1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3  *
4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
5  *
6  ******************************************************************************/
7 
8 #include <linux/etherdevice.h>
9 #include <drv_types.h>
10 #include <rtw_debug.h>
11 #include <rtw_mp.h>
12 #include <hal_btcoex.h>
13 #include <linux/jiffies.h>
14 #include <linux/kernel.h>
15 
16 #define RTL_IOCTL_WPA_SUPPLICANT	(SIOCIWFIRSTPRIV+30)
17 
18 static int wpa_set_auth_algs(struct net_device *dev, u32 value)
19 {
20 	struct adapter *padapter = rtw_netdev_priv(dev);
21 	int ret = 0;
22 
23 	if ((value & IW_AUTH_ALG_SHARED_KEY) && (value & IW_AUTH_ALG_OPEN_SYSTEM)) {
24 		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
25 		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
26 		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
27 	} else if (value & IW_AUTH_ALG_SHARED_KEY)	{
28 		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
29 
30 		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared;
31 		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Shared;
32 	} else if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
33 		/* padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled; */
34 		if (padapter->securitypriv.ndisauthtype < Ndis802_11AuthModeWPAPSK) {
35 			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
36 			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
37 		}
38 	} else {
39 		ret = -EINVAL;
40 	}
41 
42 	return ret;
43 
44 }
45 
46 static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
47 {
48 	int ret = 0;
49 	u32 wep_key_idx, wep_key_len, wep_total_len;
50 	struct ndis_802_11_wep	 *pwep = NULL;
51 	struct adapter *padapter = rtw_netdev_priv(dev);
52 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
53 	struct security_priv *psecuritypriv = &padapter->securitypriv;
54 
55 	param->u.crypt.err = 0;
56 	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
57 
58 	if (param_len < (u32)((u8 *)param->u.crypt.key - (u8 *)param) + param->u.crypt.key_len) {
59 		ret =  -EINVAL;
60 		goto exit;
61 	}
62 
63 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
64 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
65 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
66 		if (param->u.crypt.idx >= WEP_KEYS ||
67 		    param->u.crypt.idx >= BIP_MAX_KEYID) {
68 			ret = -EINVAL;
69 			goto exit;
70 		}
71 	} else {
72 		{
73 			ret = -EINVAL;
74 			goto exit;
75 		}
76 	}
77 
78 	if (strcmp(param->u.crypt.alg, "WEP") == 0) {
79 
80 		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
81 		padapter->securitypriv.dot11PrivacyAlgrthm = _WEP40_;
82 		padapter->securitypriv.dot118021XGrpPrivacy = _WEP40_;
83 
84 		wep_key_idx = param->u.crypt.idx;
85 		wep_key_len = param->u.crypt.key_len;
86 
87 		if (wep_key_idx > WEP_KEYS)
88 			return -EINVAL;
89 
90 		if (wep_key_len > 0) {
91 			wep_key_len = wep_key_len <= 5 ? 5 : 13;
92 			wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, key_material);
93 			/* Allocate a full structure to avoid potentially running off the end. */
94 			pwep = kzalloc(sizeof(*pwep), GFP_KERNEL);
95 			if (!pwep) {
96 				ret = -ENOMEM;
97 				goto exit;
98 			}
99 
100 			pwep->key_length = wep_key_len;
101 			pwep->length = wep_total_len;
102 
103 			if (wep_key_len == 13) {
104 				padapter->securitypriv.dot11PrivacyAlgrthm = _WEP104_;
105 				padapter->securitypriv.dot118021XGrpPrivacy = _WEP104_;
106 			}
107 		} else {
108 			ret = -EINVAL;
109 			goto exit;
110 		}
111 
112 		pwep->key_index = wep_key_idx;
113 		pwep->key_index |= 0x80000000;
114 
115 		memcpy(pwep->key_material,  param->u.crypt.key, pwep->key_length);
116 
117 		if (param->u.crypt.set_tx) {
118 			if (rtw_set_802_11_add_wep(padapter, pwep) == (u8)_FAIL)
119 				ret = -EOPNOTSUPP;
120 		} else {
121 			/* don't update "psecuritypriv->dot11PrivacyAlgrthm" and */
122 			/* psecuritypriv->dot11PrivacyKeyIndex =keyid", but can rtw_set_key to fw/cam */
123 
124 			if (wep_key_idx >= WEP_KEYS) {
125 				ret = -EOPNOTSUPP;
126 				goto exit;
127 			}
128 
129 			memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->key_material, pwep->key_length);
130 			psecuritypriv->dot11DefKeylen[wep_key_idx] = pwep->key_length;
131 			rtw_set_key(padapter, psecuritypriv, wep_key_idx, 0, true);
132 		}
133 
134 		goto exit;
135 	}
136 
137 	if (padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) { /*  802_1x */
138 		struct sta_info *psta, *pbcmc_sta;
139 		struct sta_priv *pstapriv = &padapter->stapriv;
140 
141 		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_MP_STATE) == true) { /* sta mode */
142 			psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));
143 			if (!psta) {
144 				/* DEBUG_ERR(("Set wpa_set_encryption: Obtain Sta_info fail\n")); */
145 			} else {
146 				/* Jeff: don't disable ieee8021x_blocked while clearing key */
147 				if (strcmp(param->u.crypt.alg, "none") != 0)
148 					psta->ieee8021x_blocked = false;
149 
150 				if ((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled) ||
151 						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled)) {
152 					psta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
153 				}
154 
