1 /*
2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
3  * All rights reserved.
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License as published by
7  * the Free Software Foundation; either version 2 of the License, or
8  * (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License along
16  * with this program; if not, write to the Free Software Foundation, Inc.,
17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * File: ioctl.c
20  *
21  * Purpose:  private ioctl functions
22  *
23  * Author: Lyndon Chen
24  *
25  * Date: Auguest 20, 2003
26  *
27  * Functions:
28  *
29  * Revision History:
30  *
31  */
32 
33 #include "ioctl.h"
34 #include "iocmd.h"
35 #include "mac.h"
36 #include "card.h"
37 #include "hostap.h"
38 #include "wpactl.h"
39 #include "control.h"
40 #include "rndis.h"
41 #include "rf.h"
42 
43 SWPAResult wpa_Result;
44 static int msglevel = MSG_LEVEL_INFO;
45 
private_ioctl(PSDevice pDevice,struct ifreq * rq)46 int private_ioctl(PSDevice pDevice, struct ifreq *rq)
47 {
48 
49 	PSCmdRequest	pReq = (PSCmdRequest)rq;
50 	PSMgmtObject	pMgmt = &(pDevice->sMgmtObj);
51 	int		result = 0;
52 	PWLAN_IE_SSID	pItemSSID;
53 	SCmdBSSJoin	sJoinCmd;
54 	SCmdZoneTypeSet	sZoneTypeCmd;
55 	SCmdScan	sScanCmd;
56 	SCmdStartAP	sStartAPCmd;
57 	SCmdSetWEP	sWEPCmd;
58 	SCmdValue	sValue;
59 	SBSSIDList	sList;
60 	SNodeList	sNodeList;
61 	PSBSSIDList	pList;
62 	PSNodeList	pNodeList;
63 	unsigned int	cbListCount;
64 	PKnownBSS	pBSS;
65 	PKnownNodeDB	pNode;
66 	unsigned int	ii, jj;
67 	SCmdLinkStatus	sLinkStatus;
68 	BYTE		abySuppRates[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
69 	BYTE		abyNullAddr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
70 	DWORD		dwKeyIndex = 0;
71 	BYTE		abyScanSSID[WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1];
72 	signed long	ldBm;
73 
74 	pReq->wResult = 0;
75 
76 	switch (pReq->wCmdCode) {
77 	case WLAN_CMD_BSS_SCAN:
78 		if (copy_from_user(&sScanCmd, pReq->data, sizeof(SCmdScan))) {
79 			result = -EFAULT;
80 			break;
81 		}
82 
83 		pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
84 		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
85 			return -EINVAL;
86 		if (pItemSSID->len != 0) {
87 			memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
88 			memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
89 		}
90 		spin_lock_irq(&pDevice->lock);
91 
92 		if (memcmp(pMgmt->abyCurrBSSID, &abyNullAddr[0], 6) == 0)
93 			BSSvClearBSSList((void *)pDevice, FALSE);
94 		else
95 			BSSvClearBSSList((void *)pDevice, pDevice->bLinkPass);
96 
97 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_BSS_SCAN..begin\n");
98 
99 		if (pItemSSID->len != 0)
100 			bScheduleCommand((void *)pDevice,
101 					 WLAN_CMD_BSSID_SCAN,
102 					 abyScanSSID);
103 		else
104 			bScheduleCommand((void *) pDevice, WLAN_CMD_BSSID_SCAN, NULL);
105 
106 		spin_unlock_irq(&pDevice->lock);
107 		break;
108 
109 	case WLAN_CMD_ZONETYPE_SET:
110 		result = -EOPNOTSUPP;
111 		break;
112 
113 		if (copy_from_user(&sZoneTypeCmd, pReq->data, sizeof(SCmdZoneTypeSet))) {
114 			result = -EFAULT;
115 			break;
116 		}
117 
118 		if (sZoneTypeCmd.bWrite == TRUE) {
119 			/* write zonetype */
120 			if (sZoneTypeCmd.ZoneType == ZoneType_USA) {
121 				/* set to USA */
122 				printk("set_ZoneType:USA\n");
123 			} else if (sZoneTypeCmd.ZoneType == ZoneType_Japan) {
124 				/* set to Japan */
125 				printk("set_ZoneType:Japan\n");
