drivers/staging/ks7010/ks_hostif.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  *   Driver for KeyStream wireless LAN cards.
   4  *
   5  *   Copyright (C) 2005-2008 KeyStream Corp.
   6  *   Copyright (C) 2009 Renesas Technology Corp.
   7  */
   8
   9 #include <crypto/hash.h>
  10 #include <linux/circ_buf.h>
  11 #include <linux/if_arp.h>
  12 #include <net/iw_handler.h>
  13 #include <uapi/linux/llc.h>
  14 #include "eap_packet.h"
  15 #include "ks_wlan.h"
  16 #include "ks_hostif.h"
  17
  18 #define MICHAEL_MIC_KEY_LEN 8
  19 #define MICHAEL_MIC_LEN     8
  20
  21 static inline void inc_smeqhead(struct ks_wlan_private *priv)
  22 {
  23         priv->sme_i.qhead = (priv->sme_i.qhead + 1) % SME_EVENT_BUFF_SIZE;
  24 }
  25
  26 static inline void inc_smeqtail(struct ks_wlan_private *priv)
  27 {
  28         priv->sme_i.qtail = (priv->sme_i.qtail + 1) % SME_EVENT_BUFF_SIZE;
  29 }
  30
  31 static inline unsigned int cnt_smeqbody(struct ks_wlan_private *priv)
  32 {
  33         return CIRC_CNT_TO_END(priv->sme_i.qhead, priv->sme_i.qtail,
  34                                SME_EVENT_BUFF_SIZE);
  35 }
  36
  37 static inline u8 get_byte(struct ks_wlan_private *priv)
  38 {
  39         u8 data;
  40
  41         data = *priv->rxp++;
  42         /* length check in advance ! */
  43         --(priv->rx_size);
  44         return data;
  45 }
  46
  47 static inline u16 get_word(struct ks_wlan_private *priv)
  48 {
  49         u16 data;
  50
  51         data = (get_byte(priv) & 0xff);
  52         data |= ((get_byte(priv) << 8) & 0xff00);
  53         return data;
  54 }
  55
  56 static inline u32 get_dword(struct ks_wlan_private *priv)
  57 {
  58         u32 data;
  59
  60         data = (get_byte(priv) & 0xff);
  61         data |= ((get_byte(priv) << 8) & 0x0000ff00);
  62         data |= ((get_byte(priv) << 16) & 0x00ff0000);
  63         data |= ((get_byte(priv) << 24) & 0xff000000);
  64         return data;
  65 }
  66
  67 static void ks_wlan_hw_wakeup_task(struct work_struct *work)
  68 {
  69         struct ks_wlan_private *priv;
  70         int ps_status;
  71         long time_left;
  72
  73         priv = container_of(work, struct ks_wlan_private, wakeup_work);
  74         ps_status = atomic_read(&priv->psstatus.status);
  75
  76         if (ps_status == PS_SNOOZE) {
  77                 ks_wlan_hw_wakeup_request(priv);
  78                 time_left = wait_for_completion_interruptible_timeout(
  79                                 &priv->psstatus.wakeup_wait,
  80                                 msecs_to_jiffies(20));
  81                 if (time_left <= 0) {
  82                         netdev_dbg(priv->net_dev, "wake up timeout or interrupted !!!\n");
  83                         schedule_work(&priv->wakeup_work);
  84                         return;
  85                 }
  86         }
  87
  88         /* power save */
  89         if (atomic_read(&priv->sme_task.count) > 0)
  90                 tasklet_enable(&priv->sme_task);
  91 }
  92
  93 static void ks_wlan_do_power_save(struct ks_wlan_private *priv)
  94 {
  95         if (is_connect_status(priv->connect_status))
  96                 hostif_sme_enqueue(priv, SME_POW_MNGMT_REQUEST);
  97         else
  98                 priv->dev_state = DEVICE_STATE_READY;
  99 }
 100
 101 static
 102 int get_current_ap(struct ks_wlan_private *priv, struct link_ap_info *ap_info)
 103 {
 104         struct local_ap *ap;
 105         union iwreq_data wrqu;
 106         struct net_device *netdev = priv->net_dev;
 107         u8 size;
 108
 109         ap = &priv->current_ap;
 110
 111         if (is_disconnect_status(priv->connect_status)) {
 112                 memset(ap, 0, sizeof(struct local_ap));
 113                 return -EPERM;
 114         }
 115
 116         ether_addr_copy(ap->bssid, ap_info->bssid);
 117         memcpy(ap->ssid.body, priv->reg.ssid.body,
 118                priv->reg.ssid.size);
 119         ap->ssid.size = priv->reg.ssid.size;
 120         memcpy(ap->rate_set.body, ap_info->rate_set.body,
 121                ap_info->rate_set.size);
 122         ap->rate_set.size = ap_info->rate_set.size;
 123         if (ap_info->ext_rate_set.size != 0) {
 124                 memcpy(&ap->rate_set.body[ap->rate_set.size],
 125                        ap_info->ext_rate_set.body,
 126                        ap_info->ext_rate_set.size);
 127                 ap->rate_set.size += ap_info->ext_rate_set.size;
 128         }
 129         ap->channel = ap_info->ds_parameter.channel;
 130         ap->rssi = ap_info->rssi;
 131         ap->sq = ap_info->sq;
 132         ap->noise = ap_info->noise;
 133         ap->capability = le16_to_cpu(ap_info->capability);
 134         size = (ap_info->rsn.size <= RSN_IE_BODY_MAX) ?
 135                 ap_info->rsn.size : RSN_IE_BODY_MAX;
 136         if ((ap_info->rsn_mode & RSN_MODE_WPA2) &&
 137             (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2)) {
 138                 ap->rsn_ie.id = RSN_INFO_ELEM_ID;
 139                 ap->rsn_ie.size = size;
 140                 memcpy(ap->rsn_ie.body, ap_info->rsn.body, size);
 141         } else if ((ap_info->rsn_mode & RSN_MODE_WPA) &&
 142                    (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA)) {
 143                 ap->wpa_ie.id = WPA_INFO_ELEM_ID;
 144                 ap->wpa_ie.size = size;
 145                 memcpy(ap->wpa_ie.body, ap_info->rsn.body, size);
 146         } else {
 147                 ap->rsn_ie.id = 0;
 148                 ap->rsn_ie.size = 0;
 149                 ap->wpa_ie.id = 0;
 150                 ap->wpa_ie.size = 0;
 151         }
 152
 153         wrqu.data.length = 0;
 154         wrqu.data.flags = 0;
 155         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 156         if (is_connect_status(priv->connect_status)) {
 157                 ether_addr_copy(wrqu.ap_addr.sa_data, priv->current_ap.bssid);
 158                 netdev_dbg(priv->net_dev,
 159                            "IWEVENT: connect bssid=%pM\n",
 160                            wrqu.ap_addr.sa_data);
 161                 wireless_send_event(netdev, SIOCGIWAP, &wrqu, NULL);
 162         }
 163         netdev_dbg(priv->net_dev, "Link AP\n"
 164                    "- bssid=%02X:%02X:%02X:%02X:%02X:%02X\n"
 165                    "- essid=%s\n"
 166                    "- rate_set=%02X,%02X,%02X,%02X,%02X,%02X,%02X,%02X\n"
 167                    "- channel=%d\n"
 168                    "- rssi=%d\n"
 169                    "- sq=%d\n"
 170                    "- capability=%04X\n"
 171                    "- rsn.mode=%d\n"
 172                    "- rsn.size=%d\n"
 173                    "- ext_rate_set_size=%d\n"
 174                    "- rate_set_size=%d\n",
 175                    ap->bssid[0], ap->bssid[1], ap->bssid[2],
 176                    ap->bssid[3], ap->bssid[4], ap->bssid[5],
 177                    &ap->ssid.body[0],
 178                    ap->rate_set.body[0], ap->rate_set.body[1],
 179                    ap->rate_set.body[2], ap->rate_set.body[3],
 180                    ap->rate_set.body[4], ap->rate_set.body[5],
 181                    ap->rate_set.body[6], ap->rate_set.body[7],
 182                    ap->channel, ap->rssi, ap->sq, ap->capability,
 183                    ap_info->rsn_mode, ap_info->rsn.size,
 184                    ap_info->ext_rate_set.size, ap_info->rate_set.size);
 185
 186         return 0;
 187 }
 188
 189 static u8 read_ie(unsigned char *bp, u8 max, u8 *body)
 190 {
 191         u8 size = (*(bp + 1) <= max) ? *(bp + 1) : max;
 192
 193         memcpy(body, bp + 2, size);
 194         return size;
 195 }
 196
 197 static int
 198 michael_mic(u8 *key, u8 *data, unsigned int len, u8 priority, u8 *result)
 199 {
 200         u8 pad_data[4] = { priority, 0, 0, 0 };
 201         struct crypto_shash *tfm = NULL;
 202         struct shash_desc *desc = NULL;
 203         int ret;
 204
 205         tfm = crypto_alloc_shash("michael_mic", 0, 0);
 206         if (IS_ERR(tfm)) {
 207                 ret = PTR_ERR(tfm);
 208                 goto err;
 209         }
 210
 211         ret = crypto_shash_setkey(tfm, key, MICHAEL_MIC_KEY_LEN);
 212         if (ret < 0)
 213                 goto err_free_tfm;
 214
 215         desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL);
 216         if (!desc) {
 217                 ret = -ENOMEM;
 218                 goto err_free_tfm;
 219         }
 220
 221         desc->tfm = tfm;
 222
 223         ret = crypto_shash_init(desc);
 224         if (ret < 0)
 225                 goto err_free_desc;
 226
 227         // Compute the MIC value
 228         /*
 229          * IEEE802.11i  page 47
 230          * Figure 43g TKIP MIC processing format
 231          * +--+--+--------+--+----+--+--+--+--+--+--+--+--+
 232          * |6 |6 |1       |3 |M   |1 |1 |1 |1 |1 |1 |1 |1 | Octet
 233          * +--+--+--------+--+----+--+--+--+--+--+--+--+--+
 234          * |DA|SA|Priority|0 |Data|M0|M1|M2|M3|M4|M5|M6|M7|
 235          * +--+--+--------+--+----+--+--+--+--+--+--+--+--+
 236          */
 237
 238         ret = crypto_shash_update(desc, data, 12);
 239         if (ret < 0)
 240                 goto err_free_desc;
 241
 242         ret = crypto_shash_update(desc, pad_data, 4);
 243         if (ret < 0)
 244                 goto err_free_desc;
 245
 246         ret = crypto_shash_finup(desc, data + 12, len - 12, result);
 247
 248 err_free_desc:
 249         kzfree(desc);
 250
 251 err_free_tfm:
 252         crypto_free_shash(tfm);
 253
 254 err:
 255         return ret;
 256 }
 257
 258 static
 259 int get_ap_information(struct ks_wlan_private *priv, struct ap_info *ap_info,
 260                        struct local_ap *ap)
 261 {
 262         unsigned char *bp;
 263         int bsize, offset;
 264
 265         memset(ap, 0, sizeof(struct local_ap));
 266
 267         ether_addr_copy(ap->bssid, ap_info->bssid);
 268         ap->rssi = ap_info->rssi;
 269         ap->sq = ap_info->sq;
 270         ap->noise = ap_info->noise;
 271         ap->capability = le16_to_cpu(ap_info->capability);
 272         ap->channel = ap_info->ch_info;
 273
 274         bp = ap_info->body;
 275         bsize = le16_to_cpu(ap_info->body_size);
 276         offset = 0;
 277
 278         while (bsize > offset) {
 279                 switch (*bp) { /* Information Element ID */
 280                 case WLAN_EID_SSID:
 281                         ap->ssid.size = read_ie(bp, IEEE80211_MAX_SSID_LEN,
 282                                                 ap->ssid.body);
 283                         break;
 284                 case WLAN_EID_SUPP_RATES:
 285                 case WLAN_EID_EXT_SUPP_RATES:
 286                         if ((*(bp + 1) + ap->rate_set.size) <=
 287                             RATE_SET_MAX_SIZE) {
 288                                 memcpy(&ap->rate_set.body[ap->rate_set.size],
 289                                        bp + 2, *(bp + 1));
 290                                 ap->rate_set.size += *(bp + 1);
 291                         } else {
 292                                 memcpy(&ap->rate_set.body[ap->rate_set.size],
 293                                        bp + 2,
 294                                        RATE_SET_MAX_SIZE - ap->rate_set.size);
 295                                 ap->rate_set.size +=
 296                                     (RATE_SET_MAX_SIZE - ap->rate_set.size);
 297                         }
 298                         break;
 299                 case WLAN_EID_RSN:
 300                         ap->rsn_ie.id = *bp;
 301                         ap->rsn_ie.size = read_ie(bp, RSN_IE_BODY_MAX,
 302                                                   ap->rsn_ie.body);
 303                         break;
 304                 case WLAN_EID_VENDOR_SPECIFIC: /* WPA */
 305                         /* WPA OUI check */
 306                         if (memcmp(bp + 2, CIPHER_ID_WPA_WEP40, 4) == 0) {
 307                                 ap->wpa_ie.id = *bp;
