1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3  *
4  * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
5  *
6  ******************************************************************************/
7 #define _RTW_MLME_C_
8 
9 #include <linux/etherdevice.h>
10 #include <drv_types.h>
11 #include <rtw_debug.h>
12 #include <hal_btcoex.h>
13 #include <linux/jiffies.h>
14 
15 extern u8 rtw_do_join(struct adapter *padapter);
16 
17 int	rtw_init_mlme_priv(struct adapter *padapter)
18 {
19 	int	i;
20 	u8 *pbuf;
21 	struct wlan_network	*pnetwork;
22 	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
23 	int	res = _SUCCESS;
24 
25 	pmlmepriv->nic_hdl = (u8 *)padapter;
26 
27 	pmlmepriv->pscanned = NULL;
28 	pmlmepriv->fw_state = WIFI_STATION_STATE; /*  Must sync with rtw_wdev_alloc() */
29 	/*  wdev->iftype = NL80211_IFTYPE_STATION */
30 	pmlmepriv->cur_network.network.InfrastructureMode = Ndis802_11AutoUnknown;
31 	pmlmepriv->scan_mode = SCAN_ACTIVE;/*  1: active, 0: pasive. Maybe someday we should rename this varable to "active_mode" (Jeff) */
32 
33 	spin_lock_init(&pmlmepriv->lock);
34 	_rtw_init_queue(&pmlmepriv->free_bss_pool);
35 	_rtw_init_queue(&pmlmepriv->scanned_queue);
36 
37 	set_scanned_network_val(pmlmepriv, 0);
38 
39 	memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
40 
41 	pbuf = vzalloc(array_size(MAX_BSS_CNT, sizeof(struct wlan_network)));
42 
43 	if (!pbuf) {
44 		res = _FAIL;
45 		goto exit;
46 	}
47 	pmlmepriv->free_bss_buf = pbuf;
48 
49 	pnetwork = (struct wlan_network *)pbuf;
50 
51 	for (i = 0; i < MAX_BSS_CNT; i++) {
52 		INIT_LIST_HEAD(&pnetwork->list);
53 
54 		list_add_tail(&pnetwork->list, &pmlmepriv->free_bss_pool.queue);
55 
56 		pnetwork++;
57 	}
58 
59 	/* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
60 
61 	rtw_clear_scan_deny(padapter);
62 
63 	#define RTW_ROAM_SCAN_RESULT_EXP_MS 5000
64 	#define RTW_ROAM_RSSI_DIFF_TH 10
65 	#define RTW_ROAM_SCAN_INTERVAL_MS 10000
66 
67 	pmlmepriv->roam_flags = 0
68 		| RTW_ROAM_ON_EXPIRED
69 		| RTW_ROAM_ON_RESUME
70 		#ifdef CONFIG_LAYER2_ROAMING_ACTIVE /* FIXME */
71 		| RTW_ROAM_ACTIVE
72 		#endif
73 		;
74 
75 	pmlmepriv->roam_scanr_exp_ms = RTW_ROAM_SCAN_RESULT_EXP_MS;
76 	pmlmepriv->roam_rssi_diff_th = RTW_ROAM_RSSI_DIFF_TH;
77 	pmlmepriv->roam_scan_int_ms = RTW_ROAM_SCAN_INTERVAL_MS;
78 
79 	rtw_init_mlme_timer(padapter);
80 
81 exit:
82 
83 	return res;
84 }
85 
86 static void rtw_free_mlme_ie_data(u8 **ppie, u32 *plen)
87 {
88 	if (*ppie) {
89 		kfree(*ppie);
90 		*plen = 0;
91 		*ppie = NULL;
92 	}
93 }
94 
95 void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
96 {
97 	rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
98 	rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
99 	rtw_free_mlme_ie_data(&pmlmepriv->wps_beacon_ie, &pmlmepriv->wps_beacon_ie_len);
100 	rtw_free_mlme_ie_data(&pmlmepriv->wps_probe_req_ie, &pmlmepriv->wps_probe_req_ie_len);
101 	rtw_free_mlme_ie_data(&pmlmepriv->wps_probe_resp_ie, &pmlmepriv->wps_probe_resp_ie_len);
102 	rtw_free_mlme_ie_data(&pmlmepriv->wps_assoc_resp_ie, &pmlmepriv->wps_assoc_resp_ie_len);
103 
104 	rtw_free_mlme_ie_data(&pmlmepriv->p2p_beacon_ie, &pmlmepriv->p2p_beacon_ie_len);
105 	rtw_free_mlme_ie_data(&pmlmepriv->p2p_probe_req_ie, &pmlmepriv->p2p_probe_req_ie_len);
106 	rtw_free_mlme_ie_data(&pmlmepriv->p2p_probe_resp_ie, &pmlmepriv->p2p_probe_resp_ie_len);
107 	rtw_free_mlme_ie_data(&pmlmepriv->p2p_go_probe_resp_ie, &pmlmepriv->p2p_go_probe_resp_ie_len);
108 	rtw_free_mlme_ie_data(&pmlmepriv->p2p_assoc_req_ie, &pmlmepriv->p2p_assoc_req_ie_len);
109 }
110 
111 void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
112 {
113 	if (pmlmepriv) {
114 		rtw_free_mlme_priv_ie_data(pmlmepriv);
115 		if (pmlmepriv->free_bss_buf)
116 			vfree(pmlmepriv->free_bss_buf);
117 	}
118 }
119 
120 /*
121 struct	wlan_network *_rtw_dequeue_network(struct __queue *queue)
122 {
123 	_irqL irqL;
124 
125 	struct wlan_network *pnetwork;
126 
127 	spin_lock_bh(&queue->lock);
128 
129 	if (list_empty(&queue->queue))
130 
131 		pnetwork = NULL;
132 
133 	else
134 	{
135 		pnetwork = LIST_CONTAINOR(get_next(&queue->queue), struct wlan_network, list);
136 
137 		list_del_init(&(pnetwork->list));
138 	}
139 
140 	spin_unlock_bh(&queue->lock);
141 
142 	return pnetwork;
143 }
144 */
145 
146 struct	wlan_network *rtw_alloc_network(struct	mlme_priv *pmlmepriv)
147 {
148 	struct	wlan_network	*pnetwork;
149 	struct __queue *free_queue = &pmlmepriv->free_bss_pool;
150 	struct list_head *plist = NULL;
151 
152 	spin_lock_bh(&free_queue->lock);
153 
154 	if (list_empty(&free_queue->queue)) {
155 		pnetwork = NULL;
156 		goto exit;
157 	}
158 	plist = get_next(&(free_queue->queue));
159 
160 	pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
161 
162 	list_del_init(&pnetwork->list);
163 
164 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
165 		 ("rtw_alloc_network: ptr =%p\n", plist));
166 	pnetwork->network_type = 0;
167 	pnetwork->fixed = false;
168 	pnetwork->last_scanned = jiffies;
169 	pnetwork->aid = 0;
170 	pnetwork->join_res = 0;
171 
172 	pmlmepriv->num_of_scanned++;
173 
174 exit:
175 	spin_unlock_bh(&free_queue->lock);
176 
177 	return pnetwork;
178 }
179 
180 void _rtw_free_network(struct	mlme_priv *pmlmepriv, struct wlan_network *pnetwork, u8 isfreeall)
181 {
182 	unsigned int delta_time;
183 	u32 lifetime = SCANQUEUE_LIFETIME;
184 /* 	_irqL irqL; */
185 	struct __queue *free_queue = &(pmlmepriv->free_bss_pool);
186 
187 	if (!pnetwork)
188 		return;
189 
190 	if (pnetwork->fixed)
191 		return;
192 
193 	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true) ||
194 		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true))
195 		lifetime = 1;
196 
197 	if (!isfreeall) {
198 		delta_time = jiffies_to_msecs(jiffies - pnetwork->last_scanned);
199 		if (delta_time < lifetime)/*  unit:msec */
200 			return;
201 	}
202 
203 	spin_lock_bh(&free_queue->lock);
204 
205 	list_del_init(&(pnetwork->list));
206 
207 	list_add_tail(&(pnetwork->list), &(free_queue->queue));
208 
209 	pmlmepriv->num_of_scanned--;
210 
211 	/* DBG_871X("_rtw_free_network:SSID =%s\n", pnetwork->network.Ssid.Ssid); */
212 
213 	spin_unlock_bh(&free_queue->lock);
214 }
215 
216 void _rtw_free_network_nolock(struct	mlme_priv *pmlmepriv, struct wlan_network *pnetwork)
217 {
218 
219 	struct __queue *free_queue = &(pmlmepriv->free_bss_pool);
220 
221 	if (!pnetwork)
222 		return;
223 
224 	if (pnetwork->fixed)
225 		return;
226 
227 	/* spin_lock_irqsave(&free_queue->lock, irqL); */
228 
229 	list_del_init(&(pnetwork->list));
230 
231 	list_add_tail(&(pnetwork->list), get_list_head(free_queue));
232 
233 	pmlmepriv->num_of_scanned--;
234 
235 	/* spin_unlock_irqrestore(&free_queue->lock, irqL); */
236 }
237 
238 /*
239 	return the wlan_network with the matching addr
240 
241 	Shall be called under atomic context... to avoid possible racing condition...
242 */
243 struct wlan_network *_rtw_find_network(struct __queue *scanned_queue, u8 *addr)
244 {
245 	struct list_head	*phead, *plist;
246 	struct	wlan_network *pnetwork = NULL;
247 	u8 zero_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
248 
249 	if (!memcmp(zero_addr, addr, ETH_ALEN)) {
250 		pnetwork = NULL;
251 		goto exit;
252 	}
253 
254 	/* spin_lock_bh(&scanned_queue->lock); */
255 
256 	phead = get_list_head(scanned_queue);
257 	plist = get_next(phead);
258 
259 	while (plist != phead) {
260 		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
261 
262 		if (!memcmp(addr, pnetwork->network.MacAddress, ETH_ALEN))
263 			break;
264 
265 		plist = get_next(plist);
266 	}
267 
268 	if (plist == phead)
269 		pnetwork = NULL;
270 
271 	/* spin_unlock_bh(&scanned_queue->lock); */
272 
273 exit:
274 	return pnetwork;
275 }
276 
277 void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)
278 {
279 	struct list_head *phead, *plist;
280 	struct wlan_network *pnetwork;
281 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
282 	struct __queue *scanned_queue = &pmlmepriv->scanned_queue;
283 
284 	spin_lock_bh(&scanned_queue->lock);
285 
286 	phead = get_list_head(scanned_queue);
287 	plist = get_next(phead);
288 
289 	while (phead != plist) {
290 
291 		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
292 
293 		plist = get_next(plist);
294 
295 		_rtw_free_network(pmlmepriv, pnetwork, isfreeall);
296 
297 	}
298 
299 	spin_unlock_bh(&scanned_queue->lock);
300 }
301 
302 sint rtw_if_up(struct adapter *padapter)
303 {
304 	sint res;
305 
306 	if (padapter->bDriverStopped || padapter->bSurpriseRemoved ||
307 		(check_fwstate(&padapter->mlmepriv, _FW_LINKED) == false)) {
308 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_if_up:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
309 		res = false;
310 	} else
311 		res =  true;
312 	return res;
313 }
314 
315 void rtw_generate_random_ibss(u8 *pibss)
316 {
317 	unsigned long curtime = jiffies;
318 
319 	pibss[0] = 0x02;  /* in ad-hoc mode bit1 must set to 1 */
320 	pibss[1] = 0x11;
321 	pibss[2] = 0x87;
322 	pibss[3] = (u8)(curtime & 0xff) ;/* p[0]; */
323 	pibss[4] = (u8)((curtime>>8) & 0xff) ;/* p[1]; */
324 	pibss[5] = (u8)((curtime>>16) & 0xff) ;/* p[2]; */
325 }
326 
327 u8 *rtw_get_capability_from_ie(u8 *ie)
328 {
329 	return ie + 8 + 2;
330 }
331 
332 u16 rtw_get_capability(struct wlan_bssid_ex *bss)
333 {
334 	__le16	val;
335 
336 	memcpy((u8 *)&val, rtw_get_capability_from_ie(bss->IEs), 2);
337 
338 	return le16_to_cpu(val);
339 }
340 
341 u8 *rtw_get_beacon_interval_from_ie(u8 *ie)
342 {
343 	return ie + 8;
344 }
345 
346 void rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
347 {
348 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("rtw_free_mlme_priv\n"));
349 	_rtw_free_mlme_priv(pmlmepriv);
350 }
351 
352 /*
353 static struct	wlan_network *rtw_dequeue_network(struct __queue *queue)
354 {
355 	struct wlan_network *pnetwork;
356 
357 	pnetwork = _rtw_dequeue_network(queue);
358 	return pnetwork;
359 }
360 */
361 
362 void rtw_free_network_nolock(struct adapter *padapter, struct wlan_network *pnetwork);
363 void rtw_free_network_nolock(struct adapter *padapter, struct wlan_network *pnetwork)
364 {
365 	/* RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("rtw_free_network ==> ssid = %s\n\n" , pnetwork->network.Ssid.Ssid)); */
366 	_rtw_free_network_nolock(&(padapter->mlmepriv), pnetwork);
367 	rtw_cfg80211_unlink_bss(padapter, pnetwork);