126 			} else if (sZoneTypeCmd.ZoneType == ZoneType_Europe) {
127 				/* set to Europe */
128 				printk("set_ZoneType:Europe\n");
129 			}
130 		} else {
131 			/* read zonetype */
132 			BYTE zonetype = 0;
133 
134 			if (zonetype == 0x00) {        /* USA */
135 				sZoneTypeCmd.ZoneType = ZoneType_USA;
136 			} else if (zonetype == 0x01) { /* Japan */
137 				sZoneTypeCmd.ZoneType = ZoneType_Japan;
138 			} else if (zonetype == 0x02) { /* Europe */
139 				sZoneTypeCmd.ZoneType = ZoneType_Europe;
140 			} else {                       /* Unknown ZoneType */
141 				printk("Error:ZoneType[%x] Unknown ???\n", zonetype);
142 				result = -EFAULT;
143 				break;
144 			}
145 
146 			if (copy_to_user(pReq->data, &sZoneTypeCmd,
147 						sizeof(SCmdZoneTypeSet))) {
148 				result = -EFAULT;
149 				break;
150 			}
151 		}
152 		break;
153 	case WLAN_CMD_BSS_JOIN:
154 		if (copy_from_user(&sJoinCmd, pReq->data, sizeof(SCmdBSSJoin))) {
155 			result = -EFAULT;
156 			break;
157 		}
158 
159 		pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
160 		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
161 			return -EINVAL;
162 		memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
163 		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
164 		if (sJoinCmd.wBSSType == ADHOC) {
165 			pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
166 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to adhoc mode\n");
167 		} else {
168 			pMgmt->eConfigMode = WMAC_CONFIG_ESS_STA;
169 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to STA mode\n");
170 		}
171 		if (sJoinCmd.bPSEnable == TRUE) {
172 			pDevice->ePSMode = WMAC_POWER_FAST;
173 			pMgmt->wListenInterval = 2;
174 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving On\n");
175 		} else {
176 			pDevice->ePSMode = WMAC_POWER_CAM;
177 			pMgmt->wListenInterval = 1;
178 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving Off\n");
179 		}
180 
181 		if (sJoinCmd.bShareKeyAuth == TRUE) {
182 			pMgmt->bShareKeyAlgorithm = TRUE;
183 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key\n");
184 		} else {
185 			pMgmt->bShareKeyAlgorithm = FALSE;
186 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System\n");
187 		}
188 
189 		pDevice->uChannel = sJoinCmd.uChannel;
190 		netif_stop_queue(pDevice->dev);
191 		spin_lock_irq(&pDevice->lock);
192 		pMgmt->eCurrState = WMAC_STATE_IDLE;
193 		bScheduleCommand((void *) pDevice,
194 				 WLAN_CMD_BSSID_SCAN,
195 				 pMgmt->abyDesireSSID);
196 		bScheduleCommand((void *) pDevice, WLAN_CMD_SSID, NULL);
197 		spin_unlock_irq(&pDevice->lock);
198 		break;
199 
200 	case WLAN_CMD_SET_WEP:
201 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WEP Key.\n");
202 		memset(&sWEPCmd, 0, sizeof(SCmdSetWEP));
203 		if (copy_from_user(&sWEPCmd, pReq->data, sizeof(SCmdSetWEP))) {
204 			result = -EFAULT;
205 			break;
206 		}
207 		if (sWEPCmd.bEnableWep != TRUE) {
208 			int uu;
209 
210 			pDevice->bEncryptionEnable = FALSE;
211 			pDevice->eEncryptionStatus = Ndis802_11EncryptionDisabled;
212 			spin_lock_irq(&pDevice->lock);
213 			for (uu = 0; uu < MAX_KEY_TABLE; uu++)
214 				MACvDisableKeyEntry(pDevice, uu);
215 			spin_unlock_irq(&pDevice->lock);
216 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WEP function disable.\n");
217 			break;
218 		}
219 
220 		for (ii = 0; ii < WLAN_WEP_NKEYS; ii++) {
221 			if (sWEPCmd.bWepKeyAvailable[ii]) {
