINTK(2,
2154 				"Adhoc bssid = %pM\n", priv->reg.bssid);
2155 		}
2156 		break;
2157 	default:
2158 		break;
2159 	}
2160 }
2161 
2162 static
2163 void hostif_sme_multicast_set(struct ks_wlan_private *priv)
2164 {
2165 	struct net_device *dev = priv->net_dev;
2166 	int mc_count;
2167 	struct netdev_hw_addr *ha;
2168 	char set_address[NIC_MAX_MCAST_LIST * ETH_ALEN];
2169 	unsigned long filter_type;
2170 	int i = 0;
2171 
2172 	DPRINTK(3, "\n");
2173 
2174 	spin_lock(&priv->multicast_spin);
2175 
2176 	memset(set_address, 0, NIC_MAX_MCAST_LIST * ETH_ALEN);
2177 
2178 	if (dev->flags & IFF_PROMISC) {
2179 		filter_type = cpu_to_le32((uint32_t)MCAST_FILTER_PROMISC);
2180 		hostif_mib_set_request(priv, LOCAL_MULTICAST_FILTER,
2181 				       sizeof(filter_type), MIB_VALUE_TYPE_BOOL,
2182 				       &filter_type);
2183 		goto spin_unlock;
2184 	}
2185 
2186 	if ((netdev_mc_count(dev) > NIC_MAX_MCAST_LIST) ||
2187 	    (dev->flags & IFF_ALLMULTI)) {
2188 		filter_type = cpu_to_le32((uint32_t)MCAST_FILTER_MCASTALL);
2189 		hostif_mib_set_request(priv, LOCAL_MULTICAST_FILTER,
2190 				       sizeof(filter_type), MIB_VALUE_TYPE_BOOL,
2191 				       &filter_type);
2192 		goto spin_unlock;
2193 	}
2194 
2195 	if (priv->sme_i.sme_flag & SME_MULTICAST) {
2196 		mc_count = netdev_mc_count(dev);
2197 		netdev_for_each_mc_addr(ha, dev) {
2198 			memcpy(&set_address[i * ETH_ALEN], ha->addr, ETH_ALEN);
2199 			i++;
2200 		}
2201 		priv->sme_i.sme_flag &= ~SME_MULTICAST;
2202 		hostif_mib_set_request(priv, LOCAL_MULTICAST_ADDRESS,
2203 				       ETH_ALEN * mc_count,
2204 				       MIB_VALUE_TYPE_OSTRING,
2205 				       &set_address[0]);
2206 	} else {
2207 		filter_type = cpu_to_le32((uint32_t)MCAST_FILTER_MCAST);
2208 		priv->sme_i.sme_flag |= SME_MULTICAST;
2209 		hostif_mib_set_request(priv, LOCAL_MULTICAST_FILTER,
2210 				       sizeof(filter_type), MIB_VALUE_TYPE_BOOL,
2211 				       &filter_type);
2212 	}
2213 
2214 spin_unlock:
2215 	spin_unlock(&priv->multicast_spin);
2216 }
2217 
2218 static
2219 void hostif_sme_power_mgmt_set(struct ks_wlan_private *priv)
2220 {
2221 	unsigned long mode, wake_up, receiveDTIMs;
2222 
2223 	DPRINTK(3, "\n");
2224 	switch (priv->reg.power_mgmt) {
2225 	case POWER_MGMT_ACTIVE:
2226 		mode = POWER_ACTIVE;
2227 		wake_up = 0;
2228 		receiveDTIMs = 0;
2229 		break;
2230 	case POWER_MGMT_SAVE1:
2231 		if (priv->reg.operation_mode == MODE_INFRASTRUCTURE) {
2232 			mode = POWER_SAVE;
2233 			wake_up = 0;
2234 			receiveDTIMs = 0;
2235 		} else {
2236 			mode = POWER_ACTIVE;
2237 			wake_up = 0;
2238 			receiveDTIMs = 0;