368 }
369 
370 /*
371 	return the wlan_network with the matching addr
372 
373 	Shall be called under atomic context... to avoid possible racing condition...
374 */
375 struct	wlan_network *rtw_find_network(struct __queue *scanned_queue, u8 *addr)
376 {
377 	struct	wlan_network *pnetwork = _rtw_find_network(scanned_queue, addr);
378 
379 	return pnetwork;
380 }
381 
382 int rtw_is_same_ibss(struct adapter *adapter, struct wlan_network *pnetwork)
383 {
384 	int ret = true;
385 	struct security_priv *psecuritypriv = &adapter->securitypriv;
386 
387 	if ((psecuritypriv->dot11PrivacyAlgrthm != _NO_PRIVACY_) &&
388 		    (pnetwork->network.Privacy == 0))
389 		ret = false;
390 	else if ((psecuritypriv->dot11PrivacyAlgrthm == _NO_PRIVACY_) &&
391 		 (pnetwork->network.Privacy == 1))
392 		ret = false;
393 	else
394 		ret = true;
395 
396 	return ret;
397 
398 }
399 
400 inline int is_same_ess(struct wlan_bssid_ex *a, struct wlan_bssid_ex *b)
401 {
402 	/* RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("(%s,%d)(%s,%d)\n", */
403 	/* 		a->Ssid.Ssid, a->Ssid.SsidLength, b->Ssid.Ssid, b->Ssid.SsidLength)); */
404 	return (a->Ssid.SsidLength == b->Ssid.SsidLength)
405 		&&  !memcmp(a->Ssid.Ssid, b->Ssid.Ssid, a->Ssid.SsidLength);
406 }
407 
408 int is_same_network(struct wlan_bssid_ex *src, struct wlan_bssid_ex *dst, u8 feature)
409 {
410 	u16 s_cap, d_cap;
411 	__le16 tmps, tmpd;
412 
413 	if (rtw_bug_check(dst, src, &s_cap, &d_cap) == false)
414 			return false;
415 
416 	memcpy((u8 *)&tmps, rtw_get_capability_from_ie(src->IEs), 2);
417 	memcpy((u8 *)&tmpd, rtw_get_capability_from_ie(dst->IEs), 2);
418 
419 	s_cap = le16_to_cpu(tmps);
420 	d_cap = le16_to_cpu(tmpd);
421 
422 	return (src->Ssid.SsidLength == dst->Ssid.SsidLength) &&
423 		/* 	(src->Configuration.DSConfig == dst->Configuration.DSConfig) && */
424 			((!memcmp(src->MacAddress, dst->MacAddress, ETH_ALEN))) &&
425 			((!memcmp(src->Ssid.Ssid, dst->Ssid.Ssid, src->Ssid.SsidLength))) &&
426 			((s_cap & WLAN_CAPABILITY_IBSS) ==
427 			(d_cap & WLAN_CAPABILITY_IBSS)) &&
428 			((s_cap & WLAN_CAPABILITY_BSS) ==
429 			(d_cap & WLAN_CAPABILITY_BSS));
430 
431 }
432 
433 struct wlan_network *_rtw_find_same_network(struct __queue *scanned_queue, struct wlan_network *network)
434 {
435 	struct list_head *phead, *plist;
436 	struct wlan_network *found = NULL;
437 
438 	phead = get_list_head(scanned_queue);
439 	plist = get_next(phead);
440 
441 	while (plist != phead) {
442 		found = LIST_CONTAINOR(plist, struct wlan_network, list);
443 
444 		if (is_same_network(&network->network, &found->network, 0))
445 			break;
446 
447 		plist = get_next(plist);
448 	}
449 
450 	if (plist == phead)
451 		found = NULL;
452 
453 	return found;
454 }
455 
456 struct	wlan_network	*rtw_get_oldest_wlan_network(struct __queue *scanned_queue)
457 {
458 	struct list_head	*plist, *phead;
459 
460 	struct	wlan_network	*pwlan = NULL;
461 	struct	wlan_network	*oldest = NULL;
462 
463 	phead = get_list_head(scanned_queue);
464 
465 	plist = get_next(phead);
466 
467 	while (1) {
468 
469 		if (phead == plist)
470 			break;
471 
472 		pwlan = LIST_CONTAINOR(plist, struct wlan_network, list);
473 
474 		if (!pwlan->fixed) {
475 			if (oldest == NULL || time_after(oldest->last_scanned, pwlan->last_scanned))
476 				oldest = pwlan;
477 		}
478 
479 		plist = get_next(plist);
480 	}
481 	return oldest;
482 
483 }
484 
485 void update_network(struct wlan_bssid_ex *dst, struct wlan_bssid_ex *src,
486 	struct adapter *padapter, bool update_ie)
487 {
488 	long rssi_ori = dst->Rssi;
489 
490 	u8 sq_smp = src->PhyInfo.SignalQuality;
491 
492 	u8 ss_final;
493 	u8 sq_final;
494 	long rssi_final;
495 
496 	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) && 1
497 	if (strcmp(dst->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
498 		DBG_871X(FUNC_ADPT_FMT" %s("MAC_FMT", ch%u) ss_ori:%3u, sq_ori:%3u, rssi_ori:%3ld, ss_smp:%3u, sq_smp:%3u, rssi_smp:%3ld\n"
499 			, FUNC_ADPT_ARG(padapter)
500 			, src->Ssid.Ssid, MAC_ARG(src->MacAddress), src->Configuration.DSConfig
501 			, ss_ori, sq_ori, rssi_ori
502 			, ss_smp, sq_smp, rssi_smp
503 		);
504 	}
505 	#endif
506 
507 	/* The rule below is 1/5 for sample value, 4/5 for history value */
508 	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) && is_same_network(&(padapter->mlmepriv.cur_network.network), src, 0)) {
509 		/* Take the recvpriv's value for the connected AP*/
510 		ss_final = padapter->recvpriv.signal_strength;
511 		sq_final = padapter->recvpriv.signal_qual;
512 		/* the rssi value here is undecorated, and will be used for antenna diversity */
513 		if (sq_smp != 101) /* from the right channel */
514 			rssi_final = (src->Rssi+dst->Rssi*4)/5;
515 		else
516 			rssi_final = rssi_ori;
517 	} else {
518 		if (sq_smp != 101) { /* from the right channel */
519 			ss_final = ((u32)(src->PhyInfo.SignalStrength)+(u32)(dst->PhyInfo.SignalStrength)*4)/5;
520 			sq_final = ((u32)(src->PhyInfo.SignalQuality)+(u32)(dst->PhyInfo.SignalQuality)*4)/5;
521 			rssi_final = (src->Rssi+dst->Rssi*4)/5;
522 		} else {
523 			/* bss info not receiving from the right channel, use the original RX signal infos */
524 			ss_final = dst->PhyInfo.SignalStrength;
525 			sq_final = dst->PhyInfo.SignalQuality;
526 			rssi_final = dst->Rssi;
527 		}
528 
529 	}
530 
531 	if (update_ie) {
532 		dst->Reserved[0] = src->Reserved[0];
533 		dst->Reserved[1] = src->Reserved[1];
534 		memcpy((u8 *)dst, (u8 *)src, get_wlan_bssid_ex_sz(src));
535 	}
536 
537 	dst->PhyInfo.SignalStrength = ss_final;
538 	dst->PhyInfo.SignalQuality = sq_final;
539 	dst->Rssi = rssi_final;
540 
541 	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) && 1
542 	if (strcmp(dst->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
543 		DBG_871X(FUNC_ADPT_FMT" %s("MAC_FMT"), SignalStrength:%u, SignalQuality:%u, RawRSSI:%ld\n"
544 			, FUNC_ADPT_ARG(padapter)
545 			, dst->Ssid.Ssid, MAC_ARG(dst->MacAddress), dst->PhyInfo.SignalStrength, dst->PhyInfo.SignalQuality, dst->Rssi);
546 	}
547 	#endif
548 }
549 
550 static void update_current_network(struct adapter *adapter, struct wlan_bssid_ex *pnetwork)
551 {
552 	struct	mlme_priv *pmlmepriv = &(adapter->mlmepriv);
553 
554 	rtw_bug_check(&(pmlmepriv->cur_network.network),
555 		&(pmlmepriv->cur_network.network),
556 		&(pmlmepriv->cur_network.network),
557 		&(pmlmepriv->cur_network.network));
558 
559 	if ((check_fwstate(pmlmepriv, _FW_LINKED) == true) && (is_same_network(&(pmlmepriv->cur_network.network), pnetwork, 0))) {
560 		/* RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,"Same Network\n"); */
561 
562 		/* if (pmlmepriv->cur_network.network.IELength<= pnetwork->IELength) */
563 		{
564 			update_network(&(pmlmepriv->cur_network.network), pnetwork, adapter, true);
565 			rtw_update_protection(adapter, (pmlmepriv->cur_network.network.IEs) + sizeof(struct ndis_802_11_fix_ie),
566 									pmlmepriv->cur_network.network.IELength);
567 		}
568 	}
569 }
570 
571 /*
572 Caller must hold pmlmepriv->lock first.
573 */
574 void rtw_update_scanned_network(struct adapter *adapter, struct wlan_bssid_ex *target)
575 {
576 	struct list_head	*plist, *phead;
577 	u32 bssid_ex_sz;
578 	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
579 	struct __queue	*queue	= &(pmlmepriv->scanned_queue);
580 	struct wlan_network	*pnetwork = NULL;
581 	struct wlan_network	*oldest = NULL;
582 	int target_find = 0;
583 	u8 feature = 0;
584 
585 	spin_lock_bh(&queue->lock);
586 	phead = get_list_head(queue);
587 	plist = get_next(phead);
588 
589 	while (1) {
590 		if (phead == plist)
591 			break;
592 
593 		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
594 
595 		rtw_bug_check(pnetwork, pnetwork, pnetwork, pnetwork);
596 
597 		if (is_same_network(&(pnetwork->network), target, feature)) {
598 			target_find = 1;
599 			break;
600 		}
601 
602 		if (rtw_roam_flags(adapter)) {
603 			/* TODO: don't  select netowrk in the same ess as oldest if it's new enough*/
604 		}
605 
606 		if (oldest == NULL || time_after(oldest->last_scanned, pnetwork->last_scanned))
607 			oldest = pnetwork;
608 
609 		plist = get_next(plist);
610 
611 	}
612 
613 	/* If we didn't find a match, then get a new network slot to initialize
614 	 * with this beacon's information */
615 	/* if (phead == plist) { */
616 	if (!target_find) {
617 		if (list_empty(&pmlmepriv->free_bss_pool.queue)) {
618 			/* If there are no more slots, expire the oldest */
619 			/* list_del_init(&oldest->list); */
620 			pnetwork = oldest;
621 			if (!pnetwork) {
622 				RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n\n\nsomething wrong here\n\n\n"));
623 				goto exit;
624 			}
625 			memcpy(&(pnetwork->network), target,  get_wlan_bssid_ex_sz(target));
626 			/*  variable initialize */
627 			pnetwork->fixed = false;
628 			pnetwork->last_scanned = jiffies;
629 
630 			pnetwork->network_type = 0;
631 			pnetwork->aid = 0;
632 			pnetwork->join_res = 0;
633 
634 			/* bss info not receiving from the right channel */
635 			if (pnetwork->network.PhyInfo.SignalQuality == 101)
636 				pnetwork->network.PhyInfo.SignalQuality = 0;
637 		} else {
638 			/* Otherwise just pull from the free list */
639 
640 			pnetwork = rtw_alloc_network(pmlmepriv); /*  will update scan_time */
641 
642 			if (!pnetwork) {
643 				RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n\n\nsomething wrong here\n\n\n"));
644 				goto exit;
645 			}
646 
647 			bssid_ex_sz = get_wlan_bssid_ex_sz(target);
648 			target->Length = bssid_ex_sz;
649 			memcpy(&(pnetwork->network), target, bssid_ex_sz);
650 
651 			pnetwork->last_scanned = jiffies;
652 
653 			/* bss info not receiving from the right channel */
654 			if (pnetwork->network.PhyInfo.SignalQuality == 101)
655 				pnetwork->network.PhyInfo.SignalQuality = 0;
656 
657 			list_add_tail(&(pnetwork->list), &(queue->queue));
658 
659 		}
660 	} else {
661 		/* we have an entry and we are going to update it. But this entry may
662 		 * be already expired. In this case we do the same as we found a new
663 		 * net and call the new_net handler
664 		 */
665 		bool update_ie = true;
666 
667 		pnetwork->last_scanned = jiffies;
668 
669 		/* target.Reserved[0]== 1, means that scanned network is a bcn frame. */
670 		if ((pnetwork->network.IELength > target->IELength) && (target->Reserved[0] == 1))
671 			update_ie = false;
672 
673 		/*  probe resp(3) > beacon(1) > probe req(2) */
674 		if ((target->Reserved[0] != 2) &&
675 			(target->Reserved[0] >= pnetwork->network.Reserved[0])
676 			) {
677 			update_ie = true;
678 		} else {
679 			update_ie = false;
680 		}
681 
682 		update_network(&(pnetwork->network), target, adapter, update_ie);
683 	}
684 
685 exit:
686 	spin_unlock_bh(&queue->lock);
687 }
688 
689 void rtw_add_network(struct adapter *adapter, struct wlan_bssid_ex *pnetwork);
690 void rtw_add_network(struct adapter *adapter, struct wlan_bssid_ex *pnetwork)
691 {
692 	/* struct __queue	*queue	= &(pmlmepriv->scanned_queue); */
693 
694 	/* spin_lock_bh(&queue->lock); */
695 
696 	update_current_network(adapter, pnetwork);
697 
698 	rtw_update_scanned_network(adapter, pnetwork);
699 
700 	/* spin_unlock_bh(&queue->lock); */
701 }
702 
703 /* select the desired network based on the capability of the (i)bss. */
704 /*  check items: (1) security */
705 /* 			   (2) network_type */
706 /* 			   (3) WMM */
707 /* 			   (4) HT */
708 /*                      (5) others */
709 int rtw_is_desired_network(struct adapter *adapter, struct wlan_network *pnetwork);
710 int rtw_is_desired_network(struct adapter *adapter, struct wlan_network *pnetwork)
711 {
712 	struct security_priv *psecuritypriv = &adapter->securitypriv;
713 	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
714 	u32 desired_encmode;
715 	u32 privacy;
716 
717 	/* u8 wps_ie[512]; */
718 	uint wps_ielen;
719 
720 	int bselected = true;
721 
722 	desired_encmode = psecuritypriv->ndisencryptstatus;
723 	privacy = pnetwork->network.Privacy;
724 
725 	if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS)) {
726 		if (rtw_get_wps_ie(pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen))
727 			return true;
728 		else
729 			return false;
730 
731 	}
732 	if (adapter->registrypriv.wifi_spec == 1) { /* for  correct flow of 8021X  to do.... */
733 		u8 *p = NULL;
734 		uint ie_len = 0;
735 
736 		if ((desired_encmode == Ndis802_11EncryptionDisabled) && (privacy != 0))
737 	    bselected = false;
738 
739 		if (psecuritypriv->ndisauthtype == Ndis802_11AuthModeWPA2PSK) {
740 			p = rtw_get_ie(pnetwork->network.IEs + _BEACON_IE_OFFSET_, _RSN_IE_2_, &ie_len, (pnetwork->network.IELength - _BEACON_IE_OFFSET_));
741 			if (p && ie_len > 0)
742 				bselected = true;
743 			else
744 				bselected = false;
745 		}
746 	}
747 
748 	if ((desired_encmode != Ndis802_11EncryptionDisabled) && (privacy == 0)) {
749 		DBG_871X("desired_encmode: %d, privacy: %d\n", desired_encmode, privacy);
750 		bselected = false;
751 	}
752 
753 	if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) {
754 		if (pnetwork->network.InfrastructureMode != pmlmepriv->cur_network.network.InfrastructureMode)
755 			bselected = false;
756 	}
757 
758 	return bselected;
759 }
760 
761 /* TODO: Perry : For Power Management */
762 void rtw_atimdone_event_callback(struct adapter	*adapter, u8 *pbuf)
763 {
764 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("receive atimdone_event\n"));
765 }
766 
767 void rtw_survey_event_callback(struct adapter	*adapter, u8 *pbuf)
768 {
769 	u32 len;
770 	struct wlan_bssid_ex *pnetwork;
771 	struct	mlme_priv *pmlmepriv = &(adapter->mlmepriv);
772 
773 	pnetwork = (struct wlan_bssid_ex *)pbuf;
774 
775 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_survey_event_callback, ssid =%s\n",  pnetwork->Ssid.Ssid));
776 
777 	len = get_wlan_bssid_ex_sz(pnetwork);
778 	if (len > (sizeof(struct wlan_bssid_ex))) {
779 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n ****rtw_survey_event_callback: return a wrong bss ***\n"));
780 		return;
781 	}
782 
783 	spin_lock_bh(&pmlmepriv->lock);
784 
785 	/*  update IBSS_network 's timestamp */
786 	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) == true) {
787 		/* RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,"rtw_survey_event_callback : WIFI_ADHOC_MASTER_STATE\n\n"); */
788 		if (!memcmp(&(pmlmepriv->cur_network.network.MacAddress), pnetwork->MacAddress, ETH_ALEN)) {
789 			struct wlan_network *ibss_wlan = NULL;
790 
791 			memcpy(pmlmepriv->cur_network.network.IEs, pnetwork->IEs, 8);
792 			spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
793 			ibss_wlan = rtw_find_network(&pmlmepriv->scanned_queue,  pnetwork->MacAddress);
794 			if (ibss_wlan) {
795 				memcpy(ibss_wlan->network.IEs, pnetwork->IEs, 8);
796 				spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
797 				goto exit;
798 			}
799 			spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
800 		}
801 	}
802 
803 	/*  lock pmlmepriv->lock when you accessing network_q */
804 	if ((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == false) {
805 		if (pnetwork->Ssid.Ssid[0] == 0)
806 			pnetwork->Ssid.SsidLength = 0;
807 		rtw_add_network(adapter, pnetwork);
808 	}
809 
810 exit:
811 
