// SPDX-License-Identifier: GPL-2.0
/******************************************************************************
 *
 * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
 *
 ******************************************************************************/
#include <drv_types.h>
#include <rtw_wifi_regd.h>
#include <hal_btcoex.h>
#include <linux/kernel.h>
#include <linux/unaligned.h>

static struct mlme_handler mlme_sta_tbl[] = {
        {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
        {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
        {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
        {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
        {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
        {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},

        /* below 2 are reserved */
        {0,                                     "DoReserved",           &DoReserved},
        {0,                                     "DoReserved",           &DoReserved},
        {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
        {WIFI_ATIM,                     "OnATIM",               &OnAtim},
        {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
        {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
        {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
        {WIFI_ACTION,           "OnAction",             &OnAction},
        {WIFI_ACTION_NOACK, "OnActionNoAck",    &OnAction},
};

static struct action_handler OnAction_tbl[] = {
        {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
        {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &DoReserved},
        {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &DoReserved},
        {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
        {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
        {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
        {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
        {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
        {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &OnAction_sa_query},
        {RTW_WLAN_CATEGORY_UNPROTECTED_WNM, "ACTION_UNPROTECTED_WNM", &DoReserved},
        {RTW_WLAN_CATEGORY_SELF_PROTECTED, "ACTION_SELF_PROTECTED", &DoReserved},
        {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &DoReserved},
        {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &DoReserved},
};

static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};

/* OUI definitions for the vendor specific IE */
unsigned char RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
unsigned char WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
unsigned char P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
unsigned char WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};

unsigned char WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
unsigned char WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};

static unsigned char REALTEK_96B_IE[] = {0x00, 0xe0, 0x4c, 0x02, 0x01, 0x20};

/* ChannelPlan definitions */
static struct rt_channel_plan_2g        RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
        {{10, 11, 12, 13}, 4},                                          /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x05, RT_CHANNEL_DOMAIN_2G_GLOBAL , Passive scan CH 12, 13, 14 */
        {{}, 0},                                                                /*  0x06, RT_CHANNEL_DOMAIN_2G_NULL */
};

static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
        /*  0x00 ~ 0x1F , Old Define ===== */
        {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
        {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
        {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
        {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
        {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
        {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
        {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
        {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
        {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
        {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
        {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
        {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
        {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
        {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
        {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
        {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
        {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
        {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
        {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
        {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
        {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
        {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
        {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
        {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
        {0x06}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
        {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
        {0x00}, /* 0x1A, */
        {0x00}, /* 0x1B, */
        {0x00}, /* 0x1C, */
        {0x00}, /* 0x1D, */
        {0x00}, /* 0x1E, */
        {0x06}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
        /*  0x20 ~ 0x7F , New Define ===== */
        {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
        {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
        {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
        {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
        {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
        {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
        {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
        {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
        {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
        {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
        {0x00}, /* 0x2A, */
        {0x00}, /* 0x2B, */
        {0x00}, /* 0x2C, */
        {0x00}, /* 0x2D, */
        {0x00}, /* 0x2E, */
        {0x00}, /* 0x2F, */
        {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
        {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
        {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
        {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
        {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
        {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
        {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
        {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
        {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
        {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
        {0x00}, /* 0x3A, */
        {0x00}, /* 0x3B, */
        {0x00}, /* 0x3C, */
        {0x00}, /* 0x3D, */
        {0x00}, /* 0x3E, */
        {0x00}, /* 0x3F, */
        {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
        {0x05}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */
        {0x01}, /* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */
        {0x02}, /* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */
        {0x02}, /* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */
        {0x00}, /* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */
        {0x02}, /* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */
        {0x00}, /* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */
        {0x00}, /* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */
        {0x00}, /* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */
        {0x00}, /* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */
        {0x00}, /* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */
        {0x00}, /* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */
        {0x02}, /* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */
        {0x00}, /* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */
        {0x02}, /* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */
        {0x00}, /* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */
        {0x02}, /* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */
};

 /* use the combination for max channel numbers */
static struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03};

/* Search the @param ch in given @param ch_set
 * @ch_set: the given channel set
 * @ch: the given channel number
 *
 * return the index of channel_num in channel_set, -1 if not found
 */
int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
{
        int i;

        for (i = 0; ch_set[i].ChannelNum != 0; i++) {
                if (ch == ch_set[i].ChannelNum)
                        break;
        }

        if (i >= ch_set[i].ChannelNum)
                return -1;
        return i;
}

/* Following are the initialization functions for WiFi MLME */

int init_hw_mlme_ext(struct adapter *padapter)
{
        struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
        return _SUCCESS;
}

void init_mlme_default_rate_set(struct adapter *padapter)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        unsigned char mixed_datarate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_, _48M_RATE_, _54M_RATE_, 0xff};
        unsigned char mixed_basicrate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _12M_RATE_, _24M_RATE_, 0xff,};
        unsigned char supported_mcs_set[16] = {0xff, 0xff, 0x00, 0x00, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};

        memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
        memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);

        memcpy(pmlmeext->default_supported_mcs_set, supported_mcs_set, sizeof(pmlmeext->default_supported_mcs_set));
}

static void init_mlme_ext_priv_value(struct adapter *padapter)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        atomic_set(&pmlmeext->event_seq, 0);
        pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
        pmlmeext->sa_query_seq = 0;
        pmlmeext->mgnt_80211w_IPN = 0;
        pmlmeext->mgnt_80211w_IPN_rx = 0;
        pmlmeext->cur_channel = padapter->registrypriv.channel;
        pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
        pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;

        pmlmeext->retry = 0;

        pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;

        init_mlme_default_rate_set(padapter);

        pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
        pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
        pmlmeext->sitesurvey_res.channel_idx = 0;
        pmlmeext->sitesurvey_res.bss_cnt = 0;
        pmlmeext->scan_abort = false;

        pmlmeinfo->state = WIFI_FW_NULL_STATE;
        pmlmeinfo->reauth_count = 0;
        pmlmeinfo->reassoc_count = 0;
        pmlmeinfo->link_count = 0;
        pmlmeinfo->auth_seq = 0;
        pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
        pmlmeinfo->key_index = 0;
        pmlmeinfo->iv = 0;

        pmlmeinfo->enc_algo = _NO_PRIVACY_;
        pmlmeinfo->authModeToggle = 0;

        memset(pmlmeinfo->chg_txt, 0, 128);

        pmlmeinfo->slotTime = SHORT_SLOT_TIME;
        pmlmeinfo->preamble_mode = PREAMBLE_AUTO;

        pmlmeinfo->dialogToken = 0;

        pmlmeext->action_public_rxseq = 0xffff;
        pmlmeext->action_public_dialog_token = 0xff;
}

static int has_channel(struct rt_channel_info *channel_set,
                                           u8 chanset_size,
                                           u8 chan)
{
        int i;

        for (i = 0; i < chanset_size; i++)
                if (channel_set[i].ChannelNum == chan)
                        return 1;

        return 0;
}

static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
                                                          u8 chanset_size,
                                                          struct p2p_channels *channel_list)
{

        static const struct p2p_oper_class_map op_class[] = {
                { IEEE80211G,  81,   1,  13,  1, BW20 },
                { IEEE80211G,  82,  14,  14,  1, BW20 },
                { IEEE80211A, 115,  36,  48,  4, BW20 },
                { IEEE80211A, 116,  36,  44,  8, BW40PLUS },
                { IEEE80211A, 117,  40,  48,  8, BW40MINUS },
                { IEEE80211A, 124, 149, 161,  4, BW20 },
                { IEEE80211A, 125, 149, 169,  4, BW20 },
                { IEEE80211A, 126, 149, 157,  8, BW40PLUS },
                { IEEE80211A, 127, 153, 161,  8, BW40MINUS },
                { -1, 0, 0, 0, 0, BW20 }
        };

        int cla, op;

        cla = 0;

        for (op = 0; op_class[op].op_class; op++) {
                u8 ch;
                const struct p2p_oper_class_map *o = &op_class[op];
                struct p2p_reg_class *reg = NULL;

                for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
                        if (!has_channel(channel_set, chanset_size, ch))
                                continue;

                        if ((padapter->registrypriv.ht_enable == 0) && (o->inc == 8))
                                continue;

                        if ((0 < (padapter->registrypriv.bw_mode & 0xf0)) &&
                                ((o->bw == BW40MINUS) || (o->bw == BW40PLUS)))
                                continue;

                        if (!reg) {
                                reg = &channel_list->reg_class[cla];
                                cla++;
                                reg->reg_class = o->op_class;
                                reg->channels = 0;
                        }
                        reg->channel[reg->channels] = ch;
                        reg->channels++;
                }
        }
        channel_list->reg_classes = cla;

}

static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
{
        u8 index, chanset_size = 0;
        u8 b2_4GBand = false;
        u8 Index2G = 0;

        memset(channel_set, 0, sizeof(struct rt_channel_info)*MAX_CHANNEL_NUM);

        if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
                return chanset_size;

        if (is_supported_24g(padapter->registrypriv.wireless_mode)) {
                b2_4GBand = true;
                if (ChannelPlan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
                        Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
                else
                        Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
        }

        if (b2_4GBand) {
                for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
                        channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];

                        if ((ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN) ||/* Channel 1~11 is active, and 12~14 is passive */
                                (ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_NULL)) {
                                if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
                                        channel_set[chanset_size].ScanType = SCAN_ACTIVE;
                                else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
                                        channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
                        } else if (ChannelPlan == RT_CHANNEL_DOMAIN_WORLD_WIDE_13 ||
                                 Index2G == RT_CHANNEL_DOMAIN_2G_WORLD) { /*  channel 12~13, passive scan */
                                if (channel_set[chanset_size].ChannelNum <= 11)
                                        channel_set[chanset_size].ScanType = SCAN_ACTIVE;
                                else
                                        channel_set[chanset_size].ScanType = SCAN_PASSIVE;
                        } else
                                channel_set[chanset_size].ScanType = SCAN_ACTIVE;

                        chanset_size++;
                }
        }

        return chanset_size;
}

static void init_mlme_ext_timer(struct adapter *padapter)
{
        struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        timer_setup(&pmlmeext->survey_timer, survey_timer_hdl, 0);
        timer_setup(&pmlmeext->link_timer, link_timer_hdl, 0);
        timer_setup(&pmlmeext->sa_query_timer, sa_query_timer_hdl, 0);
}

void init_mlme_ext_priv(struct adapter *padapter)
{
        struct registry_priv *pregistrypriv = &padapter->registrypriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        pmlmeext->padapter = padapter;

        /* fill_fwpriv(padapter, &(pmlmeext->fwpriv)); */

        init_mlme_ext_priv_value(padapter);
        pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;

        init_mlme_ext_timer(padapter);

        init_mlme_ap_info(padapter);

        pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
        init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
        pmlmeext->last_scan_time = 0;
        pmlmeext->chan_scan_time = SURVEY_TO;
        pmlmeext->mlmeext_init = true;
        pmlmeext->active_keep_alive_check = true;

#ifdef DBG_FIXED_CHAN
        pmlmeext->fixed_chan = 0xFF;
#endif
}

void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
{
        struct adapter *padapter = pmlmeext->padapter;

        if (!padapter)
                return;

        if (padapter->bDriverStopped) {
                timer_delete_sync(&pmlmeext->survey_timer);
                timer_delete_sync(&pmlmeext->link_timer);
                /* timer_delete_sync(&pmlmeext->ADDBA_timer); */
        }
}

static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, union recv_frame *precv_frame)
{
        u8 *pframe = precv_frame->u.hdr.rx_data;

        if (ptable->func) {
                /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
                if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
                    !is_broadcast_ether_addr(GetAddr1Ptr(pframe)))
                        return;

                ptable->func(padapter, precv_frame);
        }
}

void mgt_dispatcher(struct adapter *padapter, union recv_frame *precv_frame)
{
        int index;
        struct mlme_handler *ptable;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));

        if (GetFrameType(pframe) != WIFI_MGT_TYPE)
                return;

        /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
        if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
            !is_broadcast_ether_addr(GetAddr1Ptr(pframe))) {
                return;
        }

        ptable = mlme_sta_tbl;

        index = GetFrameSubType(pframe) >> 4;

        if (index >= ARRAY_SIZE(mlme_sta_tbl))
                return;

        ptable += index;

        if (psta) {
                if (GetRetry(pframe)) {
                        if (precv_frame->u.hdr.attrib.seq_num == psta->RxMgmtFrameSeqNum) {
                                /* drop the duplicate management frame */
                                return;
                        }
                }
                psta->RxMgmtFrameSeqNum = precv_frame->u.hdr.attrib.seq_num;
        }

        switch (GetFrameSubType(pframe)) {
        case WIFI_AUTH:
                if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
                        ptable->func = &OnAuth;
                else
                        ptable->func = &OnAuthClient;
                fallthrough;
        case WIFI_ASSOCREQ:
        case WIFI_REASSOCREQ:
                _mgt_dispatcher(padapter, ptable, precv_frame);
                break;
        case WIFI_PROBEREQ:
                _mgt_dispatcher(padapter, ptable, precv_frame);
                break;
        case WIFI_BEACON:
                _mgt_dispatcher(padapter, ptable, precv_frame);
                break;
        case WIFI_ACTION:
                /* if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) */
                _mgt_dispatcher(padapter, ptable, precv_frame);
                break;
        default:
                _mgt_dispatcher(padapter, ptable, precv_frame);
                break;
        }
}

/* Following are the callback functions for each subtype of the management frames */

unsigned int OnProbeReq(struct adapter *padapter, union recv_frame *precv_frame)
{
        unsigned int    ielen;
        unsigned char *p;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex    *cur = &pmlmeinfo->network;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint len = precv_frame->u.hdr.len;
        u8 is_valid_p2p_probereq = false;

        if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
                return _SUCCESS;

        if (check_fwstate(pmlmepriv, _FW_LINKED) == false &&
                check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE) == false) {
                return _SUCCESS;
        }

        p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, WLAN_EID_SSID, (int *)&ielen,
                        len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);


        /* check (wildcard) SSID */
        if (p) {
                if (is_valid_p2p_probereq)
                        goto _issue_probersp;

                if ((ielen != 0 && false == !memcmp((void *)(p+2), (void *)cur->ssid.ssid, cur->ssid.ssid_length))
                        || (ielen == 0 && pmlmeinfo->hidden_ssid_mode)
                )
                        return _SUCCESS;

_issue_probersp:
                if ((check_fwstate(pmlmepriv, _FW_LINKED) &&
                     pmlmepriv->cur_network.join_res) ||
                    check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))
                        issue_probersp(padapter, get_sa(pframe), is_valid_p2p_probereq);
        }

        return _SUCCESS;

}

unsigned int OnProbeRsp(struct adapter *padapter, union recv_frame *precv_frame)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
                report_survey_event(padapter, precv_frame);
                return _SUCCESS;
        }

        return _SUCCESS;

}

unsigned int OnBeacon(struct adapter *padapter, union recv_frame *precv_frame)
{
        int cam_idx;
        struct sta_info *psta;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct sta_priv *pstapriv = &padapter->stapriv;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint len = precv_frame->u.hdr.len;
        struct wlan_bssid_ex *pbss;
        int ret = _SUCCESS;
        u8 *p = NULL;
        u32 ielen = 0;

        p = rtw_get_ie(pframe + sizeof(struct ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, WLAN_EID_EXT_SUPP_RATES, &ielen, precv_frame->u.hdr.len - sizeof(struct ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_);
        if (p && ielen > 0) {
                if (p + 2 + ielen < pframe + len) {
                        if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D))
                                /* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */
                                *(p + 1) = ielen - 1;
                }
        }

        if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
                report_survey_event(padapter, precv_frame);
                return _SUCCESS;
        }

        if (!memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)) {
                if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
                        /* we should update current network before auth, or some IE is wrong */
                        pbss = kmalloc_obj(*pbss, GFP_ATOMIC);
                        if (pbss) {
                                if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
                                        update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
                                        rtw_get_bcn_info(&(pmlmepriv->cur_network));
                                }
                                kfree(pbss);
                        }

                        /* check the vendor of the assoc AP */
                        pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));

                        /* update TSF Value */
                        update_TSF(pmlmeext, pframe, len);

                        /* reset for adaptive_early_32k */
                        pmlmeext->adaptive_tsf_done = false;
                        pmlmeext->DrvBcnEarly = 0xff;
                        pmlmeext->DrvBcnTimeOut = 0xff;
                        pmlmeext->bcn_cnt = 0;
                        memset(pmlmeext->bcn_delay_cnt, 0, sizeof(pmlmeext->bcn_delay_cnt));
                        memset(pmlmeext->bcn_delay_ratio, 0, sizeof(pmlmeext->bcn_delay_ratio));

                        /* start auth */
                        start_clnt_auth(padapter);

                        return _SUCCESS;
                }

                if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
                        psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
                        if (psta) {
                                ret = rtw_check_bcn_info(padapter, pframe, len);
                                if (!ret) {
                                        netdev_dbg(padapter->pnetdev,
                                                   "ap has changed, disconnect now\n");
                                        receive_disconnect(padapter,
                                                           pmlmeinfo->network.mac_address, 0);
                                        return _SUCCESS;
                                }
                                /* update WMM, ERP in the beacon */
                                /* todo: the timer is used instead of the number of the beacon received */
                                if ((sta_rx_pkts(psta) & 0xf) == 0)
                                        update_beacon_info(padapter, pframe, len, psta);

                                adaptive_early_32k(pmlmeext, pframe, len);
                        }
                } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
                        psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
                        if (psta) {
                                /* update WMM, ERP in the beacon */
                                /* todo: the timer is used instead of the number of the beacon received */
                                if ((sta_rx_pkts(psta) & 0xf) == 0)
                                        update_beacon_info(padapter, pframe, len, psta);
                        } else {
                                /* allocate a new CAM entry for IBSS station */
                                cam_idx = allocate_fw_sta_entry(padapter);
                                if (cam_idx == NUM_STA)
                                        goto _END_ONBEACON_;

                                /* get supported rate */
                                if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
                                        pmlmeinfo->FW_sta_info[cam_idx].status = 0;
                                        goto _END_ONBEACON_;
                                }

                                /* update TSF Value */
                                update_TSF(pmlmeext, pframe, len);

                                /* report sta add event */
                                report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
                        }
                }
        }

_END_ONBEACON_:

        return _SUCCESS;