2239 		}
2240 		break;
2241 	case POWER_MGMT_SAVE2:
2242 		if (priv->reg.operation_mode == MODE_INFRASTRUCTURE) {
2243 			mode = POWER_SAVE;
2244 			wake_up = 0;
2245 			receiveDTIMs = 1;
2246 		} else {
2247 			mode = POWER_ACTIVE;
2248 			wake_up = 0;
2249 			receiveDTIMs = 0;
2250 		}
2251 		break;
2252 	default:
2253 		mode = POWER_ACTIVE;
2254 		wake_up = 0;
2255 		receiveDTIMs = 0;
2256 		break;
2257 	}
2258 	hostif_power_mgmt_request(priv, mode, wake_up, receiveDTIMs);
2259 }
2260 
2261 static
2262 void hostif_sme_sleep_set(struct ks_wlan_private *priv)
2263 {
2264 	DPRINTK(3, "\n");
2265 	switch (priv->sleep_mode) {
2266 	case SLP_SLEEP:
2267 		hostif_sleep_request(priv, priv->sleep_mode);
2268 		break;
2269 	case SLP_ACTIVE:
2270 		hostif_sleep_request(priv, priv->sleep_mode);
2271 		break;
2272 	default:
2273 		break;
2274 	}
2275 }
2276 
2277 static
2278 void hostif_sme_set_key(struct ks_wlan_private *priv, int type)
2279 {
2280 	u32 val;
2281 
2282 	switch (type) {
2283 	case SME_SET_FLAG:
2284 		val = cpu_to_le32((uint32_t)(priv->reg.privacy_invoked));
2285 		hostif_mib_set_request(priv, DOT11_PRIVACY_INVOKED,
2286 				       sizeof(val), MIB_VALUE_TYPE_BOOL, &val);
2287 		break;
2288 	case SME_SET_TXKEY:
2289 		val = cpu_to_le32((uint32_t)(priv->wpa.txkey));
2290 		hostif_mib_set_request(priv, DOT11_WEP_DEFAULT_KEY_ID,
2291 				       sizeof(val), MIB_VALUE_TYPE_INT, &val);
2292 		break;
2293 	case SME_SET_KEY1:
2294 		hostif_mib_set_request(priv, DOT11_WEP_DEFAULT_KEY_VALUE1,
2295 				       priv->wpa.key[0].key_len,
2296 				       MIB_VALUE_TYPE_OSTRING,
2297 				       &priv->wpa.key[0].key_val[0]);
2298 		break;
2299 	case SME_SET_KEY2:
2300 		hostif_mib_set_request(priv, DOT11_WEP_DEFAULT_KEY_VALUE2,
2301 				       priv->wpa.key[1].key_len,
2302 				       MIB_VALUE_TYPE_OSTRING,
2303 				       &priv->wpa.key[1].key_val[0]);
2304 		break;
2305 	case SME_SET_KEY3:
2306 		hostif_mib_set_request(priv, DOT11_WEP_DEFAULT_KEY_VALUE3,
2307 				       priv->wpa.key[2].key_len,
2308 				       MIB_VALUE_TYPE_OSTRING,
2309 				       &priv->wpa.key[2].key_val[0]);
2310 		break;
2311 	case SME_SET_KEY4:
2312 		hostif_mib_set_request(priv, DOT11_WEP_DEFAULT_KEY_VALUE4,
2313 				       priv->wpa.key[3].key_len,
2314 				       MIB_VALUE_TYPE_OSTRING,
2315 				       &priv->wpa.key[3].key_val[0]);
2316 		break;
2317 	case SME_SET_PMK_TSC:
2318 		hostif_mib_set_request(priv, DOT11_PMK_TSC,
2319 				       WPA_RX_SEQ_LEN, MIB_VALUE_TYPE_OSTRING,
2320 				       &priv->wpa.key[0].rx_seq[0]);
2321 		break;