812 	spin_unlock_bh(&pmlmepriv->lock);
813 }
814 
815 void rtw_surveydone_event_callback(struct adapter	*adapter, u8 *pbuf)
816 {
817 	u8 timer_cancelled = false;
818 	struct	mlme_priv *pmlmepriv = &(adapter->mlmepriv);
819 
820 	spin_lock_bh(&pmlmepriv->lock);
821 	if (pmlmepriv->wps_probe_req_ie) {
822 		pmlmepriv->wps_probe_req_ie_len = 0;
823 		kfree(pmlmepriv->wps_probe_req_ie);
824 		pmlmepriv->wps_probe_req_ie = NULL;
825 	}
826 
827 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_surveydone_event_callback: fw_state:%x\n\n", get_fwstate(pmlmepriv)));
828 
829 	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
830 		/* u8 timer_cancelled; */
831 
832 		timer_cancelled = true;
833 		/* _cancel_timer(&pmlmepriv->scan_to_timer, &timer_cancelled); */
834 
835 		_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
836 	} else {
837 
838 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("nic status =%x, survey done event comes too late!\n", get_fwstate(pmlmepriv)));
839 	}
840 	spin_unlock_bh(&pmlmepriv->lock);
841 
842 	if (timer_cancelled)
843 		_cancel_timer(&pmlmepriv->scan_to_timer, &timer_cancelled);
844 
845 	spin_lock_bh(&pmlmepriv->lock);
846 
847 	rtw_set_signal_stat_timer(&adapter->recvpriv);
848 
849 	if (pmlmepriv->to_join) {
850 		if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true)) {
851 			if (check_fwstate(pmlmepriv, _FW_LINKED) == false) {
852 				set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
853 
854 				if (rtw_select_and_join_from_scanned_queue(pmlmepriv) == _SUCCESS) {
855 					_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
856 				} else {
857 					struct wlan_bssid_ex    *pdev_network = &(adapter->registrypriv.dev_network);
858 					u8 *pibss = adapter->registrypriv.dev_network.MacAddress;
859 
860 					/* pmlmepriv->fw_state ^= _FW_UNDER_SURVEY;because don't set assoc_timer */
861 					_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
862 
863 					RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("switching to adhoc master\n"));
864 
865 					memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(struct ndis_802_11_ssid));
866 
867 					rtw_update_registrypriv_dev_network(adapter);
868 					rtw_generate_random_ibss(pibss);
869 
870 					pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
871 
872 					if (rtw_createbss_cmd(adapter) != _SUCCESS)
873 						RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Error =>rtw_createbss_cmd status FAIL\n"));
874 
875 					pmlmepriv->to_join = false;
876 				}
877 			}
878 		} else {
879 			int s_ret;
880 			set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
881 			pmlmepriv->to_join = false;
882 			s_ret = rtw_select_and_join_from_scanned_queue(pmlmepriv);
883 			if (_SUCCESS == s_ret) {
884 			     _set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
885 			} else if (s_ret == 2) {/* there is no need to wait for join */
886 				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
887 				rtw_indicate_connect(adapter);
888 			} else {
889 				DBG_871X("try_to_join, but select scanning queue fail, to_roam:%d\n", rtw_to_roam(adapter));
890 
891 				if (rtw_to_roam(adapter) != 0) {
892 					if (rtw_dec_to_roam(adapter) == 0
893 						|| _SUCCESS != rtw_sitesurvey_cmd(adapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)
894 					) {
895 						rtw_set_to_roam(adapter, 0);
896 						rtw_free_assoc_resources(adapter, 1);
897 						rtw_indicate_disconnect(adapter);
898 					} else {
899 						pmlmepriv->to_join = true;
900 					}
901 				} else
902 					rtw_indicate_disconnect(adapter);
903 
904 				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
905 			}
906 		}
907 	} else {
908 		if (rtw_chk_roam_flags(adapter, RTW_ROAM_ACTIVE)) {
909 			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)
910 				&& check_fwstate(pmlmepriv, _FW_LINKED)) {
911 				if (rtw_select_roaming_candidate(pmlmepriv) == _SUCCESS) {
912 					receive_disconnect(adapter, pmlmepriv->cur_network.network.MacAddress
913 						, WLAN_REASON_ACTIVE_ROAM);
914 				}
915 			}
916 		}
917 	}
918 
919 	/* DBG_871X("scan complete in %dms\n", jiffies_to_msecs(jiffies - pmlmepriv->scan_start_time)); */
920 
921 	spin_unlock_bh(&pmlmepriv->lock);
922 
923 	rtw_os_xmit_schedule(adapter);
924 
925 	rtw_cfg80211_surveydone_event_callback(adapter);
926 
927 	rtw_indicate_scan_done(adapter, false);
928 }
929 
930 void rtw_dummy_event_callback(struct adapter *adapter, u8 *pbuf)
931 {
932 }
933 
934 void rtw_fwdbg_event_callback(struct adapter *adapter, u8 *pbuf)
935 {
936 }
937 
938 static void free_scanqueue(struct	mlme_priv *pmlmepriv)
939 {
940 	struct __queue *free_queue = &pmlmepriv->free_bss_pool;
941 	struct __queue *scan_queue = &pmlmepriv->scanned_queue;
942 	struct list_head	*plist, *phead, *ptemp;
943 
944 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+free_scanqueue\n"));
945 	spin_lock_bh(&scan_queue->lock);
946 	spin_lock_bh(&free_queue->lock);
947 
948 	phead = get_list_head(scan_queue);
949 	plist = get_next(phead);
950 
951 	while (plist != phead) {
952 		ptemp = get_next(plist);
953 		list_del_init(plist);
954 		list_add_tail(plist, &free_queue->queue);
955 		plist = ptemp;
956 		pmlmepriv->num_of_scanned--;
957 	}
958 
959 	spin_unlock_bh(&free_queue->lock);
960 	spin_unlock_bh(&scan_queue->lock);
961 }
962 
963 static void rtw_reset_rx_info(struct debug_priv *pdbgpriv)
964 {
965 	pdbgpriv->dbg_rx_ampdu_drop_count = 0;
966 	pdbgpriv->dbg_rx_ampdu_forced_indicate_count = 0;
967 	pdbgpriv->dbg_rx_ampdu_loss_count = 0;
968 	pdbgpriv->dbg_rx_dup_mgt_frame_drop_count = 0;
969 	pdbgpriv->dbg_rx_ampdu_window_shift_cnt = 0;
970 }
971 
972 static void find_network(struct adapter *adapter)
973 {
974 	struct wlan_network *pwlan = NULL;
975 	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
976 	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
977 
978 	pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
979 	if (pwlan)
980 		pwlan->fixed = false;
981 	else
982 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("rtw_free_assoc_resources : pwlan == NULL\n\n"));
983 
984 	if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) &&
985 	    (adapter->stapriv.asoc_sta_count == 1))
986 		rtw_free_network_nolock(adapter, pwlan);
987 }
988 
989 /*
990 *rtw_free_assoc_resources: the caller has to lock pmlmepriv->lock
991 */
992 void rtw_free_assoc_resources(struct adapter *adapter, int lock_scanned_queue)
993 {
994 	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
995 	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
996 	struct	sta_priv *pstapriv = &adapter->stapriv;
997 	struct dvobj_priv *psdpriv = adapter->dvobj;
998 	struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;
999 
1000 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+rtw_free_assoc_resources\n"));
1001 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("tgt_network->network.MacAddress ="MAC_FMT" ssid =%s\n",
1002 		MAC_ARG(tgt_network->network.MacAddress), tgt_network->network.Ssid.Ssid));
1003 
1004 	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_AP_STATE)) {
1005 		struct sta_info *psta;
1006 
1007 		psta = rtw_get_stainfo(&adapter->stapriv, tgt_network->network.MacAddress);
1008 		spin_lock_bh(&(pstapriv->sta_hash_lock));
1009 		rtw_free_stainfo(adapter,  psta);
1010 
1011 		spin_unlock_bh(&(pstapriv->sta_hash_lock));
1012 
1013 	}
1014 
1015 	if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE)) {
1016 		struct sta_info *psta;
1017 
1018 		rtw_free_all_stainfo(adapter);
1019 
1020 		psta = rtw_get_bcmc_stainfo(adapter);
1021 		rtw_free_stainfo(adapter, psta);
1022 
1023 		rtw_init_bcmc_stainfo(adapter);
1024 	}
1025 
1026 	find_network(adapter);
1027 
1028 	if (lock_scanned_queue)
1029 		adapter->securitypriv.key_mask = 0;
1030 
1031 	rtw_reset_rx_info(pdbgpriv);
1032 }
1033 
1034 /*
1035 *rtw_indicate_connect: the caller has to lock pmlmepriv->lock
1036 */
1037 void rtw_indicate_connect(struct adapter *padapter)
1038 {
1039 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1040 
1041 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_indicate_connect\n"));
1042 
1043 	pmlmepriv->to_join = false;
1044 
1045 	if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
1046 
1047 		set_fwstate(pmlmepriv, _FW_LINKED);
1048 
1049 		rtw_os_indicate_connect(padapter);
1050 	}
1051 
1052 	rtw_set_to_roam(padapter, 0);
1053 	rtw_set_scan_deny(padapter, 3000);
1054 
1055 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("-rtw_indicate_connect: fw_state = 0x%08x\n", get_fwstate(pmlmepriv)));
1056 }
1057 
1058 /*
1059 *rtw_indicate_disconnect: the caller has to lock pmlmepriv->lock
1060 */
1061 void rtw_indicate_disconnect(struct adapter *padapter)
1062 {
1063 	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
1064 
1065 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_indicate_disconnect\n"));
1066 
1067 	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING|WIFI_UNDER_WPS);
1068 
1069 	/* DBG_871X("clear wps when %s\n", __func__); */
1070 
1071 	if (rtw_to_roam(padapter) > 0)
1072 		_clr_fwstate_(pmlmepriv, _FW_LINKED);
1073 
1074 	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED)
1075 		|| (rtw_to_roam(padapter) <= 0)
1076 	) {
1077 		rtw_os_indicate_disconnect(padapter);
1078 
1079 		/* set ips_deny_time to avoid enter IPS before LPS leave */
1080 		rtw_set_ips_deny(padapter, 3000);
1081 
1082 		_clr_fwstate_(pmlmepriv, _FW_LINKED);
1083 
1084 		rtw_clear_scan_deny(padapter);
1085 	}
1086 
1087 	rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_DISCONNECT, 1);
1088 }
1089 
1090 inline void rtw_indicate_scan_done(struct adapter *padapter, bool aborted)
1091 {
1092 	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
1093 
1094 	rtw_os_indicate_scan_done(padapter, aborted);
1095 
1096 	if (is_primary_adapter(padapter) &&
1097 	    (!adapter_to_pwrctl(padapter)->bInSuspend) &&
1098 	    (!check_fwstate(&padapter->mlmepriv,
1099 			    WIFI_ASOC_STATE|WIFI_UNDER_LINKING))) {
1100 		rtw_set_ips_deny(padapter, 0);
1101 		_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 1);
1102 	}
1103 }
1104 
1105 void rtw_scan_abort(struct adapter *adapter)
1106 {
1107 	unsigned long start;
1108 	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
1109 	struct mlme_ext_priv *pmlmeext = &(adapter->mlmeextpriv);
1110 
1111 	start = jiffies;
1112 	pmlmeext->scan_abort = true;
1113 	while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)
1114 		&& jiffies_to_msecs(start) <= 200) {
1115 
1116 		if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
1117 			break;
1118 
1119 		DBG_871X(FUNC_NDEV_FMT"fw_state = _FW_UNDER_SURVEY!\n", FUNC_NDEV_ARG(adapter->pnetdev));
1120 		msleep(20);
1121 	}
1122 
1123 	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
1124 		if (!adapter->bDriverStopped && !adapter->bSurpriseRemoved)
1125 			DBG_871X(FUNC_NDEV_FMT"waiting for scan_abort time out!\n", FUNC_NDEV_ARG(adapter->pnetdev));
1126 		rtw_indicate_scan_done(adapter, true);
1127 	}
1128 	pmlmeext->scan_abort = false;
1129 }
1130 
1131 static struct sta_info *rtw_joinbss_update_stainfo(struct adapter *padapter, struct wlan_network *pnetwork)
1132 {
1133 	int i;
1134 	struct sta_info *bmc_sta, *psta = NULL;
1135 	struct recv_reorder_ctrl *preorder_ctrl;
1136 	struct sta_priv *pstapriv = &padapter->stapriv;
1137 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1138 
1139 	psta = rtw_get_stainfo(pstapriv, pnetwork->network.MacAddress);
1140 	if (!psta)
1141 		psta = rtw_alloc_stainfo(pstapriv, pnetwork->network.MacAddress);
1142 
1143 	if (psta) { /* update ptarget_sta */
1144 
1145 		DBG_871X("%s\n", __func__);
1146 
1147 		psta->aid  = pnetwork->join_res;
1148 
1149 		update_sta_info(padapter, psta);
1150 
1151 		/* update station supportRate */
1152 		psta->bssratelen = rtw_get_rateset_len(pnetwork->network.SupportedRates);
1153 		memcpy(psta->bssrateset, pnetwork->network.SupportedRates, psta->bssratelen);
1154 		rtw_hal_update_sta_rate_mask(padapter, psta);
1155 
1156 		psta->wireless_mode = pmlmeext->cur_wireless_mode;
1157 		psta->raid = networktype_to_raid_ex(padapter, psta);
1158 
1159 		/* sta mode */
1160 		rtw_hal_set_odm_var(padapter, HAL_ODM_STA_INFO, psta, true);
1161 
1162 		/* security related */
1163 		if (padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) {
1164 			padapter->securitypriv.binstallGrpkey = false;
1165 			padapter->securitypriv.busetkipkey = false;
1166 			padapter->securitypriv.bgrpkey_handshake = false;
1167 
1168 			psta->ieee8021x_blocked = true;
1169 			psta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
1170 
1171 			memset((u8 *)&psta->dot118021x_UncstKey, 0, sizeof(union Keytype));
1172 
1173 			memset((u8 *)&psta->dot11tkiprxmickey, 0, sizeof(union Keytype));
1174 			memset((u8 *)&psta->dot11tkiptxmickey, 0, sizeof(union Keytype));
1175 
1176 			memset((u8 *)&psta->dot11txpn, 0, sizeof(union pn48));
1177 			psta->dot11txpn.val = psta->dot11txpn.val + 1;
1178 			memset((u8 *)&psta->dot11wtxpn, 0, sizeof(union pn48));
1179 			memset((u8 *)&psta->dot11rxpn, 0, sizeof(union pn48));
1180 		}
1181 
1182 		/* 	Commented by Albert 2012/07/21 */
1183 		/* 	When doing the WPS, the wps_ie_len won't equal to 0 */
1184 		/* 	And the Wi-Fi driver shouldn't allow the data packet to be transmitted. */
1185 		if (padapter->securitypriv.wps_ie_len != 0) {
1186 			psta->ieee8021x_blocked = true;
1187 			padapter->securitypriv.wps_ie_len = 0;
1188 		}
1189 
1190 		/* for A-MPDU Rx reordering buffer control for bmc_sta & sta_info */
1191 		/* if A-MPDU Rx is enabled, resetting  rx_ordering_ctrl wstart_b(indicate_seq) to default value = 0xffff */
1192 		/* todo: check if AP can send A-MPDU packets */
1193 		for (i = 0; i < 16 ; i++) {
1194 			/* preorder_ctrl = &precvpriv->recvreorder_ctrl[i]; */
1195 			preorder_ctrl = &psta->recvreorder_ctrl[i];
1196 			preorder_ctrl->enable = false;
1197 			preorder_ctrl->indicate_seq = 0xffff;
1198 			#ifdef DBG_RX_SEQ
1199 			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u\n", __func__, __LINE__,
1200 				preorder_ctrl->indicate_seq);
1201 			#endif
1202 			preorder_ctrl->wend_b = 0xffff;
1203 			preorder_ctrl->wsize_b = 64;/* max_ampdu_sz;ex. 32(kbytes) -> wsize_b =32 */
1204 		}
1205 
1206 		bmc_sta = rtw_get_bcmc_stainfo(padapter);
1207 		if (bmc_sta) {
1208 			for (i = 0; i < 16 ; i++) {
1209 				/* preorder_ctrl = &precvpriv->recvreorder_ctrl[i]; */
1210 				preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
1211 				preorder_ctrl->enable = false;
1212 				preorder_ctrl->indicate_seq = 0xffff;
1213 				#ifdef DBG_RX_SEQ
1214 				DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u\n", __func__, __LINE__,
1215 					preorder_ctrl->indicate_seq);
1216 				#endif
1217 				preorder_ctrl->wend_b = 0xffff;
1218 				preorder_ctrl->wsize_b = 64;/* max_ampdu_sz;ex. 32(kbytes) -> wsize_b =32 */
1219 			}
1220 		}
1221 	}
1222 
1223 	return psta;
1224 
1225 }
1226 
1227 /* pnetwork : returns from rtw_joinbss_event_callback */
1228 /* ptarget_wlan: found from scanned_queue */
1229 static void rtw_joinbss_update_network(struct adapter *padapter, struct wlan_network *ptarget_wlan, struct wlan_network  *pnetwork)
1230 {