 308                                 ap->wpa_ie.size = read_ie(bp, RSN_IE_BODY_MAX,
 309                                                           ap->wpa_ie.body);
 310                         }
 311                         break;
 312                 case WLAN_EID_DS_PARAMS:
 313                 case WLAN_EID_FH_PARAMS:
 314                 case WLAN_EID_CF_PARAMS:
 315                 case WLAN_EID_TIM:
 316                 case WLAN_EID_IBSS_PARAMS:
 317                 case WLAN_EID_COUNTRY:
 318                 case WLAN_EID_ERP_INFO:
 319                         break;
 320                 default:
 321                         netdev_err(priv->net_dev,
 322                                    "unknown Element ID=%d\n", *bp);
 323                         break;
 324                 }
 325
 326                 offset += 2;    /* id & size field */
 327                 offset += *(bp + 1);    /* +size offset */
 328                 bp += (*(bp + 1) + 2);  /* pointer update */
 329         }
 330
 331         return 0;
 332 }
 333
 334 static
 335 int hostif_data_indication_wpa(struct ks_wlan_private *priv,
 336                                unsigned short auth_type)
 337 {
 338         struct ether_hdr *eth_hdr;
 339         unsigned short eth_proto;
 340         unsigned char recv_mic[MICHAEL_MIC_LEN];
 341         char buf[128];
 342         unsigned long now;
 343         struct mic_failure *mic_failure;
 344         u8 mic[MICHAEL_MIC_LEN];
 345         union iwreq_data wrqu;
 346         unsigned int key_index = auth_type - 1;
 347         struct wpa_key *key = &priv->wpa.key[key_index];
 348
 349         eth_hdr = (struct ether_hdr *)(priv->rxp);
 350         eth_proto = ntohs(eth_hdr->h_proto);
 351
 352         if (eth_hdr->h_dest_snap != eth_hdr->h_source_snap) {
 353                 netdev_err(priv->net_dev, "invalid data format\n");
 354                 priv->nstats.rx_errors++;
 355                 return -EINVAL;
 356         }
 357         if (((auth_type == TYPE_PMK1 &&
 358               priv->wpa.pairwise_suite == IW_AUTH_CIPHER_TKIP) ||
 359              (auth_type == TYPE_GMK1 &&
 360               priv->wpa.group_suite == IW_AUTH_CIPHER_TKIP) ||
 361              (auth_type == TYPE_GMK2 &&
 362               priv->wpa.group_suite == IW_AUTH_CIPHER_TKIP)) &&
 363             key->key_len) {
 364                 int ret;
 365
 366                 netdev_dbg(priv->net_dev, "TKIP: protocol=%04X: size=%u\n",
 367                            eth_proto, priv->rx_size);
 368                 /* MIC save */
 369                 memcpy(&recv_mic[0],
 370                        (priv->rxp) + ((priv->rx_size) - sizeof(recv_mic)),
 371                        sizeof(recv_mic));
 372                 priv->rx_size = priv->rx_size - sizeof(recv_mic);
 373
 374                 ret = michael_mic(key->rx_mic_key, priv->rxp, priv->rx_size,
 375                                   0, mic);
 376                 if (ret < 0)
 377                         return ret;
 378                 if (memcmp(mic, recv_mic, sizeof(mic)) != 0) {
 379                         now = jiffies;
 380                         mic_failure = &priv->wpa.mic_failure;
 381                         /* MIC FAILURE */
 382                         if (mic_failure->last_failure_time &&
 383                             (now - mic_failure->last_failure_time) / HZ >= 60) {
 384                                 mic_failure->failure = 0;
 385                         }
 386                         netdev_err(priv->net_dev, "MIC FAILURE\n");
 387                         if (mic_failure->failure == 0) {
 388                                 mic_failure->failure = 1;
 389                                 mic_failure->counter = 0;
 390                         } else if (mic_failure->failure == 1) {
 391                                 mic_failure->failure = 2;
 392                                 mic_failure->counter =
 393                                         (u16)((now - mic_failure->last_failure_time) / HZ);
 394                                 /*  range 1-60 */
 395                                 if (!mic_failure->counter)
 396                                         mic_failure->counter = 1;
 397                         }
 398                         priv->wpa.mic_failure.last_failure_time = now;
 399
 400                         /*  needed parameters: count, keyid, key type, TSC */
 401                         sprintf(buf,
 402                                 "MLME-MICHAELMICFAILURE.indication(keyid=%d %scast addr=%pM)",
 403                                 key_index,
 404                                 eth_hdr->h_dest[0] & 0x01 ? "broad" : "uni",
 405                                 eth_hdr->h_source);
 406                         memset(&wrqu, 0, sizeof(wrqu));
 407                         wrqu.data.length = strlen(buf);
 408                         wireless_send_event(priv->net_dev, IWEVCUSTOM, &wrqu,
 409                                             buf);
 410                         return -EINVAL;
 411                 }
 412         }
 413         return 0;
 414 }
 415
 416 static
 417 void hostif_data_indication(struct ks_wlan_private *priv)
 418 {
 419         unsigned int rx_ind_size;       /* indicate data size */
 420         struct sk_buff *skb;
 421         u16 auth_type;
 422         unsigned char temp[256];
 423         struct ether_hdr *eth_hdr;
 424         struct ieee802_1x_hdr *aa1x_hdr;
 425         size_t size;
 426         int ret;
 427
 428         /* min length check */
 429         if (priv->rx_size <= ETH_HLEN) {
 430                 priv->nstats.rx_errors++;
 431                 return;
 432         }
 433
 434         auth_type = get_word(priv);     /* AuthType */
 435         get_word(priv); /* Reserve Area */
 436
 437         eth_hdr = (struct ether_hdr *)(priv->rxp);
 438
 439         /* source address check */
 440         if (ether_addr_equal(&priv->eth_addr[0], eth_hdr->h_source)) {
 441                 netdev_err(priv->net_dev, "invalid : source is own mac address !!\n");
 442                 netdev_err(priv->net_dev,
 443                            "eth_hdrernet->h_dest=%02X:%02X:%02X:%02X:%02X:%02X\n",
 444                            eth_hdr->h_source[0], eth_hdr->h_source[1],
 445                            eth_hdr->h_source[2], eth_hdr->h_source[3],
 446                            eth_hdr->h_source[4], eth_hdr->h_source[5]);
 447                 priv->nstats.rx_errors++;
 448                 return;
 449         }
 450
 451         /*  for WPA */
 452         if (auth_type != TYPE_DATA && priv->wpa.rsn_enabled) {
 453                 ret = hostif_data_indication_wpa(priv, auth_type);
 454                 if (ret)
 455                         return;
 456         }
 457
 458         if ((priv->connect_status & FORCE_DISCONNECT) ||
 459             priv->wpa.mic_failure.failure == 2) {
 460                 return;
 461         }
 462
 463         /* check 13th byte at rx data */
 464         switch (*(priv->rxp + 12)) {
 465         case LLC_SAP_SNAP:
 466                 rx_ind_size = priv->rx_size - 6;
 467                 skb = dev_alloc_skb(rx_ind_size);
 468                 if (!skb) {
 469                         priv->nstats.rx_dropped++;
 470                         return;
 471                 }
 472                 netdev_dbg(priv->net_dev, "SNAP, rx_ind_size = %d\n",
 473                            rx_ind_size);
 474
 475                 size = ETH_ALEN * 2;
 476                 skb_put_data(skb, priv->rxp, size);
 477
 478                 /* (SNAP+UI..) skip */
 479
 480                 size = rx_ind_size - (ETH_ALEN * 2);
 481                 skb_put_data(skb, &eth_hdr->h_proto, size);
 482
 483                 aa1x_hdr = (struct ieee802_1x_hdr *)(priv->rxp + ETHER_HDR_SIZE);
 484                 break;
 485         case LLC_SAP_NETBEUI:
 486                 rx_ind_size = (priv->rx_size + 2);
 487                 skb = dev_alloc_skb(rx_ind_size);
 488                 if (!skb) {
 489                         priv->nstats.rx_dropped++;
 490                         return;
 491                 }
 492                 netdev_dbg(priv->net_dev, "NETBEUI/NetBIOS rx_ind_size=%d\n",
 493                            rx_ind_size);
 494
 495                 /* 8802/FDDI MAC copy */
 496                 skb_put_data(skb, priv->rxp, 12);
 497
 498                 /* NETBEUI size add */
 499                 temp[0] = (((rx_ind_size - 12) >> 8) & 0xff);
 500                 temp[1] = ((rx_ind_size - 12) & 0xff);
 501                 skb_put_data(skb, temp, 2);
 502
 503                 /* copy after Type */
 504                 skb_put_data(skb, priv->rxp + 12, rx_ind_size - 14);
 505
 506                 aa1x_hdr = (struct ieee802_1x_hdr *)(priv->rxp + 14);
 507                 break;
 508         default:        /* other rx data */
 509                 netdev_err(priv->net_dev, "invalid data format\n");
 510                 priv->nstats.rx_errors++;
 511                 return;
 512         }
 513
 514         if (aa1x_hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
 515             priv->wpa.rsn_enabled)
 516                 atomic_set(&priv->psstatus.snooze_guard, 1);
 517
 518         /* rx indication */
 519         skb->dev = priv->net_dev;
 520         skb->protocol = eth_type_trans(skb, skb->dev);
 521         priv->nstats.rx_packets++;
 522         priv->nstats.rx_bytes += rx_ind_size;
 523         netif_rx(skb);
 524 }
 525
 526 static
 527 void hostif_mib_get_confirm(struct ks_wlan_private *priv)
 528 {
 529         struct net_device *dev = priv->net_dev;
 530         u32 mib_status;
 531         u32 mib_attribute;
 532         u16 mib_val_size;
 533         u16 mib_val_type;
 534
 535         mib_status = get_dword(priv);
 536         mib_attribute = get_dword(priv);
 537         mib_val_size = get_word(priv);
 538         mib_val_type = get_word(priv);
 539
 540         if (mib_status) {
 541                 netdev_err(priv->net_dev, "attribute=%08X, status=%08X\n",
 542                            mib_attribute, mib_status);
 543                 return;
 544         }
 545
 546         switch (mib_attribute) {
 547         case DOT11_MAC_ADDRESS:
 548                 hostif_sme_enqueue(priv, SME_GET_MAC_ADDRESS);
 549                 ether_addr_copy(priv->eth_addr, priv->rxp);
 550                 priv->mac_address_valid = true;
 551                 ether_addr_copy(dev->dev_addr, priv->eth_addr);
 552                 netdev_info(dev, "MAC ADDRESS = %pM\n", priv->eth_addr);
 553                 break;
 554         case DOT11_PRODUCT_VERSION:
 555                 priv->version_size = priv->rx_size;
 556                 memcpy(priv->firmware_version, priv->rxp, priv->rx_size);
 557                 priv->firmware_version[priv->rx_size] = '\0';
 558                 netdev_info(dev, "firmware ver. = %s\n",
 559                             priv->firmware_version);
 560                 hostif_sme_enqueue(priv, SME_GET_PRODUCT_VERSION);
 561                 /* wake_up_interruptible_all(&priv->confirm_wait); */
 562                 complete(&priv->confirm_wait);
 563                 break;
 564         case LOCAL_GAIN:
 565                 memcpy(&priv->gain, priv->rxp, sizeof(priv->gain));
 566                 netdev_dbg(priv->net_dev, "tx_mode=%d, rx_mode=%d, tx_gain=%d, rx_gain=%d\n",
 567                            priv->gain.tx_mode, priv->gain.rx_mode,
 568                            priv->gain.tx_gain, priv->gain.rx_gain);
 569                 break;
 570         case LOCAL_EEPROM_SUM:
 571                 memcpy(&priv->eeprom_sum, priv->rxp, sizeof(priv->eeprom_sum));
 572                 if (priv->eeprom_sum.type != 0 &&
 573                     priv->eeprom_sum.type != 1) {
 574                         netdev_err(dev, "LOCAL_EEPROM_SUM error!\n");
 575                         return;
 576                 }
 577                 priv->eeprom_checksum = (priv->eeprom_sum.type == 0) ?