2322 	case SME_SET_GMK1_TSC:
2323 		hostif_mib_set_request(priv, DOT11_GMK1_TSC,
2324 				       WPA_RX_SEQ_LEN, MIB_VALUE_TYPE_OSTRING,
2325 				       &priv->wpa.key[1].rx_seq[0]);
2326 		break;
2327 	case SME_SET_GMK2_TSC:
2328 		hostif_mib_set_request(priv, DOT11_GMK2_TSC,
2329 				       WPA_RX_SEQ_LEN, MIB_VALUE_TYPE_OSTRING,
2330 				       &priv->wpa.key[2].rx_seq[0]);
2331 		break;
2332 	}
2333 }
2334 
2335 static
2336 void hostif_sme_set_pmksa(struct ks_wlan_private *priv)
2337 {
2338 	struct pmk_cache_t {
2339 		u16 size;
2340 		struct {
2341 			u8 bssid[ETH_ALEN];
2342 			u8 pmkid[IW_PMKID_LEN];
2343 		} __packed list[PMK_LIST_MAX];
2344 	} __packed pmkcache;
2345 	struct pmk_t *pmk;
2346 	int i;
2347 
2348 	DPRINTK(4, "pmklist.size=%d\n", priv->pmklist.size);
2349 	i = 0;
2350 	list_for_each_entry(pmk, &priv->pmklist.head, list) {
2351 		if (i < PMK_LIST_MAX) {
2352 			memcpy(pmkcache.list[i].bssid, pmk->bssid, ETH_ALEN);
2353 			memcpy(pmkcache.list[i].pmkid, pmk->pmkid,
2354 			       IW_PMKID_LEN);
2355 			i++;
2356 		}
2357 	}
2358 	pmkcache.size = cpu_to_le16((uint16_t)(priv->pmklist.size));
2359 	hostif_mib_set_request(priv, LOCAL_PMK,
2360 			       sizeof(priv->pmklist.size) + (ETH_ALEN +
2361 							     IW_PMKID_LEN) *
2362 			       (priv->pmklist.size), MIB_VALUE_TYPE_OSTRING,
2363 			       &pmkcache);
2364 }
2365 
2366 /* execute sme */
2367 static
2368 void hostif_sme_execute(struct ks_wlan_private *priv, int event)
2369 {
2370 	u32 val;
2371 
2372 	DPRINTK(3, "event=%d\n", event);
2373 	switch (event) {
2374 	case SME_START:
2375 		if (priv->dev_state == DEVICE_STATE_BOOT)
2376 			hostif_mib_get_request(priv, DOT11_MAC_ADDRESS);
2377 		break;
2378 	case SME_MULTICAST_REQUEST:
2379 		hostif_sme_multicast_set(priv);
2380 		break;
2381 	case SME_MACADDRESS_SET_REQUEST:
2382 		hostif_mib_set_request(priv, LOCAL_CURRENTADDRESS, ETH_ALEN,
2383 				       MIB_VALUE_TYPE_OSTRING,
2384 				       &priv->eth_addr[0]);
2385 		break;
2386 	case SME_BSS_SCAN_REQUEST:
2387 		hostif_bss_scan_request(priv, priv->reg.scan_type,
2388 					priv->scan_ssid, priv->scan_ssid_len);
2389 		break;
2390 	case SME_POW_MNGMT_REQUEST:
2391 		hostif_sme_power_mgmt_set(priv);
2392 		break;
2393 	case SME_PHY_INFO_REQUEST:
2394 		hostif_phy_information_request(priv);
2395 		break;
2396 	case SME_MIC_FAILURE_REQUEST:
2397 		if (priv->wpa.mic_failure.failure == 1) {
2398 			hostif_mic_failure_request(priv,
2399 						   priv->wpa.mic_failure.failure - 1,
2400 						   0);
2401 		} else if (priv->wpa.mic_failure.failure == 2) {