1231 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1232 	struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
1233 
1234 	DBG_871X("%s\n", __func__);
1235 
1236 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("\nfw_state:%x, BSSID:"MAC_FMT"\n"
1237 		, get_fwstate(pmlmepriv), MAC_ARG(pnetwork->network.MacAddress)));
1238 
1239 	/*  why not use ptarget_wlan?? */
1240 	memcpy(&cur_network->network, &pnetwork->network, pnetwork->network.Length);
1241 	/*  some IEs in pnetwork is wrong, so we should use ptarget_wlan IEs */
1242 	cur_network->network.IELength = ptarget_wlan->network.IELength;
1243 	memcpy(&cur_network->network.IEs[0], &ptarget_wlan->network.IEs[0], MAX_IE_SZ);
1244 
1245 	cur_network->aid = pnetwork->join_res;
1246 
1247 	rtw_set_signal_stat_timer(&padapter->recvpriv);
1248 
1249 	padapter->recvpriv.signal_strength = ptarget_wlan->network.PhyInfo.SignalStrength;
1250 	padapter->recvpriv.signal_qual = ptarget_wlan->network.PhyInfo.SignalQuality;
1251 	/* the ptarget_wlan->network.Rssi is raw data, we use ptarget_wlan->network.PhyInfo.SignalStrength instead (has scaled) */
1252 	padapter->recvpriv.rssi = translate_percentage_to_dbm(ptarget_wlan->network.PhyInfo.SignalStrength);
1253 	#if defined(DBG_RX_SIGNAL_DISPLAY_PROCESSING) && 1
1254 		DBG_871X(FUNC_ADPT_FMT" signal_strength:%3u, rssi:%3d, signal_qual:%3u"
1255 			"\n"
1256 			, FUNC_ADPT_ARG(padapter)
1257 			, padapter->recvpriv.signal_strength
1258 			, padapter->recvpriv.rssi
1259 			, padapter->recvpriv.signal_qual
1260 	);
1261 	#endif
1262 
1263 	rtw_set_signal_stat_timer(&padapter->recvpriv);
1264 
1265 	/* update fw_state will clr _FW_UNDER_LINKING here indirectly */
1266 	switch (pnetwork->network.InfrastructureMode) {
1267 	case Ndis802_11Infrastructure:
1268 
1269 			if (pmlmepriv->fw_state&WIFI_UNDER_WPS)
1270 				pmlmepriv->fw_state = WIFI_STATION_STATE|WIFI_UNDER_WPS;
1271 			else
1272 				pmlmepriv->fw_state = WIFI_STATION_STATE;
1273 
1274 			break;
1275 	case Ndis802_11IBSS:
1276 			pmlmepriv->fw_state = WIFI_ADHOC_STATE;
1277 			break;
1278 	default:
1279 			pmlmepriv->fw_state = WIFI_NULL_STATE;
1280 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Invalid network_mode\n"));
1281 			break;
1282 	}
1283 
1284 	rtw_update_protection(padapter, (cur_network->network.IEs) + sizeof(struct ndis_802_11_fix_ie),
1285 									(cur_network->network.IELength));
1286 
1287 	rtw_update_ht_cap(padapter, cur_network->network.IEs, cur_network->network.IELength, (u8) cur_network->network.Configuration.DSConfig);
1288 }
1289 
1290 /* Notes: the function could be > passive_level (the same context as Rx tasklet) */
1291 /* pnetwork : returns from rtw_joinbss_event_callback */
1292 /* ptarget_wlan: found from scanned_queue */
1293 /* if join_res > 0, for (fw_state ==WIFI_STATION_STATE), we check if  "ptarget_sta" & "ptarget_wlan" exist. */
1294 /* if join_res > 0, for (fw_state ==WIFI_ADHOC_STATE), we only check if "ptarget_wlan" exist. */
1295 /* if join_res > 0, update "cur_network->network" from "pnetwork->network" if (ptarget_wlan != NULL). */
1296 /*  */
1297 /* define REJOIN */
1298 void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
1299 {
1300 	static u8 retry;
1301 	u8 timer_cancelled;
1302 	struct sta_info *ptarget_sta = NULL, *pcur_sta = NULL;
1303 	struct	sta_priv *pstapriv = &adapter->stapriv;
1304 	struct	mlme_priv *pmlmepriv = &(adapter->mlmepriv);
1305 	struct wlan_network	*pnetwork	= (struct wlan_network *)pbuf;
1306 	struct wlan_network	*cur_network = &(pmlmepriv->cur_network);
1307 	struct wlan_network	*pcur_wlan = NULL, *ptarget_wlan = NULL;
1308 	unsigned int		the_same_macaddr = false;
1309 
1310 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("joinbss event call back received with res =%d\n", pnetwork->join_res));
1311 
1312 	rtw_get_encrypt_decrypt_from_registrypriv(adapter);
1313 
1314 	if (pmlmepriv->assoc_ssid.SsidLength == 0)
1315 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("@@@@@   joinbss event call back  for Any SSid\n"));
1316 	else
1317 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("@@@@@   rtw_joinbss_event_callback for SSid:%s\n", pmlmepriv->assoc_ssid.Ssid));
1318 
1319 	the_same_macaddr = !memcmp(pnetwork->network.MacAddress, cur_network->network.MacAddress, ETH_ALEN);
1320 
1321 	pnetwork->network.Length = get_wlan_bssid_ex_sz(&pnetwork->network);
1322 	if (pnetwork->network.Length > sizeof(struct wlan_bssid_ex)) {
1323 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n\n ***joinbss_evt_callback return a wrong bss ***\n\n"));
1324 		return;
1325 	}
1326 
1327 	spin_lock_bh(&pmlmepriv->lock);
1328 
1329 	pmlmepriv->LinkDetectInfo.TrafficTransitionCount = 0;
1330 	pmlmepriv->LinkDetectInfo.LowPowerTransitionCount = 0;
1331 
1332 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("\n rtw_joinbss_event_callback !! spin_lock_irqsave\n"));
1333 
1334 	if (pnetwork->join_res > 0) {
1335 		spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1336 		retry = 0;
1337 		if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
1338 			/* s1. find ptarget_wlan */
1339 			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
1340 				if (the_same_macaddr) {
1341 					ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
1342 				} else {
1343 					pcur_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
1344 					if (pcur_wlan)
1345 						pcur_wlan->fixed = false;
1346 
1347 					pcur_sta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
1348 					if (pcur_sta)
1349 						rtw_free_stainfo(adapter,  pcur_sta);
1350 
1351 					ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, pnetwork->network.MacAddress);
1352 					if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) {
1353 						if (ptarget_wlan)
1354 							ptarget_wlan->fixed = true;
1355 					}
1356 				}
1357 
1358 			} else {
1359 				ptarget_wlan = _rtw_find_same_network(&pmlmepriv->scanned_queue, pnetwork);
1360 				if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) {
1361 					if (ptarget_wlan)
1362 						ptarget_wlan->fixed = true;
1363 				}
1364 			}
1365 
1366 			/* s2. update cur_network */
1367 			if (ptarget_wlan) {
1368 				rtw_joinbss_update_network(adapter, ptarget_wlan, pnetwork);
1369 			} else {
1370 				DBG_871X_LEVEL(_drv_always_, "Can't find ptarget_wlan when joinbss_event callback\n");
1371 				spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1372 				goto ignore_joinbss_callback;
1373 			}
1374 
1375 			/* s3. find ptarget_sta & update ptarget_sta after update cur_network only for station mode */
1376 			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) {
1377 				ptarget_sta = rtw_joinbss_update_stainfo(adapter, pnetwork);
1378 				if (!ptarget_sta) {
1379 					RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Can't update stainfo when joinbss_event callback\n"));
1380 					spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1381 					goto ignore_joinbss_callback;
1382 				}
1383 			}
1384 
1385 			/* s4. indicate connect */
1386 			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) {
1387 				pmlmepriv->cur_network_scanned = ptarget_wlan;
1388 				rtw_indicate_connect(adapter);
1389 			} else {
1390 				/* adhoc mode will rtw_indicate_connect when rtw_stassoc_event_callback */
1391 				RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("adhoc mode, fw_state:%x", get_fwstate(pmlmepriv)));
1392 			}
1393 
1394 			/* s5. Cancel assoc_timer */
1395 			_cancel_timer(&pmlmepriv->assoc_timer, &timer_cancelled);
1396 
1397 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("Cancel assoc_timer\n"));
1398 
1399 		} else {
1400 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("rtw_joinbss_event_callback err: fw_state:%x", get_fwstate(pmlmepriv)));
1401 			spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1402 			goto ignore_joinbss_callback;
1403 		}
1404 
1405 		spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1406 
1407 	} else if (pnetwork->join_res == -4) {
1408 		rtw_reset_securitypriv(adapter);
1409 		_set_timer(&pmlmepriv->assoc_timer, 1);
1410 
1411 		/* rtw_free_assoc_resources(adapter, 1); */
1412 
1413 		if ((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == true) {
1414 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("fail! clear _FW_UNDER_LINKING ^^^fw_state =%x\n", get_fwstate(pmlmepriv)));
1415 			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
1416 		}
1417 
1418 	} else {/* if join_res < 0 (join fails), then try again */
1419 
1420 		#ifdef REJOIN
1421 		res = _FAIL;
1422 		if (retry < 2) {
1423 			res = rtw_select_and_join_from_scanned_queue(pmlmepriv);
1424 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("rtw_select_and_join_from_scanned_queue again! res:%d\n", res));
1425 		}
1426 
1427 		if (res == _SUCCESS) {
1428 			/* extend time of assoc_timer */
1429 			_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
1430 			retry++;
1431 		} else if (res == 2) {/* there is no need to wait for join */
1432 			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
1433 			rtw_indicate_connect(adapter);
1434 		} else {
1435 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Set Assoc_Timer = 1; can't find match ssid in scanned_q\n"));
1436 		#endif
1437 
1438 			_set_timer(&pmlmepriv->assoc_timer, 1);
1439 			/* rtw_free_assoc_resources(adapter, 1); */
1440 			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
1441 
1442 		#ifdef REJOIN
1443 			retry = 0;
1444 		}
1445 		#endif
1446 	}
1447 
1448 ignore_joinbss_callback:
1449 
1450 	spin_unlock_bh(&pmlmepriv->lock);
1451 }
1452 
1453 void rtw_joinbss_event_callback(struct adapter *adapter, u8 *pbuf)
1454 {
1455 	struct wlan_network	*pnetwork	= (struct wlan_network *)pbuf;
1456 
1457 	mlmeext_joinbss_event_callback(adapter, pnetwork->join_res);
1458 
1459 	rtw_os_xmit_schedule(adapter);
1460 }
1461 
1462 /* FOR STA, AP , AD-HOC mode */
1463 void rtw_sta_media_status_rpt(struct adapter *adapter, struct sta_info *psta, u32 mstatus)
1464 {
1465 	u16 media_status_rpt;
1466 
1467 	if (!psta)
1468 		return;
1469 
1470 	media_status_rpt = (u16)((psta->mac_id<<8)|mstatus); /*   MACID|OPMODE:1 connect */
1471 	rtw_hal_set_hwreg(adapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status_rpt);
1472 }
1473 
1474 void rtw_stassoc_event_callback(struct adapter *adapter, u8 *pbuf)
1475 {
1476 	struct sta_info *psta;
1477 	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
1478 	struct stassoc_event	*pstassoc	= (struct stassoc_event *)pbuf;
1479 	struct wlan_network	*cur_network = &(pmlmepriv->cur_network);
1480 	struct wlan_network	*ptarget_wlan = NULL;
1481 
1482 	if (rtw_access_ctrl(adapter, pstassoc->macaddr) == false)
1483 		return;
1484 
1485 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1486 		psta = rtw_get_stainfo(&adapter->stapriv, pstassoc->macaddr);
1487 		if (psta) {
1488 			u8 *passoc_req = NULL;
1489 			u32 assoc_req_len = 0;
1490 
1491 			rtw_sta_media_status_rpt(adapter, psta, 1);
1492 
1493 #ifndef CONFIG_AUTO_AP_MODE
1494 
1495 			ap_sta_info_defer_update(adapter, psta);
1496 
1497 			/* report to upper layer */
1498 			DBG_871X("indicate_sta_assoc_event to upper layer - hostapd\n");
1499 			spin_lock_bh(&psta->lock);
1500 			if (psta->passoc_req && psta->assoc_req_len > 0) {
1501 				passoc_req = rtw_zmalloc(psta->assoc_req_len);
1502 				if (passoc_req) {
1503 					assoc_req_len = psta->assoc_req_len;
1504 					memcpy(passoc_req, psta->passoc_req, assoc_req_len);
1505 
1506 					kfree(psta->passoc_req);
1507 					psta->passoc_req = NULL;
1508 					psta->assoc_req_len = 0;
1509 				}
1510 			}
1511 			spin_unlock_bh(&psta->lock);
1512 
1513 			if (passoc_req && assoc_req_len > 0) {
1514 				rtw_cfg80211_indicate_sta_assoc(adapter, passoc_req, assoc_req_len);
1515 
1516 				kfree(passoc_req);
1517 			}
1518 #endif /* CONFIG_AUTO_AP_MODE */
1519 		}
1520 		return;
1521 	}
1522 
1523 	/* for AD-HOC mode */
1524 	psta = rtw_get_stainfo(&adapter->stapriv, pstassoc->macaddr);
1525 	if (psta) {
1526 		/* the sta have been in sta_info_queue => do nothing */
1527 
1528 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Error: rtw_stassoc_event_callback: sta has been in sta_hash_queue\n"));
1529 
1530 		return; /* between drv has received this event before and  fw have not yet to set key to CAM_ENTRY) */
1531 	}
1532 
1533 	psta = rtw_alloc_stainfo(&adapter->stapriv, pstassoc->macaddr);
1534 	if (!psta) {
1535 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Can't alloc sta_info when rtw_stassoc_event_callback\n"));
1536 		return;
1537 	}
1538 
1539 	/* to do : init sta_info variable */
1540 	psta->qos_option = 0;
1541 	psta->mac_id = (uint)pstassoc->cam_id;
1542 	/* psta->aid = (uint)pstassoc->cam_id; */
1543 	DBG_871X("%s\n", __func__);
1544 	/* for ad-hoc mode */
1545 	rtw_hal_set_odm_var(adapter, HAL_ODM_STA_INFO, psta, true);
1546 
1547 	rtw_sta_media_status_rpt(adapter, psta, 1);
1548 
1549 	if (adapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X)
1550 		psta->dot118021XPrivacy = adapter->securitypriv.dot11PrivacyAlgrthm;
1551 
1552 	psta->ieee8021x_blocked = false;
1553 
1554 	spin_lock_bh(&pmlmepriv->lock);
1555 
1556 	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true) ||
1557 		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true)) {
1558 		if (adapter->stapriv.asoc_sta_count == 2) {
1559 			spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1560 			ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
1561 			pmlmepriv->cur_network_scanned = ptarget_wlan;
1562 			if (ptarget_wlan)
1563 				ptarget_wlan->fixed = true;
1564 			spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1565 			/*  a sta + bc/mc_stainfo (not Ibss_stainfo) */
1566 			rtw_indicate_connect(adapter);
1567 		}
1568 	}
1569 
1570 	spin_unlock_bh(&pmlmepriv->lock);
1571 
1572 	mlmeext_sta_add_event_callback(adapter, psta);
1573 }
1574 
1575 void rtw_stadel_event_callback(struct adapter *adapter, u8 *pbuf)
1576 {
1577 	int mac_id = (-1);
1578 	struct sta_info *psta;
1579 	struct wlan_network *pwlan = NULL;
1580 	struct wlan_bssid_ex    *pdev_network = NULL;
1581 	u8 *pibss = NULL;
1582 	struct	mlme_priv *pmlmepriv = &(adapter->mlmepriv);
1583 	struct	stadel_event *pstadel	= (struct stadel_event *)pbuf;
1584 	struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
1585 	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
1586 	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1587 
1588 	psta = rtw_get_stainfo(&adapter->stapriv, pstadel->macaddr);
1589 	if (psta)
1590 		mac_id = psta->mac_id;
1591 	else
1592 		mac_id = pstadel->mac_id;
1593 
1594 	DBG_871X("%s(mac_id =%d) =" MAC_FMT "\n", __func__, mac_id, MAC_ARG(pstadel->macaddr));
1595 
1596 	if (mac_id >= 0) {
1597 		u16 media_status;
1598 		media_status = (mac_id<<8)|0; /*   MACID|OPMODE:0 means disconnect */
1599 		/* for STA, AP, ADHOC mode, report disconnect stauts to FW */
1600 		rtw_hal_set_hwreg(adapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
1601 	}
1602 
1603 	/* if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) */
1604 	if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1605 		return;
1606 
1607 	mlmeext_sta_del_event_callback(adapter);
1608 
1609 	spin_lock_bh(&pmlmepriv->lock);