 578                                          EEPROM_CHECKSUM_NONE :
 579                                          (priv->eeprom_sum.result == 0) ?
 580                                          EEPROM_NG : EEPROM_OK;
 581                 break;
 582         default:
 583                 netdev_err(priv->net_dev, "mib_attribute=%08x\n",
 584                            (unsigned int)mib_attribute);
 585                 break;
 586         }
 587 }
 588
 589 static
 590 void hostif_mib_set_confirm(struct ks_wlan_private *priv)
 591 {
 592         u32 mib_status;
 593         u32 mib_attribute;
 594
 595         mib_status = get_dword(priv);
 596         mib_attribute = get_dword(priv);
 597
 598         if (mib_status) {
 599                 /* in case of error */
 600                 netdev_err(priv->net_dev, "error :: attribute=%08X, status=%08X\n",
 601                            mib_attribute, mib_status);
 602         }
 603
 604         switch (mib_attribute) {
 605         case DOT11_RTS_THRESHOLD:
 606                 hostif_sme_enqueue(priv, SME_RTS_THRESHOLD_CONFIRM);
 607                 break;
 608         case DOT11_FRAGMENTATION_THRESHOLD:
 609                 hostif_sme_enqueue(priv, SME_FRAGMENTATION_THRESHOLD_CONFIRM);
 610                 break;
 611         case DOT11_WEP_DEFAULT_KEY_ID:
 612                 if (!priv->wpa.wpa_enabled)
 613                         hostif_sme_enqueue(priv, SME_WEP_INDEX_CONFIRM);
 614                 break;
 615         case DOT11_WEP_DEFAULT_KEY_VALUE1:
 616                 if (priv->wpa.rsn_enabled)
 617                         hostif_sme_enqueue(priv, SME_SET_PMK_TSC);
 618                 else
 619                         hostif_sme_enqueue(priv, SME_WEP_KEY1_CONFIRM);
 620                 break;
 621         case DOT11_WEP_DEFAULT_KEY_VALUE2:
 622                 if (priv->wpa.rsn_enabled)
 623                         hostif_sme_enqueue(priv, SME_SET_GMK1_TSC);
 624                 else
 625                         hostif_sme_enqueue(priv, SME_WEP_KEY2_CONFIRM);
 626                 break;
 627         case DOT11_WEP_DEFAULT_KEY_VALUE3:
 628                 if (priv->wpa.rsn_enabled)
 629                         hostif_sme_enqueue(priv, SME_SET_GMK2_TSC);
 630                 else
 631                         hostif_sme_enqueue(priv, SME_WEP_KEY3_CONFIRM);
 632                 break;
 633         case DOT11_WEP_DEFAULT_KEY_VALUE4:
 634                 if (!priv->wpa.rsn_enabled)
 635                         hostif_sme_enqueue(priv, SME_WEP_KEY4_CONFIRM);
 636                 break;
 637         case DOT11_PRIVACY_INVOKED:
 638                 if (!priv->wpa.rsn_enabled)
 639                         hostif_sme_enqueue(priv, SME_WEP_FLAG_CONFIRM);
 640                 break;
 641         case DOT11_RSN_ENABLED:
 642                 hostif_sme_enqueue(priv, SME_RSN_ENABLED_CONFIRM);
 643                 break;
 644         case LOCAL_RSN_MODE:
 645                 hostif_sme_enqueue(priv, SME_RSN_MODE_CONFIRM);
 646                 break;
 647         case LOCAL_MULTICAST_ADDRESS:
 648                 hostif_sme_enqueue(priv, SME_MULTICAST_REQUEST);
 649                 break;
 650         case LOCAL_MULTICAST_FILTER:
 651                 hostif_sme_enqueue(priv, SME_MULTICAST_CONFIRM);
 652                 break;
 653         case LOCAL_CURRENTADDRESS:
 654                 priv->mac_address_valid = true;
 655                 break;
 656         case DOT11_RSN_CONFIG_MULTICAST_CIPHER:
 657                 hostif_sme_enqueue(priv, SME_RSN_MCAST_CONFIRM);
 658                 break;
 659         case DOT11_RSN_CONFIG_UNICAST_CIPHER:
 660                 hostif_sme_enqueue(priv, SME_RSN_UCAST_CONFIRM);
 661                 break;
 662         case DOT11_RSN_CONFIG_AUTH_SUITE:
 663                 hostif_sme_enqueue(priv, SME_RSN_AUTH_CONFIRM);
 664                 break;
 665         case DOT11_GMK1_TSC:
 666                 if (atomic_read(&priv->psstatus.snooze_guard))
 667                         atomic_set(&priv->psstatus.snooze_guard, 0);
 668                 break;
 669         case DOT11_GMK2_TSC:
 670                 if (atomic_read(&priv->psstatus.snooze_guard))
 671                         atomic_set(&priv->psstatus.snooze_guard, 0);
 672                 break;
 673         case DOT11_PMK_TSC:
 674         case LOCAL_PMK:
 675         case LOCAL_GAIN:
 676         case LOCAL_WPS_ENABLE:
 677         case LOCAL_WPS_PROBE_REQ:
 678         case LOCAL_REGION:
 679         default:
 680                 break;
 681         }
 682 }
 683
 684 static
 685 void hostif_power_mgmt_confirm(struct ks_wlan_private *priv)
 686 {
 687         if (priv->reg.power_mgmt > POWER_MGMT_ACTIVE &&
 688             priv->reg.operation_mode == MODE_INFRASTRUCTURE) {
 689                 atomic_set(&priv->psstatus.confirm_wait, 0);
 690                 priv->dev_state = DEVICE_STATE_SLEEP;
 691                 ks_wlan_hw_power_save(priv);
 692         } else {
 693                 priv->dev_state = DEVICE_STATE_READY;
 694         }
 695 }
 696
 697 static
 698 void hostif_sleep_confirm(struct ks_wlan_private *priv)
 699 {
 700         atomic_set(&priv->sleepstatus.doze_request, 1);
 701         queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
 702 }
 703
 704 static
 705 void hostif_start_confirm(struct ks_wlan_private *priv)
 706 {
 707         union iwreq_data wrqu;
 708
 709         wrqu.data.length = 0;
 710         wrqu.data.flags = 0;
 711         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 712         if (is_connect_status(priv->connect_status)) {
 713                 eth_zero_addr(wrqu.ap_addr.sa_data);
 714                 wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
 715         }
 716         netdev_dbg(priv->net_dev, " scan_ind_count=%d\n", priv->scan_ind_count);
 717         hostif_sme_enqueue(priv, SME_START_CONFIRM);
 718 }
 719
 720 static
 721 void hostif_connect_indication(struct ks_wlan_private *priv)
 722 {
 723         u16 connect_code;
 724         unsigned int tmp = 0;
 725         unsigned int old_status = priv->connect_status;
 726         struct net_device *netdev = priv->net_dev;
 727         union iwreq_data wrqu0;
 728
 729         connect_code = get_word(priv);
 730
 731         switch (connect_code) {
 732         case RESULT_CONNECT:
 733                 if (!(priv->connect_status & FORCE_DISCONNECT))
 734                         netif_carrier_on(netdev);
 735                 tmp = FORCE_DISCONNECT & priv->connect_status;
 736                 priv->connect_status = tmp + CONNECT_STATUS;
 737                 break;
 738         case RESULT_DISCONNECT:
 739                 netif_carrier_off(netdev);
 740                 tmp = FORCE_DISCONNECT & priv->connect_status;
 741                 priv->connect_status = tmp + DISCONNECT_STATUS;
 742                 break;
 743         default:
 744                 netdev_dbg(priv->net_dev, "unknown connect_code=%d :: scan_ind_count=%d\n",
 745                            connect_code, priv->scan_ind_count);
 746                 netif_carrier_off(netdev);
 747                 tmp = FORCE_DISCONNECT & priv->connect_status;
 748                 priv->connect_status = tmp + DISCONNECT_STATUS;
 749                 break;
 750         }
 751
 752         get_current_ap(priv, (struct link_ap_info *)priv->rxp);
 753         if (is_connect_status(priv->connect_status) &&
 754             is_disconnect_status(old_status)) {
 755                 /* for power save */
 756                 atomic_set(&priv->psstatus.snooze_guard, 0);
 757                 atomic_set(&priv->psstatus.confirm_wait, 0);
 758         }
 759         ks_wlan_do_power_save(priv);
 760
 761         wrqu0.data.length = 0;
 762         wrqu0.data.flags = 0;
 763         wrqu0.ap_addr.sa_family = ARPHRD_ETHER;
 764         if (is_disconnect_status(priv->connect_status) &&
 765             is_connect_status(old_status)) {
 766                 eth_zero_addr(wrqu0.ap_addr.sa_data);
 767                 netdev_dbg(priv->net_dev, "disconnect :: scan_ind_count=%d\n",
 768                            priv->scan_ind_count);
 769                 wireless_send_event(netdev, SIOCGIWAP, &wrqu0, NULL);
 770         }
 771         priv->scan_ind_count = 0;
 772 }
 773
 774 static
 775 void hostif_scan_indication(struct ks_wlan_private *priv)
 776 {
 777         int i;
 778         struct ap_info *ap_info;
 779
 780         netdev_dbg(priv->net_dev,
 781                    "scan_ind_count = %d\n", priv->scan_ind_count);
 782         ap_info = (struct ap_info *)(priv->rxp);
 783
 784         if (priv->scan_ind_count) {
 785                 /* bssid check */
 786                 for (i = 0; i < priv->aplist.size; i++) {
 787                         u8 *bssid = priv->aplist.ap[i].bssid;
 788
 789                         if (ether_addr_equal(ap_info->bssid, bssid))
 790                                 continue;
 791
 792                         if (ap_info->frame_type == IEEE80211_STYPE_PROBE_RESP)
 793                                 get_ap_information(priv, ap_info,
 794                                                    &priv->aplist.ap[i]);
 795                         return;
 796                 }
 797         }
 798         priv->scan_ind_count++;
 799         if (priv->scan_ind_count < LOCAL_APLIST_MAX + 1) {
 800                 netdev_dbg(priv->net_dev, " scan_ind_count=%d :: aplist.size=%d\n",
 801                            priv->scan_ind_count, priv->aplist.size);
 802                 get_ap_information(priv, (struct ap_info *)(priv->rxp),
 803                                    &priv->aplist.ap[priv->scan_ind_count - 1]);
 804                 priv->aplist.size = priv->scan_ind_count;
 805         } else {
 806                 netdev_dbg(priv->net_dev, " count over :: scan_ind_count=%d\n",
 807                            priv->scan_ind_count);
 808         }
 809 }
 810
 811 static
 812 void hostif_stop_confirm(struct ks_wlan_private *priv)
 813 {
 814         unsigned int tmp = 0;
 815         unsigned int old_status = priv->connect_status;
 816         struct net_device *netdev = priv->net_dev;
 817         union iwreq_data wrqu0;
 818
 819         if (priv->dev_state == DEVICE_STATE_SLEEP)
 820                 priv->dev_state = DEVICE_STATE_READY;
 821
 822         /* disconnect indication */
 823         if (is_connect_status(priv->connect_status)) {
 824                 netif_carrier_off(netdev);
 825                 tmp = FORCE_DISCONNECT & priv->connect_status;
 826                 priv->connect_status = tmp | DISCONNECT_STATUS;
 827                 netdev_info(netdev, "IWEVENT: disconnect\n");
 828
 829                 wrqu0.data.length = 0;
 830                 wrqu0.data.flags = 0;
 831                 wrqu0.ap_addr.sa_family = ARPHRD_ETHER;
 832                 if (is_disconnect_status(priv->connect_status) &&
 833                     is_connect_status(old_status)) {
 834                         eth_zero_addr(wrqu0.ap_addr.sa_data);
 835                         netdev_info(netdev, "IWEVENT: disconnect\n");
 836                         wireless_send_event(netdev, SIOCGIWAP, &wrqu0, NULL);
 837                 }
 838                 priv->scan_ind_count = 0;
 839         }
 840
 841         hostif_sme_enqueue(priv, SME_STOP_CONFIRM);
 842 }
 843
 844 static
 845 void hostif_ps_adhoc_set_confirm(struct ks_wlan_private *priv)
 846 {
 847         priv->infra_status = 0; /* infrastructure mode cancel */
 848         hostif_sme_enqueue(priv, SME_MODE_SET_CONFIRM);
 849 }
 850
 851 static
 852 void hostif_infrastructure_set_confirm(struct ks_wlan_private *priv)
 853 {
 854         u16 result_code;
 855
 856         result_code = get_word(priv);
 857         priv->infra_status = 1; /* infrastructure mode set */
 858         hostif_sme_enqueue(priv, SME_MODE_SET_CONFIRM);
 859 }
 860
 861 static
 862 void hostif_adhoc_set_confirm(struct ks_wlan_private *priv)
 863 {
 864         priv->infra_status = 1; /* infrastructure mode set */
 865         hostif_sme_enqueue(priv, SME_MODE_SET_CONFIRM);
 866 }
 867
 868 static
 869 void hostif_associate_indication(struct ks_wlan_private *priv)
 870 {
 871         struct association_request *assoc_req;
 872         struct association_response *assoc_resp;