155 				if (param->u.crypt.set_tx == 1) { /* pairwise key */
156 					memcpy(psta->dot118021x_UncstKey.skey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
157 
158 					if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
159 						/* DEBUG_ERR(("\nset key length :param->u.crypt.key_len =%d\n", param->u.crypt.key_len)); */
160 						memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
161 						memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
162 
163 						padapter->securitypriv.busetkipkey = false;
164 						/* _set_timer(&padapter->securitypriv.tkip_timer, 50); */
165 					}
166 
167 					rtw_setstakey_cmd(padapter, psta, true, true);
168 				} else { /* group key */
169 					if (strcmp(param->u.crypt.alg, "TKIP") == 0 || strcmp(param->u.crypt.alg, "CCMP") == 0) {
170 						memcpy(padapter->securitypriv.dot118021XGrpKey[param->u.crypt.idx].skey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
171 						/* only TKIP group key need to install this */
172 						if (param->u.crypt.key_len > 16) {
173 							memcpy(padapter->securitypriv.dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
174 							memcpy(padapter->securitypriv.dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
175 						}
176 						padapter->securitypriv.binstallGrpkey = true;
177 
178 						padapter->securitypriv.dot118021XGrpKeyid = param->u.crypt.idx;
179 
180 						rtw_set_key(padapter, &padapter->securitypriv, param->u.crypt.idx, 1, true);
181 					} else if (strcmp(param->u.crypt.alg, "BIP") == 0) {
182 						/* printk("BIP key_len =%d , index =%d @@@@@@@@@@@@@@@@@@\n", param->u.crypt.key_len, param->u.crypt.idx); */
183 						/* save the IGTK key, length 16 bytes */
184 						memcpy(padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
185 						/*printk("IGTK key below:\n");
186 						for (no = 0;no<16;no++)
187 							printk(" %02x ", padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey[no]);
188 						printk("\n");*/
189 						padapter->securitypriv.dot11wBIPKeyid = param->u.crypt.idx;
190 						padapter->securitypriv.binstallBIPkey = true;
191 					}
192 				}
193 			}
194 
195 			pbcmc_sta = rtw_get_bcmc_stainfo(padapter);
196 			if (!pbcmc_sta) {
197 				/* DEBUG_ERR(("Set OID_802_11_ADD_KEY: bcmc stainfo is null\n")); */
198 			} else {
199 				/* Jeff: don't disable ieee8021x_blocked while clearing key */
200 				if (strcmp(param->u.crypt.alg, "none") != 0)
201 					pbcmc_sta->ieee8021x_blocked = false;
202 
203 				if ((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled) ||
204 						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled)) {
205 					pbcmc_sta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
206 				}
207 			}
208 		} else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
209 			/* adhoc mode */
210 		}
211 	}
212 
213 exit:
214 
215 	kfree(pwep);
216 	return ret;
217 }
218 
219 static int rtw_set_wpa_ie(struct adapter *padapter, char *pie, unsigned short ielen)
220 {
221 	u8 *buf = NULL;
222 	int group_cipher = 0, pairwise_cipher = 0;
223 	int ret = 0;
224 	u8 null_addr[] = {0, 0, 0, 0, 0, 0};
225 
226 	if (ielen > MAX_WPA_IE_LEN || !pie) {
227 		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
228 		if (!pie)
229 			return ret;
230 		else
231 			return -EINVAL;
232 	}
233 
234 	if (ielen) {
235 		buf = rtw_zmalloc(ielen);
236 		if (!buf) {
237 			ret =  -ENOMEM;
238 			goto exit;
239 		}
240 
241 		memcpy(buf, pie, ielen);
242 
243 		if (ielen < RSN_HEADER_LEN) {
244 			ret  = -1;
245 			goto exit;
246 		}
247 
248 		if (rtw_parse_wpa_ie(buf, ielen, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
249 			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
250 			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
251 			memcpy(padapter->securitypriv.supplicant_ie, &buf[0], ielen);
252 		}
253 
254 		if (rtw_parse_wpa2_ie(buf, ielen, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
255 			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
256 			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
257 			memcpy(padapter->securitypriv.supplicant_ie, &buf[0], ielen);
258 		}
259 
260 		if (group_cipher == 0)
261 			group_cipher = WPA_CIPHER_NONE;
262 		if (pairwise_cipher == 0)
263 			pairwise_cipher = WPA_CIPHER_NONE;
264 
265 		switch (group_cipher) {
266 		case WPA_CIPHER_NONE:
267 			padapter->securitypriv.dot118021XGrpPrivacy = _NO_PRIVACY_;
268 			padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
269 			break;
270 		case WPA_CIPHER_WEP40:
271 			padapter->securitypriv.dot118021XGrpPrivacy = _WEP40_;
272 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
273 			break;
274 		case WPA_CIPHER_TKIP:
275 			padapter->securitypriv.dot118021XGrpPrivacy = _TKIP_;
276 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
277 			break;
278 		case WPA_CIPHER_CCMP:
279 			padapter->securitypriv.dot118021XGrpPrivacy = _AES_;
280 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
281 			break;
282 		case WPA_CIPHER_WEP104:
283 			padapter->securitypriv.dot118021XGrpPrivacy = _WEP104_;
284 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
285 			break;
286 		}
287 
288 		switch (pairwise_cipher) {
289 		case WPA_CIPHER_NONE:
290 			padapter->securitypriv.dot11PrivacyAlgrthm = _NO_PRIVACY_;