}

unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
{
        unsigned int    auth_mode, seq, ie_len;
        unsigned char *sa, *p;
        u16 algorithm;
        int     status;
        static struct sta_info stat;
        struct  sta_info *pstat = NULL;
        struct  sta_priv *pstapriv = &padapter->stapriv;
        struct security_priv *psecuritypriv = &padapter->securitypriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint len = precv_frame->u.hdr.len;
        u8 offset = 0;

        if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
                return _FAIL;

        sa = GetAddr2Ptr(pframe);

        auth_mode = psecuritypriv->dot11AuthAlgrthm;

        if (GetPrivacy(pframe)) {
                u8 *iv;
                struct rx_pkt_attrib     *prxattrib = &(precv_frame->u.hdr.attrib);

                prxattrib->hdrlen = WLAN_HDR_A3_LEN;
                prxattrib->encrypt = _WEP40_;

                iv = pframe+prxattrib->hdrlen;
                prxattrib->key_index = ((iv[3]>>6)&0x3);

                prxattrib->iv_len = 4;
                prxattrib->icv_len = 4;

                rtw_wep_decrypt(padapter, (u8 *)precv_frame);

                offset = 4;
        }

        algorithm = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset));
        seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));

        if (auth_mode == 2 &&
                        psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
                        psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
                auth_mode = 0;

        if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
                (algorithm == 0 && auth_mode == 1)) {   /*  rx a open-system auth but shared-key is enabled */

                status = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;

                goto auth_fail;
        }

        if (rtw_access_ctrl(padapter, sa) == false) {
                status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
                goto auth_fail;
        }

        pstat = rtw_get_stainfo(pstapriv, sa);
        if (!pstat) {

                /*  allocate a new one */
                pstat = rtw_alloc_stainfo(pstapriv, sa);
                if (!pstat) {
                        status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
                        goto auth_fail;
                }

                pstat->state = WIFI_FW_AUTH_NULL;
                pstat->auth_seq = 0;

                /* pstat->flags = 0; */
                /* pstat->capability = 0; */
        } else {

                spin_lock_bh(&pstapriv->asoc_list_lock);
                if (list_empty(&pstat->asoc_list) == false) {
                        list_del_init(&pstat->asoc_list);
                        pstapriv->asoc_list_cnt--;
                        if (pstat->expire_to > 0) {
                                /* TODO: STA re_auth within expire_to */
                        }
                }
                spin_unlock_bh(&pstapriv->asoc_list_lock);

                if (seq == 1) {
                        /* TODO: STA re_auth and auth timeout */
                }
        }

        spin_lock_bh(&pstapriv->auth_list_lock);
        if (list_empty(&pstat->auth_list)) {

                list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
                pstapriv->auth_list_cnt++;
        }
        spin_unlock_bh(&pstapriv->auth_list_lock);

        if (pstat->auth_seq == 0)
                pstat->expire_to = pstapriv->auth_to;


        if ((pstat->auth_seq + 1) != seq) {
                status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
                goto auth_fail;
        }

        if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2 || auth_mode == 3)) {
                if (seq == 1) {
                        pstat->state &= ~WIFI_FW_AUTH_NULL;
                        pstat->state |= WIFI_FW_AUTH_SUCCESS;
                        pstat->expire_to = pstapriv->assoc_to;
                        pstat->authalg = algorithm;
                } else {
                        status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
                        goto auth_fail;
                }
        } else { /*  shared system or auto authentication */
                if (seq == 1) {
                        /* prepare for the challenging txt... */
                        memset((void *)pstat->chg_txt, 78, 128);

                        pstat->state &= ~WIFI_FW_AUTH_NULL;
                        pstat->state |= WIFI_FW_AUTH_STATE;
                        pstat->authalg = algorithm;
                } else if (seq == 3) {

                        p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&ie_len,
                                        len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);

                        if (!p || ie_len <= 0) {
                                status = WLAN_STATUS_CHALLENGE_FAIL;
                                goto auth_fail;
                        }

                        if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
                                pstat->state &= (~WIFI_FW_AUTH_STATE);
                                pstat->state |= WIFI_FW_AUTH_SUCCESS;
                                /*  challenging txt is correct... */
                                pstat->expire_to =  pstapriv->assoc_to;
                        } else {
                                status = WLAN_STATUS_CHALLENGE_FAIL;
                                goto auth_fail;
                        }
                } else {
                        status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
                        goto auth_fail;
                }
        }


        /*  Now, we are going to issue_auth... */
        pstat->auth_seq = seq + 1;

        issue_auth(padapter, pstat, (unsigned short)(WLAN_STATUS_SUCCESS));

        if (pstat->state & WIFI_FW_AUTH_SUCCESS)
                pstat->auth_seq = 0;


        return _SUCCESS;

auth_fail:

        if (pstat)
                rtw_free_stainfo(padapter, pstat);

        pstat = &stat;
        memset((char *)pstat, '\0', sizeof(stat));
        pstat->auth_seq = 2;
        memcpy(pstat->hwaddr, sa, 6);

        issue_auth(padapter, pstat, (unsigned short)status);

        return _FAIL;

}

unsigned int OnAuthClient(struct adapter *padapter, union recv_frame *precv_frame)
{
        unsigned int    seq, len, status, offset;
        unsigned char *p;
        unsigned int    go2asoc = 0;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint pkt_len = precv_frame->u.hdr.len;

        /* check A1 matches or not */
        if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
                return _SUCCESS;

        if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
                return _SUCCESS;

        offset = (GetPrivacy(pframe)) ? 4 : 0;

        seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
        status  = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 4));

        if (status != 0) {
                if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
                        if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
                                pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
                        else
                                pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
                        /* pmlmeinfo->reauth_count = 0; */
                }

                set_link_timer(pmlmeext, 1);
                goto authclnt_fail;
        }

        if (seq == 2) {
                if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
                         /*  legendary shared system */
                        p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&len,
                                pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);

                        if (!p)
                                goto authclnt_fail;

                        memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
                        pmlmeinfo->auth_seq = 3;
                        issue_auth(padapter, NULL, 0);
                        set_link_timer(pmlmeext, REAUTH_TO);

                        return _SUCCESS;
                }
                /* open system */
                go2asoc = 1;
        } else if (seq == 4) {
                if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
                        go2asoc = 1;
                else
                        goto authclnt_fail;
        } else {
                /*  this is also illegal */
                goto authclnt_fail;
        }

        if (go2asoc) {
                netdev_dbg(padapter->pnetdev, "auth success, start assoc\n");
                start_clnt_assoc(padapter);
                return _SUCCESS;
        }

authclnt_fail:

        /* pmlmeinfo->state &= ~(WIFI_FW_AUTH_STATE); */

        return _FAIL;

}

unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
{
        u16 capab_info;
        struct rtw_ieee802_11_elems elems;
        struct sta_info *pstat;
        unsigned char *p, *pos, *wpa_ie;
        unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
        int             i, ie_len, wpa_ie_len, left;
        unsigned char supportRate[16];
        int                                     supportRateNum;
        unsigned short          status = WLAN_STATUS_SUCCESS;
        unsigned short          frame_type, ie_offset = 0;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct security_priv *psecuritypriv = &padapter->securitypriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex    *cur = &(pmlmeinfo->network);
        struct sta_priv *pstapriv = &padapter->stapriv;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint pkt_len = precv_frame->u.hdr.len;

        if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
                return _FAIL;

        frame_type = GetFrameSubType(pframe);
        if (frame_type == WIFI_ASSOCREQ)
                ie_offset = _ASOCREQ_IE_OFFSET_;
        else /*  WIFI_REASSOCREQ */
                ie_offset = _REASOCREQ_IE_OFFSET_;


        if (pkt_len < sizeof(struct ieee80211_hdr_3addr) + ie_offset)
                return _FAIL;

        pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
        if (!pstat) {
                status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
                goto asoc_class2_error;
        }

        capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
        /* capab_info = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN)); */

        left = pkt_len - (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
        pos = pframe + (sizeof(struct ieee80211_hdr_3addr) + ie_offset);

        /*  check if this stat has been successfully authenticated/associated */
        if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
                if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
                        status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
                        goto asoc_class2_error;
                } else {
                        pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
                        pstat->state |= WIFI_FW_ASSOC_STATE;
                }
        } else {
                pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
                pstat->state |= WIFI_FW_ASSOC_STATE;
        }


        pstat->capability = capab_info;

        /* now parse all ieee802_11 ie to point to elems */
        if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
            !elems.ssid) {
                status = WLAN_STATUS_CHALLENGE_FAIL;
                goto OnAssocReqFail;
        }

        /*  now we should check all the fields... */
        /*  checking SSID */
        p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_SSID, &ie_len,
                pkt_len - WLAN_HDR_A3_LEN - ie_offset);

        if (!p || ie_len == 0) {
                /*  broadcast ssid, however it is not allowed in assocreq */
                status = WLAN_STATUS_CHALLENGE_FAIL;
                goto OnAssocReqFail;
        } else {
                /*  check if ssid match */
                if (memcmp((void *)(p+2), cur->ssid.ssid, cur->ssid.ssid_length))
                        status = WLAN_STATUS_CHALLENGE_FAIL;

                if (ie_len != cur->ssid.ssid_length)
                        status = WLAN_STATUS_CHALLENGE_FAIL;
        }

        if (status != WLAN_STATUS_SUCCESS)
                goto OnAssocReqFail;

        /*  check if the supported rate is ok */
        p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_SUPP_RATES, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
        if (!p) {
                /*  use our own rate set as statoin used */
                /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
                /* supportRateNum = AP_BSSRATE_LEN; */

                status = WLAN_STATUS_CHALLENGE_FAIL;
                goto OnAssocReqFail;
        } else {
                if (ie_len > sizeof(supportRate))
                        ie_len = sizeof(supportRate);

                memcpy(supportRate, p+2, ie_len);
                supportRateNum = ie_len;

                p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_EXT_SUPP_RATES, &ie_len,
                                pkt_len - WLAN_HDR_A3_LEN - ie_offset);
                if (p) {

                        if (supportRateNum + ie_len <= sizeof(supportRate)) {
                                memcpy(supportRate+supportRateNum, p+2, ie_len);
                                supportRateNum += ie_len;
                        }
                }
        }

        /* todo: mask supportRate between AP & STA -> move to update raid */
        /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */

        /* update station supportRate */
        pstat->bssratelen = supportRateNum;
        memcpy(pstat->bssrateset, supportRate, supportRateNum);
        update_basic_rate_table_soft_ap(pstat->bssrateset, pstat->bssratelen);

        /* check RSN/WPA/WPS */
        pstat->dot8021xalg = 0;
        pstat->wpa_psk = 0;
        pstat->wpa_group_cipher = 0;
        pstat->wpa2_group_cipher = 0;
        pstat->wpa_pairwise_cipher = 0;
        pstat->wpa2_pairwise_cipher = 0;
        memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
        if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {

                int group_cipher = 0, pairwise_cipher = 0;

                wpa_ie = elems.rsn_ie;
                wpa_ie_len = elems.rsn_ie_len;

                if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
                        pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
                        pstat->wpa_psk |= BIT(1);

                        pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
                        pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;

                        if (!pstat->wpa2_group_cipher)
                                status = WLAN_STATUS_INVALID_GROUP_CIPHER;

                        if (!pstat->wpa2_pairwise_cipher)
                                status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
                } else {
                        status = WLAN_STATUS_INVALID_IE;
                }

        } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {

                int group_cipher = 0, pairwise_cipher = 0;

                wpa_ie = elems.wpa_ie;
                wpa_ie_len = elems.wpa_ie_len;

                if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
                        pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
                        pstat->wpa_psk |= BIT(0);

                        pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
                        pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;

                        if (!pstat->wpa_group_cipher)
                                status = WLAN_STATUS_INVALID_GROUP_CIPHER;

                        if (!pstat->wpa_pairwise_cipher)
                                status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;

                } else {
                        status = WLAN_STATUS_INVALID_IE;
                }

        } else {
                wpa_ie = NULL;
                wpa_ie_len = 0;
        }

        if (status != WLAN_STATUS_SUCCESS)
                goto OnAssocReqFail;

        pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
        if (!wpa_ie) {
                if (elems.wps_ie)
                        pstat->flags |= WLAN_STA_WPS;
                else
                        pstat->flags |= WLAN_STA_MAYBE_WPS;


                /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
                /*  that the selected registrar of AP is _FLASE */
                if ((psecuritypriv->wpa_psk > 0)
                        && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
                        if (pmlmepriv->wps_beacon_ie) {
                                u8 selected_registrar = 0;

                                rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);

                                if (!selected_registrar) {
                                        status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;

                                        goto OnAssocReqFail;
                                }
                        }
                }

        } else {
                int copy_len;

                if (psecuritypriv->wpa_psk == 0) {
                        status = WLAN_STATUS_INVALID_IE;

                        goto OnAssocReqFail;

                }

                if (elems.wps_ie) {
                        pstat->flags |= WLAN_STA_WPS;
                        copy_len = 0;
                } else {
                        copy_len = ((wpa_ie_len+2) > sizeof(pstat->wpa_ie)) ? (sizeof(pstat->wpa_ie)):(wpa_ie_len+2);
                }


                if (copy_len > 0)
                        memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);

        }


        /*  check if there is WMM IE & support WWM-PS */
        pstat->flags &= ~WLAN_STA_WME;
        pstat->qos_option = 0;
        pstat->qos_info = 0;
        pstat->has_legacy_ac = true;
        pstat->uapsd_vo = 0;
        pstat->uapsd_vi = 0;
        pstat->uapsd_be = 0;
        pstat->uapsd_bk = 0;
        if (pmlmepriv->qospriv.qos_option) {
                p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
                for (;;) {
                        p = rtw_get_ie(p, WLAN_EID_VENDOR_SPECIFIC, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
                        if (!p)
                                break;

                        if (memcmp(p+2, WMM_IE, 6)) {
                                p = p + ie_len + 2;
                                continue;
                        }

                        pstat->flags |= WLAN_STA_WME;

                        pstat->qos_option = 1;
                        pstat->qos_info = *(p+8);

                        pstat->max_sp_len = (pstat->qos_info>>5)&0x3;

                        if ((pstat->qos_info&0xf) != 0xf)
                                pstat->has_legacy_ac = true;
                        else
                                pstat->has_legacy_ac = false;

                        if (pstat->qos_info&0xf) {
                                if (pstat->qos_info&BIT(0))
                                        pstat->uapsd_vo = BIT(0)|BIT(1);
                                else
                                        pstat->uapsd_vo = 0;

                                if (pstat->qos_info&BIT(1))
                                        pstat->uapsd_vi = BIT(0)|BIT(1);
                                else
                                        pstat->uapsd_vi = 0;

                                if (pstat->qos_info&BIT(2))
                                        pstat->uapsd_bk = BIT(0)|BIT(1);
                                else
                                        pstat->uapsd_bk = 0;

                                if (pstat->qos_info&BIT(3))
                                        pstat->uapsd_be = BIT(0)|BIT(1);
                                else
                                        pstat->uapsd_be = 0;

                        }

                        break;
                }
        }

        /* save HT capabilities in the sta object */
        memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
        if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
                pstat->flags |= WLAN_STA_HT;

                pstat->flags |= WLAN_STA_WME;

                memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));

        } else
                pstat->flags &= ~WLAN_STA_HT;


        if ((pmlmepriv->htpriv.ht_option == false) && (pstat->flags&WLAN_STA_HT)) {
                status = WLAN_STATUS_CHALLENGE_FAIL;
                goto OnAssocReqFail;
        }


        if ((pstat->flags & WLAN_STA_HT) &&
                    ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
                      (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
                /* status = WLAN_STATUS_CIPHER_SUITE_REJECTED; */
                /* goto OnAssocReqFail; */
        }
        pstat->flags |= WLAN_STA_NONERP;
        for (i = 0; i < pstat->bssratelen; i++) {
                if ((pstat->bssrateset[i] & 0x7f) > 22) {
                        pstat->flags &= ~WLAN_STA_NONERP;
                        break;
                }
        }

        if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
                pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
        else
                pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;

        /* TODO: identify_proprietary_vendor_ie(); */
        /*  Realtek proprietary IE */
        /*  identify if this is Broadcom sta */
        /*  identify if this is ralink sta */
        /*  Customer proprietary IE */

        /* get a unique AID */
        if (pstat->aid == 0) {
                for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
                        if (!pstapriv->sta_aid[pstat->aid - 1])
                                break;

                /* if (pstat->aid > NUM_STA) { */
                if (pstat->aid > pstapriv->max_num_sta) {

                        pstat->aid = 0;

                        status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;

                        goto OnAssocReqFail;


                } else {
                        pstapriv->sta_aid[pstat->aid - 1] = pstat;
                }
        }


        pstat->state &= (~WIFI_FW_ASSOC_STATE);
        pstat->state |= WIFI_FW_ASSOC_SUCCESS;

        spin_lock_bh(&pstapriv->auth_list_lock);
        if (!list_empty(&pstat->auth_list)) {
                list_del_init(&pstat->auth_list);
                pstapriv->auth_list_cnt--;
        }
        spin_unlock_bh(&pstapriv->auth_list_lock);

        spin_lock_bh(&pstapriv->asoc_list_lock);
        if (list_empty(&pstat->asoc_list)) {
                pstat->expire_to = pstapriv->expire_to;
                list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
                pstapriv->asoc_list_cnt++;
        }
        spin_unlock_bh(&pstapriv->asoc_list_lock);

        /*  now the station is qualified to join our BSS... */
        if (pstat && (pstat->state & WIFI_FW_ASSOC_SUCCESS) && (status == WLAN_STATUS_SUCCESS)) {
                /* 1 bss_cap_update & sta_info_update */
                bss_cap_update_on_sta_join(padapter, pstat);
                sta_info_update(padapter, pstat);

                /* 2 issue assoc rsp before notify station join event. */
                if (frame_type == WIFI_ASSOCREQ)
                        issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
                else
                        issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);

                spin_lock_bh(&pstat->lock);
                kfree(pstat->passoc_req);
                pstat->assoc_req_len = 0;
                pstat->passoc_req = kmemdup(pframe, pkt_len, GFP_ATOMIC);
                if (pstat->passoc_req)
                        pstat->assoc_req_len = pkt_len;

                spin_unlock_bh(&pstat->lock);

                /* 3-(1) report sta add event */
                report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
        }

        return _SUCCESS;

asoc_class2_error:

        issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);

        return _FAIL;

OnAssocReqFail:

        pstat->aid = 0;
        if (frame_type == WIFI_ASSOCREQ)
                issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
        else
                issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);

        return _FAIL;
}

unsigned int OnAssocRsp(struct adapter *padapter, union recv_frame *precv_frame)
{
        uint i;
        int res;
        unsigned short  status;
        struct ndis_80211_var_ie *pIE;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        /* struct wlan_bssid_ex                 *cur_network = &(pmlmeinfo->network); */
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint pkt_len = precv_frame->u.hdr.len;

        /* check A1 matches or not */
        if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
                return _SUCCESS;

        if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
                return _SUCCESS;

        if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
                return _SUCCESS;

        timer_delete_sync(&pmlmeext->link_timer);

        /* status */
        status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
        if (status > 0) {
                pmlmeinfo->state = WIFI_FW_NULL_STATE;
                res = -4;
                goto report_assoc_result;
        }

        /* get capabilities */
        pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));