2402 			hostif_mic_failure_request(priv,
2403 						   priv->wpa.mic_failure.failure - 1,
2404 						   priv->wpa.mic_failure.counter);
2405 		} else {
2406 			DPRINTK(4, "SME_MIC_FAILURE_REQUEST: failure count=%u error?\n",
2407 				priv->wpa.mic_failure.failure);
2408 		}
2409 		break;
2410 	case SME_MIC_FAILURE_CONFIRM:
2411 		if (priv->wpa.mic_failure.failure == 2) {
2412 			if (priv->wpa.mic_failure.stop)
2413 				priv->wpa.mic_failure.stop = 0;
2414 			priv->wpa.mic_failure.failure = 0;
2415 			hostif_start_request(priv, priv->reg.operation_mode);
2416 		}
2417 		break;
2418 	case SME_GET_MAC_ADDRESS:
2419 		if (priv->dev_state == DEVICE_STATE_BOOT)
2420 			hostif_mib_get_request(priv, DOT11_PRODUCT_VERSION);
2421 		break;
2422 	case SME_GET_PRODUCT_VERSION:
2423 		if (priv->dev_state == DEVICE_STATE_BOOT)
2424 			priv->dev_state = DEVICE_STATE_PREINIT;
2425 		break;
2426 	case SME_STOP_REQUEST:
2427 		hostif_stop_request(priv);
2428 		break;
2429 	case SME_RTS_THRESHOLD_REQUEST:
2430 		val = cpu_to_le32((uint32_t)(priv->reg.rts));
2431 		hostif_mib_set_request(priv, DOT11_RTS_THRESHOLD,
2432 				       sizeof(val), MIB_VALUE_TYPE_INT, &val);
2433 		break;
2434 	case SME_FRAGMENTATION_THRESHOLD_REQUEST:
2435 		val = cpu_to_le32((uint32_t)(priv->reg.fragment));
2436 		hostif_mib_set_request(priv, DOT11_FRAGMENTATION_THRESHOLD,
2437 				       sizeof(val), MIB_VALUE_TYPE_INT, &val);
2438 		break;
2439 	case SME_WEP_INDEX_REQUEST:
2440 	case SME_WEP_KEY1_REQUEST:
2441 	case SME_WEP_KEY2_REQUEST:
2442 	case SME_WEP_KEY3_REQUEST:
2443 	case SME_WEP_KEY4_REQUEST:
2444 	case SME_WEP_FLAG_REQUEST:
2445 		hostif_sme_set_wep(priv, event);
2446 		break;
2447 	case SME_RSN_UCAST_REQUEST:
2448 	case SME_RSN_MCAST_REQUEST:
2449 	case SME_RSN_AUTH_REQUEST:
2450 	case SME_RSN_ENABLED_REQUEST:
2451 	case SME_RSN_MODE_REQUEST:
2452 		hostif_sme_set_rsn(priv, event);
2453 		break;
2454 	case SME_SET_FLAG:
2455 	case SME_SET_TXKEY:
2456 	case SME_SET_KEY1:
2457 	case SME_SET_KEY2:
2458 	case SME_SET_KEY3:
2459 	case SME_SET_KEY4:
2460 	case SME_SET_PMK_TSC:
2461 	case SME_SET_GMK1_TSC:
2462 	case SME_SET_GMK2_TSC:
2463 		hostif_sme_set_key(priv, event);
2464 		break;
2465 	case SME_SET_PMKSA:
2466 		hostif_sme_set_pmksa(priv);
2467 		break;
2468 #ifdef WPS
2469 	case SME_WPS_ENABLE_REQUEST:
2470 		hostif_mib_set_request(priv, LOCAL_WPS_ENABLE,
2471 				       sizeof(priv->wps.wps_enabled),
2472 				       MIB_VALUE_TYPE_INT,
2473 				       &priv->wps.wps_enabled);
2474 		break;
2475 	case SME_WPS_PROBE_REQUEST:
2476 		hostif_mib_set_request(priv, LOCAL_WPS_PROBE_REQ,