291 			padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
292 			break;
293 		case WPA_CIPHER_WEP40:
294 			padapter->securitypriv.dot11PrivacyAlgrthm = _WEP40_;
295 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
296 			break;
297 		case WPA_CIPHER_TKIP:
298 			padapter->securitypriv.dot11PrivacyAlgrthm = _TKIP_;
299 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
300 			break;
301 		case WPA_CIPHER_CCMP:
302 			padapter->securitypriv.dot11PrivacyAlgrthm = _AES_;
303 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
304 			break;
305 		case WPA_CIPHER_WEP104:
306 			padapter->securitypriv.dot11PrivacyAlgrthm = _WEP104_;
307 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
308 			break;
309 		}
310 
311 		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
312 		{/* set wps_ie */
313 			u16 cnt = 0;
314 			u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
315 
316 			while (cnt < ielen) {
317 				eid = buf[cnt];
318 
319 				if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&buf[cnt+2], wps_oui, 4))) {
320 					padapter->securitypriv.wps_ie_len = ((buf[cnt+1]+2) < MAX_WPS_IE_LEN) ? (buf[cnt+1]+2):MAX_WPS_IE_LEN;
321 
322 					memcpy(padapter->securitypriv.wps_ie, &buf[cnt], padapter->securitypriv.wps_ie_len);
323 
324 					set_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS);
325 
326 					cnt += buf[cnt+1]+2;
327 
328 					break;
329 				} else {
330 					cnt += buf[cnt+1]+2; /* goto next */
331 				}
332 			}
333 		}
334 	}
335 
336 	/* TKIP and AES disallow multicast packets until installing group key */
337 	if (padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_ ||
338 		padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_ ||
339 		padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)
340 		/* WPS open need to enable multicast */
341 		/*  check_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS) == true) */
342 		rtw_hal_set_hwreg(padapter, HW_VAR_OFF_RCR_AM, null_addr);
343 
344 exit:
345 
346 	kfree(buf);
347 
348 	return ret;
349 }
350 
351 static int wpa_set_param(struct net_device *dev, u8 name, u32 value)
352 {
353 	uint ret = 0;
354 	struct adapter *padapter = rtw_netdev_priv(dev);
355 
356 	switch (name) {
357 	case IEEE_PARAM_WPA_ENABLED:
358 
359 		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; /* 802.1x */
360 
361 		/* ret = ieee80211_wpa_enable(ieee, value); */
362 
363 		switch ((value)&0xff) {
364 		case 1: /* WPA */
365 			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; /* WPA_PSK */
366 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
367 			break;
368 		case 2: /* WPA2 */
369 			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; /* WPA2_PSK */
370 			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
371 			break;
372 		}
373 
374 		break;
375 
376 	case IEEE_PARAM_TKIP_COUNTERMEASURES:
377 		/* ieee->tkip_countermeasures =value; */
378 		break;
379 
380 	case IEEE_PARAM_DROP_UNENCRYPTED:
381 	{
382 		/* HACK:
383 		 *
384 		 * wpa_supplicant calls set_wpa_enabled when the driver
385 		 * is loaded and unloaded, regardless of if WPA is being
386 		 * used.  No other calls are made which can be used to
387 		 * determine if encryption will be used or not prior to
388 		 * association being expected.  If encryption is not being
389 		 * used, drop_unencrypted is set to false, else true -- we
390 		 * can use this to determine if the CAP_PRIVACY_ON bit should
391 		 * be set.
392 		 */
393 		break;
394 
395 	}
396 	case IEEE_PARAM_PRIVACY_INVOKED:
397 
398 		/* ieee->privacy_invoked =value; */
399 
400 		break;
401 
402 	case IEEE_PARAM_AUTH_ALGS:
403 
404 		ret = wpa_set_auth_algs(dev, value);
405 
406 		break;
407 
408 	case IEEE_PARAM_IEEE_802_1X:
409 
410 		/* ieee->ieee802_1x =value; */
411 
412 		break;
413 
414 	case IEEE_PARAM_WPAX_SELECT:
415 
416 		/*  added for WPA2 mixed mode */
417 		/*
418 		spin_lock_irqsave(&ieee->wpax_suitlist_lock, flags);
419 		ieee->wpax_type_set = 1;
420 		ieee->wpax_type_notify = value;
421 		spin_unlock_irqrestore(&ieee->wpax_suitlist_lock, flags);
422 		*/
423 
424 		break;
425 
426 	default:
427 
428 
429 
430 		ret = -EOPNOTSUPP;
431 
432 
433 		break;
434 
435 	}
436 
437 	return ret;
438 
439 }
440 
441 static int wpa_mlme(struct net_device *dev, u32 command, u32 reason)
442 {
443 	int ret = 0;
444 	struct adapter *padapter = rtw_netdev_priv(dev);
445 
446 	switch (command) {
447 	case IEEE_MLME_STA_DEAUTH:
448 
449 		if (!rtw_set_802_11_disassociate(padapter))
450 			ret = -1;
451 
452 		break;
453 
454 	case IEEE_MLME_STA_DISASSOC:
455 
456 		if (!rtw_set_802_11_disassociate(padapter))
457 			ret = -1;
458 
459 		break;
460 
461 	default:
462 		ret = -EOPNOTSUPP;
463 		break;
464 	}
465 
466 	return ret;
467 
468 }
469 
470 static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
471 {
472 	struct ieee_param *param;
473 	uint ret = 0;
474 
475 	/* down(&ieee->wx_sem); */
476 
477 	if (!p->pointer || p->length != sizeof(struct ieee_param))
478 		return -EINVAL;
479 
480 	param = rtw_malloc(p->length);
481 	if (!param)
482 		return -ENOMEM;
483 
484 	if (copy_from_user(param, p->pointer, p->length)) {
485 		kfree(param);
486 		return -EFAULT;
487 	}
488 
489 	switch (param->cmd) {
490 
491 	case IEEE_CMD_SET_WPA_PARAM:
492 		ret = wpa_set_param(dev, param->u.wpa_param.name, param->u.wpa_param.value);
493 		break;
494 
495 	case IEEE_CMD_SET_WPA_IE:
496 		/* ret = wpa_set_wpa_ie(dev, param, p->length); */
497 		ret =  rtw_set_wpa_ie(rtw_netdev_priv(dev), (char *)param->u.wpa_ie.data, (u16)param->u.wpa_ie.len);
498 		break;
499 
500 	case IEEE_CMD_SET_ENCRYPTION:
501 		ret = wpa_set_encryption(dev, param, p->length);
502 		break;
503 
504 	case IEEE_CMD_MLME:
505 		ret = wpa_mlme(dev, param->u.mlme.command, param->u.mlme.reason_code);
506 		break;
507 
508 	default:
509 		ret = -EOPNOTSUPP;
510 		break;
511 
512 	}
513 
514 	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
515 		ret = -EFAULT;
516 
517 	kfree(param);
518 
519 	/* up(&ieee->wx_sem); */
520 	return ret;
521 }
522 
523 static int rtw_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
524 {
525 	int ret = 0;
526 	u32 wep_key_idx, wep_key_len, wep_total_len;
527 	struct ndis_802_11_wep	 *pwep = NULL;
528 	struct sta_info *psta = NULL, *pbcmc_sta = NULL;
529 	struct adapter *padapter = rtw_netdev_priv(dev);
530 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
531 	struct security_priv *psecuritypriv = &(padapter->securitypriv);
532 	struct sta_priv *pstapriv = &padapter->stapriv;
533 	char *txkey = padapter->securitypriv.dot118021XGrptxmickey[param->u.crypt.idx].skey;
534 	char *rxkey = padapter->securitypriv.dot118021XGrprxmickey[param->u.crypt.idx].skey;
535 	char *grpkey = psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey;
536 
537 	param->u.crypt.err = 0;
538 	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
539 
540 	/* sizeof(struct ieee_param) = 64 bytes; */
541 	/* if (param_len !=  (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len) */
542 	if (param_len !=  sizeof(struct ieee_param) + param->u.crypt.key_len) {
543 		ret =  -EINVAL;
544 		goto exit;
545 	}
546 
547 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
548 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
549 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
550 		if (param->u.crypt.idx >= WEP_KEYS) {
551 			ret = -EINVAL;
552 			goto exit;
553 		}
554 	} else {
555 		psta = rtw_get_stainfo(pstapriv, param->sta_addr);
556 		if (!psta)
557 			/* ret = -EINVAL; */
558 			goto exit;
559 	}
560 
561 	if (strcmp(param->u.crypt.alg, "none") == 0 && !psta) {
562 		/* todo:clear default encryption keys */
563 
564 		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
565 		psecuritypriv->ndisencryptstatus = Ndis802_11EncryptionDisabled;
566 		psecuritypriv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
567 		psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
568 
569 		goto exit;
570 	}
571 
572 
573 	if (strcmp(param->u.crypt.alg, "WEP") == 0 && !psta) {
574 		wep_key_idx = param->u.crypt.idx;
575 		wep_key_len = param->u.crypt.key_len;
576 
577 		if ((wep_key_idx >= WEP_KEYS) || (wep_key_len <= 0)) {
578 			ret = -EINVAL;
579 			goto exit;
580 		}
581 
582 
583 		if (wep_key_len > 0) {
584 			wep_key_len = wep_key_len <= 5 ? 5 : 13;
585 			wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, key_material);
586 			/* Allocate a full structure to avoid potentially running off the end. */
587 			pwep = kzalloc(sizeof(*pwep), GFP_KERNEL);
588 			if (!pwep)
589 				goto exit;
590 
591 			pwep->key_length = wep_key_len;
592 			pwep->length = wep_total_len;
593 
594 		}
595 
596 		pwep->key_index = wep_key_idx;
597 
598 		memcpy(pwep->key_material,  param->u.crypt.key, pwep->key_length);
599 
600 		if (param->u.crypt.set_tx) {
601 			psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
602 			psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
603 			psecuritypriv->dot11PrivacyAlgrthm = _WEP40_;
604 			psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
605 
606 			if (pwep->key_length == 13) {
607 				psecuritypriv->dot11PrivacyAlgrthm = _WEP104_;
608 				psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
609 			}
610 
611 
612 			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
613 
614 			memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->key_material, pwep->key_length);
615 
616 			psecuritypriv->dot11DefKeylen[wep_key_idx] = pwep->key_length;
617 
618 			rtw_ap_set_wep_key(padapter, pwep->key_material, pwep->key_length, wep_key_idx, 1);
619 		} else {
620 			/* don't update "psecuritypriv->dot11PrivacyAlgrthm" and */
621 			/* psecuritypriv->dot11PrivacyKeyIndex =keyid", but can rtw_set_key to cam */
622 
623 			memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->key_material, pwep->key_length);
624 
625 			psecuritypriv->dot11DefKeylen[wep_key_idx] = pwep->key_length;
626 
627 			rtw_ap_set_wep_key(padapter, pwep->key_material, pwep->key_length, wep_key_idx, 0);
628 		}
629 
630 		goto exit;
631 
632 	}
633 
634 
635 	if (!psta && check_fwstate(pmlmepriv, WIFI_AP_STATE)) { /*  group key */
636 		if (param->u.crypt.set_tx == 1) {
637 			if (strcmp(param->u.crypt.alg, "WEP") == 0) {
638 				memcpy(grpkey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
639 
640 				psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
641 				if (param->u.crypt.key_len == 13)
642 						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
643 