222 				if (ii == sWEPCmd.byKeyIndex)
223 					dwKeyIndex = ii | (1 << 31);
224 				else
225 					dwKeyIndex = ii;
226 				spin_lock_irq(&pDevice->lock);
227 				KeybSetDefaultKey(pDevice, &(pDevice->sKey),
228 						  dwKeyIndex,
229 						  sWEPCmd.auWepKeyLength[ii],
230 						  NULL,
231 						  (PBYTE)&sWEPCmd.abyWepKey[ii][0],
232 						  KEY_CTL_WEP);
233 				spin_unlock_irq(&pDevice->lock);
234 			}
235 		}
236 		pDevice->byKeyIndex = sWEPCmd.byKeyIndex;
237 		pDevice->bTransmitKey = TRUE;
238 		pDevice->bEncryptionEnable = TRUE;
239 		pDevice->eEncryptionStatus = Ndis802_11Encryption1Enabled;
240 		break;
241 
242 	case WLAN_CMD_GET_LINK:
243 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_GET_LINK status.\n");
244 
245 		memset(sLinkStatus.abySSID, 0, WLAN_SSID_MAXLEN + 1);
246 
247 		if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)
248 			sLinkStatus.wBSSType = ADHOC;
249 		else
250 			sLinkStatus.wBSSType = INFRA;
251 
252 		if (pMgmt->eCurrState == WMAC_STATE_JOINTED)
253 			sLinkStatus.byState = ADHOC_JOINTED;
254 		else
255 			sLinkStatus.byState = ADHOC_STARTED;
256 
257 		sLinkStatus.uChannel = pMgmt->uCurrChannel;
258 		if (pDevice->bLinkPass == TRUE) {
259 			sLinkStatus.bLink = TRUE;
260 			pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
261 			memcpy(sLinkStatus.abySSID, pItemSSID->abySSID, pItemSSID->len);
262 			memcpy(sLinkStatus.abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
263 			sLinkStatus.uLinkRate = pMgmt->sNodeDBTable[0].wTxDataRate;
264 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Link Success!\n");
265 		} else {
266 			sLinkStatus.bLink = FALSE;
267 			sLinkStatus.uLinkRate = 0;
268 		}
269 		if (copy_to_user(pReq->data, &sLinkStatus,
270 					sizeof(SCmdLinkStatus))) {
271 			result = -EFAULT;
272 			break;
273 		}
274 		break;
275 
276 	case WLAN_CMD_GET_LISTLEN:
277 		cbListCount = 0;
278 		pBSS = &(pMgmt->sBSSList[0]);
279 		for (ii = 0; ii < MAX_BSS_NUM; ii++) {
280 			pBSS = &(pMgmt->sBSSList[ii]);
281 			if (!pBSS->bActive)
282 				continue;
283 			cbListCount++;
284 		}
285 		sList.uItem = cbListCount;
286 		if (copy_to_user(pReq->data, &sList, sizeof(SBSSIDList))) {
287 			result = -EFAULT;
288 			break;
289 		}
290 		pReq->wResult = 0;
291 		break;
292 
293 	case WLAN_CMD_GET_LIST:
294 		if (copy_from_user(&sList, pReq->data, sizeof(SBSSIDList))) {
295 			result = -EFAULT;
296 			break;
297 		}
298 		if (sList.uItem > (ULONG_MAX - sizeof(SBSSIDList)) / sizeof(SBSSIDItem)) {
299 			result = -EINVAL;
300 			break;
301 		}
302 		pList = (PSBSSIDList)kmalloc(sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)), (int)GFP_ATOMIC);
303 		if (pList == NULL) {
304 			result = -ENOMEM;
305 			break;
306 		}
307 		pList->uItem = sList.uItem;
308 		pBSS = &(pMgmt->sBSSList[0]);
309 		for (ii = 0, jj = 0; jj < MAX_BSS_NUM ; jj++) {
310 			pBSS = &(pMgmt->sBSSList[jj]);
311 			if (pBSS->bActive) {
312 				pList->sBSSIDList[ii].uChannel = pBSS->uChannel;
313 				pList->sBSSIDList[ii].wBeaconInterval = pBSS->wBeaconInterval;
314 				pList->sBSSIDList[ii].wCapInfo = pBSS->wCapInfo;
315 				RFvRSSITodBm(pDevice, (BYTE)(pBSS->uRSSI), &ldBm);
316 				pList->sBSSIDList[ii].uRSSI = (unsigned int) ldBm;
317 				/* pList->sBSSIDList[ii].uRSSI = pBSS->uRSSI; */
318 				memcpy(pList->sBSSIDList[ii].abyBSSID, pBSS->abyBSSID, WLAN_BSSID_LEN);
319 				pItemSSID = (PWLAN_IE_SSID)pBSS->abySSID;