 873         unsigned char *pb;
 874         union iwreq_data wrqu;
 875         char buf[IW_CUSTOM_MAX];
 876         char *pbuf = &buf[0];
 877         int i;
 878
 879         static const char associnfo_leader0[] = "ASSOCINFO(ReqIEs=";
 880         static const char associnfo_leader1[] = " RespIEs=";
 881
 882         assoc_req = (struct association_request *)(priv->rxp);
 883         assoc_resp = (struct association_response *)(assoc_req + 1);
 884         pb = (unsigned char *)(assoc_resp + 1);
 885
 886         memset(&wrqu, 0, sizeof(wrqu));
 887         memcpy(pbuf, associnfo_leader0, sizeof(associnfo_leader0) - 1);
 888         wrqu.data.length += sizeof(associnfo_leader0) - 1;
 889         pbuf += sizeof(associnfo_leader0) - 1;
 890
 891         for (i = 0; i < le16_to_cpu(assoc_req->req_ies_size); i++)
 892                 pbuf += sprintf(pbuf, "%02x", *(pb + i));
 893         wrqu.data.length += (le16_to_cpu(assoc_req->req_ies_size)) * 2;
 894
 895         memcpy(pbuf, associnfo_leader1, sizeof(associnfo_leader1) - 1);
 896         wrqu.data.length += sizeof(associnfo_leader1) - 1;
 897         pbuf += sizeof(associnfo_leader1) - 1;
 898
 899         pb += le16_to_cpu(assoc_req->req_ies_size);
 900         for (i = 0; i < le16_to_cpu(assoc_resp->resp_ies_size); i++)
 901                 pbuf += sprintf(pbuf, "%02x", *(pb + i));
 902         wrqu.data.length += (le16_to_cpu(assoc_resp->resp_ies_size)) * 2;
 903
 904         pbuf += sprintf(pbuf, ")");
 905         wrqu.data.length += 1;
 906
 907         wireless_send_event(priv->net_dev, IWEVCUSTOM, &wrqu, buf);
 908 }
 909
 910 static
 911 void hostif_bss_scan_confirm(struct ks_wlan_private *priv)
 912 {
 913         u32 result_code;
 914         struct net_device *dev = priv->net_dev;
 915         union iwreq_data wrqu;
 916
 917         result_code = get_dword(priv);
 918         netdev_dbg(priv->net_dev, "result=%d :: scan_ind_count=%d\n",
 919                    result_code, priv->scan_ind_count);
 920
 921         priv->sme_i.sme_flag &= ~SME_AP_SCAN;
 922         hostif_sme_enqueue(priv, SME_BSS_SCAN_CONFIRM);
 923
 924         wrqu.data.length = 0;
 925         wrqu.data.flags = 0;
 926         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
 927         priv->scan_ind_count = 0;
 928 }
 929
 930 static
 931 void hostif_phy_information_confirm(struct ks_wlan_private *priv)
 932 {
 933         struct iw_statistics *wstats = &priv->wstats;
 934         u8 rssi, signal, noise;
 935         u8 link_speed;
 936         u32 transmitted_frame_count, received_fragment_count;
 937         u32 failed_count, fcs_error_count;
 938
 939         rssi = get_byte(priv);
 940         signal = get_byte(priv);
 941         noise = get_byte(priv);
 942         link_speed = get_byte(priv);
 943         transmitted_frame_count = get_dword(priv);
 944         received_fragment_count = get_dword(priv);
 945         failed_count = get_dword(priv);
 946         fcs_error_count = get_dword(priv);
 947
 948         netdev_dbg(priv->net_dev, "phyinfo confirm rssi=%d signal=%d\n",
 949                    rssi, signal);
 950         priv->current_rate = (link_speed & RATE_MASK);
 951         wstats->qual.qual = signal;
 952         wstats->qual.level = 256 - rssi;
 953         wstats->qual.noise = 0; /* invalid noise value */
 954         wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
 955
 956         netdev_dbg(priv->net_dev, "\n    rssi=%u\n"
 957                    "    signal=%u\n"
 958                    "    link_speed=%ux500Kbps\n"
 959                    "    transmitted_frame_count=%u\n"
 960                    "    received_fragment_count=%u\n"
 961                    "    failed_count=%u\n"
 962                    "    fcs_error_count=%u\n",
 963                    rssi, signal, link_speed, transmitted_frame_count,
 964                    received_fragment_count, failed_count, fcs_error_count);
 965         /* wake_up_interruptible_all(&priv->confirm_wait); */
 966         complete(&priv->confirm_wait);
 967 }
 968
 969 static
 970 void hostif_mic_failure_confirm(struct ks_wlan_private *priv)
 971 {
 972         netdev_dbg(priv->net_dev, "mic_failure=%u\n",
 973                    priv->wpa.mic_failure.failure);
 974         hostif_sme_enqueue(priv, SME_MIC_FAILURE_CONFIRM);
 975 }
 976
 977 static
 978 void hostif_event_check(struct ks_wlan_private *priv)
 979 {
 980         u16 event;
 981
 982         event = get_word(priv);
 983         switch (event) {
 984         case HIF_DATA_IND:
 985                 hostif_data_indication(priv);
 986                 break;
 987         case HIF_MIB_GET_CONF:
 988                 hostif_mib_get_confirm(priv);
 989                 break;
 990         case HIF_MIB_SET_CONF:
 991                 hostif_mib_set_confirm(priv);
 992                 break;
 993         case HIF_POWER_MGMT_CONF:
 994                 hostif_power_mgmt_confirm(priv);
 995                 break;
 996         case HIF_SLEEP_CONF:
 997                 hostif_sleep_confirm(priv);
 998                 break;
 999         case HIF_START_CONF:
1000                 hostif_start_confirm(priv);
1001                 break;
1002         case HIF_CONNECT_IND:
1003                 hostif_connect_indication(priv);
1004                 break;
1005         case HIF_STOP_CONF:
1006                 hostif_stop_confirm(priv);
1007                 break;
1008         case HIF_PS_ADH_SET_CONF:
1009                 hostif_ps_adhoc_set_confirm(priv);
1010                 break;
1011         case HIF_INFRA_SET_CONF:
1012         case HIF_INFRA_SET2_CONF:
1013                 hostif_infrastructure_set_confirm(priv);
1014                 break;
1015         case HIF_ADH_SET_CONF:
1016         case HIF_ADH_SET2_CONF:
1017                 hostif_adhoc_set_confirm(priv);
1018                 break;
1019         case HIF_ASSOC_INFO_IND:
1020                 hostif_associate_indication(priv);
1021                 break;
1022         case HIF_MIC_FAILURE_CONF:
1023                 hostif_mic_failure_confirm(priv);
1024                 break;
1025         case HIF_SCAN_CONF:
1026                 hostif_bss_scan_confirm(priv);
1027                 break;
1028         case HIF_PHY_INFO_CONF:
1029         case HIF_PHY_INFO_IND:
1030                 hostif_phy_information_confirm(priv);
1031                 break;
1032         case HIF_SCAN_IND:
1033                 hostif_scan_indication(priv);
1034                 break;
1035         case HIF_AP_SET_CONF:
1036         default:
1037                 netdev_err(priv->net_dev, "undefined event[%04X]\n", event);
1038                 /* wake_up_all(&priv->confirm_wait); */
1039                 complete(&priv->confirm_wait);
1040                 break;
1041         }
1042
1043         /* add event to hostt buffer */
1044         priv->hostt.buff[priv->hostt.qtail] = event;
1045         priv->hostt.qtail = (priv->hostt.qtail + 1) % SME_EVENT_BUFF_SIZE;
1046 }
1047
1048 /* allocate size bytes, set header size and event */
1049 static void *hostif_generic_request(size_t size, int event)
1050 {
1051         struct hostif_hdr *p;
1052
1053         p = kzalloc(hif_align_size(size), GFP_ATOMIC);
1054         if (!p)
1055                 return NULL;
1056
1057         p->size = cpu_to_le16(size - sizeof(p->size));
1058         p->event = cpu_to_le16(event);
1059
1060         return p;
1061 }
1062
1063 int hostif_data_request(struct ks_wlan_private *priv, struct sk_buff *skb)
1064 {
1065         unsigned int skb_len = 0;
1066         unsigned char *buffer = NULL;
1067         unsigned int length = 0;
1068         struct hostif_data_request *pp;
1069         unsigned char *p;
1070         int result = 0;
1071         unsigned short eth_proto;
1072         struct ether_hdr *eth_hdr;
1073         unsigned short keyinfo = 0;
1074         struct ieee802_1x_hdr *aa1x_hdr;
1075         struct wpa_eapol_key *eap_key;
1076         struct ethhdr *eth;
1077         size_t size;
1078         int ret;
1079
1080         skb_len = skb->len;
1081         if (skb_len > ETH_FRAME_LEN) {
1082                 netdev_err(priv->net_dev, "bad length skb_len=%d\n", skb_len);
1083                 ret = -EOVERFLOW;
1084                 goto err_kfree_skb;
1085         }
1086
1087         if (is_disconnect_status(priv->connect_status) ||
1088             (priv->connect_status & FORCE_DISCONNECT) ||
1089             priv->wpa.mic_failure.stop) {
1090                 if (netif_queue_stopped(priv->net_dev))
1091                         netif_wake_queue(priv->net_dev);
1092
1093                 dev_kfree_skb(skb);
1094
1095                 return 0;
1096         }
1097
1098         /* power save wakeup */
1099         if (atomic_read(&priv->psstatus.status) == PS_SNOOZE) {
1100                 if (!netif_queue_stopped(priv->net_dev))
1101                         netif_stop_queue(priv->net_dev);
1102         }
1103
1104         size = sizeof(*pp) + 6 + skb_len + 8;
1105         pp = kmalloc(hif_align_size(size), GFP_ATOMIC);
1106         if (!pp) {
1107                 ret = -ENOMEM;
1108                 goto err_kfree_skb;
1109         }
1110
1111         p = (unsigned char *)pp->data;
1112
1113         buffer = skb->data;
1114         length = skb->len;
1115
1116         /* skb check */
1117         eth = (struct ethhdr *)skb->data;
1118         if (!ether_addr_equal(&priv->eth_addr[0], eth->h_source)) {
1119                 netdev_err(priv->net_dev,
1120                            "Invalid mac address: ethernet->h_source=%pM\n",
1121                            eth->h_source);
1122                 ret = -ENXIO;
1123                 goto err_kfree;
1124         }
1125
1126         /* dest and src MAC address copy */
1127         size = ETH_ALEN * 2;
1128         memcpy(p, buffer, size);
1129         p += size;
1130         buffer += size;
1131         length -= size;
1132
1133         /* EtherType/Length check */
1134         if (*(buffer + 1) + (*buffer << 8) > 1500) {
1135                 /* ProtocolEAP = *(buffer+1) + (*buffer << 8); */
1136                 /* SAP/CTL/OUI(6 byte) add */
1137                 *p++ = 0xAA;    /* DSAP */
1138                 *p++ = 0xAA;    /* SSAP */
1139                 *p++ = 0x03;    /* CTL */
1140                 *p++ = 0x00;    /* OUI ("000000") */
1141                 *p++ = 0x00;    /* OUI ("000000") */
1142                 *p++ = 0x00;    /* OUI ("000000") */
1143                 skb_len += 6;
1144         } else {
1145                 /* Length(2 byte) delete */
1146                 buffer += 2;
1147                 length -= 2;
1148                 skb_len -= 2;
1149         }
1150
1151         /* pp->data copy */
1152         memcpy(p, buffer, length);
1153
1154         p += length;
1155
1156         /* for WPA */
1157         eth_hdr = (struct ether_hdr *)&pp->data[0];
1158         eth_proto = ntohs(eth_hdr->h_proto);
1159
1160         /* for MIC FAILURE REPORT check */
1161         if (eth_proto == ETH_P_PAE &&
1162             priv->wpa.mic_failure.failure > 0) {
1163                 aa1x_hdr = (struct ieee802_1x_hdr *)(eth_hdr + 1);
1164                 if (aa1x_hdr->type == IEEE802_1X_TYPE_EAPOL_KEY) {
1165                         eap_key = (struct wpa_eapol_key *)(aa1x_hdr + 1);
1166                         keyinfo = ntohs(eap_key->key_info);
1167                 }
1168         }
1169
1170         if (priv->wpa.rsn_enabled && priv->wpa.key[0].key_len) {
1171                 /* no encryption */
1172                 if (eth_proto == ETH_P_PAE &&
1173                     priv->wpa.key[1].key_len == 0 &&
1174                     priv->wpa.key[2].key_len == 0 &&
1175                     priv->wpa.key[3].key_len == 0) {
1176                         pp->auth_type = cpu_to_le16(TYPE_AUTH);
1177                 } else {
1178                         if (priv->wpa.pairwise_suite == IW_AUTH_CIPHER_TKIP) {
1179                                 u8 mic[MICHAEL_MIC_LEN];
1180
1181                                 ret = michael_mic(priv->wpa.key[0].tx_mic_key,
1182                                                   &pp->data[0], skb_len,
1183                                                   0, mic);
1184                                 if (ret < 0)