        /* set slot time */
        pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;

        /* AID */
        res = pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);

        /* following are moved to join event callback function */
        /* to handle HT, WMM, rate adaptive, update MAC reg */
        /* for not to handle the synchronous IO in the tasklet */
        for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
                pIE = (struct ndis_80211_var_ie *)(pframe + i);

                switch (pIE->element_id) {
                case WLAN_EID_VENDOR_SPECIFIC:
                        if (!memcmp(pIE->data, WMM_PARA_OUI, 6))        /* WMM */
                                WMM_param_handler(padapter, pIE);
                        break;

                case WLAN_EID_HT_CAPABILITY:    /* HT caps */
                        HT_caps_handler(padapter, pIE);
                        break;

                case WLAN_EID_HT_OPERATION:     /* HT info */
                        HT_info_handler(padapter, pIE);
                        break;

                case WLAN_EID_ERP_INFO:
                        ERP_IE_handler(padapter, pIE);
                        break;

                default:
                        break;
                }

                i += (pIE->length + 2);
        }

        pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
        pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;

        /* Update Basic Rate Table for spec, 2010-12-28 , by thomas */
        update_basic_rate_table(padapter, pmlmeinfo->network.supported_rates);

report_assoc_result:
        if (res > 0)
                rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
        else
                rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);

        report_join_res(padapter, res);

        return _SUCCESS;
}

unsigned int OnDeAuth(struct adapter *padapter, union recv_frame *precv_frame)
{
        unsigned short  reason;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        int ignore_received_deauth = 0;

        /* check A3 */
        if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
                return _SUCCESS;

        reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));

        if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
                struct sta_info *psta;
                struct sta_priv *pstapriv = &padapter->stapriv;

                /* rtw_free_stainfo(padapter, psta); */

                netdev_dbg(padapter->pnetdev,
                           "ap recv deauth reason code(%d) sta:%pM\n", reason,
                           GetAddr2Ptr(pframe));

                psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
                if (psta) {
                        u8 updated = false;

                        spin_lock_bh(&pstapriv->asoc_list_lock);
                        if (list_empty(&psta->asoc_list) == false) {
                                list_del_init(&psta->asoc_list);
                                pstapriv->asoc_list_cnt--;
                                updated = ap_free_sta(padapter, psta, false, reason);

                        }
                        spin_unlock_bh(&pstapriv->asoc_list_lock);

                        associated_clients_update(padapter, updated);
                }


                return _SUCCESS;
        }

        /* Commented by Albert 20130604
         * Before sending the auth frame to start the STA/GC mode connection with AP/GO,
         * we will send the deauth first.
         * However, the Win8.1 with BRCM Wi-Fi will send the deauth with reason code 6 to us after receieving our deauth.
         * Added the following code to avoid this case.
         */
        if ((pmlmeinfo->state & WIFI_FW_AUTH_STATE) ||
            (pmlmeinfo->state & WIFI_FW_ASSOC_STATE)) {
                if (reason == WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA) {
                        ignore_received_deauth = 1;
                } else if (reason == WLAN_REASON_PREV_AUTH_NOT_VALID) {
                        /*  TODO: 802.11r */
                        ignore_received_deauth = 1;
                }
        }

        netdev_dbg(padapter->pnetdev,
                   "sta recv deauth reason code(%d) sta:%pM, ignore = %d\n",
                   reason, GetAddr3Ptr(pframe),
                   ignore_received_deauth);

        if (ignore_received_deauth == 0)
                receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);

        pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
        return _SUCCESS;
}

unsigned int OnDisassoc(struct adapter *padapter, union recv_frame *precv_frame)
{
        unsigned short  reason;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 *pframe = precv_frame->u.hdr.rx_data;

        /* check A3 */
        if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
                return _SUCCESS;

        reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));

        if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
                struct sta_info *psta;
                struct sta_priv *pstapriv = &padapter->stapriv;

                /* rtw_free_stainfo(padapter, psta); */

                netdev_dbg(padapter->pnetdev,
                           "ap recv disassoc reason code(%d) sta:%pM\n",
                           reason, GetAddr2Ptr(pframe));

                psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
                if (psta) {
                        u8 updated = false;

                        spin_lock_bh(&pstapriv->asoc_list_lock);
                        if (list_empty(&psta->asoc_list) == false) {
                                list_del_init(&psta->asoc_list);
                                pstapriv->asoc_list_cnt--;
                                updated = ap_free_sta(padapter, psta, false, reason);

                        }
                        spin_unlock_bh(&pstapriv->asoc_list_lock);

                        associated_clients_update(padapter, updated);
                }

                return _SUCCESS;
        }
        netdev_dbg(padapter->pnetdev,
                   "sta recv disassoc reason code(%d) sta:%pM\n",
                   reason, GetAddr3Ptr(pframe));

        receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);

        pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
        return _SUCCESS;

}

unsigned int OnAtim(struct adapter *padapter, union recv_frame *precv_frame)
{
        return _SUCCESS;
}

unsigned int on_action_spct(struct adapter *padapter, union recv_frame *precv_frame)
{
        struct sta_info *psta = NULL;
        struct sta_priv *pstapriv = &padapter->stapriv;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        u8 *frame_body = (u8 *)(pframe + sizeof(struct ieee80211_hdr_3addr));
        u8 category;
        u8 action;

        psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));

        if (!psta)
                goto exit;

        category = frame_body[0];
        if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
                goto exit;

        action = frame_body[1];
        switch (action) {
        case WLAN_ACTION_SPCT_MSR_REQ:
        case WLAN_ACTION_SPCT_MSR_RPRT:
        case WLAN_ACTION_SPCT_TPC_REQ:
        case WLAN_ACTION_SPCT_TPC_RPRT:
        case WLAN_ACTION_SPCT_CHL_SWITCH:
                break;
        default:
                break;
        }

exit:
        return _FAIL;
}

unsigned int OnAction_back(struct adapter *padapter, union recv_frame *precv_frame)
{
        u8 *addr;
        struct sta_info *psta = NULL;
        struct recv_reorder_ctrl *preorder_ctrl;
        unsigned char *frame_body;
        unsigned char category, action;
        unsigned short  tid, status;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        struct sta_priv *pstapriv = &padapter->stapriv;

        /* check RA matches or not */
        if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))/* for if1, sta/ap mode */
                return _SUCCESS;

        if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
                if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
                        return _SUCCESS;

        addr = GetAddr2Ptr(pframe);
        psta = rtw_get_stainfo(pstapriv, addr);

        if (!psta)
                return _SUCCESS;

        frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));

        category = frame_body[0];
        if (category == RTW_WLAN_CATEGORY_BACK) {/*  representing Block Ack */
                if (!pmlmeinfo->HT_enable)
                        return _SUCCESS;

                action = frame_body[1];
                switch (action) {
                case WLAN_ACTION_ADDBA_REQ: /* ADDBA request */

                        memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
                        /* process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), GetAddr3Ptr(pframe)); */
                        process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);

                        if (pmlmeinfo->accept_addba_req)
                                issue_action_BA(padapter, addr, WLAN_ACTION_ADDBA_RESP, 0);
                        else
                                issue_action_BA(padapter, addr, WLAN_ACTION_ADDBA_RESP, 37);/* reject ADDBA Req */

                        break;

                case WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
                        status = get_unaligned_le16(&frame_body[3]);
                        tid = ((frame_body[5] >> 2) & 0x7);

                        if (status == 0) {
                                /* successful */
                                psta->htpriv.agg_enable_bitmap |= BIT(tid);
                                psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
                        } else {
                                psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
                        }

                        if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
                                psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
                                psta->expire_to = pstapriv->expire_to;
                                psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
                        }

                        break;

                case WLAN_ACTION_DELBA: /* DELBA */
                        if ((frame_body[3] & BIT(3)) == 0) {
                                psta->htpriv.agg_enable_bitmap &=
                                        ~BIT((frame_body[3] >> 4) & 0xf);
                                psta->htpriv.candidate_tid_bitmap &=
                                        ~BIT((frame_body[3] >> 4) & 0xf);
                        } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
                                tid = (frame_body[3] >> 4) & 0x0F;

                                preorder_ctrl =  &psta->recvreorder_ctrl[tid];
                                preorder_ctrl->enable = false;
                                preorder_ctrl->indicate_seq = 0xffff;
                        }
                        /* todo: how to notify the host while receiving DELETE BA */
                        break;

                default:
                        break;
                }
        }
        return _SUCCESS;
}

static s32 rtw_action_public_decache(union recv_frame *recv_frame, s32 token)
{
        struct adapter *adapter = recv_frame->u.hdr.adapter;
        struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
        u8 *frame = recv_frame->u.hdr.rx_data;
        u16 seq_ctrl = ((recv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
                (recv_frame->u.hdr.attrib.frag_num & 0xf);

        if (GetRetry(frame)) {
                if (token >= 0) {
                        if ((seq_ctrl == mlmeext->action_public_rxseq)
                                && (token == mlmeext->action_public_dialog_token))
                                return _FAIL;
                } else {
                        if (seq_ctrl == mlmeext->action_public_rxseq)
                                return _FAIL;
                }
        }

        mlmeext->action_public_rxseq = seq_ctrl;

        if (token >= 0)
                mlmeext->action_public_dialog_token = token;

        return _SUCCESS;
}

static unsigned int on_action_public_p2p(union recv_frame *precv_frame)
{
        u8 *pframe = precv_frame->u.hdr.rx_data;
        u8 *frame_body;
        u8 dialogToken = 0;

        frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));

        dialogToken = frame_body[7];

        if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
                return _FAIL;

        return _SUCCESS;
}

static unsigned int on_action_public_vendor(union recv_frame *precv_frame)
{
        unsigned int ret = _FAIL;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);

        if (!memcmp(frame_body + 2, P2P_OUI, 4))
                ret = on_action_public_p2p(precv_frame);

        return ret;
}

static unsigned int on_action_public_default(union recv_frame *precv_frame, u8 action)
{
        unsigned int ret = _FAIL;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        uint frame_len = precv_frame->u.hdr.len;
        u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
        u8 token;
        struct adapter *adapter = precv_frame->u.hdr.adapter;
        char msg[64];

        token = frame_body[2];

        if (rtw_action_public_decache(precv_frame, token) == _FAIL)
                goto exit;

        scnprintf(msg, sizeof(msg), "%s(token:%u)", action_public_str(action), token);
        rtw_cfg80211_rx_action(adapter, pframe, frame_len, msg);

        ret = _SUCCESS;

exit:
        return ret;
}

unsigned int on_action_public(struct adapter *padapter, union recv_frame *precv_frame)
{
        unsigned int ret = _FAIL;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
        u8 category, action;

        /* check RA matches or not */
        if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
                goto exit;

        category = frame_body[0];
        if (category != RTW_WLAN_CATEGORY_PUBLIC)
                goto exit;

        action = frame_body[1];
        switch (action) {
        case ACT_PUBLIC_VENDOR:
                ret = on_action_public_vendor(precv_frame);
                break;
        default:
                ret = on_action_public_default(precv_frame, action);
                break;
        }

exit:
        return ret;
}

unsigned int OnAction_ht(struct adapter *padapter, union recv_frame *precv_frame)
{
        u8 *pframe = precv_frame->u.hdr.rx_data;
        u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
        u8 category, action;

        /* check RA matches or not */
        if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
                goto exit;

        category = frame_body[0];
        if (category != RTW_WLAN_CATEGORY_HT)
                goto exit;

        action = frame_body[1];
        switch (action) {
        case WLAN_HT_ACTION_COMPRESSED_BF:
                break;
        default:
                break;
        }

exit:

        return _SUCCESS;
}

unsigned int OnAction_sa_query(struct adapter *padapter, union recv_frame *precv_frame)
{
        u8 *pframe = precv_frame->u.hdr.rx_data;
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        unsigned short tid;

        switch (pframe[WLAN_HDR_A3_LEN+1]) {
        case 0: /* SA Query req */
                memcpy(&tid, &pframe[WLAN_HDR_A3_LEN+2], sizeof(unsigned short));
                issue_action_SA_Query(padapter, GetAddr2Ptr(pframe), 1, tid);
                break;

        case 1: /* SA Query rsp */
                timer_delete_sync(&pmlmeext->sa_query_timer);
                break;
        default:
                break;
        }

        return _SUCCESS;
}

unsigned int OnAction(struct adapter *padapter, union recv_frame *precv_frame)
{
        int i;
        unsigned char category;
        struct action_handler *ptable;
        unsigned char *frame_body;
        u8 *pframe = precv_frame->u.hdr.rx_data;

        frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));

        category = frame_body[0];

        for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
                ptable = &OnAction_tbl[i];

                if (category == ptable->num)
                        ptable->func(padapter, precv_frame);

        }

        return _SUCCESS;

}

unsigned int DoReserved(struct adapter *padapter, union recv_frame *precv_frame)
{
        return _SUCCESS;
}

static struct xmit_frame *_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv, bool once)
{
        struct xmit_frame *pmgntframe;
        struct xmit_buf *pxmitbuf;

        if (once)
                pmgntframe = rtw_alloc_xmitframe_once(pxmitpriv);
        else
                pmgntframe = rtw_alloc_xmitframe_ext(pxmitpriv);

        if (!pmgntframe)
                goto exit;

        pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
        if (!pxmitbuf) {
                rtw_free_xmitframe(pxmitpriv, pmgntframe);
                pmgntframe = NULL;
                goto exit;
        }

        pmgntframe->frame_tag = MGNT_FRAMETAG;
        pmgntframe->pxmitbuf = pxmitbuf;
        pmgntframe->buf_addr = pxmitbuf->pbuf;
        pxmitbuf->priv_data = pmgntframe;

exit:
        return pmgntframe;

}

inline struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
{
        return _alloc_mgtxmitframe(pxmitpriv, false);
}

/* Following are some TX functions for WiFi MLME */

void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
{
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);

        pmlmeext->tx_rate = rate;
}

void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
{
        u8 wireless_mode;
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);

        /* memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib)); */

        pattrib->hdrlen = 24;
        pattrib->nr_frags = 1;
        pattrib->priority = 7;
        pattrib->mac_id = 0;
        pattrib->qsel = 0x12;

        pattrib->pktlen = 0;

        if (pmlmeext->tx_rate == IEEE80211_CCK_RATE_1MB)
                wireless_mode = WIRELESS_11B;
        else
                wireless_mode = WIRELESS_11G;
        pattrib->raid =  rtw_get_mgntframe_raid(padapter, wireless_mode);
        pattrib->rate = pmlmeext->tx_rate;

        pattrib->encrypt = _NO_PRIVACY_;
        pattrib->bswenc = false;

        pattrib->qos_en = false;
        pattrib->ht_en = false;
        pattrib->bwmode = CHANNEL_WIDTH_20;
        pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
        pattrib->sgi = false;

        pattrib->seqnum = pmlmeext->mgnt_seq;

        pattrib->retry_ctrl = true;

        pattrib->mbssid = 0;

}

void update_mgntframe_attrib_addr(struct adapter *padapter, struct xmit_frame *pmgntframe)
{
        u8 *pframe;
        struct pkt_attrib       *pattrib = &pmgntframe->attrib;

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;

        memcpy(pattrib->ra, GetAddr1Ptr(pframe), ETH_ALEN);
        memcpy(pattrib->ta, GetAddr2Ptr(pframe), ETH_ALEN);
}

void dump_mgntframe(struct adapter *padapter, struct xmit_frame *pmgntframe)
{
        if (padapter->bSurpriseRemoved ||
                padapter->bDriverStopped) {
                rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
                rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
                return;
        }

        rtw_hal_mgnt_xmit(padapter, pmgntframe);
}

s32 dump_mgntframe_and_wait(struct adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms)
{
        s32 ret = _FAIL;
        unsigned long irqL;
        struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
        struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
        struct submit_ctx sctx;

        if (padapter->bSurpriseRemoved ||
                padapter->bDriverStopped) {
                rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
                rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
                return ret;
        }

        rtw_sctx_init(&sctx, timeout_ms);
        pxmitbuf->sctx = &sctx;

        ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);

        if (ret == _SUCCESS)
                ret = rtw_sctx_wait(&sctx);

        spin_lock_irqsave(&pxmitpriv->lock_sctx, irqL);
        pxmitbuf->sctx = NULL;
        spin_unlock_irqrestore(&pxmitpriv->lock_sctx, irqL);

        return ret;
}

s32 dump_mgntframe_and_wait_ack(struct adapter *padapter, struct xmit_frame *pmgntframe)
{
        static u8 seq_no;
        s32 ret = _FAIL;
        u32 timeout_ms = 500;/*   500ms */
        struct xmit_priv *pxmitpriv = &padapter->xmitpriv;

        if (padapter->bSurpriseRemoved ||
                padapter->bDriverStopped) {
                rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
                rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
                return -1;
        }

        if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex) == 0) {
                pxmitpriv->ack_tx = true;
                pxmitpriv->seq_no = seq_no++;
                pmgntframe->ack_report = 1;
                if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
                        ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);

                pxmitpriv->ack_tx = false;
                mutex_unlock(&pxmitpriv->ack_tx_mutex);
        }

        return ret;
}

static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
{
        u8 *ssid_ie;
        signed int ssid_len_ori;
        int len_diff = 0;

        ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);

        if (ssid_ie && ssid_len_ori > 0) {
                switch (hidden_ssid_mode) {
                case 1:
                {
                        u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
                        u32 remain_len = 0;

                        remain_len = ies_len - (next_ie-ies);

                        ssid_ie[1] = 0;
                        memcpy(ssid_ie+2, next_ie, remain_len);
                        len_diff -= ssid_len_ori;

                        break;
                }
                case 2:
                        memset(&ssid_ie[2], 0, ssid_len_ori);
                        break;
                default:
                        break;
        }
        }

        return len_diff;
}

void issue_beacon(struct adapter *padapter, int timeout_ms)
{
        struct xmit_frame       *pmgntframe;
        struct pkt_attrib       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr *pwlanhdr;
        __le16 *fctrl;
        unsigned int    rate_len;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        spin_lock_bh(&pmlmepriv->bcn_update_lock);

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);
        pattrib->qsel = 0x10;

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;


        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        eth_broadcast_addr(pwlanhdr->addr1);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);

        SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
        /* pmlmeext->mgnt_seq++; */
        SetFrameSubType(pframe, WIFI_BEACON);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
                {
                        int len_diff;

                        memcpy(pframe, cur_network->ies, cur_network->ie_length);
                        len_diff = update_hidden_ssid(pframe+_BEACON_IE_OFFSET_,
                                                      cur_network->ie_length-_BEACON_IE_OFFSET_,
                                                      pmlmeinfo->hidden_ssid_mode);
                        pframe += (cur_network->ie_length+len_diff);
                        pattrib->pktlen += (cur_network->ie_length+len_diff);
                }

                {
                        u8 *wps_ie;
                        uint wps_ielen;
                        u8 sr = 0;