644 			} else if (strcmp(param->u.crypt.alg, "TKIP") == 0) {
645 				psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
646 
647 				memcpy(grpkey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
648 
649 				/* DEBUG_ERR("set key length :param->u.crypt.key_len =%d\n", param->u.crypt.key_len); */
650 				/* set mic key */
651 				memcpy(txkey, &(param->u.crypt.key[16]), 8);
652 				memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
653 
654 				psecuritypriv->busetkipkey = true;
655 
656 			}
657 			else if (strcmp(param->u.crypt.alg, "CCMP") == 0) {
658 				psecuritypriv->dot118021XGrpPrivacy = _AES_;
659 
660 				memcpy(grpkey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
661 			} else {
662 				psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
663 			}
664 
665 			psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
666 
667 			psecuritypriv->binstallGrpkey = true;
668 
669 			psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;/*  */
670 
671 			rtw_ap_set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
672 
673 			pbcmc_sta = rtw_get_bcmc_stainfo(padapter);
674 			if (pbcmc_sta) {
675 				pbcmc_sta->ieee8021x_blocked = false;
676 				pbcmc_sta->dot118021XPrivacy = psecuritypriv->dot118021XGrpPrivacy;/* rx will use bmc_sta's dot118021XPrivacy */
677 			}
678 		}
679 
680 		goto exit;
681 
682 	}
683 
684 	if (psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X && psta) { /*  psk/802_1x */
685 		if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
686 			if (param->u.crypt.set_tx == 1)	{
687 				memcpy(psta->dot118021x_UncstKey.skey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
688 
689 				if (strcmp(param->u.crypt.alg, "WEP") == 0) {
690 					psta->dot118021XPrivacy = _WEP40_;
691 					if (param->u.crypt.key_len == 13)
692 						psta->dot118021XPrivacy = _WEP104_;
693 				} else if (strcmp(param->u.crypt.alg, "TKIP") == 0) {
694 					psta->dot118021XPrivacy = _TKIP_;
695 
696 					/* DEBUG_ERR("set key length :param->u.crypt.key_len =%d\n", param->u.crypt.key_len); */
697 					/* set mic key */
698 					memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
699 					memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
700 
701 					psecuritypriv->busetkipkey = true;
702 
703 				} else if (strcmp(param->u.crypt.alg, "CCMP") == 0) {
704 
705 					psta->dot118021XPrivacy = _AES_;
706 				} else {
707 					psta->dot118021XPrivacy = _NO_PRIVACY_;
708 				}
709 
710 				rtw_ap_set_pairwise_key(padapter, psta);
711 
712 				psta->ieee8021x_blocked = false;
713 
714 			} else { /* group key??? */
715 				if (strcmp(param->u.crypt.alg, "WEP") == 0) {
716 					memcpy(grpkey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
717 
718 					psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
719 					if (param->u.crypt.key_len == 13)
720 						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
721 				} else if (strcmp(param->u.crypt.alg, "TKIP") == 0) {
722 					psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
723 
724 					memcpy(grpkey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
725 
726 					/* DEBUG_ERR("set key length :param->u.crypt.key_len =%d\n", param->u.crypt.key_len); */
727 					/* set mic key */
728 					memcpy(txkey, &(param->u.crypt.key[16]), 8);
729 					memcpy(rxkey, &(param->u.crypt.key[24]), 8);
730 
731 					psecuritypriv->busetkipkey = true;
732 
733 				} else if (strcmp(param->u.crypt.alg, "CCMP") == 0) {
734 					psecuritypriv->dot118021XGrpPrivacy = _AES_;
735 
736 					memcpy(grpkey, param->u.crypt.key, (param->u.crypt.key_len > 16 ? 16 : param->u.crypt.key_len));
737 				} else {
738 					psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
739 				}
740 
741 				psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
742 
743 				psecuritypriv->binstallGrpkey = true;
744 
745 				psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;/*  */
746 
747 				rtw_ap_set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
748 
749 				pbcmc_sta = rtw_get_bcmc_stainfo(padapter);
750 				if (pbcmc_sta) {
751 					pbcmc_sta->ieee8021x_blocked = false;
752 					pbcmc_sta->dot118021XPrivacy = psecuritypriv->dot118021XGrpPrivacy;/* rx will use bmc_sta's dot118021XPrivacy */
753 				}
754 			}
755 		}
756 	}
757 
758 exit:
759 	kfree(pwep);
760 
761 	return ret;
762 
763 }
764 
765 static int rtw_set_beacon(struct net_device *dev, struct ieee_param *param, int len)
766 {
767 	int ret = 0;
768 	struct adapter *padapter = rtw_netdev_priv(dev);
769 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
770 	struct sta_priv *pstapriv = &padapter->stapriv;
771 	unsigned char *pbuf = param->u.bcn_ie.buf;
772 
773 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
774 		return -EINVAL;
775 
776 	memcpy(&pstapriv->max_num_sta, param->u.bcn_ie.reserved, 2);
777 
778 	if ((pstapriv->max_num_sta > NUM_STA) || (pstapriv->max_num_sta <= 0))
779 		pstapriv->max_num_sta = NUM_STA;
780 
781 
782 	if (rtw_check_beacon_data(padapter, pbuf,  (len-12-2)) == _SUCCESS)/*  12 = param header, 2:no packed */
783 		ret = 0;
784 	else
785 		ret = -EINVAL;
786 
787 
788 	return ret;
789 
790 }
791 
792 static void rtw_hostapd_sta_flush(struct net_device *dev)
793 {
794 	/* _irqL irqL; */
795 	/* struct list_head	*phead, *plist; */