2477 				       priv->wps.ielen,
2478 				       MIB_VALUE_TYPE_OSTRING, priv->wps.ie);
2479 		break;
2480 #endif /* WPS */
2481 	case SME_MODE_SET_REQUEST:
2482 		hostif_sme_mode_setup(priv);
2483 		break;
2484 	case SME_SET_GAIN:
2485 		hostif_mib_set_request(priv, LOCAL_GAIN,
2486 				       sizeof(priv->gain),
2487 				       MIB_VALUE_TYPE_OSTRING, &priv->gain);
2488 		break;
2489 	case SME_GET_GAIN:
2490 		hostif_mib_get_request(priv, LOCAL_GAIN);
2491 		break;
2492 	case SME_GET_EEPROM_CKSUM:
2493 		priv->eeprom_checksum = EEPROM_FW_NOT_SUPPORT;	/* initialize */
2494 		hostif_mib_get_request(priv, LOCAL_EEPROM_SUM);
2495 		break;
2496 	case SME_START_REQUEST:
2497 		hostif_start_request(priv, priv->reg.operation_mode);
2498 		break;
2499 	case SME_START_CONFIRM:
2500 		/* for power save */
2501 		atomic_set(&priv->psstatus.snooze_guard, 0);
2502 		atomic_set(&priv->psstatus.confirm_wait, 0);
2503 		if (priv->dev_state == DEVICE_STATE_PREINIT)
2504 			priv->dev_state = DEVICE_STATE_INIT;
2505 		/* wake_up_interruptible_all(&priv->confirm_wait); */
2506 		complete(&priv->confirm_wait);
2507 		break;
2508 	case SME_SLEEP_REQUEST:
2509 		hostif_sme_sleep_set(priv);
2510 		break;
2511 	case SME_SET_REGION:
2512 		val = cpu_to_le32((uint32_t)(priv->region));
2513 		hostif_mib_set_request(priv, LOCAL_REGION,
2514 				       sizeof(val), MIB_VALUE_TYPE_INT, &val);
2515 		break;
2516 	case SME_MULTICAST_CONFIRM:
2517 	case SME_BSS_SCAN_CONFIRM:
2518 	case SME_POW_MNGMT_CONFIRM:
2519 	case SME_PHY_INFO_CONFIRM:
2520 	case SME_STOP_CONFIRM:
2521 	case SME_RTS_THRESHOLD_CONFIRM:
2522 	case SME_FRAGMENTATION_THRESHOLD_CONFIRM:
2523 	case SME_WEP_INDEX_CONFIRM:
2524 	case SME_WEP_KEY1_CONFIRM:
2525 	case SME_WEP_KEY2_CONFIRM:
2526 	case SME_WEP_KEY3_CONFIRM:
2527 	case SME_WEP_KEY4_CONFIRM:
2528 	case SME_WEP_FLAG_CONFIRM:
2529 	case SME_RSN_UCAST_CONFIRM:
2530 	case SME_RSN_MCAST_CONFIRM:
2531 	case SME_RSN_AUTH_CONFIRM:
2532 	case SME_RSN_ENABLED_CONFIRM:
2533 	case SME_RSN_MODE_CONFIRM:
2534 	case SME_MODE_SET_CONFIRM:
2535 		break;
2536 	case SME_TERMINATE:
2537 	default:
2538 		break;
2539 	}
2540 }
2541 
2542 static
2543 void hostif_sme_task(unsigned long dev)
2544 {
2545 	struct ks_wlan_private *priv = (struct ks_wlan_private *)dev;
2546 
2547 	DPRINTK(3, "\n");
2548 
2549 	if (priv->dev_state < DEVICE_STATE_BOOT)
2550 		return;
2551 
2552 	if (cnt_smeqbody(priv) <= 0)
2553 		return;
2554 
2555 	hostif_sme_execute(priv, priv->sme_i.event_buff[priv->sme_i.qhead]);
2556 	inc_smeqhead(priv);
2557 	if (cnt_smeqbody(priv) > 0)