                        wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
                                pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
                        if (wps_ie && wps_ielen > 0)
                                rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
                        if (sr != 0)
                                set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
                        else
                                _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
                }

                goto _issue_bcn;

        }

        /* below for ad-hoc mode */

        /* timestamp will be inserted by hardware */
        pframe += 8;
        pattrib->pktlen += 8;

        /*  beacon interval: 2 bytes */

        memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);

        pframe += 2;
        pattrib->pktlen += 2;

        /*  capability info: 2 bytes */

        memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);

        pframe += 2;
        pattrib->pktlen += 2;

        /*  SSID */
        pframe = rtw_set_ie(pframe, WLAN_EID_SSID, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);

        /*  supported rates... */
        rate_len = rtw_get_rateset_len(cur_network->supported_rates);
        pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, ((rate_len > 8) ? 8 : rate_len), cur_network->supported_rates, &pattrib->pktlen);

        /*  DS parameter set */
        pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, (unsigned char *)&(cur_network->configuration.ds_config), &pattrib->pktlen);

        /* if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) */
        {
                u8 erpinfo = 0;
                u32 ATIMWindow;
                /*  IBSS Parameter Set... */
                /* ATIMWindow = cur->configuration.ATIMWindow; */
                ATIMWindow = 0;
                pframe = rtw_set_ie(pframe, WLAN_EID_IBSS_PARAMS, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);

                /* ERP IE */
                pframe = rtw_set_ie(pframe, WLAN_EID_ERP_INFO, 1, &erpinfo, &pattrib->pktlen);
        }


        /*  EXTERNDED SUPPORTED RATE */
        if (rate_len > 8)
                pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (cur_network->supported_rates + 8), &pattrib->pktlen);


        /* todo:HT for adhoc */

_issue_bcn:

        pmlmepriv->update_bcn = false;

        spin_unlock_bh(&pmlmepriv->bcn_update_lock);

        if ((pattrib->pktlen + TXDESC_SIZE) > 512)
                return;

        pattrib->last_txcmdsz = pattrib->pktlen;

        if (timeout_ms > 0)
                dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
        else
                dump_mgntframe(padapter, pmgntframe);

}

void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq)
{
        struct xmit_frame                       *pmgntframe;
        struct pkt_attrib                       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        unsigned char *mac, *bssid;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);

        u8 *pwps_ie;
        uint wps_ielen;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
        unsigned int    rate_len;

        if (!da)
                return;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        mac = myid(&(padapter->eeprompriv));
        bssid = cur_network->mac_address;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;
        memcpy(pwlanhdr->addr1, da, ETH_ALEN);
        memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
        memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(fctrl, WIFI_PROBERSP);

        pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = pattrib->hdrlen;
        pframe += pattrib->hdrlen;


        if (cur_network->ie_length > MAX_IE_SZ)
                return;

        if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
                pwps_ie = rtw_get_wps_ie(cur_network->ies+_FIXED_IE_LENGTH_, cur_network->ie_length-_FIXED_IE_LENGTH_, NULL, &wps_ielen);

                /* inerset & update wps_probe_resp_ie */
                if (pmlmepriv->wps_probe_resp_ie && pwps_ie && wps_ielen > 0) {
                        uint wps_offset, remainder_ielen;
                        u8 *premainder_ie;

                        wps_offset = (uint)(pwps_ie - cur_network->ies);

                        premainder_ie = pwps_ie + wps_ielen;

                        remainder_ielen = cur_network->ie_length - wps_offset - wps_ielen;

                        memcpy(pframe, cur_network->ies, wps_offset);
                        pframe += wps_offset;
                        pattrib->pktlen += wps_offset;

                        wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
                        if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
                                memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
                                pframe += wps_ielen+2;
                                pattrib->pktlen += wps_ielen+2;
                        }

                        if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
                                memcpy(pframe, premainder_ie, remainder_ielen);
                                pframe += remainder_ielen;
                                pattrib->pktlen += remainder_ielen;
                        }
                } else {
                        memcpy(pframe, cur_network->ies, cur_network->ie_length);
                        pframe += cur_network->ie_length;
                        pattrib->pktlen += cur_network->ie_length;
                }

                /* retrieve SSID IE from cur_network->ssid */
                {
                        u8 *ssid_ie;
                        signed int ssid_ielen;
                        signed int ssid_ielen_diff;
                        u8 *buf;
                        u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr);

                        buf = kzalloc(MAX_IE_SZ, GFP_ATOMIC);
                        if (!buf)
                                return;

                        ssid_ie = rtw_get_ie(ies+_FIXED_IE_LENGTH_, WLAN_EID_SSID, &ssid_ielen,
                                (pframe-ies)-_FIXED_IE_LENGTH_);

                        ssid_ielen_diff = cur_network->ssid.ssid_length - ssid_ielen;

                        if (ssid_ie &&  cur_network->ssid.ssid_length) {
                                uint remainder_ielen;
                                u8 *remainder_ie;

                                remainder_ie = ssid_ie+2;
                                remainder_ielen = (pframe-remainder_ie);

                                if (remainder_ielen > MAX_IE_SZ) {
                                        netdev_warn(padapter->pnetdev,
                                                    FUNC_ADPT_FMT " remainder_ielen > MAX_IE_SZ\n",
                                                    FUNC_ADPT_ARG(padapter));
                                        remainder_ielen = MAX_IE_SZ;
                                }

                                memcpy(buf, remainder_ie, remainder_ielen);
                                memcpy(remainder_ie+ssid_ielen_diff, buf, remainder_ielen);
                                *(ssid_ie+1) = cur_network->ssid.ssid_length;
                                memcpy(ssid_ie+2, cur_network->ssid.ssid, cur_network->ssid.ssid_length);

                                pframe += ssid_ielen_diff;
                                pattrib->pktlen += ssid_ielen_diff;
                        }
                        kfree(buf);
                }
        } else {
                /* timestamp will be inserted by hardware */
                pframe += 8;
                pattrib->pktlen += 8;

                /*  beacon interval: 2 bytes */

                memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);

                pframe += 2;
                pattrib->pktlen += 2;

                /*  capability info: 2 bytes */

                memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);

                pframe += 2;
                pattrib->pktlen += 2;

                /* below for ad-hoc mode */

                /*  SSID */
                pframe = rtw_set_ie(pframe, WLAN_EID_SSID, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);

                /*  supported rates... */
                rate_len = rtw_get_rateset_len(cur_network->supported_rates);
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, ((rate_len > 8) ? 8 : rate_len), cur_network->supported_rates, &pattrib->pktlen);

                /*  DS parameter set */
                pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, (unsigned char *)&(cur_network->configuration.ds_config), &pattrib->pktlen);

                if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
                        u8 erpinfo = 0;
                        u32 ATIMWindow;
                        /*  IBSS Parameter Set... */
                        /* ATIMWindow = cur->configuration.ATIMWindow; */
                        ATIMWindow = 0;
                        pframe = rtw_set_ie(pframe, WLAN_EID_IBSS_PARAMS, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);

                        /* ERP IE */
                        pframe = rtw_set_ie(pframe, WLAN_EID_ERP_INFO, 1, &erpinfo, &pattrib->pktlen);
                }


                /*  EXTERNDED SUPPORTED RATE */
                if (rate_len > 8)
                        pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (cur_network->supported_rates + 8), &pattrib->pktlen);


                /* todo:HT for adhoc */

        }

        pattrib->last_txcmdsz = pattrib->pktlen;


        dump_mgntframe(padapter, pmgntframe);

        return;

}

static int _issue_probereq(struct adapter *padapter,
                           struct ndis_802_11_ssid *pssid,
                           u8 *da, u8 ch, bool append_wps, bool wait_ack)
{
        int ret = _FAIL;
        struct xmit_frame               *pmgntframe;
        struct pkt_attrib               *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        unsigned char *mac;
        unsigned char bssrate[NumRates];
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        int     bssrate_len = 0;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                goto exit;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);


        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        mac = myid(&(padapter->eeprompriv));

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        if (da) {
                /* unicast probe request frame */
                memcpy(pwlanhdr->addr1, da, ETH_ALEN);
                memcpy(pwlanhdr->addr3, da, ETH_ALEN);
        } else {
                /* broadcast probe request frame */
                eth_broadcast_addr(pwlanhdr->addr1);
                eth_broadcast_addr(pwlanhdr->addr3);
        }

        memcpy(pwlanhdr->addr2, mac, ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_PROBEREQ);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        if (pssid)
                pframe = rtw_set_ie(pframe, WLAN_EID_SSID, pssid->ssid_length, pssid->ssid, &(pattrib->pktlen));
        else
                pframe = rtw_set_ie(pframe, WLAN_EID_SSID, 0, NULL, &(pattrib->pktlen));

        get_rate_set(padapter, bssrate, &bssrate_len);

        if (bssrate_len > 8) {
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, bssrate, &(pattrib->pktlen));
                pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
        } else {
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, bssrate_len, bssrate, &(pattrib->pktlen));
        }

        if (ch)
                pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, &ch, &pattrib->pktlen);

        if (append_wps) {
                /* add wps_ie for wps2.0 */
                if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
                        memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
                        pframe += pmlmepriv->wps_probe_req_ie_len;
                        pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
                }
        }

        pattrib->last_txcmdsz = pattrib->pktlen;

        if (wait_ack) {
                ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
        } else {
                dump_mgntframe(padapter, pmgntframe);
                ret = _SUCCESS;
        }

exit:
        return ret;
}

inline void issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da)
{
        _issue_probereq(padapter, pssid, da, 0, 1, false);
}

int issue_probereq_ex(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, u8 ch, bool append_wps,
        int try_cnt, int wait_ms)
{
        int ret;
        int i = 0;

        do {
                ret = _issue_probereq(padapter, pssid, da, ch, append_wps,
                                      wait_ms > 0);

                i++;

                if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
                        break;

                if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
                        msleep(wait_ms);

        } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));

        if (ret != _FAIL) {
                ret = _SUCCESS;
                #ifndef DBG_XMIT_ACK
                goto exit;
                #endif
        }

exit:
        return ret;
}

/*  if psta == NULL, indicate we are station(client) now... */
void issue_auth(struct adapter *padapter, struct sta_info *psta, unsigned short status)
{
        struct xmit_frame                       *pmgntframe;
        struct pkt_attrib                       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        unsigned int                                    val32;
        unsigned short                          val16;
        int use_shared_key = 0;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        __le16 le_tmp;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_AUTH);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);


        if (psta) { /*  for AP mode */
                memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);
                memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
                memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);

                /*  setting auth algo number */
                val16 = (u16)psta->authalg;

                if (status != WLAN_STATUS_SUCCESS)
                        val16 = 0;

                if (val16)
                        use_shared_key = 1;

                le_tmp = cpu_to_le16(val16);

                pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

                /*  setting auth seq number */
                val16 = (u16)psta->auth_seq;
                le_tmp = cpu_to_le16(val16);
                pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

                /*  setting status code... */
                val16 = status;
                le_tmp = cpu_to_le16(val16);
                pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

                /*  added challenging text... */
                if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
                        pframe = rtw_set_ie(pframe, WLAN_EID_CHALLENGE, 128, psta->chg_txt, &(pattrib->pktlen));

        } else {
                memcpy(pwlanhdr->addr1, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
                memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
                memcpy(pwlanhdr->addr3, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);

                /*  setting auth algo number */
                val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
                if (val16)
                        use_shared_key = 1;
                le_tmp = cpu_to_le16(val16);

                /* setting IV for auth seq #3 */
                if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
                        __le32 le_tmp32;

                        val32 = ((pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30));
                        le_tmp32 = cpu_to_le32(val32);
                        pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *)&le_tmp32, &(pattrib->pktlen));

                        pattrib->iv_len = 4;
                }

                pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

                /*  setting auth seq number */
                le_tmp = cpu_to_le16(pmlmeinfo->auth_seq);
                pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));


                /*  setting status code... */
                le_tmp = cpu_to_le16(status);
                pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

                /*  then checking to see if sending challenging text... */
                if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
                        pframe = rtw_set_ie(pframe, WLAN_EID_CHALLENGE, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));

                        SetPrivacy(fctrl);

                        pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);

                        pattrib->encrypt = _WEP40_;

                        pattrib->icv_len = 4;

                        pattrib->pktlen += pattrib->icv_len;

                }

        }

        pattrib->last_txcmdsz = pattrib->pktlen;

        rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
        dump_mgntframe(padapter, pmgntframe);
}


void issue_asocrsp(struct adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type)
{
        struct xmit_frame       *pmgntframe;
        struct ieee80211_hdr    *pwlanhdr;
        struct pkt_attrib *pattrib;
        unsigned char *pbuf, *pframe;
        unsigned short val;
        __le16 *fctrl;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
        u8 *ie = pnetwork->ies;
        __le16 lestatus, le_tmp;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);


        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
        memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy((void *)GetAddr3Ptr(pwlanhdr), get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);


        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
                SetFrameSubType(pwlanhdr, pkt_type);
        else
                return;

        pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen += pattrib->hdrlen;
        pframe += pattrib->hdrlen;

        /* capability */
        val = *(unsigned short *)rtw_get_capability_from_ie(ie);

        pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, (unsigned char *)&val, &(pattrib->pktlen));

        lestatus = cpu_to_le16(status);
        pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&lestatus, &(pattrib->pktlen));

        le_tmp = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
        pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

        if (pstat->bssratelen <= 8) {
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
        } else {
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, pstat->bssrateset, &(pattrib->pktlen));
                pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
        }

        if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
                uint ie_len = 0;

                /* FILL HT CAP INFO IE */
                /* p = hostapd_eid_ht_capabilities_info(hapd, p); */
                pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_HT_CAPABILITY, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
                if (pbuf && ie_len > 0) {
                        memcpy(pframe, pbuf, ie_len+2);
                        pframe += (ie_len+2);
                        pattrib->pktlen += (ie_len+2);
                }

                /* FILL HT ADD INFO IE */
                /* p = hostapd_eid_ht_operation(hapd, p); */
                pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_HT_OPERATION, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
                if (pbuf && ie_len > 0) {
                        memcpy(pframe, pbuf, ie_len+2);
                        pframe += (ie_len+2);
                        pattrib->pktlen += (ie_len+2);
                }

        }

        /* FILL WMM IE */
        if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
                uint ie_len = 0;
                unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};

                for (pbuf = ie + _BEACON_IE_OFFSET_; ; pbuf += (ie_len + 2)) {
                        pbuf = rtw_get_ie(pbuf, WLAN_EID_VENDOR_SPECIFIC, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_ - (ie_len + 2)));
                        if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
                                memcpy(pframe, pbuf, ie_len+2);
                                pframe += (ie_len+2);
                                pattrib->pktlen += (ie_len+2);

                                break;
                        }

                        if (!pbuf || ie_len == 0)
                                break;
                }

        }

        if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
                pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, 6, REALTEK_96B_IE, &(pattrib->pktlen));

        /* add WPS IE ie for wps 2.0 */
        if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
                memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);

                pframe += pmlmepriv->wps_assoc_resp_ie_len;
                pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
        }

        pattrib->last_txcmdsz = pattrib->pktlen;

        dump_mgntframe(padapter, pmgntframe);
}

void issue_assocreq(struct adapter *padapter)
{
        int ret = _FAIL;
        struct xmit_frame                               *pmgntframe;
        struct pkt_attrib                               *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr                    *pwlanhdr;
        __le16 *fctrl;
        __le16 val16;
        unsigned int                                    i, j, index = 0;
        unsigned char bssrate[NumRates], sta_bssrate[NumRates];
        struct ndis_80211_var_ie *pIE;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        int     bssrate_len = 0, sta_bssrate_len = 0;
        u8 vs_ie_length = 0;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                goto exit;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;
        memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_ASSOCREQ);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        /* caps */
        memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.ies), 2);

        pframe += 2;
        pattrib->pktlen += 2;

        /* listen interval */
        /* todo: listen interval for power saving */
        val16 = cpu_to_le16(3);
        memcpy(pframe, (unsigned char *)&val16, 2);
        pframe += 2;
        pattrib->pktlen += 2;

        /* SSID */
        pframe = rtw_set_ie(pframe, WLAN_EID_SSID,  pmlmeinfo->network.ssid.ssid_length, pmlmeinfo->network.ssid.ssid, &(pattrib->pktlen));

        /* supported rate & extended supported rate */

        /*  Check if the AP's supported rates are also supported by STA. */
        get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);

        if (pmlmeext->cur_channel == 14) /*  for JAPAN, channel 14 can only uses B Mode(CCK) */
                sta_bssrate_len = 4;


        /* for (i = 0; i < sta_bssrate_len; i++) { */
        /*  */

        for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
                if (pmlmeinfo->network.supported_rates[i] == 0)
                        break;
        }


        for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
                if (pmlmeinfo->network.supported_rates[i] == 0)
                        break;


                /*  Check if the AP's supported rates are also supported by STA. */
                for (j = 0; j < sta_bssrate_len; j++) {
                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
                        if ((pmlmeinfo->network.supported_rates[i] | IEEE80211_BASIC_RATE_MASK)
                                        == (sta_bssrate[j] | IEEE80211_BASIC_RATE_MASK))
                                break;
                }

                if (j != sta_bssrate_len)
                        /*  the rate is supported by STA */
                        bssrate[index++] = pmlmeinfo->network.supported_rates[i];
        }

        bssrate_len = index;

        if (bssrate_len == 0) {
                rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
                rtw_free_xmitframe(pxmitpriv, pmgntframe);
                goto exit; /* don't connect to AP if no joint supported rate */
        }


        if (bssrate_len > 8) {
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, bssrate, &(pattrib->pktlen));
                pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
        } else
                pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, bssrate_len, bssrate, &(pattrib->pktlen));

        /* vendor specific IE, such as WPA, WMM, WPS */
        for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
                pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);

                switch (pIE->element_id) {
                case WLAN_EID_VENDOR_SPECIFIC:
                        if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
                                        (!memcmp(pIE->data, WMM_OUI, 4)) ||
                                        (!memcmp(pIE->data, WPS_OUI, 4))) {
                                vs_ie_length = pIE->length;
                                if ((!padapter->registrypriv.wifi_spec) && (!memcmp(pIE->data, WPS_OUI, 4))) {
                                        /* Commented by Kurt 20110629
                                         * In some older APs, WPS handshake
                                         * would be fail if we append vendor
                                         * extensions information to AP
                                         */