796 	/* struct sta_info *psta = NULL; */
797 	struct adapter *padapter = rtw_netdev_priv(dev);
798 	/* struct sta_priv *pstapriv = &padapter->stapriv; */
799 
800 	flush_all_cam_entry(padapter);	/* clear CAM */
801 
802 	rtw_sta_flush(padapter);
803 }
804 
805 static int rtw_add_sta(struct net_device *dev, struct ieee_param *param)
806 {
807 	int ret = 0;
808 	struct sta_info *psta = NULL;
809 	struct adapter *padapter = rtw_netdev_priv(dev);
810 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
811 	struct sta_priv *pstapriv = &padapter->stapriv;
812 
813 	if (check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != true)
814 		return -EINVAL;
815 
816 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
817 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
818 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
819 		return -EINVAL;
820 	}
821 
822 /*
823 	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
824 	if (psta)
825 	{
826 		rtw_free_stainfo(padapter,  psta);
827 
828 		psta = NULL;
829 	}
830 */
831 	/* psta = rtw_alloc_stainfo(pstapriv, param->sta_addr); */
832 	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
833 	if (psta) {
834 		int flags = param->u.add_sta.flags;
835 
836 		psta->aid = param->u.add_sta.aid;/* aid = 1~2007 */
837 
838 		memcpy(psta->bssrateset, param->u.add_sta.tx_supp_rates, 16);
839 
840 
841 		/* check wmm cap. */
842 		if (WLAN_STA_WME&flags)
843 			psta->qos_option = 1;
844 		else
845 			psta->qos_option = 0;
846 
847 		if (pmlmepriv->qospriv.qos_option == 0)
848 			psta->qos_option = 0;
849 
850 		/* chec 802.11n ht cap. */
851 		if (WLAN_STA_HT&flags) {
852 			psta->htpriv.ht_option = true;
853 			psta->qos_option = 1;
854 			memcpy((void *)&psta->htpriv.ht_cap, (void *)&param->u.add_sta.ht_cap, sizeof(struct ieee80211_ht_cap));
855 		} else {
856 			psta->htpriv.ht_option = false;
857 		}
858 
859 		if (pmlmepriv->htpriv.ht_option == false)
860 			psta->htpriv.ht_option = false;
861 
862 		update_sta_info_apmode(padapter, psta);
863 
864 
865 	} else {
866 		ret = -ENOMEM;
867 	}
868 
869 	return ret;
870 
871 }
872 
873 static int rtw_del_sta(struct net_device *dev, struct ieee_param *param)
874 {
875 	int ret = 0;
876 	struct sta_info *psta = NULL;
877 	struct adapter *padapter = rtw_netdev_priv(dev);
878 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
879 	struct sta_priv *pstapriv = &padapter->stapriv;
880 
881 	if (check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != true)
882 		return -EINVAL;
883 
884 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
885 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
886 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
887 		return -EINVAL;
888 	}
889 
890 	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
891 	if (psta) {
892 		u8 updated = false;
893 
894 		spin_lock_bh(&pstapriv->asoc_list_lock);
895 		if (list_empty(&psta->asoc_list) == false) {
896 			list_del_init(&psta->asoc_list);
897 			pstapriv->asoc_list_cnt--;
898 			updated = ap_free_sta(padapter, psta, true, WLAN_REASON_DEAUTH_LEAVING);
899 
900 		}
901 		spin_unlock_bh(&pstapriv->asoc_list_lock);
902 
903 		associated_clients_update(padapter, updated);
904 
905 		psta = NULL;
906 
907 	}
908 
909 	return ret;
910 
911 }
912 
913 static int rtw_ioctl_get_sta_data(struct net_device *dev, struct ieee_param *param, int len)
914 {
915 	int ret = 0;
916 	struct sta_info *psta = NULL;
917 	struct adapter *padapter = rtw_netdev_priv(dev);
918 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
919 	struct sta_priv *pstapriv = &padapter->stapriv;
920 	struct ieee_param_ex *param_ex = (struct ieee_param_ex *)param;
921 	struct sta_data *psta_data = (struct sta_data *)param_ex->data;
922 
923 	if (check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != true)
924 		return -EINVAL;
925 
926 	if (param_ex->sta_addr[0] == 0xff && param_ex->sta_addr[1] == 0xff &&
927 	    param_ex->sta_addr[2] == 0xff && param_ex->sta_addr[3] == 0xff &&
928 	    param_ex->sta_addr[4] == 0xff && param_ex->sta_addr[5] == 0xff) {
929 		return -EINVAL;
930 	}
931 
932 	psta = rtw_get_stainfo(pstapriv, param_ex->sta_addr);
933 	if (psta) {
934 		psta_data->aid = (u16)psta->aid;
935 		psta_data->capability = psta->capability;
936 		psta_data->flags = psta->flags;
937 
938 /*
939 		nonerp_set : BIT(0)
940 		no_short_slot_time_set : BIT(1)
941 		no_short_preamble_set : BIT(2)
942 		no_ht_gf_set : BIT(3)
943 		no_ht_set : BIT(4)
944 		ht_20mhz_set : BIT(5)
945 */
946 
947 		psta_data->sta_set = ((psta->nonerp_set) |
948 							 (psta->no_short_slot_time_set << 1) |
949 							 (psta->no_short_preamble_set << 2) |
950 							 (psta->no_ht_gf_set << 3) |
951 							 (psta->no_ht_set << 4) |
952 							 (psta->ht_20mhz_set << 5));
953 
954 		psta_data->tx_supp_rates_len =  psta->bssratelen;
955 		memcpy(psta_data->tx_supp_rates, psta->bssrateset, psta->bssratelen);
956 		memcpy(&psta_data->ht_cap, &psta->htpriv.ht_cap, sizeof(struct ieee80211_ht_cap));
957 		psta_data->rx_pkts = psta->sta_stats.rx_data_pkts;
958 		psta_data->rx_bytes = psta->sta_stats.rx_bytes;
959 		psta_data->rx_drops = psta->sta_stats.rx_drops;
960 
961 		psta_data->tx_pkts = psta->sta_stats.tx_pkts;