1610 
1611 	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
1612 		u16 reason = *((unsigned short *)(pstadel->rsvd));
1613 		bool roam = false;
1614 		struct wlan_network *roam_target = NULL;
1615 
1616 		if (adapter->registrypriv.wifi_spec == 1) {
1617 			roam = false;
1618 		} else if (reason == WLAN_REASON_EXPIRATION_CHK && rtw_chk_roam_flags(adapter, RTW_ROAM_ON_EXPIRED)) {
1619 			roam = true;
1620 		} else if (reason == WLAN_REASON_ACTIVE_ROAM && rtw_chk_roam_flags(adapter, RTW_ROAM_ACTIVE)) {
1621 			roam = true;
1622 			roam_target = pmlmepriv->roam_network;
1623 		}
1624 
1625 		if (roam) {
1626 			if (rtw_to_roam(adapter) > 0)
1627 				rtw_dec_to_roam(adapter); /* this stadel_event is caused by roaming, decrease to_roam */
1628 			else if (rtw_to_roam(adapter) == 0)
1629 				rtw_set_to_roam(adapter, adapter->registrypriv.max_roaming_times);
1630 		} else {
1631 			rtw_set_to_roam(adapter, 0);
1632 		}
1633 
1634 		rtw_free_uc_swdec_pending_queue(adapter);
1635 
1636 		rtw_free_assoc_resources(adapter, 1);
1637 		rtw_indicate_disconnect(adapter);
1638 
1639 		spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1640 		/*  remove the network entry in scanned_queue */
1641 		pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
1642 		if (pwlan) {
1643 			pwlan->fixed = false;
1644 			rtw_free_network_nolock(adapter, pwlan);
1645 		}
1646 		spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1647 
1648 		_rtw_roaming(adapter, roam_target);
1649 	}
1650 
1651 	if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) ||
1652 	      check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
1653 
1654 		rtw_free_stainfo(adapter,  psta);
1655 
1656 		if (adapter->stapriv.asoc_sta_count == 1) {/* a sta + bc/mc_stainfo (not Ibss_stainfo) */
1657 			/* rtw_indicate_disconnect(adapter);removed@20091105 */
1658 			spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1659 			/* free old ibss network */
1660 			/* pwlan = rtw_find_network(&pmlmepriv->scanned_queue, pstadel->macaddr); */
1661 			pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
1662 			if (pwlan) {
1663 				pwlan->fixed = false;
1664 				rtw_free_network_nolock(adapter, pwlan);
1665 			}
1666 			spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
1667 			/* re-create ibss */
1668 			pdev_network = &(adapter->registrypriv.dev_network);
1669 			pibss = adapter->registrypriv.dev_network.MacAddress;
1670 
1671 			memcpy(pdev_network, &tgt_network->network, get_wlan_bssid_ex_sz(&tgt_network->network));
1672 
1673 			memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(struct ndis_802_11_ssid));
1674 
1675 			rtw_update_registrypriv_dev_network(adapter);
1676 
1677 			rtw_generate_random_ibss(pibss);
1678 
1679 			if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
1680 				set_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
1681 				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_STATE);
1682 			}
1683 
1684 			if (rtw_createbss_cmd(adapter) != _SUCCESS)
1685 				RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_, ("***Error =>stadel_event_callback: rtw_createbss_cmd status FAIL***\n "));
1686 		}
1687 
1688 	}
1689 
1690 	spin_unlock_bh(&pmlmepriv->lock);
1691 }
1692 
1693 void rtw_cpwm_event_callback(struct adapter *padapter, u8 *pbuf)
1694 {
1695 	struct reportpwrstate_parm *preportpwrstate;
1696 
1697 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_cpwm_event_callback !!!\n"));
1698 	preportpwrstate = (struct reportpwrstate_parm *)pbuf;
1699 	preportpwrstate->state |= (u8)(adapter_to_pwrctl(padapter)->cpwm_tog + 0x80);
1700 	cpwm_int_hdl(padapter, preportpwrstate);
1701 }
1702 
1703 void rtw_wmm_event_callback(struct adapter *padapter, u8 *pbuf)
1704 {
1705 	WMMOnAssocRsp(padapter);
1706 }
1707 
1708 /*
1709 * _rtw_join_timeout_handler - Timeout/failure handler for CMD JoinBss
1710 * @adapter: pointer to struct adapter structure
1711 */
1712 void _rtw_join_timeout_handler(struct timer_list *t)
1713 {
1714 	struct adapter *adapter = from_timer(adapter, t,
1715 						  mlmepriv.assoc_timer);
1716 	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
1717 
1718 	DBG_871X("%s, fw_state =%x\n", __func__, get_fwstate(pmlmepriv));
1719 
1720 	if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
1721 		return;
1722 
1723 	spin_lock_bh(&pmlmepriv->lock);
1724 
1725 	if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */
1726 		while (1) {
1727 			rtw_dec_to_roam(adapter);
1728 			if (rtw_to_roam(adapter) != 0) { /* try another */
1729 				int do_join_r;
1730 				DBG_871X("%s try another roaming\n", __func__);
1731 				do_join_r = rtw_do_join(adapter);
1732 				if (_SUCCESS != do_join_r) {
1733 					DBG_871X("%s roaming do_join return %d\n", __func__, do_join_r);
1734 					continue;
1735 				}
1736 				break;
1737 			} else {
1738 				DBG_871X("%s We've try roaming but fail\n", __func__);
1739 				rtw_indicate_disconnect(adapter);
1740 				break;
1741 			}
1742 		}
1743 
1744 	} else {
1745 		rtw_indicate_disconnect(adapter);
1746 		free_scanqueue(pmlmepriv);/*  */
1747 
1748 		/* indicate disconnect for the case that join_timeout and check_fwstate != FW_LINKED */
1749 		rtw_cfg80211_indicate_disconnect(adapter);
1750 
1751 	}
1752 
1753 	spin_unlock_bh(&pmlmepriv->lock);
1754 }
1755 
1756 /*
1757 * rtw_scan_timeout_handler - Timeout/Failure handler for CMD SiteSurvey
1758 * @adapter: pointer to struct adapter structure
1759 */
1760 void rtw_scan_timeout_handler(struct timer_list *t)
1761 {
1762 	struct adapter *adapter = from_timer(adapter, t,
1763 						  mlmepriv.scan_to_timer);
1764 	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
1765 
1766 	DBG_871X(FUNC_ADPT_FMT" fw_state =%x\n", FUNC_ADPT_ARG(adapter), get_fwstate(pmlmepriv));
1767 
1768 	spin_lock_bh(&pmlmepriv->lock);
1769 
1770 	_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
1771 
1772 	spin_unlock_bh(&pmlmepriv->lock);
1773 
1774 	rtw_indicate_scan_done(adapter, true);
1775 }
1776 
1777 void rtw_mlme_reset_auto_scan_int(struct adapter *adapter)
1778 {
1779 	struct mlme_priv *mlme = &adapter->mlmepriv;
1780 	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
1781 	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1782 
1783 	if (pmlmeinfo->VHT_enable) /* disable auto scan when connect to 11AC AP */
1784 		mlme->auto_scan_int_ms = 0;
1785 	else if (adapter->registrypriv.wifi_spec && is_client_associated_to_ap(adapter) == true)
1786 		mlme->auto_scan_int_ms = 60*1000;
1787 	else if (rtw_chk_roam_flags(adapter, RTW_ROAM_ACTIVE)) {
1788 		if (check_fwstate(mlme, WIFI_STATION_STATE) && check_fwstate(mlme, _FW_LINKED))
1789 			mlme->auto_scan_int_ms = mlme->roam_scan_int_ms;
1790 	} else
1791 		mlme->auto_scan_int_ms = 0; /* disabled */
1792 }
1793 
1794 static void rtw_auto_scan_handler(struct adapter *padapter)
1795 {
1796 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1797 
1798 	rtw_mlme_reset_auto_scan_int(padapter);
1799 
1800 	if (pmlmepriv->auto_scan_int_ms != 0
1801 		&& jiffies_to_msecs(jiffies - pmlmepriv->scan_start_time) > pmlmepriv->auto_scan_int_ms) {
1802 
1803 		if (!padapter->registrypriv.wifi_spec) {
1804 			if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == true) {
1805 				DBG_871X(FUNC_ADPT_FMT" _FW_UNDER_SURVEY|_FW_UNDER_LINKING\n", FUNC_ADPT_ARG(padapter));
1806 				goto exit;
1807 			}
1808 
1809 			if (pmlmepriv->LinkDetectInfo.bBusyTraffic) {
1810 				DBG_871X(FUNC_ADPT_FMT" exit BusyTraffic\n", FUNC_ADPT_ARG(padapter));
1811 				goto exit;
1812 			}
1813 		}
1814 
1815 		DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
1816 
1817 		rtw_set_802_11_bssid_list_scan(padapter, NULL, 0);
1818 	}
1819 
1820 exit:
1821 	return;
1822 }
1823 
1824 void rtw_dynamic_check_timer_handler(struct adapter *adapter)
1825 {
1826 	if (!adapter)
1827 		return;
1828 
1829 	if (!adapter->hw_init_completed)
1830 		return;
1831 
1832 	if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
1833 		return;
1834 
1835 	if (adapter->net_closed)
1836 		return;
1837 
1838 	if (is_primary_adapter(adapter))
1839 		DBG_871X("IsBtDisabled =%d, IsBtControlLps =%d\n", hal_btcoex_IsBtDisabled(adapter), hal_btcoex_IsBtControlLps(adapter));
1840 
1841 	if ((adapter_to_pwrctl(adapter)->bFwCurrentInPSMode)
1842 		&& !(hal_btcoex_IsBtControlLps(adapter))
1843 		) {
1844 		u8 bEnterPS;
1845 
1846 		linked_status_chk(adapter);
1847 
1848 		bEnterPS = traffic_status_watchdog(adapter, 1);
1849 		if (bEnterPS) {
1850 			/* rtw_lps_ctrl_wk_cmd(adapter, LPS_CTRL_ENTER, 1); */
1851 			rtw_hal_dm_watchdog_in_lps(adapter);
1852 		} else {
1853 			/* call rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_LEAVE, 1) in traffic_status_watchdog() */
1854 		}
1855 
1856 	} else {
1857 		if (is_primary_adapter(adapter))
1858 			rtw_dynamic_chk_wk_cmd(adapter);
1859 	}
1860 
1861 	/* auto site survey */
1862 	rtw_auto_scan_handler(adapter);
1863 }
1864 
1865 inline bool rtw_is_scan_deny(struct adapter *adapter)
1866 {
1867 	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
1868 	return (atomic_read(&mlmepriv->set_scan_deny) != 0) ? true : false;
1869 }
1870 
1871 inline void rtw_clear_scan_deny(struct adapter *adapter)
1872 {
1873 	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
1874 	atomic_set(&mlmepriv->set_scan_deny, 0);
1875 
1876 	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter));
1877 }
1878 
1879 void rtw_set_scan_deny(struct adapter *adapter, u32 ms)
1880 {
1881 	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
1882 
1883 	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter));
1884 	atomic_set(&mlmepriv->set_scan_deny, 1);
1885 	_set_timer(&mlmepriv->set_scan_deny_timer, ms);
1886 }
1887 
1888 /*
1889 * Select a new roaming candidate from the original @param candidate and @param competitor
1890 * @return true: candidate is updated
1891 * @return false: candidate is not updated
1892 */
1893 static int rtw_check_roaming_candidate(struct mlme_priv *mlme
1894 	, struct wlan_network **candidate, struct wlan_network *competitor)
1895 {
1896 	int updated = false;
1897 	struct adapter *adapter = container_of(mlme, struct adapter, mlmepriv);
1898 
1899 	if (is_same_ess(&competitor->network, &mlme->cur_network.network) == false)
1900 		goto exit;
1901 
1902 	if (rtw_is_desired_network(adapter, competitor) == false)
1903 		goto exit;
1904 
1905 	DBG_871X("roam candidate:%s %s("MAC_FMT", ch%3u) rssi:%d, age:%5d\n",
1906 		(competitor == mlme->cur_network_scanned)?"*":" ",
1907 		competitor->network.Ssid.Ssid,
1908 		MAC_ARG(competitor->network.MacAddress),
1909 		competitor->network.Configuration.DSConfig,
1910 		(int)competitor->network.Rssi,
1911 		jiffies_to_msecs(jiffies - competitor->last_scanned)
1912 	);
1913 
1914 	/* got specific addr to roam */
1915 	if (!is_zero_mac_addr(mlme->roam_tgt_addr)) {
1916 		if (!memcmp(mlme->roam_tgt_addr, competitor->network.MacAddress, ETH_ALEN))
1917 			goto update;
1918 		else
1919 			goto exit;
1920 	}
1921 	if (jiffies_to_msecs(jiffies - competitor->last_scanned) >= mlme->roam_scanr_exp_ms)
1922 		goto exit;
1923 
1924 	if (competitor->network.Rssi - mlme->cur_network_scanned->network.Rssi < mlme->roam_rssi_diff_th)
1925 		goto exit;
1926 
1927 	if (*candidate != NULL && (*candidate)->network.Rssi >= competitor->network.Rssi)
1928 		goto exit;
1929 
1930 update:
1931 	*candidate = competitor;
1932 	updated = true;
1933 
1934 exit:
1935 	return updated;
1936 }
1937 
1938 int rtw_select_roaming_candidate(struct mlme_priv *mlme)
1939 {
1940 	int ret = _FAIL;
1941 	struct list_head	*phead;
1942 	struct __queue	*queue	= &(mlme->scanned_queue);
1943 	struct	wlan_network	*pnetwork = NULL;
1944 	struct	wlan_network	*candidate = NULL;
1945 
1946 	if (!mlme->cur_network_scanned) {
1947 		rtw_warn_on(1);
1948 		return ret;
1949 	}
1950 
1951 	spin_lock_bh(&(mlme->scanned_queue.lock));
1952 	phead = get_list_head(queue);
1953 
1954 	mlme->pscanned = get_next(phead);
1955 
1956 	while (phead != mlme->pscanned) {
1957 
1958 		pnetwork = LIST_CONTAINOR(mlme->pscanned, struct wlan_network, list);
1959 		if (!pnetwork) {
1960 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("%s return _FAIL:(pnetwork == NULL)\n", __func__));
1961 			ret = _FAIL;
1962 			goto exit;
1963 		}
1964 
1965 		mlme->pscanned = get_next(mlme->pscanned);
1966 
1967 		DBG_871X("%s("MAC_FMT", ch%u) rssi:%d\n"
1968 			, pnetwork->network.Ssid.Ssid
1969 			, MAC_ARG(pnetwork->network.MacAddress)
1970 			, pnetwork->network.Configuration.DSConfig
1971 			, (int)pnetwork->network.Rssi);
1972 
1973 		rtw_check_roaming_candidate(mlme, &candidate, pnetwork);
1974 
1975 	}
1976 
1977 	if (!candidate) {
1978 		DBG_871X("%s: return _FAIL(candidate == NULL)\n", __func__);
1979 		ret = _FAIL;
1980 		goto exit;
1981 	} else {
1982 		DBG_871X("%s: candidate: %s("MAC_FMT", ch:%u)\n", __func__,
1983 			candidate->network.Ssid.Ssid, MAC_ARG(candidate->network.MacAddress),
1984 			candidate->network.Configuration.DSConfig);
1985 
1986 		mlme->roam_network = candidate;
1987 
1988 		if (!memcmp(candidate->network.MacAddress, mlme->roam_tgt_addr, ETH_ALEN))
1989 			eth_zero_addr(mlme->roam_tgt_addr);
1990 	}
1991 
1992 	ret = _SUCCESS;
1993 exit:
1994 	spin_unlock_bh(&(mlme->scanned_queue.lock));
1995 
1996 	return ret;
1997 }
1998 
1999 /*
2000 * Select a new join candidate from the original @param candidate and @param competitor
2001 * @return true: candidate is updated
2002 * @return false: candidate is not updated
2003 */
2004 static int rtw_check_join_candidate(struct mlme_priv *mlme
2005 	, struct wlan_network **candidate, struct wlan_network *competitor)
2006 {
2007 	int updated = false;
2008 	struct adapter *adapter = container_of(mlme, struct adapter, mlmepriv);
2009 
2010 	/* check bssid, if needed */
2011 	if (mlme->assoc_by_bssid) {
2012 		if (memcmp(competitor->network.MacAddress, mlme->assoc_bssid, ETH_ALEN))
2013 			goto exit;
2014 	}
2015 
2016 	/* check ssid, if needed */
2017 	if (mlme->assoc_ssid.Ssid[0] && mlme->assoc_ssid.SsidLength) {
2018 		if (competitor->network.Ssid.SsidLength != mlme->assoc_ssid.SsidLength
2019 			|| memcmp(competitor->network.Ssid.Ssid, mlme->assoc_ssid.Ssid, mlme->assoc_ssid.SsidLength)
2020 		)
2021 			goto exit;
2022 	}
2023 
2024 	if (rtw_is_desired_network(adapter, competitor)  == false)
2025 		goto exit;
2026 
2027 	if (rtw_to_roam(adapter) > 0) {
2028 		if (jiffies_to_msecs(jiffies - competitor->last_scanned) >= mlme->roam_scanr_exp_ms
2029 			|| is_same_ess(&competitor->network, &mlme->cur_network.network) == false
2030 		)
2031 			goto exit;
2032 	}
2033 
2034 	if (*candidate == NULL || (*candidate)->network.Rssi < competitor->network.Rssi) {
2035 		*candidate = competitor;
2036 		updated = true;
2037 	}
2038 
2039 	if (updated) {
2040 		DBG_871X("[by_bssid:%u][assoc_ssid:%s]"
2041 			"[to_roam:%u] "
2042 			"new candidate: %s("MAC_FMT", ch%u) rssi:%d\n",
2043 			mlme->assoc_by_bssid,
2044 			mlme->assoc_ssid.Ssid,
2045 			rtw_to_roam(adapter),
2046 			(*candidate)->network.Ssid.Ssid,
2047 			MAC_ARG((*candidate)->network.MacAddress),
2048 			(*candidate)->network.Configuration.DSConfig,
2049 			(int)(*candidate)->network.Rssi
2050 		);
2051 	}
2052 
2053 exit:
2054 	return updated;