                                        vs_ie_length = 14;
                                }

                                pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, vs_ie_length, pIE->data, &(pattrib->pktlen));
                        }
                        break;

                case WLAN_EID_RSN:
                        pframe = rtw_set_ie(pframe, WLAN_EID_RSN, pIE->length, pIE->data, &(pattrib->pktlen));
                        break;
                case WLAN_EID_HT_CAPABILITY:
                        if (padapter->mlmepriv.htpriv.ht_option) {
                                if (!(is_ap_in_tkip(padapter))) {
                                        memcpy(&(pmlmeinfo->HT_caps), pIE->data, sizeof(struct HT_caps_element));
                                        pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY, pIE->length, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
                                }
                        }
                        break;

                case WLAN_EID_EXT_CAPABILITY:
                        if (padapter->mlmepriv.htpriv.ht_option)
                                pframe = rtw_set_ie(pframe, WLAN_EID_EXT_CAPABILITY, pIE->length, pIE->data, &(pattrib->pktlen));
                        break;
                default:
                        break;
                }

                i += (pIE->length + 2);
        }

        if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
                pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, 6, REALTEK_96B_IE, &(pattrib->pktlen));


        pattrib->last_txcmdsz = pattrib->pktlen;
        dump_mgntframe(padapter, pmgntframe);

        ret = _SUCCESS;

exit:
        if (ret == _SUCCESS)
                rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
        else
                rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
}

/* when wait_ack is true, this function should be called at process context */
static int _issue_nulldata(struct adapter *padapter, unsigned char *da,
                           unsigned int power_mode, bool wait_ack)
{
        int ret = _FAIL;
        struct xmit_frame                       *pmgntframe;
        struct pkt_attrib                       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        struct xmit_priv *pxmitpriv;
        struct mlme_ext_priv *pmlmeext;
        struct mlme_ext_info *pmlmeinfo;

        if (!padapter)
                goto exit;

        pxmitpriv = &(padapter->xmitpriv);
        pmlmeext = &(padapter->mlmeextpriv);
        pmlmeinfo = &pmlmeext->mlmext_info;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                goto exit;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);
        pattrib->retry_ctrl = false;

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
                SetFrDs(fctrl);
        else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
                SetToDs(fctrl);

        if (power_mode)
                SetPwrMgt(fctrl);

        memcpy(pwlanhdr->addr1, da, ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_DATA_NULL);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        pattrib->last_txcmdsz = pattrib->pktlen;

        if (wait_ack) {
                ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
        } else {
                dump_mgntframe(padapter, pmgntframe);
                ret = _SUCCESS;
        }

exit:
        return ret;
}

/*
 * [IMPORTANT] Don't call this function in interrupt context
 *
 * When wait_ms > 0, this function should be called at process context
 * da == NULL for station mode
 */
int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
{
        int ret;
        int i = 0;
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct sta_info *psta;


        /* da == NULL, assume it's null data for sta to ap*/
        if (!da)
                da = get_my_bssid(&(pmlmeinfo->network));

        psta = rtw_get_stainfo(&padapter->stapriv, da);
        if (psta) {
                if (power_mode)
                        rtw_hal_macid_sleep(padapter, psta->mac_id);
                else
                        rtw_hal_macid_wakeup(padapter, psta->mac_id);
        } else {
                rtw_warn_on(1);
        }

        do {
                ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0);

                i++;

                if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
                        break;

                if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
                        msleep(wait_ms);

        } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));

        if (ret != _FAIL) {
                ret = _SUCCESS;
                #ifndef DBG_XMIT_ACK
                goto exit;
                #endif
        }

exit:
        return ret;
}

/*
 * [IMPORTANT] This function run in interrupt context
 *
 * The null data packet would be sent without power bit,
 * and not guarantee success.
 */
s32 issue_nulldata_in_interrupt(struct adapter *padapter, u8 *da)
{
        struct mlme_ext_priv *pmlmeext;
        struct mlme_ext_info *pmlmeinfo;


        pmlmeext = &padapter->mlmeextpriv;
        pmlmeinfo = &pmlmeext->mlmext_info;

        /* da == NULL, assume it's null data for sta to ap*/
        if (!da)
                da = get_my_bssid(&(pmlmeinfo->network));

        return _issue_nulldata(padapter, da, 0, false);
}

/* when wait_ack is true, this function should be called at process context */
static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
                               u16 tid, bool wait_ack)
{
        int ret = _FAIL;
        struct xmit_frame                       *pmgntframe;
        struct pkt_attrib                       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        u16 *qc;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                goto exit;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        pattrib->hdrlen += 2;
        pattrib->qos_en = true;
        pattrib->eosp = 1;
        pattrib->ack_policy = 0;
        pattrib->mdata = 0;

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
                SetFrDs(fctrl);
        else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
                SetToDs(fctrl);

        qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);

        SetPriority(qc, tid);

        SetEOSP(qc, pattrib->eosp);

        SetAckpolicy(qc, pattrib->ack_policy);

        memcpy(pwlanhdr->addr1, da, ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);

        pframe += sizeof(struct ieee80211_qos_hdr);
        pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);

        pattrib->last_txcmdsz = pattrib->pktlen;

        if (wait_ack) {
                ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
        } else {
                dump_mgntframe(padapter, pmgntframe);
                ret = _SUCCESS;
        }

exit:
        return ret;
}

/* when wait_ms >0 , this function should be called at process context */
/* da == NULL for station mode */
int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
{
        int ret;
        int i = 0;
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        /* da == NULL, assume it's null data for sta to ap*/
        if (!da)
                da = get_my_bssid(&(pmlmeinfo->network));

        do {
                ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0);

                i++;

                if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
                        break;

                if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
                        msleep(wait_ms);

        } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));

        if (ret != _FAIL) {
                ret = _SUCCESS;
                #ifndef DBG_XMIT_ACK
                goto exit;
                #endif
        }

exit:
        return ret;
}

static int _issue_deauth(struct adapter *padapter, unsigned char *da,
                         unsigned short reason, bool wait_ack)
{
        struct xmit_frame                       *pmgntframe;
        struct pkt_attrib                       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        int ret = _FAIL;
        __le16 le_tmp;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                goto exit;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);
        pattrib->retry_ctrl = false;

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        memcpy(pwlanhdr->addr1, da, ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_DEAUTH);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        le_tmp = cpu_to_le16(reason);
        pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));

        pattrib->last_txcmdsz = pattrib->pktlen;


        if (wait_ack) {
                ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
        } else {
                dump_mgntframe(padapter, pmgntframe);
                ret = _SUCCESS;
        }

exit:
        return ret;
}

int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
{
        return _issue_deauth(padapter, da, reason, false);
}

int issue_deauth_ex(struct adapter *padapter, u8 *da, unsigned short reason, int try_cnt,
        int wait_ms)
{
        int ret;
        int i = 0;

        do {
                ret = _issue_deauth(padapter, da, reason, wait_ms > 0);

                i++;

                if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
                        break;

                if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
                        mdelay(wait_ms);

        } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));

        if (ret != _FAIL) {
                ret = _SUCCESS;
                #ifndef DBG_XMIT_ACK
                goto exit;
                #endif
        }

exit:
        return ret;
}

void issue_action_SA_Query(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid)
{
        u8 category = RTW_WLAN_CATEGORY_SA_QUERY;
        struct xmit_frame               *pmgntframe;
        struct pkt_attrib               *pattrib;
        u8 *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        __le16 le_tmp;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        if (raddr)
                memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
        else
                memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_ACTION);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
        pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);

        switch (action) {
        case 0: /* SA Query req */
                pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&pmlmeext->sa_query_seq, &pattrib->pktlen);
                pmlmeext->sa_query_seq++;
                /* send sa query request to AP, AP should reply sa query response in 1 second */
                set_sa_query_timer(pmlmeext, 1000);
                break;

        case 1: /* SA Query rsp */
                le_tmp = cpu_to_le16(tid);
                pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&le_tmp, &pattrib->pktlen);
                break;
        default:
                break;
        }

        pattrib->last_txcmdsz = pattrib->pktlen;

        dump_mgntframe(padapter, pmgntframe);
}

void issue_action_BA(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status)
{
        u8 category = RTW_WLAN_CATEGORY_BACK;
        u16 start_seq;
        u16 BA_para_set;
        u16 reason_code;
        u16 BA_timeout_value;
        u16 BA_starting_seqctrl = 0;
        enum ieee80211_max_ampdu_length_exp max_rx_ampdu_factor;
        struct xmit_frame               *pmgntframe;
        struct pkt_attrib               *pattrib;
        u8 *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct sta_info *psta;
        struct sta_priv *pstapriv = &padapter->stapriv;
        struct registry_priv *pregpriv = &padapter->registrypriv;
        __le16 le_tmp;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        /* memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN); */
        memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_ACTION);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
        pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));

        if (category == 3) {
                switch (action) {
                case 0: /* ADDBA req */
                        do {
                                pmlmeinfo->dialogToken++;
                        } while (pmlmeinfo->dialogToken == 0);
                        pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));

                        if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter)) {
                                /*  A-MSDU NOT Supported */
                                BA_para_set = 0;
                                /*  immediate Block Ack */
                                BA_para_set |= BIT(1) & IEEE80211_ADDBA_PARAM_POLICY_MASK;
                                /*  TID */
                                BA_para_set |= (status << 2) & IEEE80211_ADDBA_PARAM_TID_MASK;
                                /*  max buffer size is 8 MSDU */
                                BA_para_set |= (8 << 6) & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
                        } else {
                                BA_para_set = (0x1002 | ((status & 0xf) << 2)); /* immediate ack & 64 buffer size */
                        }
                        le_tmp = cpu_to_le16(BA_para_set);
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));

                        BA_timeout_value = 5000;/*  5ms */
                        le_tmp = cpu_to_le16(BA_timeout_value);
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));

                        /* if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.mac_address)) != NULL) */
                        psta = rtw_get_stainfo(pstapriv, raddr);
                        if (psta) {
                                start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07] % 4096u) + 1;

                                psta->BA_starting_seqctrl[status & 0x07] = start_seq;

                                BA_starting_seqctrl = start_seq << 4;
                        }

                        le_tmp = cpu_to_le16(BA_starting_seqctrl);
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
                        break;

                case 1: /* ADDBA rsp */
                        pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->ADDBA_req.dialog_token), &(pattrib->pktlen));
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&status), &(pattrib->pktlen));
                        if (padapter->driver_rx_ampdu_factor != 0xFF)
                                max_rx_ampdu_factor =
                                  (enum ieee80211_max_ampdu_length_exp)padapter->driver_rx_ampdu_factor;
                        else
                                rtw_hal_get_def_var(padapter,
                                                    HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);

                        if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_64K)
                                BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
                        else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_32K)
                                BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0800); /* 32 buffer size */
                        else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_16K)
                                BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0400); /* 16 buffer size */
                        else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_8K)
                                BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0200); /* 8 buffer size */
                        else
                                BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */

                        if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter) &&
                            padapter->driver_rx_ampdu_factor == 0xFF) {
                                /*  max buffer size is 8 MSDU */
                                BA_para_set &= ~IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
                                BA_para_set |= (8 << 6) & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
                        }

                        if (pregpriv->ampdu_amsdu == 0)/* disabled */
                                le_tmp = cpu_to_le16(BA_para_set & ~BIT(0));
                        else if (pregpriv->ampdu_amsdu == 1)/* enabled */
                                le_tmp = cpu_to_le16(BA_para_set | BIT(0));
                        else /* auto */
                                le_tmp = cpu_to_le16(BA_para_set);

                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(pmlmeinfo->ADDBA_req.BA_timeout_value)), &(pattrib->pktlen));
                        break;
                case 2:/* DELBA */
                        BA_para_set = (status & 0x1F) << 3;
                        le_tmp = cpu_to_le16(BA_para_set);
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));

                        reason_code = 37;
                        le_tmp = cpu_to_le16(reason_code);
                        pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
                        break;
                default:
                        break;
                }
        }

        pattrib->last_txcmdsz = pattrib->pktlen;

        dump_mgntframe(padapter, pmgntframe);
}

static void issue_action_BSSCoexistPacket(struct adapter *padapter)
{
        struct list_head                *plist, *phead;
        unsigned char category, action;
        struct xmit_frame                       *pmgntframe;
        struct pkt_attrib                       *pattrib;
        unsigned char *pframe;
        struct ieee80211_hdr    *pwlanhdr;
        __le16 *fctrl;
        struct  wlan_network    *pnetwork = NULL;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct __queue          *queue  = &(pmlmepriv->scanned_queue);
        u8 InfoContent[16] = {0};
        u8 ICS[8][15];

        if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
                return;

        if (true == pmlmeinfo->bwmode_updated)
                return;

        category = RTW_WLAN_CATEGORY_PUBLIC;
        action = ACT_PUBLIC_BSSCOEXIST;

        pmgntframe = alloc_mgtxmitframe(pxmitpriv);
        if (!pmgntframe)
                return;

        /* update attribute */
        pattrib = &pmgntframe->attrib;
        update_mgntframe_attrib(padapter, pattrib);

        memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);

        pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
        pwlanhdr = (struct ieee80211_hdr *)pframe;

        fctrl = &(pwlanhdr->frame_control);
        *(fctrl) = 0;

        memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
        memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
        memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);

        SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
        pmlmeext->mgnt_seq++;
        SetFrameSubType(pframe, WIFI_ACTION);

        pframe += sizeof(struct ieee80211_hdr_3addr);
        pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);

        pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
        pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));


        /*  */
        if (pmlmepriv->num_FortyMHzIntolerant > 0) {
                u8 iedata = 0;

                iedata |= BIT(2);/* 20 MHz BSS Width Request */

                pframe = rtw_set_ie(pframe, WLAN_EID_BSS_COEX_2040,  1, &iedata, &(pattrib->pktlen));

        }


        /*  */
        memset(ICS, 0, sizeof(ICS));
        if (pmlmepriv->num_sta_no_ht > 0) {
                int i;

                spin_lock_bh(&(pmlmepriv->scanned_queue.lock));

                phead = get_list_head(queue);
                plist = get_next(phead);

                while (1) {
                        int len;
                        u8 *p;
                        struct wlan_bssid_ex *pbss_network;

                        if (phead == plist)
                                break;

                        pnetwork = container_of(plist, struct wlan_network, list);

                        plist = get_next(plist);

                        pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;

                        p = rtw_get_ie(pbss_network->ies + _FIXED_IE_LENGTH_, WLAN_EID_HT_CAPABILITY, &len, pbss_network->ie_length - _FIXED_IE_LENGTH_);
                        if (!p || len == 0) {/* non-HT */

                                if (pbss_network->configuration.ds_config <= 0)
                                        continue;

                                ICS[0][pbss_network->configuration.ds_config] = 1;

                                if (ICS[0][0] == 0)
                                        ICS[0][0] = 1;
                        }

                }

                spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));


                for (i = 0; i < 8; i++) {
                        int j, k = 0;

                        if (ICS[i][0] != 1)
                                continue;

                        InfoContent[k] = i;
                        /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
                        k++;

                        for (j = 1; j <= 14; j++) {
                                if (ICS[i][j] != 1)
                                        continue;

                                if (k < 16) {
                                        InfoContent[k] = j; /* channel number */
                                        /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
                                        k++;
                                }
                        }

                        pframe = rtw_set_ie(pframe, WLAN_EID_BSS_INTOLERANT_CHL_REPORT, k, InfoContent, &(pattrib->pktlen));

                }

        }


        pattrib->last_txcmdsz = pattrib->pktlen;

        dump_mgntframe(padapter, pmgntframe);
}

unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
{
        struct sta_priv *pstapriv = &padapter->stapriv;
        struct sta_info *psta = NULL;
        /* struct recv_reorder_ctrl *preorder_ctrl; */
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u16 tid;

        if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
                if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
                        return _SUCCESS;

        psta = rtw_get_stainfo(pstapriv, addr);
        if (!psta)
                return _SUCCESS;

        if (initiator == 0) {/*  recipient */
                for (tid = 0; tid < MAXTID; tid++) {
                        if (psta->recvreorder_ctrl[tid].enable) {
                                issue_action_BA(padapter, addr, WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
                                psta->recvreorder_ctrl[tid].enable = false;
                                psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
                        }
                }
        } else if (initiator == 1) {/*  originator */
                for (tid = 0; tid < MAXTID; tid++) {
                        if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
                                issue_action_BA(padapter, addr, WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
                                psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
                                psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);

                        }
                }
        }

        return _SUCCESS;

}

unsigned int send_beacon(struct adapter *padapter)
{
        u8 bxmitok = false;
        int     issue = 0;
        int poll = 0;

        rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
        rtw_hal_set_hwreg(padapter, HW_VAR_DL_BCN_SEL, NULL);
        do {
                issue_beacon(padapter, 100);
                issue++;
                do {
                        cond_resched();
                        rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
                        poll++;
                } while ((poll%10) != 0 && false == bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);

        } while (false == bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);

        if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
                return _FAIL;

        if (!bxmitok)
                return _FAIL;
        else
                return _SUCCESS;
}

/* Following are some utility functions for WiFi MLME */

void site_survey(struct adapter *padapter)
{
        unsigned char survey_channel = 0, val8;
        enum rt_scan_type       ScanType = SCAN_PASSIVE;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u32 initialgain = 0;
        u32 channel_scan_time_ms = 0;

        {
                struct rtw_ieee80211_channel *ch;

                if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
                        ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
                        survey_channel = ch->hw_value;
                        ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
                }
        }

        if (survey_channel != 0) {
                /* PAUSE 4-AC Queue when site_survey */
                /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
                /* val8 |= 0x0f; */
                /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
                if (pmlmeext->sitesurvey_res.channel_idx == 0) {
#ifdef DBG_FIXED_CHAN
                        if (pmlmeext->fixed_chan != 0xff)
                                set_channel_bwmode(padapter, pmlmeext->fixed_chan, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
                        else
#endif
                                set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
                } else {
#ifdef DBG_FIXED_CHAN
                        if (pmlmeext->fixed_chan != 0xff)
                                r8723bs_select_channel(padapter, pmlmeext->fixed_chan);
                        else
#endif
                                r8723bs_select_channel(padapter, survey_channel);
                }

                if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
                        {
                                int i;

                                for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
                                        if (!pmlmeext->sitesurvey_res.ssid[i].ssid_length)
                                                continue;

                                        /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
                                        if (padapter->registrypriv.wifi_spec)
                                                issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
                                        else
                                                issue_probereq_ex(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL, 0, 0, 0, 0);

                                        issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
                                }

                                if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
                                        /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
                                        if (padapter->registrypriv.wifi_spec)
                                                issue_probereq(padapter, NULL, NULL);
                                        else
                                                issue_probereq_ex(padapter, NULL, NULL, 0, 0, 0, 0);
                                        issue_probereq(padapter, NULL, NULL);
                                }
                        }
                }

                channel_scan_time_ms = pmlmeext->chan_scan_time;

                set_survey_timer(pmlmeext, channel_scan_time_ms);
        } else {

                /* channel number is 0 or this channel is not valid. */

                {
                        pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;

                        /* switch back to the original channel */
                        /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */

                        set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);

                        /* flush 4-AC Queue after site_survey */
                        /* val8 = 0; */
                        /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */

                        /* config MSR */
                        set_msr(padapter, (pmlmeinfo->state & 0x3));