1185                                         goto err_kfree;
1186
1187                                 memcpy(p, mic, sizeof(mic));
1188                                 length += sizeof(mic);
1189                                 skb_len += sizeof(mic);
1190                                 p += sizeof(mic);
1191                                 pp->auth_type =
1192                                     cpu_to_le16(TYPE_DATA);
1193                         } else if (priv->wpa.pairwise_suite ==
1194                                    IW_AUTH_CIPHER_CCMP) {
1195                                 pp->auth_type =
1196                                     cpu_to_le16(TYPE_DATA);
1197                         }
1198                 }
1199         } else {
1200                 if (eth_proto == ETH_P_PAE)
1201                         pp->auth_type = cpu_to_le16(TYPE_AUTH);
1202                 else
1203                         pp->auth_type = cpu_to_le16(TYPE_DATA);
1204         }
1205
1206         /* header value set */
1207         pp->header.size =
1208             cpu_to_le16((sizeof(*pp) - sizeof(pp->header.size) + skb_len));
1209         pp->header.event = cpu_to_le16(HIF_DATA_REQ);
1210
1211         /* tx request */
1212         result = ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp) + skb_len),
1213                                send_packet_complete, skb);
1214
1215         /* MIC FAILURE REPORT check */
1216         if (eth_proto == ETH_P_PAE &&
1217             priv->wpa.mic_failure.failure > 0) {
1218                 if (keyinfo & WPA_KEY_INFO_ERROR &&
1219                     keyinfo & WPA_KEY_INFO_REQUEST) {
1220                         netdev_err(priv->net_dev,
1221                                    "MIC ERROR Report SET : %04X\n", keyinfo);
1222                         hostif_sme_enqueue(priv, SME_MIC_FAILURE_REQUEST);
1223                 }
1224                 if (priv->wpa.mic_failure.failure == 2)
1225                         priv->wpa.mic_failure.stop = 1;
1226         }
1227
1228         return result;
1229
1230 err_kfree:
1231         kfree(pp);
1232 err_kfree_skb:
1233         dev_kfree_skb(skb);
1234
1235         return ret;
1236 }
1237
1238 static inline void ps_confirm_wait_inc(struct ks_wlan_private *priv)
1239 {
1240         if (atomic_read(&priv->psstatus.status) > PS_ACTIVE_SET)
1241                 atomic_inc(&priv->psstatus.confirm_wait);
1242 }
1243
1244 static inline void send_request_to_device(struct ks_wlan_private *priv,
1245                                           void *data, size_t size)
1246 {
1247         ps_confirm_wait_inc(priv);
1248         ks_wlan_hw_tx(priv, data, size, NULL, NULL);
1249 }
1250
1251 static void hostif_mib_get_request(struct ks_wlan_private *priv,
1252                                    u32 mib_attribute)
1253 {
1254         struct hostif_mib_get_request *pp;
1255
1256         pp = hostif_generic_request(sizeof(*pp), HIF_MIB_GET_REQ);
1257         if (!pp)
1258                 return;
1259
1260         pp->mib_attribute = cpu_to_le32(mib_attribute);
1261
1262         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1263 }
1264
1265 static void hostif_mib_set_request(struct ks_wlan_private *priv,
1266                                    enum mib_attribute attr,
1267                                    enum mib_data_type type,
1268                                    void *data, size_t size)
1269 {
1270         struct hostif_mib_set_request_t *pp;
1271
1272         if (priv->dev_state < DEVICE_STATE_BOOT)
1273                 return;
1274
1275         pp = hostif_generic_request(sizeof(*pp), HIF_MIB_SET_REQ);
1276         if (!pp)
1277                 return;
1278
1279         pp->mib_attribute = cpu_to_le32(attr);
1280         pp->mib_value.size = cpu_to_le16(size);
1281         pp->mib_value.type = cpu_to_le16(type);
1282         memcpy(&pp->mib_value.body, data, size);
1283
1284         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp) + size));
1285 }
1286
1287 static inline void hostif_mib_set_request_int(struct ks_wlan_private *priv,
1288                                               enum mib_attribute attr, int val)
1289 {
1290         __le32 v = cpu_to_le32(val);
1291         size_t size = sizeof(v);
1292
1293         hostif_mib_set_request(priv, attr, MIB_VALUE_TYPE_INT, &v, size);
1294 }
1295
1296 static inline void hostif_mib_set_request_bool(struct ks_wlan_private *priv,
1297                                                enum mib_attribute attr,
1298                                                bool val)
1299 {
1300         __le32 v = cpu_to_le32(val);
1301         size_t size = sizeof(v);
1302
1303         hostif_mib_set_request(priv, attr, MIB_VALUE_TYPE_BOOL, &v, size);
1304 }
1305
1306 static inline void hostif_mib_set_request_ostring(struct ks_wlan_private *priv,
1307                                                   enum mib_attribute attr,
1308                                                   void *data, size_t size)
1309 {
1310         hostif_mib_set_request(priv, attr, MIB_VALUE_TYPE_OSTRING, data, size);
1311 }
1312
1313 static
1314 void hostif_start_request(struct ks_wlan_private *priv, unsigned char mode)
1315 {
1316         struct hostif_start_request *pp;
1317
1318         pp = hostif_generic_request(sizeof(*pp), HIF_START_REQ);
1319         if (!pp)
1320                 return;
1321
1322         pp->mode = cpu_to_le16(mode);
1323
1324         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1325
1326         priv->aplist.size = 0;
1327         priv->scan_ind_count = 0;
1328 }
1329
1330 static __le16 ks_wlan_cap(struct ks_wlan_private *priv)
1331 {
1332         u16 capability = 0x0000;
1333
1334         if (priv->reg.preamble == SHORT_PREAMBLE)
1335                 capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1336
1337         capability &= ~(WLAN_CAPABILITY_PBCC);  /* pbcc not support */
1338
1339         if (priv->reg.phy_type != D_11B_ONLY_MODE) {
1340                 capability |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1341                 capability &= ~(WLAN_CAPABILITY_DSSS_OFDM);
1342         }
1343
1344         return cpu_to_le16(capability);
1345 }
1346
1347 static void init_request(struct ks_wlan_private *priv,
1348                          struct hostif_request *req)
1349 {
1350         req->phy_type = cpu_to_le16(priv->reg.phy_type);
1351         req->cts_mode = cpu_to_le16(priv->reg.cts_mode);
1352         req->scan_type = cpu_to_le16(priv->reg.scan_type);
1353         req->rate_set.size = priv->reg.rate_set.size;
1354         req->capability = ks_wlan_cap(priv);
1355         memcpy(&req->rate_set.body[0], &priv->reg.rate_set.body[0],
1356                priv->reg.rate_set.size);
1357 }
1358
1359 static
1360 void hostif_ps_adhoc_set_request(struct ks_wlan_private *priv)
1361 {
1362         struct hostif_ps_adhoc_set_request *pp;
1363
1364         pp = hostif_generic_request(sizeof(*pp), HIF_PS_ADH_SET_REQ);
1365         if (!pp)
1366                 return;
1367
1368         init_request(priv, &pp->request);
1369         pp->channel = cpu_to_le16(priv->reg.channel);
1370
1371         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1372 }
1373
1374 static
1375 void hostif_infrastructure_set_request(struct ks_wlan_private *priv, int event)
1376 {
1377         struct hostif_infrastructure_set_request *pp;
1378
1379         pp = hostif_generic_request(sizeof(*pp), event);
1380         if (!pp)
1381                 return;
1382
1383         init_request(priv, &pp->request);
1384         pp->ssid.size = priv->reg.ssid.size;
1385         memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1386         pp->beacon_lost_count =
1387             cpu_to_le16(priv->reg.beacon_lost_count);
1388         pp->auth_type = cpu_to_le16(priv->reg.authenticate_type);
1389
1390         pp->channel_list.body[0] = 1;
1391         pp->channel_list.body[1] = 8;
1392         pp->channel_list.body[2] = 2;
1393         pp->channel_list.body[3] = 9;
1394         pp->channel_list.body[4] = 3;
1395         pp->channel_list.body[5] = 10;
1396         pp->channel_list.body[6] = 4;
1397         pp->channel_list.body[7] = 11;
1398         pp->channel_list.body[8] = 5;
1399         pp->channel_list.body[9] = 12;
1400         pp->channel_list.body[10] = 6;
1401         pp->channel_list.body[11] = 13;
1402         pp->channel_list.body[12] = 7;
1403         if (priv->reg.phy_type == D_11G_ONLY_MODE) {
1404                 pp->channel_list.size = 13;
1405         } else {
1406                 pp->channel_list.body[13] = 14;
1407                 pp->channel_list.size = 14;
1408         }
1409
1410         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1411 }
1412
1413 static
1414 void hostif_adhoc_set_request(struct ks_wlan_private *priv)
1415 {
1416         struct hostif_adhoc_set_request *pp;
1417
1418         pp = hostif_generic_request(sizeof(*pp), HIF_ADH_SET_REQ);
1419         if (!pp)
1420                 return;
1421
1422         init_request(priv, &pp->request);
1423         pp->channel = cpu_to_le16(priv->reg.channel);
1424         pp->ssid.size = priv->reg.ssid.size;
1425         memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1426
1427         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1428 }
1429
1430 static
1431 void hostif_adhoc_set2_request(struct ks_wlan_private *priv)
1432 {
1433         struct hostif_adhoc_set2_request *pp;
1434
1435         pp = hostif_generic_request(sizeof(*pp), HIF_ADH_SET_REQ);
1436         if (!pp)
1437                 return;
1438
1439         init_request(priv, &pp->request);
1440         pp->ssid.size = priv->reg.ssid.size;
1441         memcpy(&pp->ssid.body[0], &priv->reg.ssid.body[0], priv->reg.ssid.size);
1442
1443         pp->channel_list.body[0] = priv->reg.channel;
1444         pp->channel_list.size = 1;
1445         memcpy(pp->bssid, priv->reg.bssid, ETH_ALEN);
1446
1447         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1448 }
1449
1450 static
1451 void hostif_stop_request(struct ks_wlan_private *priv)
1452 {
1453         struct hostif_stop_request *pp;
1454
1455         pp = hostif_generic_request(sizeof(*pp), HIF_STOP_REQ);
1456         if (!pp)
1457                 return;
1458
1459         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1460 }
1461
1462 static
1463 void hostif_phy_information_request(struct ks_wlan_private *priv)
1464 {
1465         struct hostif_phy_information_request *pp;
1466
1467         pp = hostif_generic_request(sizeof(*pp), HIF_PHY_INFO_REQ);
1468         if (!pp)
1469                 return;
1470
1471         if (priv->reg.phy_info_timer) {
1472                 pp->type = cpu_to_le16(TIME_TYPE);
1473                 pp->time = cpu_to_le16(priv->reg.phy_info_timer);
1474         } else {
1475                 pp->type = cpu_to_le16(NORMAL_TYPE);
1476                 pp->time = cpu_to_le16(0);
1477         }
1478
1479         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1480 }
1481
1482 static
1483 void hostif_power_mgmt_request(struct ks_wlan_private *priv,
1484                                u32 mode, u32 wake_up, u32 receive_dtims)
1485 {
1486         struct hostif_power_mgmt_request *pp;
1487
1488         pp = hostif_generic_request(sizeof(*pp), HIF_POWER_MGMT_REQ);
1489         if (!pp)
1490                 return;
1491
1492         pp->mode = cpu_to_le32(mode);
1493         pp->wake_up = cpu_to_le32(wake_up);
1494         pp->receive_dtims = cpu_to_le32(receive_dtims);
1495
1496         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1497 }
1498
1499 static
1500 void hostif_sleep_request(struct ks_wlan_private *priv,
1501                           enum sleep_mode_type mode)
1502 {
1503         struct hostif_sleep_request *pp;
1504
1505         if (mode == SLP_SLEEP) {
1506                 pp = hostif_generic_request(sizeof(*pp), HIF_SLEEP_REQ);
1507                 if (!pp)
1508                         return;
1509
1510                 send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1511         } else if (mode == SLP_ACTIVE) {
1512                 atomic_set(&priv->sleepstatus.wakeup_request, 1);
1513                 queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
1514         } else {