320 				memset(pList->sBSSIDList[ii].abySSID, 0, WLAN_SSID_MAXLEN + 1);
321 				memcpy(pList->sBSSIDList[ii].abySSID, pItemSSID->abySSID, pItemSSID->len);
322 				if (WLAN_GET_CAP_INFO_ESS(pBSS->wCapInfo)) {
323 					pList->sBSSIDList[ii].byNetType = INFRA;
324 				} else {
325 					pList->sBSSIDList[ii].byNetType = ADHOC;
326 				}
327 				if (WLAN_GET_CAP_INFO_PRIVACY(pBSS->wCapInfo)) {
328 					pList->sBSSIDList[ii].bWEPOn = TRUE;
329 				} else {
330 					pList->sBSSIDList[ii].bWEPOn = FALSE;
331 				}
332 				ii++;
333 				if (ii >= pList->uItem)
334 					break;
335 			}
336 		}
337 
338 		if (copy_to_user(pReq->data, pList, sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)))) {
339 			result = -EFAULT;
340 			break;
341 		}
342 		kfree(pList);
343 		pReq->wResult = 0;
344 		break;
345 
346 	case WLAN_CMD_GET_MIB:
347 		if (copy_to_user(pReq->data, &(pDevice->s802_11Counter), sizeof(SDot11MIBCount))) {
348 			result = -EFAULT;
349 			break;
350 		}
351 		break;
352 
353 	case WLAN_CMD_GET_STAT:
354 		if (copy_to_user(pReq->data, &(pDevice->scStatistic), sizeof(SStatCounter))) {
355 			result = -EFAULT;
356 			break;
357 		}
358 		break;
359 	case WLAN_CMD_STOP_MAC:
360 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_STOP_MAC\n");
361 		/* Todo xxxxxx */
362 		netif_stop_queue(pDevice->dev);
363 		spin_lock_irq(&pDevice->lock);
364 		if (pDevice->bRadioOff == FALSE) {
365 			CARDbRadioPowerOff(pDevice);
366 		}
367 		pDevice->bLinkPass = FALSE;
368 		ControlvMaskByte(pDevice, MESSAGE_REQUEST_MACREG, MAC_REG_PAPEDELAY, LEDSTS_STS, LEDSTS_SLOW);
369 		memset(pMgmt->abyCurrBSSID, 0, 6);
370 		pMgmt->eCurrState = WMAC_STATE_IDLE;
371 		/* del_timer(&pDevice->sTimerCommand); */
372 		/* del_timer(&pMgmt->sTimerSecondCallback); */
373 		pDevice->bCmdRunning = FALSE;
374 		spin_unlock_irq(&pDevice->lock);
375 		break;
376 
377 	case WLAN_CMD_START_MAC:
378 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_START_MAC\n");
379 		/* Todo xxxxxxx */
380 		if (pDevice->bRadioOff == TRUE)
381 			CARDbRadioPowerOn(pDevice);
382 		break;
383 
384 	case WLAN_CMD_SET_HOSTAPD:
385 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD\n");
386 
387 		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
388 			result = -EFAULT;
389 			break;
390 		}
391 		if (sValue.dwValue == 1) {
392 			if (vt6656_hostap_set_hostapd(pDevice, 1, 1) == 0) {
393 				DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HOSTAP\n");
394 			} else {
395 				result = -EFAULT;
396 				break;
397 			}
398 		} else {
399 			vt6656_hostap_set_hostapd(pDevice, 0, 1);
400 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HOSTAP\n");
401 		}
402 		break;
403 
404 	case WLAN_CMD_SET_HOSTAPD_STA:
405 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD_STA\n");
406 		break;
407 
408 	case WLAN_CMD_SET_802_1X:
409 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_802_1X\n");
410 		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
411 			result = -EFAULT;
412 			break;
413 		}
414 
415 		if (sValue.dwValue == 1) {
416 			pDevice->bEnable8021x = TRUE;
417 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable 802.1x\n");
418 		} else {
419 			pDevice->bEnable8021x = FALSE;
420 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable 802.1x\n");
421 		}
422 		break;
423 
424 	case WLAN_CMD_SET_HOST_WEP:
425 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOST_WEP\n");