962 		psta_data->tx_bytes = psta->sta_stats.tx_bytes;
963 		psta_data->tx_drops = psta->sta_stats.tx_drops;
964 
965 
966 	} else {
967 		ret = -1;
968 	}
969 
970 	return ret;
971 
972 }
973 
974 static int rtw_get_sta_wpaie(struct net_device *dev, struct ieee_param *param)
975 {
976 	int ret = 0;
977 	struct sta_info *psta = NULL;
978 	struct adapter *padapter = rtw_netdev_priv(dev);
979 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
980 	struct sta_priv *pstapriv = &padapter->stapriv;
981 
982 	if (check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != true)
983 		return -EINVAL;
984 
985 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
986 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
987 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
988 		return -EINVAL;
989 	}
990 
991 	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
992 	if (psta) {
993 		if ((psta->wpa_ie[0] == WLAN_EID_RSN) || (psta->wpa_ie[0] == WLAN_EID_VENDOR_SPECIFIC)) {
994 			int wpa_ie_len;
995 			int copy_len;
996 
997 			wpa_ie_len = psta->wpa_ie[1];
998 
999 			copy_len = ((wpa_ie_len+2) > sizeof(psta->wpa_ie)) ? (sizeof(psta->wpa_ie)):(wpa_ie_len+2);
1000 
1001 			param->u.wpa_ie.len = copy_len;
1002 
1003 			memcpy(param->u.wpa_ie.reserved, psta->wpa_ie, copy_len);
1004 		}
1005 	} else {
1006 		ret = -1;
1007 	}
1008 
1009 	return ret;
1010 
1011 }
1012 
1013 static int rtw_set_wps_beacon(struct net_device *dev, struct ieee_param *param, int len)
1014 {
1015 	int ret = 0;
1016 	unsigned char wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
1017 	struct adapter *padapter = rtw_netdev_priv(dev);
1018 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1019 	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1020 	int ie_len;
1021 
1022 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
1023 		return -EINVAL;
1024 
1025 	ie_len = len-12-2;/*  12 = param header, 2:no packed */
1026 
1027 
1028 	kfree(pmlmepriv->wps_beacon_ie);
1029 	pmlmepriv->wps_beacon_ie = NULL;
1030 
1031 	if (ie_len > 0) {
1032 		pmlmepriv->wps_beacon_ie = rtw_malloc(ie_len);
1033 		pmlmepriv->wps_beacon_ie_len = ie_len;
1034 		if (!pmlmepriv->wps_beacon_ie)
1035 			return -EINVAL;
1036 
1037 		memcpy(pmlmepriv->wps_beacon_ie, param->u.bcn_ie.buf, ie_len);
1038 
1039 		update_beacon(padapter, WLAN_EID_VENDOR_SPECIFIC, wps_oui, true);
1040 
1041 		pmlmeext->bstart_bss = true;
1042 	}
1043 
1044 
1045 	return ret;
1046 
1047 }
1048 
1049 static int rtw_set_wps_probe_resp(struct net_device *dev, struct ieee_param *param, int len)
1050 {
1051 	int ret = 0;
1052 	struct adapter *padapter = rtw_netdev_priv(dev);
1053 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1054 	int ie_len;
1055 
1056 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
1057 		return -EINVAL;
1058 
1059 	ie_len = len-12-2;/*  12 = param header, 2:no packed */
1060 
1061 
1062 	kfree(pmlmepriv->wps_probe_resp_ie);
1063 	pmlmepriv->wps_probe_resp_ie = NULL;
1064 
1065 	if (ie_len > 0) {
1066 		pmlmepriv->wps_probe_resp_ie = rtw_malloc(ie_len);
1067 		pmlmepriv->wps_probe_resp_ie_len = ie_len;
1068 		if (!pmlmepriv->wps_probe_resp_ie)
1069 			return -EINVAL;
1070 
1071 		memcpy(pmlmepriv->wps_probe_resp_ie, param->u.bcn_ie.buf, ie_len);
1072 	}
1073 
1074 
1075 	return ret;
1076 
1077 }
1078 
1079 static int rtw_set_wps_assoc_resp(struct net_device *dev, struct ieee_param *param, int len)
1080 {
1081 	int ret = 0;
1082 	struct adapter *padapter = rtw_netdev_priv(dev);
1083 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1084 	int ie_len;
1085 
1086 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
1087 		return -EINVAL;
1088 
1089 	ie_len = len-12-2;/*  12 = param header, 2:no packed */
1090 
1091 
1092 	kfree(pmlmepriv->wps_assoc_resp_ie);
1093 	pmlmepriv->wps_assoc_resp_ie = NULL;
1094 
1095 	if (ie_len > 0) {
1096 		pmlmepriv->wps_assoc_resp_ie = rtw_malloc(ie_len);
1097 		pmlmepriv->wps_assoc_resp_ie_len = ie_len;
1098 		if (!pmlmepriv->wps_assoc_resp_ie)
1099 			return -EINVAL;
1100 
1101 		memcpy(pmlmepriv->wps_assoc_resp_ie, param->u.bcn_ie.buf, ie_len);
1102 	}
1103 
1104 
1105 	return ret;
1106 
1107 }
1108 
1109 static int rtw_set_hidden_ssid(struct net_device *dev, struct ieee_param *param, int len)
1110 {
1111 	int ret = 0;
1112 	struct adapter *adapter = rtw_netdev_priv(dev);
1113 	struct mlme_priv *mlmepriv = &(adapter->mlmepriv);
1114 	struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
1115 	struct mlme_ext_info *mlmeinfo = &(mlmeext->mlmext_info);
1116 	int ie_len;
1117 	u8 *ssid_ie;
1118 	char ssid[NDIS_802_11_LENGTH_SSID + 1];
1119 	signed int ssid_len;
1120 	u8 ignore_broadcast_ssid;
1121 
1122 	if (check_fwstate(mlmepriv, WIFI_AP_STATE) != true)
1123 		return -EPERM;
1124 
1125 	if (param->u.bcn_ie.reserved[0] != 0xea)
1126 		return -EINVAL;
1127 
1128 	mlmeinfo->hidden_ssid_mode = ignore_broadcast_ssid = param->u.bcn_ie.reserved[1];
1129 
1130 	ie_len = len-12-2;/*  12 = param header, 2:no packed */
1131 	ssid_ie = rtw_get_ie(param->u.bcn_ie.buf,  WLAN_EID_SSID, &ssid_len, ie_len);
1132 
1133 	if (ssid_ie && ssid_len > 0 && ssid_len <= NDIS_802_11_LENGTH_SSID) {
1134 		struct wlan_bssid_ex *pbss_network = &mlmepriv->cur_network.network;