2055 }
2056 
2057 /*
2058 Calling context:
2059 The caller of the sub-routine will be in critical section...
2060 The caller must hold the following spinlock
2061 pmlmepriv->lock
2062 */
2063 
2064 int rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv)
2065 {
2066 	int ret;
2067 	struct list_head	*phead;
2068 	struct adapter *adapter;
2069 	struct __queue	*queue	= &(pmlmepriv->scanned_queue);
2070 	struct	wlan_network	*pnetwork = NULL;
2071 	struct	wlan_network	*candidate = NULL;
2072 
2073 	adapter = (struct adapter *)pmlmepriv->nic_hdl;
2074 
2075 	spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
2076 
2077 	if (pmlmepriv->roam_network) {
2078 		candidate = pmlmepriv->roam_network;
2079 		pmlmepriv->roam_network = NULL;
2080 		goto candidate_exist;
2081 	}
2082 
2083 	phead = get_list_head(queue);
2084 	pmlmepriv->pscanned = get_next(phead);
2085 
2086 	while (phead != pmlmepriv->pscanned) {
2087 
2088 		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
2089 		if (!pnetwork) {
2090 			RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("%s return _FAIL:(pnetwork == NULL)\n", __func__));
2091 			ret = _FAIL;
2092 			goto exit;
2093 		}
2094 
2095 		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
2096 
2097 		DBG_871X("%s("MAC_FMT", ch%u) rssi:%d\n"
2098 			, pnetwork->network.Ssid.Ssid
2099 			, MAC_ARG(pnetwork->network.MacAddress)
2100 			, pnetwork->network.Configuration.DSConfig
2101 			, (int)pnetwork->network.Rssi);
2102 
2103 		rtw_check_join_candidate(pmlmepriv, &candidate, pnetwork);
2104 
2105 	}
2106 
2107 	if (!candidate) {
2108 		DBG_871X("%s: return _FAIL(candidate == NULL)\n", __func__);
2109 #ifdef CONFIG_WOWLAN
2110 		_clr_fwstate_(pmlmepriv, _FW_LINKED|_FW_UNDER_LINKING);
2111 #endif
2112 		ret = _FAIL;
2113 		goto exit;
2114 	} else {
2115 		DBG_871X("%s: candidate: %s("MAC_FMT", ch:%u)\n", __func__,
2116 			candidate->network.Ssid.Ssid, MAC_ARG(candidate->network.MacAddress),
2117 			candidate->network.Configuration.DSConfig);
2118 		goto candidate_exist;
2119 	}
2120 
2121 candidate_exist:
2122 
2123 	/*  check for situation of  _FW_LINKED */
2124 	if (check_fwstate(pmlmepriv, _FW_LINKED) == true) {
2125 		DBG_871X("%s: _FW_LINKED while ask_for_joinbss!!!\n", __func__);
2126 
2127 		rtw_disassoc_cmd(adapter, 0, true);
2128 		rtw_indicate_disconnect(adapter);
2129 		rtw_free_assoc_resources(adapter, 0);
2130 	}
2131 
2132 	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
2133 	ret = rtw_joinbss_cmd(adapter, candidate);
2134 
2135 exit:
2136 	spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
2137 	return ret;
2138 }
2139 
2140 sint rtw_set_auth(struct adapter *adapter, struct security_priv *psecuritypriv)
2141 {
2142 	struct	cmd_obj *pcmd;
2143 	struct	setauth_parm *psetauthparm;
2144 	struct	cmd_priv *pcmdpriv = &(adapter->cmdpriv);
2145 	sint		res = _SUCCESS;
2146 
2147 	pcmd = rtw_zmalloc(sizeof(struct cmd_obj));
2148 	if (!pcmd) {
2149 		res = _FAIL;  /* try again */
2150 		goto exit;
2151 	}
2152 
2153 	psetauthparm = rtw_zmalloc(sizeof(struct setauth_parm));
2154 	if (!psetauthparm) {
2155 		kfree(pcmd);
2156 		res = _FAIL;
2157 		goto exit;
2158 	}
2159 
2160 	psetauthparm->mode = (unsigned char)psecuritypriv->dot11AuthAlgrthm;
2161 
2162 	pcmd->cmdcode = _SetAuth_CMD_;
2163 	pcmd->parmbuf = (unsigned char *)psetauthparm;
2164 	pcmd->cmdsz =  (sizeof(struct setauth_parm));
2165 	pcmd->rsp = NULL;
2166 	pcmd->rspsz = 0;
2167 
2168 	INIT_LIST_HEAD(&pcmd->list);
2169 
2170 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("after enqueue set_auth_cmd, auth_mode =%x\n", psecuritypriv->dot11AuthAlgrthm));
2171 
2172 	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
2173 
2174 exit:
2175 	return res;
2176 }
2177 
2178 sint rtw_set_key(struct adapter *adapter, struct security_priv *psecuritypriv, sint keyid, u8 set_tx, bool enqueue)
2179 {
2180 	u8 keylen;
2181 	struct cmd_obj		*pcmd;
2182 	struct setkey_parm	*psetkeyparm;
2183 	struct cmd_priv 	*pcmdpriv = &(adapter->cmdpriv);
2184 	sint	res = _SUCCESS;
2185 
2186 	psetkeyparm = rtw_zmalloc(sizeof(struct setkey_parm));
2187 	if (!psetkeyparm) {
2188 		res = _FAIL;
2189 		goto exit;
2190 	}
2191 
2192 	if (psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) {
2193 		psetkeyparm->algorithm = (unsigned char)psecuritypriv->dot118021XGrpPrivacy;
2194 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n rtw_set_key: psetkeyparm->algorithm =(unsigned char)psecuritypriv->dot118021XGrpPrivacy =%d\n", psetkeyparm->algorithm));
2195 	} else {
2196 		psetkeyparm->algorithm = (u8)psecuritypriv->dot11PrivacyAlgrthm;
2197 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n rtw_set_key: psetkeyparm->algorithm =(u8)psecuritypriv->dot11PrivacyAlgrthm =%d\n", psetkeyparm->algorithm));
2198 
2199 	}
2200 	psetkeyparm->keyid = (u8)keyid;/* 0~3 */
2201 	psetkeyparm->set_tx = set_tx;
2202 	if (is_wep_enc(psetkeyparm->algorithm))
2203 		adapter->securitypriv.key_mask |= BIT(psetkeyparm->keyid);
2204 
2205 	DBG_871X("==> rtw_set_key algorithm(%x), keyid(%x), key_mask(%x)\n", psetkeyparm->algorithm, psetkeyparm->keyid, adapter->securitypriv.key_mask);
2206 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n rtw_set_key: psetkeyparm->algorithm =%d psetkeyparm->keyid =(u8)keyid =%d\n", psetkeyparm->algorithm, keyid));
2207 
2208 	switch (psetkeyparm->algorithm) {
2209 
2210 	case _WEP40_:
2211 		keylen = 5;
2212 		memcpy(&(psetkeyparm->key[0]), &(psecuritypriv->dot11DefKey[keyid].skey[0]), keylen);
2213 		break;
2214 	case _WEP104_:
2215 		keylen = 13;
2216 		memcpy(&(psetkeyparm->key[0]), &(psecuritypriv->dot11DefKey[keyid].skey[0]), keylen);
2217 		break;
2218 	case _TKIP_:
2219 		keylen = 16;
2220 		memcpy(&psetkeyparm->key, &psecuritypriv->dot118021XGrpKey[keyid], keylen);
2221 		psetkeyparm->grpkey = 1;
2222 		break;
2223 	case _AES_:
2224 		keylen = 16;
2225 		memcpy(&psetkeyparm->key, &psecuritypriv->dot118021XGrpKey[keyid], keylen);
2226 		psetkeyparm->grpkey = 1;
2227 		break;
2228 	default:
2229 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("\n rtw_set_key:psecuritypriv->dot11PrivacyAlgrthm = %x (must be 1 or 2 or 4 or 5)\n", psecuritypriv->dot11PrivacyAlgrthm));
2230 		res = _FAIL;
2231 		kfree(psetkeyparm);
2232 		goto exit;
2233 	}
2234 
2235 	if (enqueue) {
2236 		pcmd = rtw_zmalloc(sizeof(struct cmd_obj));
2237 		if (!pcmd) {
2238 			kfree(psetkeyparm);
2239 			res = _FAIL;  /* try again */
2240 			goto exit;
2241 		}
2242 
2243 		pcmd->cmdcode = _SetKey_CMD_;
2244 		pcmd->parmbuf = (u8 *)psetkeyparm;
2245 		pcmd->cmdsz =  (sizeof(struct setkey_parm));
2246 		pcmd->rsp = NULL;
2247 		pcmd->rspsz = 0;
2248 
2249 		INIT_LIST_HEAD(&pcmd->list);
2250 
2251 		res = rtw_enqueue_cmd(pcmdpriv, pcmd);
2252 	} else {
2253 		setkey_hdl(adapter, (u8 *)psetkeyparm);
2254 		kfree(psetkeyparm);
2255 	}
2256 exit:
2257 	return res;
2258 }
2259 
2260 /* adjust IEs for rtw_joinbss_cmd in WMM */
2261 int rtw_restruct_wmm_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_len, uint initial_out_len)
2262 {
2263 	unsigned	int ielength = 0;
2264 	unsigned int i, j;
2265 
2266 	i = 12; /* after the fixed IE */
2267 	while (i < in_len) {
2268 		ielength = initial_out_len;
2269 
2270 		if (in_ie[i] == 0xDD && in_ie[i+2] == 0x00 && in_ie[i+3] == 0x50  && in_ie[i+4] == 0xF2 && in_ie[i+5] == 0x02 && i+5 < in_len) { /* WMM element ID and OUI */
2271 			for (j = i; j < i + 9; j++) {
2272 					out_ie[ielength] = in_ie[j];
2273 					ielength++;
2274 			}
2275 			out_ie[initial_out_len + 1] = 0x07;
2276 			out_ie[initial_out_len + 6] = 0x00;
2277 			out_ie[initial_out_len + 8] = 0x00;
2278 
2279 			break;
2280 		}
2281 
2282 		i += (in_ie[i+1]+2); /*  to the next IE element */
2283 	}
2284 
2285 	return ielength;
2286 
2287 }
2288 
2289 /*  */
2290 /*  Ported from 8185: IsInPreAuthKeyList(). (Renamed from SecIsInPreAuthKeyList(), 2006-10-13.) */
2291 /*  Added by Annie, 2006-05-07. */
2292 /*  */
2293 /*  Search by BSSID, */
2294 /*  Return Value: */
2295 /* 		-1		:if there is no pre-auth key in the  table */
2296 /* 		>= 0		:if there is pre-auth key, and   return the entry id */
2297 /*  */
2298 /*  */
2299 
2300 static int SecIsInPMKIDList(struct adapter *Adapter, u8 *bssid)
2301 {
2302 	struct security_priv *psecuritypriv = &Adapter->securitypriv;
2303 	int i = 0;
2304 
2305 	do {
2306 		if ((psecuritypriv->PMKIDList[i].bUsed) &&
2307 				(!memcmp(psecuritypriv->PMKIDList[i].Bssid, bssid, ETH_ALEN))) {
2308 			break;
2309 		} else {
2310 			i++;
2311 			/* continue; */
2312 		}
2313 
2314 	} while (i < NUM_PMKID_CACHE);
2315 
2316 	if (i == NUM_PMKID_CACHE) {
2317 		i = -1;/*  Could not find. */
2318 	} else {
2319 		/*  There is one Pre-Authentication Key for the specific BSSID. */
2320 	}
2321 
2322 	return i;
2323 
2324 }
2325 
2326 /*  */
2327 /*  Check the RSN IE length */
2328 /*  If the RSN IE length <= 20, the RSN IE didn't include the PMKID information */
2329 /*  0-11th element in the array are the fixed IE */
2330 /*  12th element in the array is the IE */
2331 /*  13th element in the array is the IE length */
2332 /*  */
2333 
2334 static int rtw_append_pmkid(struct adapter *Adapter, int iEntry, u8 *ie, uint ie_len)
2335 {
2336 	struct security_priv *psecuritypriv = &Adapter->securitypriv;
2337 
2338 	if (ie[13] <= 20) {
2339 		/*  The RSN IE didn't include the PMK ID, append the PMK information */
2340 			ie[ie_len] = 1;
2341 			ie_len++;
2342 			ie[ie_len] = 0;	/* PMKID count = 0x0100 */
2343 			ie_len++;
2344 			memcpy(&ie[ie_len], &psecuritypriv->PMKIDList[iEntry].PMKID, 16);
2345 
2346 			ie_len += 16;
2347 			ie[13] += 18;/* PMKID length = 2+16 */
2348 
2349 	}
2350 	return ie_len;
2351 }
2352 
2353 sint rtw_restruct_sec_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_len)
2354 {
2355 	u8 authmode = 0x0;
2356 	uint	ielength;
2357 	int iEntry;
2358 
2359 	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
2360 	struct security_priv *psecuritypriv = &adapter->securitypriv;
2361 	uint	ndisauthmode = psecuritypriv->ndisauthtype;
2362 
2363 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2364 		 ("+rtw_restruct_sec_ie: ndisauthmode =%d\n", ndisauthmode));
2365 
2366 	/* copy fixed ie only */
2367 	memcpy(out_ie, in_ie, 12);
2368 	ielength = 12;
2369 	if ((ndisauthmode == Ndis802_11AuthModeWPA) || (ndisauthmode == Ndis802_11AuthModeWPAPSK))
2370 			authmode = _WPA_IE_ID_;
2371 	if ((ndisauthmode == Ndis802_11AuthModeWPA2) || (ndisauthmode == Ndis802_11AuthModeWPA2PSK))
2372 			authmode = _WPA2_IE_ID_;
2373 
2374 	if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS)) {
2375 		memcpy(out_ie+ielength, psecuritypriv->wps_ie, psecuritypriv->wps_ie_len);
2376 
2377 		ielength += psecuritypriv->wps_ie_len;
2378 	} else if ((authmode == _WPA_IE_ID_) || (authmode == _WPA2_IE_ID_)) {
2379 		/* copy RSN or SSN */
2380 		memcpy(&out_ie[ielength], &psecuritypriv->supplicant_ie[0], psecuritypriv->supplicant_ie[1]+2);
2381 		/* debug for CONFIG_IEEE80211W
2382 		{
2383 			int jj;
2384 			printk("supplicant_ie_length =%d &&&&&&&&&&&&&&&&&&&\n", psecuritypriv->supplicant_ie[1]+2);
2385 			for (jj = 0; jj < psecuritypriv->supplicant_ie[1]+2; jj++)