2558 		tasklet_schedule(&priv->sme_task);
2559 }
2560 
2561 /* send to Station Management Entity module */
2562 void hostif_sme_enqueue(struct ks_wlan_private *priv, unsigned short event)
2563 {
2564 	DPRINTK(3, "\n");
2565 
2566 	/* enqueue sme event */
2567 	if (cnt_smeqbody(priv) < (SME_EVENT_BUFF_SIZE - 1)) {
2568 		priv->sme_i.event_buff[priv->sme_i.qtail] = event;
2569 		inc_smeqtail(priv);
2570 #ifdef KS_WLAN_DEBUG
2571 		if (priv->sme_i.max_event_count < cnt_smeqbody(priv))
2572 			priv->sme_i.max_event_count = cnt_smeqbody(priv);
2573 #endif /* KS_WLAN_DEBUG */
2574 	} else {
2575 		/* in case of buffer overflow */
2576 		netdev_err(priv->net_dev, "sme queue buffer overflow\n");
2577 	}
2578 
2579 	tasklet_schedule(&priv->sme_task);
2580 }
2581 
2582 int hostif_init(struct ks_wlan_private *priv)
2583 {
2584 	int i;
2585 
2586 	DPRINTK(3, "\n");
2587 
2588 	priv->aplist.size = 0;
2589 	for (i = 0; i < LOCAL_APLIST_MAX; i++)
2590 		memset(&priv->aplist.ap[i], 0, sizeof(struct local_ap_t));
2591 	priv->infra_status = 0;
2592 	priv->current_rate = 4;
2593 	priv->connect_status = DISCONNECT_STATUS;
2594 
2595 	spin_lock_init(&priv->multicast_spin);
2596 
2597 	spin_lock_init(&priv->dev_read_lock);
2598 	init_waitqueue_head(&priv->devread_wait);
2599 	priv->dev_count = 0;
2600 	atomic_set(&priv->event_count, 0);
2601 	atomic_set(&priv->rec_count, 0);
2602 
2603 	/* for power save */
2604 	atomic_set(&priv->psstatus.status, PS_NONE);
2605 	atomic_set(&priv->psstatus.confirm_wait, 0);
2606 	atomic_set(&priv->psstatus.snooze_guard, 0);
2607 	init_completion(&priv->psstatus.wakeup_wait);
2608 	INIT_WORK(&priv->wakeup_work, ks_wlan_hw_wakeup_task);
2609 
2610 	/* WPA */
2611 	memset(&priv->wpa, 0, sizeof(priv->wpa));
2612 	priv->wpa.rsn_enabled = 0;
2613 	priv->wpa.mic_failure.failure = 0;
2614 	priv->wpa.mic_failure.last_failure_time = 0;
2615 	priv->wpa.mic_failure.stop = 0;
2616 	memset(&priv->pmklist, 0, sizeof(priv->pmklist));
2617 	INIT_LIST_HEAD(&priv->pmklist.head);
2618 	for (i = 0; i < PMK_LIST_MAX; i++)
2619 		INIT_LIST_HEAD(&priv->pmklist.pmk[i].list);
2620 
2621 	priv->sme_i.sme_status = SME_IDLE;
2622 	priv->sme_i.qhead = 0;
2623 	priv->sme_i.qtail = 0;
2624 #ifdef KS_WLAN_DEBUG
2625 	priv->sme_i.max_event_count = 0;
2626 #endif
2627 	spin_lock_init(&priv->sme_i.sme_spin);
2628 	priv->sme_i.sme_flag = 0;
2629 
2630 	tasklet_init(&priv->sme_task, hostif_sme_task, (unsigned long)priv);
2631 
2632 	return 0;
2633 }
2634 
2635 void hostif_exit(struct ks_wlan_private *priv)
2636 {
2637 	tasklet_kill(&priv->sme_task);
2638 }
2639