426 		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
427 			result = -EFAULT;
428 			break;
429 		}
430 
431 		if (sValue.dwValue == 1) {
432 			pDevice->bEnableHostWEP = TRUE;
433 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HostWEP\n");
434 		} else {
435 			pDevice->bEnableHostWEP = FALSE;
436 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HostWEP\n");
437 		}
438 		break;
439 
440 	case WLAN_CMD_SET_WPA:
441 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WPA\n");
442 
443 		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
444 			result = -EFAULT;
445 			break;
446 		}
447 		if (sValue.dwValue == 1) {
448 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "up wpadev\n");
449 			memcpy(pDevice->wpadev->dev_addr, pDevice->dev->dev_addr,
450 			       ETH_ALEN);
451 			pDevice->bWPADEVUp = TRUE;
452 		} else {
453 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "close wpadev\n");
454 			pDevice->bWPADEVUp = FALSE;
455 		}
456 		break;
457 
458 	case WLAN_CMD_AP_START:
459 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_AP_START\n");
460 		if (pDevice->bRadioOff == TRUE) {
461 			CARDbRadioPowerOn(pDevice);
462 			add_timer(&pMgmt->sTimerSecondCallback);
463 		}
464 		if (copy_from_user(&sStartAPCmd, pReq->data, sizeof(SCmdStartAP))) {
465 			result = -EFAULT;
466 			break;
467 		}
468 
469 		if (sStartAPCmd.wBSSType == AP) {
470 			pMgmt->eConfigMode = WMAC_CONFIG_AP;
471 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to AP mode\n");
472 		} else {
473 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct BSS type not set to AP mode\n");
474 			result = -EFAULT;
475 			break;
476 		}
477 
478 		if (sStartAPCmd.wBBPType == PHY80211g) {
479 			pMgmt->byAPBBType = PHY_TYPE_11G;
480 		} else if (sStartAPCmd.wBBPType == PHY80211a) {
481 			pMgmt->byAPBBType = PHY_TYPE_11A;
482 		} else {
483 			pMgmt->byAPBBType = PHY_TYPE_11B;
484 		}
485 
486 		pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
487 		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
488 			return -EINVAL;
489 		memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
490 		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
491 
492 		if ((sStartAPCmd.uChannel > 0) && (sStartAPCmd.uChannel <= 14))
493 			pDevice->uChannel = sStartAPCmd.uChannel;
494 
495 		if ((sStartAPCmd.uBeaconInt >= 20) && (sStartAPCmd.uBeaconInt <= 1000))
496 			pMgmt->wIBSSBeaconPeriod = sStartAPCmd.uBeaconInt;
497 		else
498 			pMgmt->wIBSSBeaconPeriod = 100;
499 
500 		if (sStartAPCmd.bShareKeyAuth == TRUE) {
501 			pMgmt->bShareKeyAlgorithm = TRUE;
502 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key\n");
503 		} else {
504 			pMgmt->bShareKeyAlgorithm = FALSE;
505 			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System\n");
506 		}
507 		memcpy(pMgmt->abyIBSSSuppRates, abySuppRates, 6);
508 
509 		if (sStartAPCmd.byBasicRate & BIT3) {
510 			pMgmt->abyIBSSSuppRates[2] |= BIT7;
511 			pMgmt->abyIBSSSuppRates[3] |= BIT7;
512 			pMgmt->abyIBSSSuppRates[4] |= BIT7;
513 			pMgmt->abyIBSSSuppRates[5] |= BIT7;
514 		} else if (sStartAPCmd.byBasicRate & BIT2) {
515 			pMgmt->abyIBSSSuppRates[2] |= BIT7;
516 			pMgmt->abyIBSSSuppRates[3] |= BIT7;
517 			pMgmt->abyIBSSSuppRates[4] |= BIT7;
518 		} else if (sStartAPCmd.byBasicRate & BIT1) {
519 			pMgmt->abyIBSSSuppRates[2] |= BIT7;
520 			pMgmt->abyIBSSSuppRates[3] |= BIT7;
521 		} else if (sStartAPCmd.byBasicRate & BIT1) {