2386 				printk(" %02x ", psecuritypriv->supplicant_ie[jj]);
2387 			printk("\n");
2388 		}*/
2389 		ielength += psecuritypriv->supplicant_ie[1]+2;
2390 		rtw_report_sec_ie(adapter, authmode, psecuritypriv->supplicant_ie);
2391 	}
2392 
2393 	iEntry = SecIsInPMKIDList(adapter, pmlmepriv->assoc_bssid);
2394 	if (iEntry < 0) {
2395 		return ielength;
2396 	} else {
2397 		if (authmode == _WPA2_IE_ID_)
2398 			ielength = rtw_append_pmkid(adapter, iEntry, out_ie, ielength);
2399 	}
2400 	return ielength;
2401 }
2402 
2403 void rtw_init_registrypriv_dev_network(struct adapter *adapter)
2404 {
2405 	struct registry_priv *pregistrypriv = &adapter->registrypriv;
2406 	struct eeprom_priv *peepriv = &adapter->eeprompriv;
2407 	struct wlan_bssid_ex    *pdev_network = &pregistrypriv->dev_network;
2408 	u8 *myhwaddr = myid(peepriv);
2409 
2410 	memcpy(pdev_network->MacAddress, myhwaddr, ETH_ALEN);
2411 
2412 	memcpy(&pdev_network->Ssid, &pregistrypriv->ssid, sizeof(struct ndis_802_11_ssid));
2413 
2414 	pdev_network->Configuration.Length = sizeof(struct ndis_802_11_conf);
2415 	pdev_network->Configuration.BeaconPeriod = 100;
2416 	pdev_network->Configuration.FHConfig.Length = 0;
2417 	pdev_network->Configuration.FHConfig.HopPattern = 0;
2418 	pdev_network->Configuration.FHConfig.HopSet = 0;
2419 	pdev_network->Configuration.FHConfig.DwellTime = 0;
2420 }
2421 
2422 void rtw_update_registrypriv_dev_network(struct adapter *adapter)
2423 {
2424 	int sz = 0;
2425 	struct registry_priv *pregistrypriv = &adapter->registrypriv;
2426 	struct wlan_bssid_ex    *pdev_network = &pregistrypriv->dev_network;
2427 	struct	security_priv *psecuritypriv = &adapter->securitypriv;
2428 	struct	wlan_network	*cur_network = &adapter->mlmepriv.cur_network;
2429 	/* struct	xmit_priv *pxmitpriv = &adapter->xmitpriv; */
2430 
2431 	pdev_network->Privacy = (psecuritypriv->dot11PrivacyAlgrthm > 0 ? 1 : 0) ; /*  adhoc no 802.1x */
2432 
2433 	pdev_network->Rssi = 0;
2434 
2435 	switch (pregistrypriv->wireless_mode) {
2436 	case WIRELESS_11B:
2437 		pdev_network->NetworkTypeInUse = (Ndis802_11DS);
2438 		break;
2439 	case WIRELESS_11G:
2440 	case WIRELESS_11BG:
2441 	case WIRELESS_11_24N:
2442 	case WIRELESS_11G_24N:
2443 	case WIRELESS_11BG_24N:
2444 		pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
2445 		break;
2446 	case WIRELESS_11A:
2447 	case WIRELESS_11A_5N:
2448 		pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
2449 		break;
2450 	case WIRELESS_11ABGN:
2451 		if (pregistrypriv->channel > 14)
2452 			pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
2453 		else
2454 			pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
2455 		break;
2456 	default:
2457 		/*  TODO */
2458 		break;
2459 	}
2460 
2461 	pdev_network->Configuration.DSConfig = (pregistrypriv->channel);
2462 	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("pregistrypriv->channel =%d, pdev_network->Configuration.DSConfig = 0x%x\n", pregistrypriv->channel, pdev_network->Configuration.DSConfig));
2463 
2464 	if (cur_network->network.InfrastructureMode == Ndis802_11IBSS)
2465 		pdev_network->Configuration.ATIMWindow = (0);
2466 
2467 	pdev_network->InfrastructureMode = (cur_network->network.InfrastructureMode);
2468 
2469 	/*  1. Supported rates */
2470 	/*  2. IE */
2471 
2472 	/* rtw_set_supported_rate(pdev_network->SupportedRates, pregistrypriv->wireless_mode) ;  will be called in rtw_generate_ie */
2473 	sz = rtw_generate_ie(pregistrypriv);
2474 
2475 	pdev_network->IELength = sz;
2476 
2477 	pdev_network->Length = get_wlan_bssid_ex_sz((struct wlan_bssid_ex  *)pdev_network);
2478 
2479 	/* notes: translate IELength & Length after assign the Length to cmdsz in createbss_cmd(); */
2480 	/* pdev_network->IELength = cpu_to_le32(sz); */
2481 }
2482 
2483 void rtw_get_encrypt_decrypt_from_registrypriv(struct adapter *adapter)
2484 {
2485 }
2486 
2487 /* the function is at passive_level */
2488 void rtw_joinbss_reset(struct adapter *padapter)
2489 {
2490 	u8 threshold;
2491 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2492 
2493 	struct ht_priv 	*phtpriv = &pmlmepriv->htpriv;
2494 
2495 	/* todo: if you want to do something io/reg/hw setting before join_bss, please add code here */
2496 
2497 	pmlmepriv->num_FortyMHzIntolerant = 0;
2498 
2499 	pmlmepriv->num_sta_no_ht = 0;
2500 
2501 	phtpriv->ampdu_enable = false;/* reset to disabled */
2502 
2503 	/*  TH = 1 => means that invalidate usb rx aggregation */
2504 	/*  TH = 0 => means that validate usb rx aggregation, use init value. */
2505 	if (phtpriv->ht_option) {
2506 		if (padapter->registrypriv.wifi_spec == 1)
2507 			threshold = 1;
2508 		else
2509 			threshold = 0;
2510 		rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
2511 	} else {
2512 		threshold = 1;
2513 		rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
2514 	}
2515 }
2516 
2517 void rtw_ht_use_default_setting(struct adapter *padapter)
2518 {
2519 	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
2520 	struct ht_priv 	*phtpriv = &pmlmepriv->htpriv;
2521 	struct registry_priv *pregistrypriv = &padapter->registrypriv;
2522 	bool		bHwLDPCSupport = false, bHwSTBCSupport = false;
2523 	bool		bHwSupportBeamformer = false, bHwSupportBeamformee = false;
2524 
2525 	if (pregistrypriv->wifi_spec)
2526 		phtpriv->bss_coexist = 1;
2527 	else
2528 		phtpriv->bss_coexist = 0;
2529 
2530 	phtpriv->sgi_40m = TEST_FLAG(pregistrypriv->short_gi, BIT1) ? true : false;
2531 	phtpriv->sgi_20m = TEST_FLAG(pregistrypriv->short_gi, BIT0) ? true : false;
2532 
2533 	/*  LDPC support */
2534 	rtw_hal_get_def_var(padapter, HAL_DEF_RX_LDPC, (u8 *)&bHwLDPCSupport);
2535 	CLEAR_FLAGS(phtpriv->ldpc_cap);
2536 	if (bHwLDPCSupport) {
2537 		if (TEST_FLAG(pregistrypriv->ldpc_cap, BIT4))
2538 			SET_FLAG(phtpriv->ldpc_cap, LDPC_HT_ENABLE_RX);
2539 	}
2540 	rtw_hal_get_def_var(padapter, HAL_DEF_TX_LDPC, (u8 *)&bHwLDPCSupport);
2541 	if (bHwLDPCSupport) {
2542 		if (TEST_FLAG(pregistrypriv->ldpc_cap, BIT5))
2543 			SET_FLAG(phtpriv->ldpc_cap, LDPC_HT_ENABLE_TX);
2544 	}
2545 	if (phtpriv->ldpc_cap)
2546 		DBG_871X("[HT] Support LDPC = 0x%02X\n", phtpriv->ldpc_cap);
2547 
2548 	/*  STBC */
2549 	rtw_hal_get_def_var(padapter, HAL_DEF_TX_STBC, (u8 *)&bHwSTBCSupport);
2550 	CLEAR_FLAGS(phtpriv->stbc_cap);
2551 	if (bHwSTBCSupport) {
2552 		if (TEST_FLAG(pregistrypriv->stbc_cap, BIT5))
2553 			SET_FLAG(phtpriv->stbc_cap, STBC_HT_ENABLE_TX);
2554 	}
2555 	rtw_hal_get_def_var(padapter, HAL_DEF_RX_STBC, (u8 *)&bHwSTBCSupport);
2556 	if (bHwSTBCSupport) {
2557 		if (TEST_FLAG(pregistrypriv->stbc_cap, BIT4))
2558 			SET_FLAG(phtpriv->stbc_cap, STBC_HT_ENABLE_RX);
2559 	}
2560 	if (phtpriv->stbc_cap)
2561 		DBG_871X("[HT] Support STBC = 0x%02X\n", phtpriv->stbc_cap);
2562 
2563 	/*  Beamforming setting */
2564 	rtw_hal_get_def_var(padapter, HAL_DEF_EXPLICIT_BEAMFORMER, (u8 *)&bHwSupportBeamformer);
2565 	rtw_hal_get_def_var(padapter, HAL_DEF_EXPLICIT_BEAMFORMEE, (u8 *)&bHwSupportBeamformee);
2566 	CLEAR_FLAGS(phtpriv->beamform_cap);
2567 	if (TEST_FLAG(pregistrypriv->beamform_cap, BIT4) && bHwSupportBeamformer) {
2568 		SET_FLAG(phtpriv->beamform_cap, BEAMFORMING_HT_BEAMFORMER_ENABLE);
2569 		DBG_871X("[HT] Support Beamformer\n");
2570 	}
2571 	if (TEST_FLAG(pregistrypriv->beamform_cap, BIT5) && bHwSupportBeamformee) {
2572 		SET_FLAG(phtpriv->beamform_cap, BEAMFORMING_HT_BEAMFORMEE_ENABLE);
2573 		DBG_871X("[HT] Support Beamformee\n");
2574 	}
2575 }
2576 
2577 void rtw_build_wmm_ie_ht(struct adapter *padapter, u8 *out_ie, uint *pout_len)
2578 {
2579 	unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
2580 	int out_len;
2581 	u8 *pframe;
2582 
2583 	if (padapter->mlmepriv.qospriv.qos_option == 0) {
2584 		out_len = *pout_len;
2585 		pframe = rtw_set_ie(out_ie+out_len, _VENDOR_SPECIFIC_IE_,
2586 							_WMM_IE_Length_, WMM_IE, pout_len);
2587 
2588 		padapter->mlmepriv.qospriv.qos_option = 1;
2589 	}
2590 }
2591 
2592 /* the function is >= passive_level */
2593 unsigned int rtw_restructure_ht_ie(struct adapter *padapter, u8 *in_ie, u8 *out_ie, uint in_len, uint *pout_len, u8 channel)
2594 {
2595 	u32 ielen, out_len;
2596 	enum HT_CAP_AMPDU_FACTOR max_rx_ampdu_factor;
2597 	unsigned char *p, *pframe;
2598 	struct rtw_ieee80211_ht_cap ht_capie;
2599 	u8 cbw40_enable = 0, stbc_rx_enable = 0, rf_type = 0, operation_bw = 0;
2600 	struct registry_priv *pregistrypriv = &padapter->registrypriv;
2601 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2602 	struct ht_priv 	*phtpriv = &pmlmepriv->htpriv;
2603 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2604 
2605 	phtpriv->ht_option = false;
2606 
2607 	out_len = *pout_len;
2608 
2609 	memset(&ht_capie, 0, sizeof(struct rtw_ieee80211_ht_cap));
2610 
2611 	ht_capie.cap_info = cpu_to_le16(IEEE80211_HT_CAP_DSSSCCK40);
2612 
2613 	if (phtpriv->sgi_20m)
2614 		ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_SGI_20);
2615 
2616 	/* Get HT BW */
2617 	if (!in_ie) {
2618 		/* TDLS: TODO 20/40 issue */
2619 		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
2620 			operation_bw = padapter->mlmeextpriv.cur_bwmode;
2621 			if (operation_bw > CHANNEL_WIDTH_40)
2622 				operation_bw = CHANNEL_WIDTH_40;
2623 		} else
2624 			/* TDLS: TODO 40? */
2625 			operation_bw = CHANNEL_WIDTH_40;
2626 	} else {
2627 		p = rtw_get_ie(in_ie, _HT_ADD_INFO_IE_, &ielen, in_len);
2628 		if (p && (ielen == sizeof(struct ieee80211_ht_addt_info))) {
2629 			struct HT_info_element *pht_info = (struct HT_info_element *)(p+2);
2630 			if (pht_info->infos[0] & BIT(2)) {
2631 				switch (pht_info->infos[0] & 0x3) {
2632 				case 1:
2633 				case 3:
2634 					operation_bw = CHANNEL_WIDTH_40;
2635 					break;
2636 				default:
2637 					operation_bw = CHANNEL_WIDTH_20;
2638 					break;
2639 				}
2640 			} else {
2641 				operation_bw = CHANNEL_WIDTH_20;
2642 			}
2643 		}
2644 	}
2645 
2646 	/* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
2647 	if (channel > 14) {
2648 		if ((pregistrypriv->bw_mode & 0xf0) > 0)
2649 			cbw40_enable = 1;
2650 	} else {
2651 		if ((pregistrypriv->bw_mode & 0x0f) > 0)
2652 			cbw40_enable = 1;
2653 	}
2654 
2655 	if ((cbw40_enable == 1) && (operation_bw == CHANNEL_WIDTH_40)) {
2656 		ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH);
2657 		if (phtpriv->sgi_40m)
2658 			ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_SGI_40);
2659 	}
2660 
2661 	if (TEST_FLAG(phtpriv->stbc_cap, STBC_HT_ENABLE_TX))
2662 		ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_TX_STBC);
2663 
2664 	/* todo: disable SM power save mode */
2665 	ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_SM_PS);
2666 
2667 	if (TEST_FLAG(phtpriv->stbc_cap, STBC_HT_ENABLE_RX)) {
2668 		if ((channel <= 14 && pregistrypriv->rx_stbc == 0x1) ||	/* enable for 2.4GHz */
2669 			(pregistrypriv->wifi_spec == 1)) {
2670 			stbc_rx_enable = 1;
2671 			DBG_871X("declare supporting RX STBC\n");
2672 		}
2673 	}
2674 
2675 	/* fill default supported_mcs_set */
2676 	memcpy(ht_capie.supp_mcs_set, pmlmeext->default_supported_mcs_set, 16);
2677 
2678 	/* update default supported_mcs_set */
2679 	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
2680 