1515                 netdev_err(priv->net_dev, "invalid mode %ld\n", (long)mode);
1516                 return;
1517         }
1518 }
1519
1520 static
1521 void hostif_bss_scan_request(struct ks_wlan_private *priv,
1522                              unsigned long scan_type, u8 *scan_ssid,
1523                              u8 scan_ssid_len)
1524 {
1525         struct hostif_bss_scan_request *pp;
1526
1527         pp = hostif_generic_request(sizeof(*pp), HIF_SCAN_REQ);
1528         if (!pp)
1529                 return;
1530
1531         pp->scan_type = scan_type;
1532
1533         pp->ch_time_min = cpu_to_le32(110);     /* default value */
1534         pp->ch_time_max = cpu_to_le32(130);     /* default value */
1535         pp->channel_list.body[0] = 1;
1536         pp->channel_list.body[1] = 8;
1537         pp->channel_list.body[2] = 2;
1538         pp->channel_list.body[3] = 9;
1539         pp->channel_list.body[4] = 3;
1540         pp->channel_list.body[5] = 10;
1541         pp->channel_list.body[6] = 4;
1542         pp->channel_list.body[7] = 11;
1543         pp->channel_list.body[8] = 5;
1544         pp->channel_list.body[9] = 12;
1545         pp->channel_list.body[10] = 6;
1546         pp->channel_list.body[11] = 13;
1547         pp->channel_list.body[12] = 7;
1548         if (priv->reg.phy_type == D_11G_ONLY_MODE) {
1549                 pp->channel_list.size = 13;
1550         } else {
1551                 pp->channel_list.body[13] = 14;
1552                 pp->channel_list.size = 14;
1553         }
1554         pp->ssid.size = 0;
1555
1556         /* specified SSID SCAN */
1557         if (scan_ssid_len > 0 && scan_ssid_len <= 32) {
1558                 pp->ssid.size = scan_ssid_len;
1559                 memcpy(&pp->ssid.body[0], scan_ssid, scan_ssid_len);
1560         }
1561
1562         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1563
1564         priv->aplist.size = 0;
1565         priv->scan_ind_count = 0;
1566 }
1567
1568 static
1569 void hostif_mic_failure_request(struct ks_wlan_private *priv,
1570                                 u16 failure_count, u16 timer)
1571 {
1572         struct hostif_mic_failure_request *pp;
1573
1574         pp = hostif_generic_request(sizeof(*pp), HIF_MIC_FAILURE_REQ);
1575         if (!pp)
1576                 return;
1577
1578         pp->failure_count = cpu_to_le16(failure_count);
1579         pp->timer = cpu_to_le16(timer);
1580
1581         send_request_to_device(priv, pp, hif_align_size(sizeof(*pp)));
1582 }
1583
1584 /* Device I/O Receive indicate */
1585 static void devio_rec_ind(struct ks_wlan_private *priv, unsigned char *p,
1586                           unsigned int size)
1587 {
1588         if (!priv->is_device_open)
1589                 return;
1590
1591         spin_lock(&priv->dev_read_lock);
1592         priv->dev_data[atomic_read(&priv->rec_count)] = p;
1593         priv->dev_size[atomic_read(&priv->rec_count)] = size;
1594
1595         if (atomic_read(&priv->event_count) != DEVICE_STOCK_COUNT) {
1596                 /* rx event count inc */
1597                 atomic_inc(&priv->event_count);
1598         }
1599         atomic_inc(&priv->rec_count);
1600         if (atomic_read(&priv->rec_count) == DEVICE_STOCK_COUNT)
1601                 atomic_set(&priv->rec_count, 0);
1602
1603         wake_up_interruptible_all(&priv->devread_wait);
1604
1605         spin_unlock(&priv->dev_read_lock);
1606 }
1607
1608 void hostif_receive(struct ks_wlan_private *priv, unsigned char *p,
1609                     unsigned int size)
1610 {
1611         devio_rec_ind(priv, p, size);
1612
1613         priv->rxp = p;
1614         priv->rx_size = size;
1615
1616         if (get_word(priv) == priv->rx_size)
1617                 hostif_event_check(priv);
1618 }
1619
1620 static void hostif_sme_set_wep(struct ks_wlan_private *priv, int type)
1621 {
1622         switch (type) {
1623         case SME_WEP_INDEX_REQUEST:
1624                 hostif_mib_set_request_int(priv, DOT11_WEP_DEFAULT_KEY_ID,
1625                                            priv->reg.wep_index);
1626                 break;
1627         case SME_WEP_KEY1_REQUEST:
1628                 if (priv->wpa.wpa_enabled)
1629                         return;
1630                 hostif_mib_set_request_ostring(priv,
1631                                                DOT11_WEP_DEFAULT_KEY_VALUE1,
1632                                                &priv->reg.wep_key[0].val[0],
1633                                                priv->reg.wep_key[0].size);
1634                 break;
1635         case SME_WEP_KEY2_REQUEST:
1636                 if (priv->wpa.wpa_enabled)
1637                         return;
1638                 hostif_mib_set_request_ostring(priv,
1639                                                DOT11_WEP_DEFAULT_KEY_VALUE2,
1640                                                &priv->reg.wep_key[1].val[0],
1641                                                priv->reg.wep_key[1].size);
1642                 break;
1643         case SME_WEP_KEY3_REQUEST:
1644                 if (priv->wpa.wpa_enabled)
1645                         return;
1646                 hostif_mib_set_request_ostring(priv,
1647                                                DOT11_WEP_DEFAULT_KEY_VALUE3,
1648                                                &priv->reg.wep_key[2].val[0],
1649                                                priv->reg.wep_key[2].size);
1650                 break;
1651         case SME_WEP_KEY4_REQUEST:
1652                 if (priv->wpa.wpa_enabled)
1653                         return;
1654                 hostif_mib_set_request_ostring(priv,
1655                                                DOT11_WEP_DEFAULT_KEY_VALUE4,
1656                                                &priv->reg.wep_key[3].val[0],
1657                                                priv->reg.wep_key[3].size);
1658                 break;
1659         case SME_WEP_FLAG_REQUEST:
1660                 hostif_mib_set_request_bool(priv, DOT11_PRIVACY_INVOKED,
1661                                             priv->reg.privacy_invoked);
1662                 break;
1663         }
1664 }
1665
1666 struct wpa_suite {
1667         __le16 size;
1668         unsigned char suite[4][CIPHER_ID_LEN];
1669 } __packed;
1670
1671 struct rsn_mode {
1672         __le32 rsn_mode;
1673         __le16 rsn_capability;
1674 } __packed;
1675
1676 static void hostif_sme_set_rsn(struct ks_wlan_private *priv, int type)
1677 {
1678         struct wpa_suite wpa_suite;
1679         struct rsn_mode rsn_mode;
1680         size_t size;
1681         u32 mode;
1682         const u8 *buf = NULL;
1683
1684         memset(&wpa_suite, 0, sizeof(wpa_suite));
1685
1686         switch (type) {
1687         case SME_RSN_UCAST_REQUEST:
1688                 wpa_suite.size = cpu_to_le16(1);
1689                 switch (priv->wpa.pairwise_suite) {
1690                 case IW_AUTH_CIPHER_NONE:
1691                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1692                                 CIPHER_ID_WPA2_NONE : CIPHER_ID_WPA_NONE;
1693                         break;
1694                 case IW_AUTH_CIPHER_WEP40:
1695                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1696                                 CIPHER_ID_WPA2_WEP40 : CIPHER_ID_WPA_WEP40;
1697                         break;
1698                 case IW_AUTH_CIPHER_TKIP:
1699                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1700                                 CIPHER_ID_WPA2_TKIP : CIPHER_ID_WPA_TKIP;
1701                         break;
1702                 case IW_AUTH_CIPHER_CCMP:
1703                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1704                                 CIPHER_ID_WPA2_CCMP : CIPHER_ID_WPA_CCMP;
1705                         break;
1706                 case IW_AUTH_CIPHER_WEP104:
1707                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1708                                 CIPHER_ID_WPA2_WEP104 : CIPHER_ID_WPA_WEP104;
1709                         break;
1710                 }
1711
1712                 if (buf)
1713                         memcpy(&wpa_suite.suite[0][0], buf, CIPHER_ID_LEN);
1714                 size = sizeof(wpa_suite.size) +
1715                        (CIPHER_ID_LEN * le16_to_cpu(wpa_suite.size));
1716                 hostif_mib_set_request_ostring(priv,
1717                                                DOT11_RSN_CONFIG_UNICAST_CIPHER,
1718                                                &wpa_suite, size);
1719                 break;
1720         case SME_RSN_MCAST_REQUEST:
1721                 switch (priv->wpa.group_suite) {
1722                 case IW_AUTH_CIPHER_NONE:
1723                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1724                                 CIPHER_ID_WPA2_NONE : CIPHER_ID_WPA_NONE;
1725                         break;
1726                 case IW_AUTH_CIPHER_WEP40:
1727                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1728                                 CIPHER_ID_WPA2_WEP40 : CIPHER_ID_WPA_WEP40;
1729                         break;
1730                 case IW_AUTH_CIPHER_TKIP:
1731                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1732                                 CIPHER_ID_WPA2_TKIP : CIPHER_ID_WPA_TKIP;
1733                         break;
1734                 case IW_AUTH_CIPHER_CCMP:
1735                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1736                                 CIPHER_ID_WPA2_CCMP : CIPHER_ID_WPA_CCMP;
1737                         break;
1738                 case IW_AUTH_CIPHER_WEP104:
1739                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1740                                 CIPHER_ID_WPA2_WEP104 : CIPHER_ID_WPA_WEP104;
1741                         break;
1742                 }
1743                 if (buf)
1744                         memcpy(&wpa_suite.suite[0][0], buf, CIPHER_ID_LEN);
1745                 hostif_mib_set_request_ostring(priv,
1746                                                DOT11_RSN_CONFIG_MULTICAST_CIPHER,
1747                                                &wpa_suite.suite[0][0],
1748                                                CIPHER_ID_LEN);
1749                 break;
1750         case SME_RSN_AUTH_REQUEST:
1751                 wpa_suite.size = cpu_to_le16(1);
1752                 switch (priv->wpa.key_mgmt_suite) {
1753                 case IW_AUTH_KEY_MGMT_802_1X:
1754                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1755                                 KEY_MGMT_ID_WPA2_1X : KEY_MGMT_ID_WPA_1X;
1756                         break;
1757                 case IW_AUTH_KEY_MGMT_PSK:
1758                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1759                                 KEY_MGMT_ID_WPA2_PSK : KEY_MGMT_ID_WPA_PSK;
1760                         break;
1761                 case 0:
1762                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1763                                 KEY_MGMT_ID_WPA2_NONE : KEY_MGMT_ID_WPA_NONE;
1764                         break;
1765                 case 4:
1766                         buf = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1767                                 KEY_MGMT_ID_WPA2_WPANONE :
1768                                 KEY_MGMT_ID_WPA_WPANONE;
1769                         break;
1770                 }
1771
1772                 if (buf)
1773                         memcpy(&wpa_suite.suite[0][0], buf, KEY_MGMT_ID_LEN);
1774                 size = sizeof(wpa_suite.size) +
1775                        (KEY_MGMT_ID_LEN * le16_to_cpu(wpa_suite.size));
1776                 hostif_mib_set_request_ostring(priv,
1777                                                DOT11_RSN_CONFIG_AUTH_SUITE,
1778                                                &wpa_suite, size);
1779                 break;
1780         case SME_RSN_ENABLED_REQUEST:
1781                 hostif_mib_set_request_bool(priv, DOT11_RSN_ENABLED,
1782                                             priv->wpa.rsn_enabled);
1783                 break;
1784         case SME_RSN_MODE_REQUEST:
1785                 mode = (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA2) ?