                        initialgain = 0xff; /* restore RX GAIN */
                        rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
                        /* turn on dynamic functions */
                        Restore_DM_Func_Flag(padapter);
                        /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */

                        if (is_client_associated_to_ap(padapter))
                                issue_nulldata(padapter, NULL, 0, 3, 500);

                        val8 = 0; /* survey done */
                        rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));

                        report_surveydone_event(padapter);

                        pmlmeext->chan_scan_time = SURVEY_TO;
                        pmlmeext->sitesurvey_res.state = SCAN_DISABLE;

                        issue_action_BSSCoexistPacket(padapter);
                        issue_action_BSSCoexistPacket(padapter);
                        issue_action_BSSCoexistPacket(padapter);
                }
        }

        return;

}

/* collect bss info from Beacon and Probe request/response frames. */
u8 collect_bss_info(struct adapter *padapter, union recv_frame *precv_frame, struct wlan_bssid_ex *bssid)
{
        int     i;
        u32 len;
        u8 *p;
        u16 val16, subtype;
        u8 *pframe = precv_frame->u.hdr.rx_data;
        u32 packet_len = precv_frame->u.hdr.len;
        u8 ie_offset;
        struct registry_priv *pregistrypriv = &padapter->registrypriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        __le32 le32_tmp;

        len = packet_len - sizeof(struct ieee80211_hdr_3addr);

        if (len > MAX_IE_SZ)
                return _FAIL;

        memset(bssid, 0, sizeof(struct wlan_bssid_ex));

        subtype = GetFrameSubType(pframe);

        if (subtype == WIFI_BEACON) {
                bssid->reserved[0] = 1;
                ie_offset = _BEACON_IE_OFFSET_;
        } else {
                /*  FIXME : more type */
                if (subtype == WIFI_PROBERSP) {
                        ie_offset = _PROBERSP_IE_OFFSET_;
                        bssid->reserved[0] = 3;
                } else if (subtype == WIFI_PROBEREQ) {
                        ie_offset = _PROBEREQ_IE_OFFSET_;
                        bssid->reserved[0] = 2;
                } else {
                        bssid->reserved[0] = 0;
                        ie_offset = _FIXED_IE_LENGTH_;
                }
        }

        bssid->length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;

        /* below is to copy the information element */
        bssid->ie_length = len;
        memcpy(bssid->ies, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->ie_length);

        /* get the signal strength */
        bssid->rssi = precv_frame->u.hdr.attrib.phy_info.RecvSignalPower; /*  in dBM.raw data */
        bssid->phy_info.signal_quality = precv_frame->u.hdr.attrib.phy_info.SignalQuality;/* in percentage */
        bssid->phy_info.signal_strength = precv_frame->u.hdr.attrib.phy_info.SignalStrength;/* in percentage */

        /*  checking SSID */
        p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_SSID, &len, bssid->ie_length - ie_offset);
        if (!p)
                return _FAIL;

        if (*(p + 1)) {
                if (len > NDIS_802_11_LENGTH_SSID)
                        return _FAIL;

                memcpy(bssid->ssid.ssid, (p + 2), *(p + 1));
                bssid->ssid.ssid_length = *(p + 1);
        } else
                bssid->ssid.ssid_length = 0;

        memset(bssid->supported_rates, 0, NDIS_802_11_LENGTH_RATES_EX);

        /* checking rate info... */
        i = 0;
        p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_SUPP_RATES, &len, bssid->ie_length - ie_offset);
        if (p) {
                if (len > NDIS_802_11_LENGTH_RATES_EX)
                        return _FAIL;

                memcpy(bssid->supported_rates, (p + 2), len);
                i = len;
        }

        p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_EXT_SUPP_RATES, &len, bssid->ie_length - ie_offset);
        if (p) {
                if (len > (NDIS_802_11_LENGTH_RATES_EX-i))
                        return _FAIL;

                memcpy(bssid->supported_rates + i, (p + 2), len);
        }

        bssid->network_type_in_use = Ndis802_11OFDM24;

        if (bssid->ie_length < 12)
                return _FAIL;

        /*  Checking for ds_config */
        p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_DS_PARAMS, &len, bssid->ie_length - ie_offset);

        bssid->configuration.ds_config = 0;
        bssid->configuration.length = 0;

        if (p) {
                bssid->configuration.ds_config = *(p + 2);
        } else {
                /*  In 5G, some ap do not have DSSET IE */
                /*  checking HT info for channel */
                p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_HT_OPERATION, &len, bssid->ie_length - ie_offset);
                if (p) {
                        struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);

                        bssid->configuration.ds_config = HT_info->primary_channel;
                } else { /*  use current channel */
                        bssid->configuration.ds_config = rtw_get_oper_ch(padapter);
                }
        }

        memcpy(&le32_tmp, rtw_get_beacon_interval_from_ie(bssid->ies), 2);
        bssid->configuration.beacon_period = le32_to_cpu(le32_tmp);

        val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);

        if (val16 & BIT(0)) {
                bssid->infrastructure_mode = Ndis802_11Infrastructure;
                memcpy(bssid->mac_address, GetAddr2Ptr(pframe), ETH_ALEN);
        } else {
                bssid->infrastructure_mode = Ndis802_11IBSS;
                memcpy(bssid->mac_address, GetAddr3Ptr(pframe), ETH_ALEN);
        }

        if (val16 & BIT(4))
                bssid->privacy = 1;
        else
                bssid->privacy = 0;

        bssid->configuration.atim_window = 0;

        /* 20/40 BSS Coexistence check */
        if ((pregistrypriv->wifi_spec == 1) && (false == pmlmeinfo->bwmode_updated)) {
                struct mlme_priv *pmlmepriv = &padapter->mlmepriv;

                p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_HT_CAPABILITY, &len, bssid->ie_length - ie_offset);
                if (p && len > 0) {
                        struct HT_caps_element  *pHT_caps;

                        pHT_caps = (struct HT_caps_element      *)(p + 2);

                        if (le16_to_cpu(pHT_caps->u.HT_cap_element.HT_caps_info) & BIT(14))
                                pmlmepriv->num_FortyMHzIntolerant++;
                } else
                        pmlmepriv->num_sta_no_ht++;
        }

        /*  mark bss info receiving from nearby channel as signal_quality 101 */
        if (bssid->configuration.ds_config != rtw_get_oper_ch(padapter))
                bssid->phy_info.signal_quality = 101;

        return _SUCCESS;
}

void start_create_ibss(struct adapter *padapter)
{
        unsigned short  caps;
        u8 val8;
        u8 join_type;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));

        pmlmeext->cur_channel = (u8)pnetwork->configuration.ds_config;
        pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);

        /* update wireless mode */
        update_wireless_mode(padapter);

        /* update capability */
        caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
        update_capinfo(padapter, caps);
        if (caps&WLAN_CAPABILITY_IBSS) {/* adhoc master */
                val8 = 0xcf;
                rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));

                rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);

                /* switch channel */
                /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
                set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);

                beacon_timing_control(padapter);

                /* set msr to WIFI_FW_ADHOC_STATE */
                pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
                set_msr(padapter, (pmlmeinfo->state & 0x3));

                /* issue beacon */
                if (send_beacon(padapter) == _FAIL) {
                        report_join_res(padapter, -1);
                        pmlmeinfo->state = WIFI_FW_NULL_STATE;
                } else {
                        rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.mac_address);
                        join_type = 0;
                        rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));

                        report_join_res(padapter, 1);
                        pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
                        rtw_indicate_connect(padapter);
                }
        } else {
                return;
        }
        /* update bc/mc sta_info */
        update_bmc_sta(padapter);

}

void start_clnt_join(struct adapter *padapter)
{
        unsigned short  caps;
        u8 val8;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
        int beacon_timeout;

        /* update wireless mode */
        update_wireless_mode(padapter);

        /* update capability */
        caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
        update_capinfo(padapter, caps);
        if (caps&WLAN_CAPABILITY_ESS) {
                set_msr(padapter, WIFI_FW_STATION_STATE);

                val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;

                rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));

                /* Because of AP's not receiving deauth before
                 * AP may: 1)not response auth or 2)deauth us after link is complete
                 * issue deauth before issuing auth to deal with the situation
                 *
                 * Commented by Albert 2012/07/21
                 * For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it.
                 */
                {
                                /* To avoid connecting to AP fail during resume process, change retry count from 5 to 1 */
                                issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
                }

                /* here wait for receiving the beacon to start auth */
                /* and enable a timer */
                beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
                set_link_timer(pmlmeext, beacon_timeout);
                _set_timer(&padapter->mlmepriv.assoc_timer,
                        (REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO*REASSOC_LIMIT) + beacon_timeout);

                pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
        } else if (caps&WLAN_CAPABILITY_IBSS) { /* adhoc client */
                set_msr(padapter, WIFI_FW_ADHOC_STATE);

                val8 = 0xcf;
                rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));

                beacon_timing_control(padapter);

                pmlmeinfo->state = WIFI_FW_ADHOC_STATE;

                report_join_res(padapter, 1);
        } else {
                return;
        }

}

void start_clnt_auth(struct adapter *padapter)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        timer_delete_sync(&pmlmeext->link_timer);

        pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
        pmlmeinfo->state |= WIFI_FW_AUTH_STATE;

        pmlmeinfo->auth_seq = 1;
        pmlmeinfo->reauth_count = 0;
        pmlmeinfo->reassoc_count = 0;
        pmlmeinfo->link_count = 0;
        pmlmeext->retry = 0;


        netdev_dbg(padapter->pnetdev, "start auth\n");
        issue_auth(padapter, NULL, 0);

        set_link_timer(pmlmeext, REAUTH_TO);

}


void start_clnt_assoc(struct adapter *padapter)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        timer_delete_sync(&pmlmeext->link_timer);

        pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
        pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);

        issue_assocreq(padapter);

        set_link_timer(pmlmeext, REASSOC_TO);
}

unsigned int receive_disconnect(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        /* check A3 */
        if (!(!memcmp(MacAddr, get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
                return _SUCCESS;

        if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
                if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
                        pmlmeinfo->state = WIFI_FW_NULL_STATE;
                        report_del_sta_event(padapter, MacAddr, reason);

                } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
                        pmlmeinfo->state = WIFI_FW_NULL_STATE;
                        report_join_res(padapter, -2);
                }
        }

        return _SUCCESS;
}

static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
{
        struct registry_priv *pregistrypriv;
        struct mlme_ext_priv *pmlmeext;
        struct rt_channel_info *chplan_new;
        u8 channel;
        u8 i;


        pregistrypriv = &padapter->registrypriv;
        pmlmeext = &padapter->mlmeextpriv;

        /*  Adjust channel plan by AP Country IE */
        if (pregistrypriv->enable80211d &&
                (!pmlmeext->update_channel_plan_by_ap_done)) {
                u8 *ie, *p;
                u32 len;
                struct rt_channel_plan chplan_ap;
                struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
                u8 country[4];
                u8 fcn; /*  first channel number */
                u8 noc; /*  number of channel */
                u8 j, k;

                ie = rtw_get_ie(bssid->ies + _FIXED_IE_LENGTH_, WLAN_EID_COUNTRY, &len, bssid->ie_length - _FIXED_IE_LENGTH_);
                if (!ie)
                        return;
                if (len < 6)
                        return;

                ie += 2;
                p = ie;
                ie += len;

                memset(country, 0, 4);
                memcpy(country, p, 3);
                p += 3;

                i = 0;
                while ((ie - p) >= 3) {
                        fcn = *(p++);
                        noc = *(p++);
                        p++;

                        for (j = 0; j < noc; j++) {
                                if (fcn <= 14)
                                        channel = fcn + j; /*  2.4 GHz */
                                else
                                        channel = fcn + j*4; /*  5 GHz */

                                chplan_ap.Channel[i++] = channel;
                        }
                }
                chplan_ap.Len = i;

                memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));

                memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
                chplan_new = pmlmeext->channel_set;

                i = j = k = 0;
                if (pregistrypriv->wireless_mode & WIRELESS_11G) {
                        do {
                                if ((i == MAX_CHANNEL_NUM) ||
                                        (chplan_sta[i].ChannelNum == 0) ||
                                        (chplan_sta[i].ChannelNum > 14))
                                        break;

                                if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
                                        break;

                                if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
                                        chplan_new[k].ChannelNum = chplan_ap.Channel[j];
                                        chplan_new[k].ScanType = SCAN_ACTIVE;
                                        i++;
                                        j++;
                                        k++;
                                } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
                                        chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
                                        chplan_new[k].ScanType = SCAN_PASSIVE;
                                        i++;
                                        k++;
                                } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
                                        chplan_new[k].ChannelNum = chplan_ap.Channel[j];
                                        chplan_new[k].ScanType = SCAN_ACTIVE;
                                        j++;
                                        k++;
                                }
                        } while (1);

                        /*  change AP not support channel to Passive scan */
                        while ((i < MAX_CHANNEL_NUM) &&
                                (chplan_sta[i].ChannelNum != 0) &&
                                (chplan_sta[i].ChannelNum <= 14)) {

                                chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
                                chplan_new[k].ScanType = SCAN_PASSIVE;
                                i++;
                                k++;
                        }

                        /*  add channel AP supported */
                        while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
                                chplan_new[k].ChannelNum = chplan_ap.Channel[j];
                                chplan_new[k].ScanType = SCAN_ACTIVE;
                                j++;
                                k++;
                        }
                } else {
                        /*  keep original STA 2.4G channel plan */
                        while ((i < MAX_CHANNEL_NUM) &&
                                (chplan_sta[i].ChannelNum != 0) &&
                                (chplan_sta[i].ChannelNum <= 14)) {
                                chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
                                chplan_new[k].ScanType = chplan_sta[i].ScanType;
                                i++;
                                k++;
                        }

                        /*  skip AP 2.4G channel plan */
                        while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
                                j++;
                }

                pmlmeext->update_channel_plan_by_ap_done = 1;
        }

        /*  If channel is used by AP, set channel scan type to active */
        channel = bssid->configuration.ds_config;
        chplan_new = pmlmeext->channel_set;
        i = 0;
        while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
                if (chplan_new[i].ChannelNum == channel) {
                        if (chplan_new[i].ScanType == SCAN_PASSIVE)
                                chplan_new[i].ScanType = SCAN_ACTIVE;
                        break;
                }
                i++;
        }
}

/* Following are the functions to report events */

void report_survey_event(struct adapter *padapter, union recv_frame *precv_frame)
{
        struct cmd_obj *pcmd_obj;
        u8 *pevtcmd;
        u32 cmdsz;
        struct survey_event     *psurvey_evt;
        struct C2HEvent_Header *pc2h_evt_hdr;
        struct mlme_ext_priv *pmlmeext;
        struct cmd_priv *pcmdpriv;
        /* u8 *pframe = precv_frame->u.hdr.rx_data; */
        /* uint len = precv_frame->u.hdr.len; */

        if (!padapter)
                return;

        pmlmeext = &padapter->mlmeextpriv;
        pcmdpriv = &padapter->cmdpriv;

        pcmd_obj = kzalloc_obj(*pcmd_obj, GFP_ATOMIC);
        if (!pcmd_obj)
                return;

        cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
        if (!pevtcmd) {
                kfree(pcmd_obj);
                return;
        }

        INIT_LIST_HEAD(&pcmd_obj->list);

        pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
        pcmd_obj->cmdsz = cmdsz;
        pcmd_obj->parmbuf = pevtcmd;

        pcmd_obj->rsp = NULL;
        pcmd_obj->rspsz  = 0;

        pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
        pc2h_evt_hdr->len = sizeof(struct survey_event);
        pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
        pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);

        psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));

        if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
                kfree(pcmd_obj);
                kfree(pevtcmd);
                return;
        }

        process_80211d(padapter, &psurvey_evt->bss);

        rtw_enqueue_cmd(pcmdpriv, pcmd_obj);

        pmlmeext->sitesurvey_res.bss_cnt++;

        return;

}

void report_surveydone_event(struct adapter *padapter)
{
        struct cmd_obj *pcmd_obj;
        u8 *pevtcmd;
        u32 cmdsz;
        struct surveydone_event *psurveydone_evt;
        struct C2HEvent_Header  *pc2h_evt_hdr;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

        pcmd_obj = kzalloc_obj(*pcmd_obj, GFP_ATOMIC);
        if (!pcmd_obj)
                return;

        cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));
        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
        if (!pevtcmd) {
                kfree(pcmd_obj);
                return;
        }

        INIT_LIST_HEAD(&pcmd_obj->list);

        pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
        pcmd_obj->cmdsz = cmdsz;
        pcmd_obj->parmbuf = pevtcmd;

        pcmd_obj->rsp = NULL;
        pcmd_obj->rspsz  = 0;

        pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
        pc2h_evt_hdr->len = sizeof(struct surveydone_event);
        pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
        pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);

        psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
        psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;

        rtw_enqueue_cmd(pcmdpriv, pcmd_obj);

        return;

}

void report_join_res(struct adapter *padapter, int res)
{
        struct cmd_obj *pcmd_obj;
        u8 *pevtcmd;
        u32 cmdsz;
        struct joinbss_event            *pjoinbss_evt;
        struct C2HEvent_Header  *pc2h_evt_hdr;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

        pcmd_obj = kzalloc_obj(*pcmd_obj, GFP_ATOMIC);
        if (!pcmd_obj)
                return;

        cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
        if (!pevtcmd) {
                kfree(pcmd_obj);
                return;
        }

        INIT_LIST_HEAD(&pcmd_obj->list);

        pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
        pcmd_obj->cmdsz = cmdsz;
        pcmd_obj->parmbuf = pevtcmd;

        pcmd_obj->rsp = NULL;
        pcmd_obj->rspsz  = 0;

        pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
        pc2h_evt_hdr->len = sizeof(struct joinbss_event);
        pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
        pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);

        pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
        memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
        pjoinbss_evt->network.join_res  = pjoinbss_evt->network.aid = res;


        rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);


        rtw_enqueue_cmd(pcmdpriv, pcmd_obj);

        return;

}

void report_wmm_edca_update(struct adapter *padapter)
{
        struct cmd_obj *pcmd_obj;
        u8 *pevtcmd;
        u32 cmdsz;
        struct wmm_event                *pwmm_event;
        struct C2HEvent_Header  *pc2h_evt_hdr;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

        pcmd_obj = kzalloc_obj(*pcmd_obj, GFP_ATOMIC);
        if (!pcmd_obj)
                return;

        cmdsz = (sizeof(struct wmm_event) + sizeof(struct C2HEvent_Header));
        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
        if (!pevtcmd) {
                kfree(pcmd_obj);
                return;
        }