2681 	switch (rf_type) {
2682 	case RF_1T1R:
2683 		if (stbc_rx_enable)
2684 			ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_RX_STBC_1R);/* RX STBC One spatial stream */
2685 
2686 		set_mcs_rate_by_mask(ht_capie.supp_mcs_set, MCS_RATE_1R);
2687 		break;
2688 
2689 	case RF_2T2R:
2690 	case RF_1T2R:
2691 	default:
2692 		if (stbc_rx_enable)
2693 			ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_RX_STBC_2R);/* RX STBC two spatial stream */
2694 
2695 		#ifdef CONFIG_DISABLE_MCS13TO15
2696 		if (((cbw40_enable == 1) && (operation_bw == CHANNEL_WIDTH_40)) && (pregistrypriv->wifi_spec != 1))
2697 				set_mcs_rate_by_mask(ht_capie.supp_mcs_set, MCS_RATE_2R_13TO15_OFF);
2698 		else
2699 				set_mcs_rate_by_mask(ht_capie.supp_mcs_set, MCS_RATE_2R);
2700 		#else /* CONFIG_DISABLE_MCS13TO15 */
2701 			set_mcs_rate_by_mask(ht_capie.supp_mcs_set, MCS_RATE_2R);
2702 		#endif /* CONFIG_DISABLE_MCS13TO15 */
2703 		break;
2704 	}
2705 
2706 	{
2707 		u32 rx_packet_offset, max_recvbuf_sz;
2708 		rtw_hal_get_def_var(padapter, HAL_DEF_RX_PACKET_OFFSET, &rx_packet_offset);
2709 		rtw_hal_get_def_var(padapter, HAL_DEF_MAX_RECVBUF_SZ, &max_recvbuf_sz);
2710 	}
2711 
2712 	if (padapter->driver_rx_ampdu_factor != 0xFF)
2713 		max_rx_ampdu_factor =
2714 		  (enum HT_CAP_AMPDU_FACTOR)padapter->driver_rx_ampdu_factor;
2715 	else
2716 		rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR,
2717 				    &max_rx_ampdu_factor);
2718 
2719 	/* rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor); */
2720 	ht_capie.ampdu_params_info = (max_rx_ampdu_factor&0x03);
2721 
2722 	if (padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)
2723 		ht_capie.ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&(0x07<<2));
2724 	else
2725 		ht_capie.ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&0x00);
2726 
2727 	pframe = rtw_set_ie(out_ie+out_len, _HT_CAPABILITY_IE_,
2728 						sizeof(struct rtw_ieee80211_ht_cap), (unsigned char *)&ht_capie, pout_len);
2729 
2730 	phtpriv->ht_option = true;
2731 
2732 	if (in_ie) {
2733 		p = rtw_get_ie(in_ie, _HT_ADD_INFO_IE_, &ielen, in_len);
2734 		if (p && (ielen == sizeof(struct ieee80211_ht_addt_info))) {
2735 			out_len = *pout_len;
2736 			pframe = rtw_set_ie(out_ie+out_len, _HT_ADD_INFO_IE_, ielen, p+2, pout_len);
2737 		}
2738 	}
2739 
2740 	return phtpriv->ht_option;
2741 
2742 }
2743 
2744 /* the function is > passive_level (in critical_section) */
2745 void rtw_update_ht_cap(struct adapter *padapter, u8 *pie, uint ie_len, u8 channel)
2746 {
2747 	u8 *p, max_ampdu_sz;
2748 	int len;
2749 	/* struct sta_info *bmc_sta, *psta; */
2750 	struct rtw_ieee80211_ht_cap *pht_capie;
2751 	struct ieee80211_ht_addt_info *pht_addtinfo;
2752 	/* struct recv_reorder_ctrl *preorder_ctrl; */
2753 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2754 	struct ht_priv 	*phtpriv = &pmlmepriv->htpriv;
2755 	/* struct recv_priv *precvpriv = &padapter->recvpriv; */
2756 	struct registry_priv *pregistrypriv = &padapter->registrypriv;
2757 	/* struct wlan_network *pcur_network = &(pmlmepriv->cur_network);; */
2758 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2759 	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2760 	u8 cbw40_enable = 0;
2761 
2762 	if (!phtpriv->ht_option)
2763 		return;
2764 
2765 	if ((!pmlmeinfo->HT_info_enable) || (!pmlmeinfo->HT_caps_enable))
2766 		return;
2767 
2768 	DBG_871X("+rtw_update_ht_cap()\n");
2769 
2770 	/* maybe needs check if ap supports rx ampdu. */
2771 	if (!(phtpriv->ampdu_enable) && pregistrypriv->ampdu_enable == 1) {
2772 		phtpriv->ampdu_enable = true;
2773 	}
2774 
2775 	/* check Max Rx A-MPDU Size */
2776 	len = 0;
2777 	p = rtw_get_ie(pie+sizeof(struct ndis_802_11_fix_ie), _HT_CAPABILITY_IE_, &len, ie_len-sizeof(struct ndis_802_11_fix_ie));
2778 	if (p && len > 0) {
2779 		pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);
2780 		max_ampdu_sz = (pht_capie->ampdu_params_info & IEEE80211_HT_CAP_AMPDU_FACTOR);
2781 		max_ampdu_sz = 1 << (max_ampdu_sz+3); /*  max_ampdu_sz (kbytes); */
2782 
2783 		/* DBG_871X("rtw_update_ht_cap(): max_ampdu_sz =%d\n", max_ampdu_sz); */
2784 		phtpriv->rx_ampdu_maxlen = max_ampdu_sz;
2785 
2786 	}
2787 
2788 	len = 0;
2789 	p = rtw_get_ie(pie+sizeof(struct ndis_802_11_fix_ie), _HT_ADD_INFO_IE_, &len, ie_len-sizeof(struct ndis_802_11_fix_ie));
2790 	if (p && len > 0) {
2791 		pht_addtinfo = (struct ieee80211_ht_addt_info *)(p+2);
2792 		/* todo: */
2793 	}
2794 
2795 	if (channel > 14) {
2796 		if ((pregistrypriv->bw_mode & 0xf0) > 0)
2797 			cbw40_enable = 1;
2798 	} else {
2799 		if ((pregistrypriv->bw_mode & 0x0f) > 0)
2800 			cbw40_enable = 1;
2801 	}
2802 
2803 	/* update cur_bwmode & cur_ch_offset */
2804 	if ((cbw40_enable) &&
2805 	    (le16_to_cpu(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info) &
2806 	      BIT(1)) && (pmlmeinfo->HT_info.infos[0] & BIT(2))) {
2807 		int i;
2808 		u8 rf_type;
2809 
2810 		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
2811 
2812 		/* update the MCS set */
2813 		for (i = 0; i < 16; i++)
2814 			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= pmlmeext->default_supported_mcs_set[i];
2815 
2816 		/* update the MCS rates */
2817 		switch (rf_type) {
2818 		case RF_1T1R:
2819 		case RF_1T2R:
2820 			set_mcs_rate_by_mask(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_RATE_1R);
2821 			break;
2822 		case RF_2T2R:
2823 		default:
2824 #ifdef CONFIG_DISABLE_MCS13TO15
2825 			if (pmlmeext->cur_bwmode == CHANNEL_WIDTH_40 && pregistrypriv->wifi_spec != 1)
2826 				set_mcs_rate_by_mask(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_RATE_2R_13TO15_OFF);
2827 			else
2828 				set_mcs_rate_by_mask(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_RATE_2R);
2829 #else /* CONFIG_DISABLE_MCS13TO15 */
2830 			set_mcs_rate_by_mask(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_RATE_2R);
2831 #endif /* CONFIG_DISABLE_MCS13TO15 */
2832 		}
2833 
2834 		/* switch to the 40M Hz mode according to the AP */
2835 		/* pmlmeext->cur_bwmode = CHANNEL_WIDTH_40; */
2836 		switch ((pmlmeinfo->HT_info.infos[0] & 0x3)) {
2837 		case EXTCHNL_OFFSET_UPPER:
2838 			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
2839 			break;
2840 
2841 		case EXTCHNL_OFFSET_LOWER:
2842 			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
2843 			break;
2844 
2845 		default:
2846 			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
2847 			break;
2848 		}
2849 	}
2850 
2851 	/*  */
2852 	/*  Config SM Power Save setting */
2853 	/*  */
2854 	pmlmeinfo->SM_PS =
2855 		(le16_to_cpu(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info) &
2856 		 0x0C) >> 2;
2857 	if (pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
2858 		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n", __func__);
2859 
2860 	/*  */
2861 	/*  Config current HT Protection mode. */
2862 	/*  */
2863 	pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
2864 }
2865 
2866 void rtw_issue_addbareq_cmd(struct adapter *padapter, struct xmit_frame *pxmitframe)
2867 {
2868 	u8 issued;
2869 	int priority;
2870 	struct sta_info *psta = NULL;
2871 	struct ht_priv *phtpriv;
2872 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
2873 	s32 bmcst = IS_MCAST(pattrib->ra);
2874 
2875 	/* if (bmcst || (padapter->mlmepriv.LinkDetectInfo.bTxBusyTraffic == false)) */
2876 	if (bmcst || (padapter->mlmepriv.LinkDetectInfo.NumTxOkInPeriod < 100))
2877 		return;
2878 
2879 	priority = pattrib->priority;
2880 
2881 	psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
2882 	if (pattrib->psta != psta) {
2883 		DBG_871X("%s, pattrib->psta(%p) != psta(%p)\n", __func__, pattrib->psta, psta);
2884 		return;
2885 	}
2886 
2887 	if (!psta) {
2888 		DBG_871X("%s, psta ==NUL\n", __func__);
2889 		return;
2890 	}
2891 
2892 	if (!(psta->state & _FW_LINKED)) {
2893 		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
2894 		return;
2895 	}
2896 
2897 	phtpriv = &psta->htpriv;
2898 
2899 	if (phtpriv->ht_option && phtpriv->ampdu_enable) {
2900 		issued = (phtpriv->agg_enable_bitmap>>priority)&0x1;
2901 		issued |= (phtpriv->candidate_tid_bitmap>>priority)&0x1;
2902 
2903 		if (0 == issued) {
2904 			DBG_871X("rtw_issue_addbareq_cmd, p =%d\n", priority);
2905 			psta->htpriv.candidate_tid_bitmap |= BIT((u8)priority);
2906 			rtw_addbareq_cmd(padapter, (u8) priority, pattrib->ra);
2907 		}
2908 	}
2909 
2910 }
2911 
2912 void rtw_append_exented_cap(struct adapter *padapter, u8 *out_ie, uint *pout_len)
2913 {
2914 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2915 	struct ht_priv 	*phtpriv = &pmlmepriv->htpriv;
2916 	u8 cap_content[8] = {0};
2917 
2918 	if (phtpriv->bss_coexist)
2919 		SET_EXT_CAPABILITY_ELE_BSS_COEXIST(cap_content, 1);
2920 
2921 	rtw_set_ie(out_ie + *pout_len, EID_EXTCapability, 8, cap_content, pout_len);
2922 }
2923 
2924 inline void rtw_set_to_roam(struct adapter *adapter, u8 to_roam)
2925 {
2926 	if (to_roam == 0)
2927 		adapter->mlmepriv.to_join = false;
2928 	adapter->mlmepriv.to_roam = to_roam;
2929 }
2930 
2931 inline u8 rtw_dec_to_roam(struct adapter *adapter)
2932 {
2933 	adapter->mlmepriv.to_roam--;
2934 	return adapter->mlmepriv.to_roam;
2935 }
2936 
2937 inline u8 rtw_to_roam(struct adapter *adapter)
2938 {
2939 	return adapter->mlmepriv.to_roam;
2940 }
2941 
2942 void rtw_roaming(struct adapter *padapter, struct wlan_network *tgt_network)
2943 {
2944 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2945 
2946 	spin_lock_bh(&pmlmepriv->lock);
2947 	_rtw_roaming(padapter, tgt_network);
2948 	spin_unlock_bh(&pmlmepriv->lock);
2949 }
2950 void _rtw_roaming(struct adapter *padapter, struct wlan_network *tgt_network)
2951 {
2952 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2953 	struct wlan_network *cur_network = &pmlmepriv->cur_network;
2954 	int do_join_r;
2955 
2956 	if (0 < rtw_to_roam(padapter)) {
2957 		DBG_871X("roaming from %s("MAC_FMT"), length:%d\n",
2958 				cur_network->network.Ssid.Ssid, MAC_ARG(cur_network->network.MacAddress),
2959 				cur_network->network.Ssid.SsidLength);
2960 		memcpy(&pmlmepriv->assoc_ssid, &cur_network->network.Ssid, sizeof(struct ndis_802_11_ssid));
2961 
2962 		pmlmepriv->assoc_by_bssid = false;
2963 
2964 		while (1) {
2965 			do_join_r = rtw_do_join(padapter);
2966 			if (_SUCCESS == do_join_r) {
2967 				break;
2968 			} else {
2969 				DBG_871X("roaming do_join return %d\n", do_join_r);
2970 				rtw_dec_to_roam(padapter);
2971 
2972 				if (rtw_to_roam(padapter) > 0) {
2973 					continue;
2974 				} else {
2975 					DBG_871X("%s(%d) -to roaming fail, indicate_disconnect\n", __func__, __LINE__);
2976 					rtw_indicate_disconnect(padapter);
2977 					break;
2978 				}
2979 			}
2980 		}
2981 	}
2982 
2983 }
2984 
2985 sint rtw_linked_check(struct adapter *padapter)
2986 {
2987 	if ((check_fwstate(&padapter->mlmepriv, WIFI_AP_STATE) == true) ||
2988 			(check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == true)) {
2989 		if (padapter->stapriv.asoc_sta_count > 2)
2990 			return true;
2991 	} else {	/* Station mode */
2992 		if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) == true)
2993 			return true;
2994 	}
2995 	return false;
2996 }
2997