1786                         RSN_MODE_WPA2 :
1787                         (priv->wpa.version == IW_AUTH_WPA_VERSION_WPA) ?
1788                          RSN_MODE_WPA : RSN_MODE_NONE;
1789                 rsn_mode.rsn_mode = cpu_to_le32(mode);
1790                 rsn_mode.rsn_capability = cpu_to_le16(0);
1791                 hostif_mib_set_request_ostring(priv, LOCAL_RSN_MODE,
1792                                                &rsn_mode, sizeof(rsn_mode));
1793                 break;
1794         }
1795 }
1796
1797 static
1798 void hostif_sme_mode_setup(struct ks_wlan_private *priv)
1799 {
1800         unsigned char rate_size;
1801         unsigned char rate_octet[RATE_SET_MAX_SIZE];
1802         int i = 0;
1803
1804         /* rate setting if rate segging is auto for changing phy_type (#94) */
1805         if (priv->reg.tx_rate == TX_RATE_FULL_AUTO) {
1806                 if (priv->reg.phy_type == D_11B_ONLY_MODE) {
1807                         priv->reg.rate_set.body[3] = TX_RATE_11M;
1808                         priv->reg.rate_set.body[2] = TX_RATE_5M;
1809                         priv->reg.rate_set.body[1] = TX_RATE_2M | BASIC_RATE;
1810                         priv->reg.rate_set.body[0] = TX_RATE_1M | BASIC_RATE;
1811                         priv->reg.rate_set.size = 4;
1812                 } else {        /* D_11G_ONLY_MODE or D_11BG_COMPATIBLE_MODE */
1813                         priv->reg.rate_set.body[11] = TX_RATE_54M;
1814                         priv->reg.rate_set.body[10] = TX_RATE_48M;
1815                         priv->reg.rate_set.body[9] = TX_RATE_36M;
1816                         priv->reg.rate_set.body[8] = TX_RATE_18M;
1817                         priv->reg.rate_set.body[7] = TX_RATE_9M;
1818                         priv->reg.rate_set.body[6] = TX_RATE_24M | BASIC_RATE;
1819                         priv->reg.rate_set.body[5] = TX_RATE_12M | BASIC_RATE;
1820                         priv->reg.rate_set.body[4] = TX_RATE_6M | BASIC_RATE;
1821                         priv->reg.rate_set.body[3] = TX_RATE_11M | BASIC_RATE;
1822                         priv->reg.rate_set.body[2] = TX_RATE_5M | BASIC_RATE;
1823                         priv->reg.rate_set.body[1] = TX_RATE_2M | BASIC_RATE;
1824                         priv->reg.rate_set.body[0] = TX_RATE_1M | BASIC_RATE;
1825                         priv->reg.rate_set.size = 12;
1826                 }
1827         }
1828
1829         /* rate mask by phy setting */
1830         if (priv->reg.phy_type == D_11B_ONLY_MODE) {
1831                 for (i = 0; i < priv->reg.rate_set.size; i++) {
1832                         if (!is_11b_rate(priv->reg.rate_set.body[i]))
1833                                 break;
1834
1835                         if ((priv->reg.rate_set.body[i] & RATE_MASK) >= TX_RATE_5M) {
1836                                 rate_octet[i] = priv->reg.rate_set.body[i] &
1837                                                 RATE_MASK;
1838                         } else {
1839                                 rate_octet[i] = priv->reg.rate_set.body[i];
1840                         }
1841                 }
1842
1843         } else {        /* D_11G_ONLY_MODE or D_11BG_COMPATIBLE_MODE */
1844                 for (i = 0; i < priv->reg.rate_set.size; i++) {
1845                         if (!is_11bg_rate(priv->reg.rate_set.body[i]))
1846                                 break;
1847
1848                         if (is_ofdm_ext_rate(priv->reg.rate_set.body[i])) {
1849                                 rate_octet[i] = priv->reg.rate_set.body[i] &
1850                                                 RATE_MASK;
1851                         } else {
1852                                 rate_octet[i] = priv->reg.rate_set.body[i];
1853                         }
1854                 }
1855         }
1856         rate_size = i;
1857         if (rate_size == 0) {
1858                 if (priv->reg.phy_type == D_11G_ONLY_MODE)
1859                         rate_octet[0] = TX_RATE_6M | BASIC_RATE;
1860                 else
1861                         rate_octet[0] = TX_RATE_2M | BASIC_RATE;
1862                 rate_size = 1;
1863         }
1864
1865         /* rate set update */
1866         priv->reg.rate_set.size = rate_size;
1867         memcpy(&priv->reg.rate_set.body[0], &rate_octet[0], rate_size);
1868
1869         switch (priv->reg.operation_mode) {
1870         case MODE_PSEUDO_ADHOC:
1871                 hostif_ps_adhoc_set_request(priv);
1872                 break;
1873         case MODE_INFRASTRUCTURE:
1874                 if (!is_valid_ether_addr((u8 *)priv->reg.bssid)) {
1875                         hostif_infrastructure_set_request(priv,
1876                                                           HIF_INFRA_SET_REQ);
1877                 } else {
1878                         hostif_infrastructure_set_request(priv,
1879                                                           HIF_INFRA_SET2_REQ);
1880                         netdev_dbg(priv->net_dev,
1881                                    "Infra bssid = %pM\n", priv->reg.bssid);
1882                 }
1883                 break;
1884         case MODE_ADHOC:
1885                 if (!is_valid_ether_addr((u8 *)priv->reg.bssid)) {
1886                         hostif_adhoc_set_request(priv);
1887                 } else {
1888                         hostif_adhoc_set2_request(priv);
1889                         netdev_dbg(priv->net_dev,
1890                                    "Adhoc bssid = %pM\n", priv->reg.bssid);
1891                 }
1892                 break;
1893         default:
1894                 break;
1895         }
1896 }
1897
1898 static
1899 void hostif_sme_multicast_set(struct ks_wlan_private *priv)
1900 {
1901         struct net_device *dev = priv->net_dev;
1902         int mc_count;
1903         struct netdev_hw_addr *ha;
1904         char set_address[NIC_MAX_MCAST_LIST * ETH_ALEN];
1905         int i = 0;
1906
1907         spin_lock(&priv->multicast_spin);
1908
1909         memset(set_address, 0, NIC_MAX_MCAST_LIST * ETH_ALEN);
1910
1911         if (dev->flags & IFF_PROMISC) {
1912                 hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
1913                                            MCAST_FILTER_PROMISC);
1914                 goto spin_unlock;
1915         }
1916
1917         if ((netdev_mc_count(dev) > NIC_MAX_MCAST_LIST) ||
1918             (dev->flags & IFF_ALLMULTI)) {
1919                 hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
1920                                            MCAST_FILTER_MCASTALL);
1921                 goto spin_unlock;
1922         }
1923
1924         if (priv->sme_i.sme_flag & SME_MULTICAST) {
1925                 mc_count = netdev_mc_count(dev);
1926                 netdev_for_each_mc_addr(ha, dev) {
1927                         ether_addr_copy(&set_address[i * ETH_ALEN], ha->addr);
1928                         i++;
1929                 }
1930                 priv->sme_i.sme_flag &= ~SME_MULTICAST;
1931                 hostif_mib_set_request_ostring(priv, LOCAL_MULTICAST_ADDRESS,
1932                                                &set_address[0],
1933                                                ETH_ALEN * mc_count);
1934         } else {
1935                 priv->sme_i.sme_flag |= SME_MULTICAST;
1936                 hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
1937                                            MCAST_FILTER_MCAST);
1938         }
1939
1940 spin_unlock:
1941         spin_unlock(&priv->multicast_spin);
1942 }
1943
1944 static void hostif_sme_power_mgmt_set(struct ks_wlan_private *priv)
1945 {
1946         u32 mode, wake_up, receive_dtims;
1947
1948         if (priv->reg.power_mgmt != POWER_MGMT_SAVE1 &&
1949             priv->reg.power_mgmt != POWER_MGMT_SAVE2) {
1950                 mode = POWER_ACTIVE;
1951                 wake_up = 0;
1952                 receive_dtims = 0;
1953         } else {
1954                 mode = (priv->reg.operation_mode == MODE_INFRASTRUCTURE) ?
1955                         POWER_SAVE : POWER_ACTIVE;
1956                 wake_up = 0;
1957                 receive_dtims = (priv->reg.operation_mode == MODE_INFRASTRUCTURE &&
1958                                  priv->reg.power_mgmt == POWER_MGMT_SAVE2);
1959         }
1960
1961         hostif_power_mgmt_request(priv, mode, wake_up, receive_dtims);
1962 }
1963
1964 static void hostif_sme_sleep_set(struct ks_wlan_private *priv)
1965 {
1966         if (priv->sleep_mode != SLP_SLEEP &&
1967             priv->sleep_mode != SLP_ACTIVE)
1968                 return;
1969
1970         hostif_sleep_request(priv, priv->sleep_mode);
1971 }
1972
1973 static
1974 void hostif_sme_set_key(struct ks_wlan_private *priv, int type)
1975 {
1976         switch (type) {
1977         case SME_SET_FLAG:
1978                 hostif_mib_set_request_bool(priv, DOT11_PRIVACY_INVOKED,
1979                                             priv->reg.privacy_invoked);
1980                 break;
1981         case SME_SET_TXKEY:
1982                 hostif_mib_set_request_int(priv, DOT11_WEP_DEFAULT_KEY_ID,
1983                                            priv->wpa.txkey);
1984                 break;
1985         case SME_SET_KEY1:
1986                 hostif_mib_set_request_ostring(priv,
1987                                                DOT11_WEP_DEFAULT_KEY_VALUE1,
1988                                                &priv->wpa.key[0].key_val[0],
1989                                                priv->wpa.key[0].key_len);
1990                 break;
1991         case SME_SET_KEY2:
1992                 hostif_mib_set_request_ostring(priv,
1993                                                DOT11_WEP_DEFAULT_KEY_VALUE2,
1994                                                &priv->wpa.key[1].key_val[0],
1995                                                priv->wpa.key[1].key_len);
1996                 break;
1997         case SME_SET_KEY3:
1998                 hostif_mib_set_request_ostring(priv,
1999                                                DOT11_WEP_DEFAULT_KEY_VALUE3,
2000                                                &priv->wpa.key[2].key_val[0],
2001                                                priv->wpa.key[2].key_len);
2002                 break;
2003         case SME_SET_KEY4:
2004                 hostif_mib_set_request_ostring(priv,
2005                                                DOT11_WEP_DEFAULT_KEY_VALUE4,
2006                                                &priv->wpa.key[3].key_val[0],
2007                                                priv->wpa.key[3].key_len);
2008                 break;
2009         case SME_SET_PMK_TSC:
2010                 hostif_mib_set_request_ostring(priv, DOT11_PMK_TSC,
2011                                                &priv->wpa.key[0].rx_seq[0],
2012                                                WPA_RX_SEQ_LEN);
2013                 break;
2014         case SME_SET_GMK1_TSC:
2015                 hostif_mib_set_request_ostring(priv, DOT11_GMK1_TSC,
2016                                                &priv->wpa.key[1].rx_seq[0],
2017                                                WPA_RX_SEQ_LEN);
2018                 break;
2019         case SME_SET_GMK2_TSC:
2020                 hostif_mib_set_request_ostring(priv, DOT11_GMK2_TSC,
2021                                                &priv->wpa.key[2].rx_seq[0],
2022                                                WPA_RX_SEQ_LEN);
2023                 break;
2024         }
2025 }
2026
2027 static
2028 void hostif_sme_set_pmksa(struct ks_wlan_private *priv)
2029 {
2030         struct pmk_cache {
2031                 __le16 size;
2032                 struct {
2033                         u8 bssid[ETH_ALEN];
2034                         u8 pmkid[IW_PMKID_LEN];
2035                 } __packed list[PMK_LIST_MAX];
2036         } __packed pmkcache;
2037         struct pmk *pmk;
2038         size_t size;
2039         int i = 0;
2040
2041         list_for_each_entry(pmk, &priv->pmklist.head, list) {
2042                 if (i >= PMK_LIST_MAX)
2043                         break;
2044                 ether_addr_copy(pmkcache.list[i].bssid, pmk->bssid);
2045                 memcpy(pmkcache.list[i].pmkid, pmk->pmkid, IW_PMKID_LEN);
2046                 i++;
2047         }
2048         pmkcache.size = cpu_to_le16(priv->pmklist.size);
2049         size = sizeof(priv->pmklist.size) +
2050                ((ETH_ALEN + IW_PMKID_LEN) * priv->pmklist.size);
2051         hostif_mib_set_request_ostring(priv, LOCAL_PMK, &pmkcache, size);
2052 }
2053
2054 /* execute sme */
2055 static void hostif_sme_execute(struct ks_wlan_private *priv, int event)
2056 {
2057         u16 failure;
2058
2059         switch (event) {
2060         case SME_START:
2061                 if (priv->dev_state == DEVICE_STATE_BOOT)
2062                         hostif_mib_get_request(priv, DOT11_MAC_ADDRESS);
2063                 break;
2064         case SME_MULTICAST_REQUEST:
2065                 hostif_sme_multicast_set(priv);
2066                 break;
2067         case SME_MACADDRESS_SET_REQUEST:
2068                 hostif_mib_set_request_ostring(priv, LOCAL_CURRENTADDRESS,
2069                                                &priv->eth_addr[0], ETH_ALEN);
2070                 break;
2071         case SME_BSS_SCAN_REQUEST:
2072                 hostif_bss_scan_request(priv, priv->reg.scan_type,
2073                                         priv->scan_ssid, priv->scan_ssid_len);
2074                 break;
2075         case SME_POW_MNGMT_REQUEST:
2076                 hostif_sme_power_mgmt_set(priv);
2077                 break;
2078         case SME_PHY_INFO_REQUEST:
2079                 hostif_phy_information_request(priv);
2080                 break;
2081         case SME_MIC_FAILURE_REQUEST:
2082                 failure = priv->wpa.mic_failure.failure;
2083                 if (failure != 1 && failure != 2) {
2084                         netdev_err(priv->net_dev,
2085                                    "SME_MIC_FAILURE_REQUEST: failure count=%u error?\n",
2086                                    failure);
2087                         return;
2088                 }
2089                 hostif_mic_failure_request(priv, failure - 1, (failure == 1) ?