        INIT_LIST_HEAD(&pcmd_obj->list);

        pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
        pcmd_obj->cmdsz = cmdsz;
        pcmd_obj->parmbuf = pevtcmd;

        pcmd_obj->rsp = NULL;
        pcmd_obj->rspsz  = 0;

        pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
        pc2h_evt_hdr->len = sizeof(struct wmm_event);
        pc2h_evt_hdr->ID = GEN_EVT_CODE(_WMM);
        pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);

        pwmm_event = (struct wmm_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
        pwmm_event->wmm = 0;

        rtw_enqueue_cmd(pcmdpriv, pcmd_obj);

        return;

}

void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
{
        struct cmd_obj *pcmd_obj;
        u8 *pevtcmd;
        u32 cmdsz;
        struct sta_info *psta;
        int     mac_id;
        struct stadel_event                     *pdel_sta_evt;
        struct C2HEvent_Header  *pc2h_evt_hdr;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

        pcmd_obj = kzalloc_obj(*pcmd_obj, GFP_ATOMIC);
        if (!pcmd_obj)
                return;

        cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
        if (!pevtcmd) {
                kfree(pcmd_obj);
                return;
        }

        INIT_LIST_HEAD(&pcmd_obj->list);

        pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
        pcmd_obj->cmdsz = cmdsz;
        pcmd_obj->parmbuf = pevtcmd;

        pcmd_obj->rsp = NULL;
        pcmd_obj->rspsz  = 0;

        pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
        pc2h_evt_hdr->len = sizeof(struct stadel_event);
        pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
        pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);

        pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
        memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
        memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);


        psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
        if (psta)
                mac_id = (int)psta->mac_id;
        else
                mac_id = (-1);

        pdel_sta_evt->mac_id = mac_id;

        rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
}

void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
{
        struct cmd_obj *pcmd_obj;
        u8 *pevtcmd;
        u32 cmdsz;
        struct stassoc_event            *padd_sta_evt;
        struct C2HEvent_Header  *pc2h_evt_hdr;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

        pcmd_obj = kzalloc_obj(*pcmd_obj, GFP_ATOMIC);
        if (!pcmd_obj)
                return;

        cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
        if (!pevtcmd) {
                kfree(pcmd_obj);
                return;
        }

        INIT_LIST_HEAD(&pcmd_obj->list);

        pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
        pcmd_obj->cmdsz = cmdsz;
        pcmd_obj->parmbuf = pevtcmd;

        pcmd_obj->rsp = NULL;
        pcmd_obj->rspsz  = 0;

        pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
        pc2h_evt_hdr->len = sizeof(struct stassoc_event);
        pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
        pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);

        padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
        memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
        padd_sta_evt->cam_id = cam_idx;

        rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
}

/* Following are the event callback functions */

/* for sta/adhoc mode */
void update_sta_info(struct adapter *padapter, struct sta_info *psta)
{
        struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        /* ERP */
        VCS_update(padapter, psta);

        /* HT */
        if (pmlmepriv->htpriv.ht_option) {
                psta->htpriv.ht_option = true;

                psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;

                psta->htpriv.rx_ampdu_min_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para&IEEE80211_HT_CAP_AMPDU_DENSITY)>>2;

                if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_20))
                        psta->htpriv.sgi_20m = true;

                if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_40))
                        psta->htpriv.sgi_40m = true;

                psta->qos_option = true;

                psta->htpriv.ldpc_cap = pmlmepriv->htpriv.ldpc_cap;
                psta->htpriv.stbc_cap = pmlmepriv->htpriv.stbc_cap;
                psta->htpriv.beamform_cap = pmlmepriv->htpriv.beamform_cap;

                memcpy(&psta->htpriv.ht_cap, &pmlmeinfo->HT_caps, sizeof(struct ieee80211_ht_cap));
        } else {
                psta->htpriv.ht_option = false;

                psta->htpriv.ampdu_enable = false;

                psta->htpriv.sgi_20m = false;
                psta->htpriv.sgi_40m = false;
                psta->qos_option = false;

        }

        psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;

        psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
        psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */

        psta->bw_mode = pmlmeext->cur_bwmode;

        /* QoS */
        if (pmlmepriv->qospriv.qos_option)
                psta->qos_option = true;

        update_ldpc_stbc_cap(psta);

        spin_lock_bh(&psta->lock);
        psta->state = _FW_LINKED;
        spin_unlock_bh(&psta->lock);

}

static void rtw_mlmeext_disconnect(struct adapter *padapter)
{
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));

        /* set_opmode_cmd(padapter, infra_client_with_mlme); */

        /* For safety, prevent from keeping macid sleep.
         * If we can sure all power mode enter/leave are paired,
         * this check can be removed.
         * Lucas@20131113
         */
        /* wakeup macid after disconnect. */
        {
                struct sta_info *psta;

                psta = rtw_get_stainfo(&padapter->stapriv, get_my_bssid(pnetwork));
                if (psta)
                        rtw_hal_macid_wakeup(padapter, psta->mac_id);
        }

        rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
        rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);

        /* set MSR to no link state -> infra. mode */
        set_msr(padapter, _HW_STATE_STATION_);

        pmlmeinfo->state = WIFI_FW_NULL_STATE;

        /* switch to the 20M Hz mode after disconnect */
        pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
        pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;

        set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);

        flush_all_cam_entry(padapter);

        timer_delete_sync(&pmlmeext->link_timer);

        /* pmlmepriv->LinkDetectInfo.TrafficBusyState = false; */
        pmlmepriv->LinkDetectInfo.TrafficTransitionCount = 0;
        pmlmepriv->LinkDetectInfo.LowPowerTransitionCount = 0;

}

void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
        struct sta_priv *pstapriv = &padapter->stapriv;
        u8 join_type;
        struct sta_info *psta;

        if (join_res < 0) {
                join_type = 1;
                rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
                rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);

                return;
        }

        if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
                /* update bc/mc sta_info */
                update_bmc_sta(padapter);


        /* turn on dynamic functions */
        Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);

        /*  update IOT-related issue */
        update_IOT_info(padapter);

        rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->supported_rates);

        /* BCN interval */
        rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));

        /* update capability */
        update_capinfo(padapter, pmlmeinfo->capability);

        /* WMM, Update EDCA param */
        WMMOnAssocRsp(padapter);

        /* HT */
        HTOnAssocRsp(padapter);

        /* Set cur_channel&cur_bwmode&cur_ch_offset */
        set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);

        psta = rtw_get_stainfo(pstapriv, cur_network->mac_address);
        if (psta) { /* only for infra. mode */

                pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;

                psta->wireless_mode = pmlmeext->cur_wireless_mode;

                /* set per sta rate after updating HT cap. */
                set_sta_rate(padapter, psta);

                rtw_sta_media_status_rpt(padapter, psta, 1);

                /*
                 * wakeup macid after join bss successfully to ensure
                 * the subsequent data frames can be sent out normally
                 */
                rtw_hal_macid_wakeup(padapter, psta->mac_id);
        }

        join_type = 2;
        rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));

        if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
                /*  correcting TSF */
                correct_TSF(padapter, pmlmeext);

                /* set_link_timer(pmlmeext, DISCONNECT_TO); */
        }

        rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
}

/* currently only adhoc mode will go here */
void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
{
        struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 join_type;

        if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
                if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) { /* adhoc master or sta_count>1 */

                        /* nothing to do */
                } else { /* adhoc client */
                        /* update TSF Value */
                        /* update_TSF(pmlmeext, pframe, len); */

                        /*  correcting TSF */
                        correct_TSF(padapter, pmlmeext);

                        /* start beacon */
                        if (send_beacon(padapter) == _FAIL) {
                                pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;

                                pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;

                                return;
                        }

                        pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;

                }

                join_type = 2;
                rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
        }

        pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;

        psta->bssratelen = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates);
        memcpy(psta->bssrateset, pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates, psta->bssratelen);

        /* update adhoc sta_info */
        update_sta_info(padapter, psta);

        rtw_hal_update_sta_rate_mask(padapter, psta);

        /*  ToDo: HT for Ad-hoc */
        psta->wireless_mode = rtw_check_network_type(psta->bssrateset, psta->bssratelen, pmlmeext->cur_channel);
        psta->raid = networktype_to_raid_ex(padapter, psta);

        /* rate radaptive */
        Update_RA_Entry(padapter, psta);
}

void mlmeext_sta_del_event_callback(struct adapter *padapter)
{
        if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter))
                rtw_mlmeext_disconnect(padapter);
}

/* Following are the functions for the timer handlers */

void _linked_info_dump(struct adapter *padapter)
{
        int i;
        struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info    *pmlmeinfo = &pmlmeext->mlmext_info;
        int UndecoratedSmoothedPWDB;
        struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);

        if (padapter->bLinkInfoDump) {

                if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
                        rtw_hal_get_def_var(padapter,
                                            HAL_DEF_UNDERCORATEDSMOOTHEDPWDB,
                                            &UndecoratedSmoothedPWDB);

                for (i = 0; i < NUM_STA; i++) {
                        if (pdvobj->macid[i]) {
                                if (i != 1) /* skip bc/mc sta */
                                        /*   tx info ============ */
                                        rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &i);
                        }
                }
        }
}

static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
{
        u8 ret = false;

        if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta))
                && sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta)
                && sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta)
        ) {
                ret = false;
        } else {
                ret = true;
        }

        sta_update_last_rx_pkts(psta);

        return ret;
}

void linked_status_chk(struct adapter *padapter)
{
        u32 i;
        struct sta_info *psta;
        struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct sta_priv *pstapriv = &padapter->stapriv;

        if (is_client_associated_to_ap(padapter)) {
                /* linked infrastructure client mode */

                int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
                int rx_chk_limit;
                int link_count_limit;

                #if defined(DBG_ROAMING_TEST)
                rx_chk_limit = 1;
                #else
                rx_chk_limit = 8;
                #endif
                link_count_limit = 7; /*  16 sec */

                /*  Marked by Kurt 20130715 */
                /*  For WiDi 3.5 and latered on, they don't ask WiDi sink to do roaming, */
                /* so we could not check rx limit that strictly. */
                /*  todo: To check why we under miracast session, rx_chk would be false */
                psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.mac_address);
                if (psta) {
                        if (chk_ap_is_alive(padapter, psta) == false)
                                rx_chk = _FAIL;

                        if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
                                tx_chk = _FAIL;

                        {
                                if (rx_chk != _SUCCESS) {
                                        if (pmlmeext->retry == 0) {
                                                issue_probereq_ex(padapter,
                                                                  &pmlmeinfo->network.ssid,
                                                                  pmlmeinfo->network.mac_address,
                                                                  0, 0, 0, 0);
                                                issue_probereq_ex(padapter,
                                                                  &pmlmeinfo->network.ssid,
                                                                  pmlmeinfo->network.mac_address,
                                                                  0, 0, 0, 0);
                                                issue_probereq_ex(padapter,
                                                                  &pmlmeinfo->network.ssid,
                                                                  pmlmeinfo->network.mac_address,
                                                                  0, 0, 0, 0);
                                        }
                                }

                                if (tx_chk != _SUCCESS &&
                                    pmlmeinfo->link_count++ == link_count_limit)
                                        tx_chk = issue_nulldata_in_interrupt(padapter, NULL);
                        }

                        if (rx_chk == _FAIL) {
                                pmlmeext->retry++;
                                if (pmlmeext->retry > rx_chk_limit) {
                                        netdev_dbg(padapter->pnetdev,
                                                   FUNC_ADPT_FMT " disconnect or roaming\n",
                                                   FUNC_ADPT_ARG(padapter));
                                        receive_disconnect(padapter, pmlmeinfo->network.mac_address
                                                , WLAN_REASON_EXPIRATION_CHK);
                                        return;
                                }
                        } else {
                                pmlmeext->retry = 0;
                        }

                        if (tx_chk == _FAIL) {
                                pmlmeinfo->link_count %= (link_count_limit + 1);
                        } else {
                                pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
                                pmlmeinfo->link_count = 0;
                        }

                } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.mac_address)) != NULL) */
        } else if (is_client_associated_to_ibss(padapter)) {
                /* linked IBSS mode */
                /* for each assoc list entry to check the rx pkt counter */
                for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
                        if (pmlmeinfo->FW_sta_info[i].status == 1) {
                                psta = pmlmeinfo->FW_sta_info[i].psta;

                                if (psta == NULL)
                                        continue;

                                if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
                                        if (pmlmeinfo->FW_sta_info[i].retry < 3) {
                                                pmlmeinfo->FW_sta_info[i].retry++;
                                        } else {
                                                pmlmeinfo->FW_sta_info[i].retry = 0;
                                                pmlmeinfo->FW_sta_info[i].status = 0;
                                                report_del_sta_event(padapter, psta->hwaddr
                                                        , 65535/*  indicate disconnect caused by no rx */
                                                );
                                        }
                                } else {
                                        pmlmeinfo->FW_sta_info[i].retry = 0;
                                        pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
                                }
                        }
                }

                /* set_link_timer(pmlmeext, DISCONNECT_TO); */
        }
}

void survey_timer_hdl(struct timer_list *t)
{
        struct adapter *padapter =
                timer_container_of(padapter, t, mlmeextpriv.survey_timer);
        struct cmd_obj  *ph2c;
        struct sitesurvey_parm  *psurveyPara;
        struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        /* issue rtw_sitesurvey_cmd */
        if (pmlmeext->sitesurvey_res.state > SCAN_START) {
                if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
                        pmlmeext->sitesurvey_res.channel_idx++;

                if (pmlmeext->scan_abort) {
                        pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;

                        pmlmeext->scan_abort = false;/* reset */
                }

                ph2c = kzalloc_obj(*ph2c, GFP_ATOMIC);
                if (!ph2c)
                        return;

                psurveyPara = kzalloc_obj(*psurveyPara, GFP_ATOMIC);
                if (!psurveyPara) {
                        kfree(ph2c);
                        return;
                }

                init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
                rtw_enqueue_cmd(pcmdpriv, ph2c);
        }
}

void link_timer_hdl(struct timer_list *t)
{
        struct adapter *padapter =
                timer_container_of(padapter, t, mlmeextpriv.link_timer);
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;


        if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
                pmlmeinfo->state = WIFI_FW_NULL_STATE;
                report_join_res(padapter, -3);
        } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
                /* re-auth timer */
                if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
                        pmlmeinfo->state = 0;
                        report_join_res(padapter, -1);
                        return;
                }

                pmlmeinfo->auth_seq = 1;
                issue_auth(padapter, NULL, 0);
                set_link_timer(pmlmeext, REAUTH_TO);
        } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
                /* re-assoc timer */
                if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
                        pmlmeinfo->state = WIFI_FW_NULL_STATE;
                        report_join_res(padapter, -2);
                        return;
                }

                issue_assocreq(padapter);
                set_link_timer(pmlmeext, REASSOC_TO);
        }
}

void addba_timer_hdl(struct timer_list *t)
{
        struct sta_info *psta = timer_container_of(psta, t, addba_retry_timer);
        struct ht_priv *phtpriv;

        if (!psta)
                return;

        phtpriv = &psta->htpriv;

        if (phtpriv->ht_option && phtpriv->ampdu_enable) {
                if (phtpriv->candidate_tid_bitmap)
                        phtpriv->candidate_tid_bitmap = 0x0;

        }
}

void sa_query_timer_hdl(struct timer_list *t)
{
        struct adapter *padapter =
                timer_container_of(padapter, t, mlmeextpriv.sa_query_timer);
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        /* disconnect */
        spin_lock_bh(&pmlmepriv->lock);

        if (check_fwstate(pmlmepriv, _FW_LINKED)) {
                rtw_disassoc_cmd(padapter, 0, true);
                rtw_indicate_disconnect(padapter);
                rtw_free_assoc_resources(padapter, 1);
        }

        spin_unlock_bh(&pmlmepriv->lock);
}

u8 NULL_hdl(struct adapter *padapter, u8 *pbuf)
{
        return H2C_SUCCESS;
}

u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
{
        u8 type;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;

        if (psetop->mode == Ndis802_11APMode) {
                pmlmeinfo->state = WIFI_FW_AP_STATE;
                type = _HW_STATE_AP_;
                /* start_ap_mode(padapter); */
        } else if (psetop->mode == Ndis802_11Infrastructure) {
                pmlmeinfo->state &= ~(BIT(0) | BIT(1));/*  clear state */
                pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
                type = _HW_STATE_STATION_;
        } else if (psetop->mode == Ndis802_11IBSS) {
                type = _HW_STATE_ADHOC_;
        } else {
                type = _HW_STATE_NOLINK_;
        }

        rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
        /* set_msr(padapter, type); */

        if (psetop->mode == Ndis802_11APMode) {
                /*  Do this after port switch to */
                /*  prevent from downloading rsvd page to wrong port */
                rtw_btcoex_MediaStatusNotify(padapter, 1); /* connect */
        }

        return H2C_SUCCESS;
}

u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex    *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
        struct joinbss_parm *pparm = (struct joinbss_parm *)pbuf;
        /* u32 initialgain; */

        if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
                start_bss_network(padapter);
                return H2C_SUCCESS;
        }

        /* below is for ad-hoc master */
        if (pparm->network.infrastructure_mode == Ndis802_11IBSS) {
                rtw_joinbss_reset(padapter);

                pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
                pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
                pmlmeinfo->ERP_enable = 0;
                pmlmeinfo->WMM_enable = 0;
                pmlmeinfo->HT_enable = 0;
                pmlmeinfo->HT_caps_enable = 0;
                pmlmeinfo->HT_info_enable = 0;
                pmlmeinfo->agg_enable_bitmap = 0;
                pmlmeinfo->candidate_tid_bitmap = 0;

                /* disable dynamic functions, such as high power, DIG */
                Save_DM_Func_Flag(padapter);
                Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);

                /* config the initial gain under linking, need to write the BB registers */
                /* initialgain = 0x1E; */
                /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */

                /* cancel link timer */
                timer_delete_sync(&pmlmeext->link_timer);

                /* clear CAM */
                flush_all_cam_entry(padapter);

                memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, ie_length));
                pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;

                if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
                        return H2C_PARAMETERS_ERROR;

                memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);

                start_create_ibss(padapter);

        }

        return H2C_SUCCESS;

}

u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
{
        u8 join_type;
        struct ndis_80211_var_ie *pIE;
        struct registry_priv *pregpriv = &padapter->registrypriv;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
        u32 i;
        u8 cbw40_enable = 0;
        /* u32 initialgain; */
        /* u32 acparm; */
        u8 ch, bw, offset;

        /* check already connecting to AP or not */
        if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
                if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
                        issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
                pmlmeinfo->state = WIFI_FW_NULL_STATE;

                /* clear CAM */
                flush_all_cam_entry(padapter);

                timer_delete_sync(&pmlmeext->link_timer);