1135 		struct wlan_bssid_ex *pbss_network_ext = &mlmeinfo->network;
1136 
1137 		memcpy(ssid, ssid_ie+2, ssid_len);
1138 		ssid[ssid_len] = 0x0;
1139 
1140 		memcpy(pbss_network->ssid.ssid, (void *)ssid, ssid_len);
1141 		pbss_network->ssid.ssid_length = ssid_len;
1142 		memcpy(pbss_network_ext->ssid.ssid, (void *)ssid, ssid_len);
1143 		pbss_network_ext->ssid.ssid_length = ssid_len;
1144 	}
1145 
1146 	return ret;
1147 }
1148 
1149 static int rtw_ioctl_acl_remove_sta(struct net_device *dev, struct ieee_param *param, int len)
1150 {
1151 	struct adapter *padapter = rtw_netdev_priv(dev);
1152 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1153 
1154 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
1155 		return -EINVAL;
1156 
1157 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
1158 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
1159 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
1160 		return -EINVAL;
1161 	}
1162 
1163 	rtw_acl_remove_sta(padapter, param->sta_addr);
1164 	return 0;
1165 
1166 }
1167 
1168 static int rtw_ioctl_acl_add_sta(struct net_device *dev, struct ieee_param *param, int len)
1169 {
1170 	struct adapter *padapter = rtw_netdev_priv(dev);
1171 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1172 
1173 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
1174 		return -EINVAL;
1175 
1176 	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
1177 	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
1178 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
1179 		return -EINVAL;
1180 	}
1181 
1182 	return rtw_acl_add_sta(padapter, param->sta_addr);
1183 
1184 }
1185 
1186 static int rtw_ioctl_set_macaddr_acl(struct net_device *dev, struct ieee_param *param, int len)
1187 {
1188 	int ret = 0;
1189 	struct adapter *padapter = rtw_netdev_priv(dev);
1190 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1191 
1192 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
1193 		return -EINVAL;
1194 
1195 	rtw_set_macaddr_acl(padapter, param->u.mlme.command);
1196 
1197 	return ret;
1198 }
1199 
1200 static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
1201 {
1202 	struct ieee_param *param;
1203 	int ret = 0;
1204 	struct adapter *padapter = rtw_netdev_priv(dev);
1205 
1206 	/*
1207 	* this function is expect to call in master mode, which allows no power saving
1208 	* so, we just check hw_init_completed
1209 	*/
1210 
1211 	if (!padapter->hw_init_completed)
1212 		return -EPERM;
1213 
1214 	if (!p->pointer || p->length != sizeof(*param))
1215 		return -EINVAL;
1216 
1217 	param = rtw_malloc(p->length);
1218 	if (!param)
1219 		return -ENOMEM;
1220 
1221 	if (copy_from_user(param, p->pointer, p->length)) {
1222 		kfree(param);
1223 		return -EFAULT;
1224 	}
1225 
1226 	switch (param->cmd) {
1227 	case RTL871X_HOSTAPD_FLUSH:
1228 
1229 		rtw_hostapd_sta_flush(dev);
1230 
1231 		break;
1232 
1233 	case RTL871X_HOSTAPD_ADD_STA:
1234 
1235 		ret = rtw_add_sta(dev, param);
1236 
1237 		break;
1238 
1239 	case RTL871X_HOSTAPD_REMOVE_STA:
1240 
1241 		ret = rtw_del_sta(dev, param);
1242 
1243 		break;
1244 
1245 	case RTL871X_HOSTAPD_SET_BEACON:
1246 
1247 		ret = rtw_set_beacon(dev, param, p->length);
1248 
1249 		break;
1250 
1251 	case RTL871X_SET_ENCRYPTION:
1252 
1253 		ret = rtw_set_encryption(dev, param, p->length);
1254 
1255 		break;
1256 
1257 	case RTL871X_HOSTAPD_GET_WPAIE_STA:
1258 
1259 		ret = rtw_get_sta_wpaie(dev, param);
1260 
1261 		break;
1262 
1263 	case RTL871X_HOSTAPD_SET_WPS_BEACON:
1264 
1265 		ret = rtw_set_wps_beacon(dev, param, p->length);
1266 
1267 		break;
1268 
1269 	case RTL871X_HOSTAPD_SET_WPS_PROBE_RESP:
1270 
1271 		ret = rtw_set_wps_probe_resp(dev, param, p->length);
1272 
1273 		break;
1274 
1275 	case RTL871X_HOSTAPD_SET_WPS_ASSOC_RESP:
1276 
1277 		ret = rtw_set_wps_assoc_resp(dev, param, p->length);
1278 
1279 		break;
1280 
1281 	case RTL871X_HOSTAPD_SET_HIDDEN_SSID:
1282 
1283 		ret = rtw_set_hidden_ssid(dev, param, p->length);
1284 
1285 		break;
1286 
1287 	case RTL871X_HOSTAPD_GET_INFO_STA:
1288 
1289 		ret = rtw_ioctl_get_sta_data(dev, param, p->length);
1290 
1291 		break;
1292 
1293 	case RTL871X_HOSTAPD_SET_MACADDR_ACL:
1294 
1295 		ret = rtw_ioctl_set_macaddr_acl(dev, param, p->length);
1296 
1297 		break;
1298 
1299 	case RTL871X_HOSTAPD_ACL_ADD_STA:
1300 
1301 		ret = rtw_ioctl_acl_add_sta(dev, param, p->length);
1302 
1303 		break;
1304 
1305 	case RTL871X_HOSTAPD_ACL_REMOVE_STA:
1306 
1307 		ret = rtw_ioctl_acl_remove_sta(dev, param, p->length);
1308 
1309 		break;
1310 
1311 	default:
1312 		ret = -EOPNOTSUPP;
1313 		break;
1314 
1315 	}
1316 
1317 	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
1318 		ret = -EFAULT;
1319 
1320 	kfree(param);
1321 	return ret;
1322 }
1323 
1324 /*  copy from net/wireless/wext.c end */
1325 
1326 int rtw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
1327 {
1328 	struct iwreq *wrq = (struct iwreq *)rq;
1329 	int ret = 0;
1330 
1331 	switch (cmd) {
1332 	case RTL_IOCTL_WPA_SUPPLICANT:
1333 		ret = wpa_supplicant_ioctl(dev, &wrq->u.data);
1334 		break;
1335 	case RTL_IOCTL_HOSTAPD:
1336 		ret = rtw_hostapd_ioctl(dev, &wrq->u.data);
1337 		break;
1338 	default:
1339 		ret = -EOPNOTSUPP;
1340 		break;
1341 	}
1342 
1343 	return ret;
1344 }
1345