2090                                             0 : priv->wpa.mic_failure.counter);
2091                 break;
2092         case SME_MIC_FAILURE_CONFIRM:
2093                 if (priv->wpa.mic_failure.failure == 2) {
2094                         if (priv->wpa.mic_failure.stop)
2095                                 priv->wpa.mic_failure.stop = 0;
2096                         priv->wpa.mic_failure.failure = 0;
2097                         hostif_start_request(priv, priv->reg.operation_mode);
2098                 }
2099                 break;
2100         case SME_GET_MAC_ADDRESS:
2101                 if (priv->dev_state == DEVICE_STATE_BOOT)
2102                         hostif_mib_get_request(priv, DOT11_PRODUCT_VERSION);
2103                 break;
2104         case SME_GET_PRODUCT_VERSION:
2105                 if (priv->dev_state == DEVICE_STATE_BOOT)
2106                         priv->dev_state = DEVICE_STATE_PREINIT;
2107                 break;
2108         case SME_STOP_REQUEST:
2109                 hostif_stop_request(priv);
2110                 break;
2111         case SME_RTS_THRESHOLD_REQUEST:
2112                 hostif_mib_set_request_int(priv, DOT11_RTS_THRESHOLD,
2113                                            priv->reg.rts);
2114                 break;
2115         case SME_FRAGMENTATION_THRESHOLD_REQUEST:
2116                 hostif_mib_set_request_int(priv, DOT11_FRAGMENTATION_THRESHOLD,
2117                                            priv->reg.fragment);
2118                 break;
2119         case SME_WEP_INDEX_REQUEST:
2120         case SME_WEP_KEY1_REQUEST:
2121         case SME_WEP_KEY2_REQUEST:
2122         case SME_WEP_KEY3_REQUEST:
2123         case SME_WEP_KEY4_REQUEST:
2124         case SME_WEP_FLAG_REQUEST:
2125                 hostif_sme_set_wep(priv, event);
2126                 break;
2127         case SME_RSN_UCAST_REQUEST:
2128         case SME_RSN_MCAST_REQUEST:
2129         case SME_RSN_AUTH_REQUEST:
2130         case SME_RSN_ENABLED_REQUEST:
2131         case SME_RSN_MODE_REQUEST:
2132                 hostif_sme_set_rsn(priv, event);
2133                 break;
2134         case SME_SET_FLAG:
2135         case SME_SET_TXKEY:
2136         case SME_SET_KEY1:
2137         case SME_SET_KEY2:
2138         case SME_SET_KEY3:
2139         case SME_SET_KEY4:
2140         case SME_SET_PMK_TSC:
2141         case SME_SET_GMK1_TSC:
2142         case SME_SET_GMK2_TSC:
2143                 hostif_sme_set_key(priv, event);
2144                 break;
2145         case SME_SET_PMKSA:
2146                 hostif_sme_set_pmksa(priv);
2147                 break;
2148         case SME_WPS_ENABLE_REQUEST:
2149                 hostif_mib_set_request_int(priv, LOCAL_WPS_ENABLE,
2150                                            priv->wps.wps_enabled);
2151                 break;
2152         case SME_WPS_PROBE_REQUEST:
2153                 hostif_mib_set_request_ostring(priv, LOCAL_WPS_PROBE_REQ,
2154                                                priv->wps.ie, priv->wps.ielen);
2155                 break;
2156         case SME_MODE_SET_REQUEST:
2157                 hostif_sme_mode_setup(priv);
2158                 break;
2159         case SME_SET_GAIN:
2160                 hostif_mib_set_request_ostring(priv, LOCAL_GAIN,
2161                                                &priv->gain, sizeof(priv->gain));
2162                 break;
2163         case SME_GET_GAIN:
2164                 hostif_mib_get_request(priv, LOCAL_GAIN);
2165                 break;
2166         case SME_GET_EEPROM_CKSUM:
2167                 priv->eeprom_checksum = EEPROM_FW_NOT_SUPPORT;  /* initialize */
2168                 hostif_mib_get_request(priv, LOCAL_EEPROM_SUM);
2169                 break;
2170         case SME_START_REQUEST:
2171                 hostif_start_request(priv, priv->reg.operation_mode);
2172                 break;
2173         case SME_START_CONFIRM:
2174                 /* for power save */
2175                 atomic_set(&priv->psstatus.snooze_guard, 0);
2176                 atomic_set(&priv->psstatus.confirm_wait, 0);
2177                 if (priv->dev_state == DEVICE_STATE_PREINIT)
2178                         priv->dev_state = DEVICE_STATE_INIT;
2179                 /* wake_up_interruptible_all(&priv->confirm_wait); */
2180                 complete(&priv->confirm_wait);
2181                 break;
2182         case SME_SLEEP_REQUEST:
2183                 hostif_sme_sleep_set(priv);
2184                 break;
2185         case SME_SET_REGION:
2186                 hostif_mib_set_request_int(priv, LOCAL_REGION, priv->region);
2187                 break;
2188         case SME_MULTICAST_CONFIRM:
2189         case SME_BSS_SCAN_CONFIRM:
2190         case SME_POW_MNGMT_CONFIRM:
2191         case SME_PHY_INFO_CONFIRM:
2192         case SME_STOP_CONFIRM:
2193         case SME_RTS_THRESHOLD_CONFIRM:
2194         case SME_FRAGMENTATION_THRESHOLD_CONFIRM:
2195         case SME_WEP_INDEX_CONFIRM:
2196         case SME_WEP_KEY1_CONFIRM:
2197         case SME_WEP_KEY2_CONFIRM:
2198         case SME_WEP_KEY3_CONFIRM:
2199         case SME_WEP_KEY4_CONFIRM:
2200         case SME_WEP_FLAG_CONFIRM:
2201         case SME_RSN_UCAST_CONFIRM:
2202         case SME_RSN_MCAST_CONFIRM:
2203         case SME_RSN_AUTH_CONFIRM:
2204         case SME_RSN_ENABLED_CONFIRM:
2205         case SME_RSN_MODE_CONFIRM:
2206         case SME_MODE_SET_CONFIRM:
2207         case SME_TERMINATE:
2208         default:
2209                 break;
2210         }
2211 }
2212
2213 static
2214 void hostif_sme_task(unsigned long dev)
2215 {
2216         struct ks_wlan_private *priv = (struct ks_wlan_private *)dev;
2217
2218         if (priv->dev_state < DEVICE_STATE_BOOT)
2219                 return;
2220
2221         if (cnt_smeqbody(priv) <= 0)
2222                 return;
2223
2224         hostif_sme_execute(priv, priv->sme_i.event_buff[priv->sme_i.qhead]);
2225         inc_smeqhead(priv);
2226         if (cnt_smeqbody(priv) > 0)
2227                 tasklet_schedule(&priv->sme_task);
2228 }
2229
2230 /* send to Station Management Entity module */
2231 void hostif_sme_enqueue(struct ks_wlan_private *priv, u16 event)
2232 {
2233         /* enqueue sme event */
2234         if (cnt_smeqbody(priv) < (SME_EVENT_BUFF_SIZE - 1)) {
2235                 priv->sme_i.event_buff[priv->sme_i.qtail] = event;
2236                 inc_smeqtail(priv);
2237         } else {
2238                 /* in case of buffer overflow */
2239                 netdev_err(priv->net_dev, "sme queue buffer overflow\n");
2240         }
2241
2242         tasklet_schedule(&priv->sme_task);
2243 }
2244
2245 static inline void hostif_aplist_init(struct ks_wlan_private *priv)
2246 {
2247         size_t size = LOCAL_APLIST_MAX * sizeof(struct local_ap);
2248
2249         priv->aplist.size = 0;
2250         memset(&priv->aplist.ap[0], 0, size);
2251 }
2252
2253 static inline void hostif_status_init(struct ks_wlan_private *priv)
2254 {
2255         priv->infra_status = 0;
2256         priv->current_rate = 4;
2257         priv->connect_status = DISCONNECT_STATUS;
2258 }
2259
2260 static inline void hostif_sme_init(struct ks_wlan_private *priv)
2261 {
2262         priv->sme_i.sme_status = SME_IDLE;
2263         priv->sme_i.qhead = 0;
2264         priv->sme_i.qtail = 0;
2265         spin_lock_init(&priv->sme_i.sme_spin);
2266         priv->sme_i.sme_flag = 0;
2267         tasklet_init(&priv->sme_task, hostif_sme_task, (unsigned long)priv);
2268 }
2269
2270 static inline void hostif_wpa_init(struct ks_wlan_private *priv)
2271 {
2272         memset(&priv->wpa, 0, sizeof(priv->wpa));
2273         priv->wpa.rsn_enabled = false;
2274         priv->wpa.mic_failure.failure = 0;
2275         priv->wpa.mic_failure.last_failure_time = 0;
2276         priv->wpa.mic_failure.stop = 0;
2277 }
2278
2279 static inline void hostif_power_save_init(struct ks_wlan_private *priv)
2280 {
2281         atomic_set(&priv->psstatus.status, PS_NONE);
2282         atomic_set(&priv->psstatus.confirm_wait, 0);
2283         atomic_set(&priv->psstatus.snooze_guard, 0);
2284         init_completion(&priv->psstatus.wakeup_wait);
2285         INIT_WORK(&priv->wakeup_work, ks_wlan_hw_wakeup_task);
2286 }
2287
2288 static inline void hostif_pmklist_init(struct ks_wlan_private *priv)
2289 {
2290         int i;
2291
2292         memset(&priv->pmklist, 0, sizeof(priv->pmklist));
2293         INIT_LIST_HEAD(&priv->pmklist.head);
2294         for (i = 0; i < PMK_LIST_MAX; i++)
2295                 INIT_LIST_HEAD(&priv->pmklist.pmk[i].list);
2296 }
2297
2298 static inline void hostif_counters_init(struct ks_wlan_private *priv)
2299 {
2300         priv->dev_count = 0;
2301         atomic_set(&priv->event_count, 0);
2302         atomic_set(&priv->rec_count, 0);
2303 }
2304
2305 int hostif_init(struct ks_wlan_private *priv)
2306 {
2307         hostif_aplist_init(priv);
2308         hostif_status_init(priv);
2309
2310         spin_lock_init(&priv->multicast_spin);
2311         spin_lock_init(&priv->dev_read_lock);
2312         init_waitqueue_head(&priv->devread_wait);
2313
2314         hostif_counters_init(priv);
2315         hostif_power_save_init(priv);
2316         hostif_wpa_init(priv);
2317         hostif_pmklist_init(priv);
2318         hostif_sme_init(priv);
2319
2320         return 0;
2321 }
2322
2323 void hostif_exit(struct ks_wlan_private *priv)
2324 {
2325         tasklet_kill(&priv->sme_task);
2326 }