                /* set MSR to nolink -> infra. mode */
                /* set_msr(padapter, _HW_STATE_NOLINK_); */
                set_msr(padapter, _HW_STATE_STATION_);


                rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
        }

        rtw_joinbss_reset(padapter);

        pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
        pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
        pmlmeinfo->ERP_enable = 0;
        pmlmeinfo->WMM_enable = 0;
        pmlmeinfo->HT_enable = 0;
        pmlmeinfo->HT_caps_enable = 0;
        pmlmeinfo->HT_info_enable = 0;
        pmlmeinfo->agg_enable_bitmap = 0;
        pmlmeinfo->candidate_tid_bitmap = 0;
        pmlmeinfo->bwmode_updated = false;
        /* pmlmeinfo->assoc_AP_vendor = HT_IOT_PEER_MAX; */
        pmlmeinfo->VHT_enable = 0;

        memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, ie_length));
        pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;

        if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
                return H2C_PARAMETERS_ERROR;

        memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);

        pmlmeext->cur_channel = (u8)pnetwork->configuration.ds_config;
        pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);

        /* Check AP vendor to move rtw_joinbss_cmd() */
        /* pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->ies, pnetwork->ie_length); */

        /* sizeof(struct ndis_802_11_fix_ie) */
        for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) {
                pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i);

                switch (pIE->element_id) {
                case WLAN_EID_VENDOR_SPECIFIC:/* Get WMM IE. */
                        if (!memcmp(pIE->data, WMM_OUI, 4))
                                WMM_param_handler(padapter, pIE);
                        break;

                case WLAN_EID_HT_CAPABILITY:    /* Get HT Cap IE. */
                        pmlmeinfo->HT_caps_enable = 1;
                        break;

                case WLAN_EID_HT_OPERATION:     /* Get HT Info IE. */
                        pmlmeinfo->HT_info_enable = 1;

                        /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
                        {
                                struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);

                                if (pnetwork->configuration.ds_config <= 14) {
                                        if ((pregpriv->bw_mode & 0x0f) > CHANNEL_WIDTH_20)
                                                cbw40_enable = 1;
                                }

                                if ((cbw40_enable) && (pht_info->infos[0] & BIT(2))) {
                                        /* switch to the 40M Hz mode according to the AP */
                                        pmlmeext->cur_bwmode = CHANNEL_WIDTH_40;
                                        switch (pht_info->infos[0] & 0x3) {
                                        case 1:
                                                pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
                                                break;

                                        case 3:
                                                pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
                                                break;

                                        default:
                                                pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
                                                pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
                                                break;
                                        }
                                }
                        }
                        break;
                default:
                        break;
                }

                i += (pIE->length + 2);
        }

        /* check channel, bandwidth, offset and switch */
        if (rtw_chk_start_clnt_join(padapter, &ch, &bw, &offset) == _FAIL) {
                report_join_res(padapter, (-4));
                return H2C_SUCCESS;
        }

        /* disable dynamic functions, such as high power, DIG */
        /* Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false); */

        /* config the initial gain under linking, need to write the BB registers */
        /* initialgain = 0x1E; */
        /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */

        rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.mac_address);
        join_type = 0;
        rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
        rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);

        set_channel_bwmode(padapter, ch, offset, bw);

        /* cancel link timer */
        timer_delete_sync(&pmlmeext->link_timer);

        start_clnt_join(padapter);

        return H2C_SUCCESS;

}

u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
        u8 val8;

        if (is_client_associated_to_ap(padapter))
                issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);

        if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
                /* Stop BCN */
                val8 = 0;
                rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
        }

        rtw_mlmeext_disconnect(padapter);

        rtw_free_uc_swdec_pending_queue(padapter);

        return  H2C_SUCCESS;
}

static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
        u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
{
        int i, j;
        int set_idx;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        /* clear first */
        memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);

        /* acquire channels from in */
        j = 0;
        for (i = 0; i < in_num; i++) {

                set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
                if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
                        && set_idx >= 0
                ) {
                        if (j >= out_num) {
                                netdev_dbg(padapter->pnetdev,
                                           FUNC_ADPT_FMT " out_num:%u not enough\n",
                                           FUNC_ADPT_ARG(padapter), out_num);
                                break;
                        }

                        memcpy(&out[j], &in[i], sizeof(struct rtw_ieee80211_channel));

                        if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
                                out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;

                        j++;
                }
                if (j >= out_num)
                        break;
        }

        /* if out is empty, use channel_set as default */
        if (j == 0) {
                for (i = 0; i < pmlmeext->max_chan_nums; i++) {

                        if (j >= out_num) {
                                netdev_dbg(padapter->pnetdev,
                                           FUNC_ADPT_FMT " out_num:%u not enough\n",
                                           FUNC_ADPT_ARG(padapter),
                                           out_num);
                                break;
                        }

                        out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;

                        if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
                                out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;

                        j++;
                }
        }

        return j;
}

u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
        u8 bdelayscan = false;
        u8 val8;
        u32 initialgain;
        u32 i;

        if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
                pmlmeext->sitesurvey_res.state = SCAN_START;
                pmlmeext->sitesurvey_res.bss_cnt = 0;
                pmlmeext->sitesurvey_res.channel_idx = 0;

                for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
                        if (pparm->ssid[i].ssid_length) {
                                memcpy(pmlmeext->sitesurvey_res.ssid[i].ssid,
                                       pparm->ssid[i].ssid,
                                       IW_ESSID_MAX_SIZE);
                                pmlmeext->sitesurvey_res.ssid[i].ssid_length =
                                        pparm->ssid[i].ssid_length;
                        } else {
                                pmlmeext->sitesurvey_res.ssid[i].ssid_length = 0;
                        }
                }

                pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
                        , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
                        , pparm->ch, pparm->ch_num
                );

                pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;

                /* issue null data if associating to the AP */
                if (is_client_associated_to_ap(padapter)) {
                        pmlmeext->sitesurvey_res.state = SCAN_TXNULL;

                        issue_nulldata(padapter, NULL, 1, 3, 500);

                        bdelayscan = true;
                }
                if (bdelayscan) {
                        /* delay 50ms to protect nulldata(1). */
                        set_survey_timer(pmlmeext, 50);
                        return H2C_SUCCESS;
                }
        }

        if ((pmlmeext->sitesurvey_res.state == SCAN_START) ||
            (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
                /* disable dynamic functions, such as high power, DIG */
                Save_DM_Func_Flag(padapter);
                Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);

                /* config the initial gain under scanning, need to write the BB
                 * registers
                 */
                initialgain = 0x1e;

                rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));

                /* set MSR to no link state */
                set_msr(padapter, _HW_STATE_NOLINK_);

                val8 = 1; /* under site survey */
                rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));

                pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
        }

        site_survey(padapter);

        return H2C_SUCCESS;
}

u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        if (pparm->mode < 4)
                pmlmeinfo->auth_algo = pparm->mode;

        return  H2C_SUCCESS;
}

u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
{
        u16 ctrl = 0;
        s16 cam_id = 0;
        struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        unsigned char null_addr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
        u8 *addr;

        /* main tx key for wep. */
        if (pparm->set_tx)
                pmlmeinfo->key_index = pparm->keyid;

        cam_id = rtw_camid_alloc(padapter, NULL, pparm->keyid);

        if (cam_id < 0) {
        } else {
                if (cam_id > 3) /* not default key, searched by A2 */
                        addr = get_bssid(&padapter->mlmepriv);
                else
                        addr = null_addr;

                ctrl = BIT(15) | BIT6 | ((pparm->algorithm) << 2) | pparm->keyid;
                write_cam(padapter, cam_id, ctrl, addr, pparm->key);
                netdev_dbg(padapter->pnetdev,
                           "set group key camid:%d, addr:%pM, kid:%d, type:%s\n",
                           cam_id, addr, pparm->keyid,
                           security_type_str(pparm->algorithm));
        }

        if (cam_id >= 0 && cam_id <= 3)
                rtw_hal_set_hwreg(padapter, HW_VAR_SEC_DK_CFG, (u8 *)true);

        /* allow multicast packets to driver */
        SetHwReg8723BS(padapter, HW_VAR_ON_RCR_AM, null_addr);

        return H2C_SUCCESS;
}

u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
{
        u16 ctrl = 0;
        s16 cam_id = 0;
        u8 ret = H2C_SUCCESS;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
        struct sta_priv *pstapriv = &padapter->stapriv;
        struct sta_info *psta;

        if (pparm->algorithm == _NO_PRIVACY_)
                goto write_to_cam;

        psta = rtw_get_stainfo(pstapriv, pparm->addr);
        if (!psta) {
                netdev_dbg(padapter->pnetdev, "%s sta:%pM not found\n",
                           __func__, pparm->addr);
                ret = H2C_REJECTED;
                goto exit;
        }

        pmlmeinfo->enc_algo = pparm->algorithm;
        cam_id = rtw_camid_alloc(padapter, psta, 0);
        if (cam_id < 0)
                goto exit;

write_to_cam:
        if (pparm->algorithm == _NO_PRIVACY_) {
                while ((cam_id = rtw_camid_search(padapter, pparm->addr, -1)) >= 0) {
                        netdev_dbg(padapter->pnetdev,
                                   "clear key for addr:%pM, camid:%d\n",
                                   pparm->addr, cam_id);
                        clear_cam_entry(padapter, cam_id);
                        rtw_camid_free(padapter, cam_id);
                }
        } else {
                netdev_dbg(padapter->pnetdev,
                           "set pairwise key camid:%d, addr:%pM, kid:%d, type:%s\n",
                           cam_id, pparm->addr, pparm->keyid,
                           security_type_str(pparm->algorithm));
                ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
                write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
        }
        ret = H2C_SUCCESS_RSP;

exit:
        return ret;
}

u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

        struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);

        if (!psta)
                return  H2C_SUCCESS;

        if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
                ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
                /* pmlmeinfo->ADDBA_retry_count = 0; */
                /* pmlmeinfo->candidate_tid_bitmap |= (0x1 << pparm->tid); */
                /* psta->htpriv.candidate_tid_bitmap |= BIT(pparm->tid); */
                issue_action_BA(padapter, pparm->addr, WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
                /* _set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO); */
                _set_timer(&psta->addba_retry_timer, ADDBA_TO);
        } else {
                psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
        }
        return  H2C_SUCCESS;
}

u8 chk_bmc_sleepq_cmd(struct adapter *padapter)
{
        struct cmd_obj *ph2c;
        struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
        u8 res = _SUCCESS;

        ph2c = kzalloc_obj(*ph2c, GFP_ATOMIC);
        if (!ph2c) {
                res = _FAIL;
                goto exit;
        }

        init_h2fwcmd_w_parm_no_parm_rsp(ph2c, GEN_CMD_CODE(_ChkBMCSleepq));

        res = rtw_enqueue_cmd(pcmdpriv, ph2c);

exit:
        return res;
}

u8 set_tx_beacon_cmd(struct adapter *padapter)
{
        struct cmd_obj  *ph2c;
        struct Tx_Beacon_param  *ptxBeacon_parm;
        struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
        u8 res = _SUCCESS;
        int len_diff = 0;

        ph2c = kzalloc_obj(*ph2c, GFP_ATOMIC);
        if (!ph2c) {
                res = _FAIL;
                goto exit;
        }

        ptxBeacon_parm = kzalloc_obj(*ptxBeacon_parm, GFP_ATOMIC);
        if (!ptxBeacon_parm) {
                kfree(ph2c);
                res = _FAIL;
                goto exit;
        }

        memcpy(&(ptxBeacon_parm->network), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));

        len_diff = update_hidden_ssid(ptxBeacon_parm->network.ies + _BEACON_IE_OFFSET_,
                                      ptxBeacon_parm->network.ie_length - _BEACON_IE_OFFSET_,
                                      pmlmeinfo->hidden_ssid_mode);
        ptxBeacon_parm->network.ie_length += len_diff;

        init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));

        res = rtw_enqueue_cmd(pcmdpriv, ph2c);

exit:
        return res;
}

static struct fwevent wlanevents[] = {
        {0, rtw_dummy_event_callback},  /*0*/
        {0, NULL},
        {0, NULL},
        {0, NULL},
        {0, NULL},
        {0, NULL},
        {0, NULL},
        {0, NULL},
        {0, &rtw_survey_event_callback},                /*8*/
        {sizeof(struct surveydone_event), &rtw_surveydone_event_callback},      /*9*/

        {0, &rtw_joinbss_event_callback},               /*10*/
        {sizeof(struct stassoc_event), &rtw_stassoc_event_callback},
        {sizeof(struct stadel_event), &rtw_stadel_event_callback},
        {0, &rtw_atimdone_event_callback},
        {0, rtw_dummy_event_callback},
        {0, NULL},      /*15*/
        {0, NULL},
        {0, NULL},
        {0, NULL},
        {0, rtw_fwdbg_event_callback},
        {0, NULL},       /*20*/
        {0, NULL},
        {0, NULL},
        {0, &rtw_cpwm_event_callback},
        {0, NULL},
        {0, &rtw_wmm_event_callback},

};

u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        u8 evt_code;
        u16 evt_sz;
        uint    *peventbuf;
        void (*event_callback)(struct adapter *dev, u8 *pbuf);
        struct evt_priv *pevt_priv = &(padapter->evtpriv);

        if (!pbuf)
                goto _abort_event_;

        peventbuf = (uint *)pbuf;
        evt_sz = (u16)(*peventbuf & 0xffff);
        evt_code = (u8)((*peventbuf >> 16) & 0xff);

        /*  checking if event code is valid */
        if (evt_code >= MAX_C2HEVT)
                goto _abort_event_;

        /*  checking if event size match the event parm size */
        if ((wlanevents[evt_code].parmsize != 0) &&
            (wlanevents[evt_code].parmsize != evt_sz))
                goto _abort_event_;

        atomic_inc(&pevt_priv->event_seq);

        peventbuf += 2;

        if (peventbuf) {
                event_callback = wlanevents[evt_code].event_callback;
                event_callback(padapter, (u8 *)peventbuf);

                pevt_priv->evt_done_cnt++;
        }

_abort_event_:
        return H2C_SUCCESS;
}

u8 h2c_msg_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        if (!pbuf)
                return H2C_PARAMETERS_ERROR;

        return H2C_SUCCESS;
}

u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        struct sta_info *psta_bmc;
        struct list_head *xmitframe_plist, *xmitframe_phead, *tmp;
        struct xmit_frame *pxmitframe = NULL;
        struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
        struct sta_priv  *pstapriv = &padapter->stapriv;

        /* for BC/MC Frames */
        psta_bmc = rtw_get_bcmc_stainfo(padapter);
        if (!psta_bmc)
                return H2C_SUCCESS;

        if ((pstapriv->tim_bitmap & BIT(0)) && (psta_bmc->sleepq_len > 0)) {
                msleep(10);/*  10ms, ATIM(HIQ) Windows */

                /* spin_lock_bh(&psta_bmc->sleep_q.lock); */
                spin_lock_bh(&pxmitpriv->lock);

                xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
                list_for_each_safe(xmitframe_plist, tmp, xmitframe_phead) {
                        pxmitframe = list_entry(xmitframe_plist,
                                                struct xmit_frame, list);

                        list_del_init(&pxmitframe->list);

                        psta_bmc->sleepq_len--;
                        if (psta_bmc->sleepq_len > 0)
                                pxmitframe->attrib.mdata = 1;
                        else
                                pxmitframe->attrib.mdata = 0;

                        pxmitframe->attrib.triggered = 1;

                        if (xmitframe_hiq_filter(pxmitframe))
                                pxmitframe->attrib.qsel = 0x11;/* HIQ */

                        rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
                }

                /* spin_unlock_bh(&psta_bmc->sleep_q.lock); */
                spin_unlock_bh(&pxmitpriv->lock);

                /* check hi queue and bmc_sleepq */
                rtw_chk_hi_queue_cmd(padapter);
        }

        return H2C_SUCCESS;
}

u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        if (send_beacon(padapter) == _FAIL)
                return H2C_PARAMETERS_ERROR;

        /* tx bc/mc frames after update TIM */
        chk_bmc_sleepq_hdl(padapter, NULL);

        return H2C_SUCCESS;
}

int rtw_chk_start_clnt_join(struct adapter *padapter, u8 *ch, u8 *bw, u8 *offset)
{
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
        unsigned char cur_ch = pmlmeext->cur_channel;
        unsigned char cur_bw = pmlmeext->cur_bwmode;
        unsigned char cur_ch_offset = pmlmeext->cur_ch_offset;
        bool connect_allow = true;

        if (!ch || !bw || !offset) {
                rtw_warn_on(1);
                connect_allow = false;
        }

        if (connect_allow) {
                *ch = cur_ch;
                *bw = cur_bw;
                *offset = cur_ch_offset;
        }

        return connect_allow ? _SUCCESS : _FAIL;
}

u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
{
        struct set_ch_parm *set_ch_parm;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        if (!pbuf)
                return H2C_PARAMETERS_ERROR;

        set_ch_parm = (struct set_ch_parm *)pbuf;

        pmlmeext->cur_channel = set_ch_parm->ch;
        pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
        pmlmeext->cur_bwmode = set_ch_parm->bw;

        set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);

        return  H2C_SUCCESS;
}

u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        struct SetChannelPlan_param *setChannelPlan_param;
        struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

        if (!pbuf)
                return H2C_PARAMETERS_ERROR;

        setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;

        pmlmeext->max_chan_nums = init_channel_set(padapter,
                                                   setChannelPlan_param->channel_plan,
                                                   pmlmeext->channel_set);
        init_channel_list(padapter,
                          pmlmeext->channel_set,
                          pmlmeext->max_chan_nums,
                          &pmlmeext->channel_list);

        if (padapter->rtw_wdev && padapter->rtw_wdev->wiphy) {
                struct regulatory_request request;

                request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
                rtw_reg_notifier(padapter->rtw_wdev->wiphy, &request);
        }

        return  H2C_SUCCESS;
}

u8 set_csa_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        return  H2C_REJECTED;
}

/*  TDLS_ESTABLISHED    : write RCR DATA BIT */
/*  TDLS_CS_OFF         : go back to the channel linked with AP, terminating channel switch procedure */
/*  TDLS_INIT_CH_SEN    : init channel sensing, receive all data and mgnt frame */
/*  TDLS_DONE_CH_SEN    : channel sensing and report candidate channel */
/*  TDLS_OFF_CH         : first time set channel to off channel */
/*  TDLS_BASE_CH        : go back tp the channel linked with AP when set */
/*                        base channel as target channel */
/*  TDLS_P_OFF_CH       : periodically go to off channel */
/*  TDLS_P_BASE_CH      : periodically go back to base channel */
/*  TDLS_RS_RCR         : restore RCR */
/*  TDLS_TEAR_STA       : free tdls sta */
u8 tdls_hdl(struct adapter *padapter, unsigned char *pbuf)
{
        return H2C_REJECTED;
}

u8 run_in_thread_hdl(struct adapter *padapter, u8 *pbuf)
{
        struct RunInThread_param *p;

        if (!pbuf)
                return H2C_PARAMETERS_ERROR;
        p = (struct RunInThread_param *)pbuf;

        if (p->func)
                p->func(p->context);

        return H2C_SUCCESS;
}