522 			pMgmt->abyIBSSSuppRates[2] |= BIT7;
523 		} else {
524 			/* default 1,2M */
525 			pMgmt->abyIBSSSuppRates[2] |= BIT7;
526 			pMgmt->abyIBSSSuppRates[3] |= BIT7;
527 		}
528 
529 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Support Rate= %x %x %x %x\n",
530 			pMgmt->abyIBSSSuppRates[2],
531 			pMgmt->abyIBSSSuppRates[3],
532 			pMgmt->abyIBSSSuppRates[4],
533 			pMgmt->abyIBSSSuppRates[5]);
534 
535 		netif_stop_queue(pDevice->dev);
536 		spin_lock_irq(&pDevice->lock);
537 		bScheduleCommand((void *)pDevice, WLAN_CMD_RUN_AP, NULL);
538 		spin_unlock_irq(&pDevice->lock);
539 		break;
540 
541 	case WLAN_CMD_GET_NODE_CNT:
542 		cbListCount = 0;
543 		pNode = &(pMgmt->sNodeDBTable[0]);
544 		for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
545 			pNode = &(pMgmt->sNodeDBTable[ii]);
546 			if (!pNode->bActive)
547 				continue;
548 			cbListCount++;
549 		}
550 
551 		sNodeList.uItem = cbListCount;
552 		if (copy_to_user(pReq->data, &sNodeList, sizeof(SNodeList))) {
553 			result = -EFAULT;
554 			break;
555 		}
556 		pReq->wResult = 0;
557 		break;
558 
559 	case WLAN_CMD_GET_NODE_LIST:
560 		if (copy_from_user(&sNodeList, pReq->data, sizeof(SNodeList))) {
561 			result = -EFAULT;
562 			break;
563 		}
564 		if (sNodeList.uItem > (ULONG_MAX - sizeof(SNodeList)) / sizeof(SNodeItem)) {
565 			result = -ENOMEM;
566 			break;
567 		}
568 		pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);
569 		if (pNodeList == NULL) {
570 			result = -ENOMEM;
571 			break;
572 		}
573 		pNodeList->uItem = sNodeList.uItem;
574 		pNode = &(pMgmt->sNodeDBTable[0]);
575 		for (ii = 0, jj = 0; ii < (MAX_NODE_NUM + 1); ii++) {
576 			pNode = &(pMgmt->sNodeDBTable[ii]);
577 			if (pNode->bActive) {
578 				pNodeList->sNodeList[jj].wAID = pNode->wAID;
579 				memcpy(pNodeList->sNodeList[jj].abyMACAddr, pNode->abyMACAddr, WLAN_ADDR_LEN);
580 				pNodeList->sNodeList[jj].wTxDataRate = pNode->wTxDataRate;
581 				pNodeList->sNodeList[jj].wInActiveCount = (WORD)pNode->uInActiveCount;
582 				pNodeList->sNodeList[jj].wEnQueueCnt = (WORD)pNode->wEnQueueCnt;
583 				pNodeList->sNodeList[jj].wFlags = (WORD)pNode->dwFlags;
584 				pNodeList->sNodeList[jj].bPWBitOn = pNode->bPSEnable;
585 				pNodeList->sNodeList[jj].byKeyIndex = pNode->byKeyIndex;
586 				pNodeList->sNodeList[jj].wWepKeyLength = pNode->uWepKeyLength;
587 				memcpy(&(pNodeList->sNodeList[jj].abyWepKey[0]), &(pNode->abyWepKey[0]), WEP_KEYMAXLEN);
588 				DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "key= %2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
589 					pNodeList->sNodeList[jj].abyWepKey[0],
590 					pNodeList->sNodeList[jj].abyWepKey[1],
591 					pNodeList->sNodeList[jj].abyWepKey[2],
592 					pNodeList->sNodeList[jj].abyWepKey[3],
593 					pNodeList->sNodeList[jj].abyWepKey[4]);
594 				pNodeList->sNodeList[jj].bIsInFallback = pNode->bIsInFallback;
595 				pNodeList->sNodeList[jj].uTxFailures = pNode->uTxFailures;
596 				pNodeList->sNodeList[jj].uTxAttempts = pNode->uTxAttempts;
597 				pNodeList->sNodeList[jj].wFailureRatio = (WORD)pNode->uFailureRatio;
598 				jj++;
599 				if (jj >= pNodeList->uItem)
600 					break;
601 			}
602 		}
603 		if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {
604 			result = -EFAULT;
605 			break;
606 		}
607 		kfree(pNodeList);
608 		pReq->wResult = 0;
609 		break;
610 
611 	case 0xFF:
612 		memset(wpa_Result.ifname, 0, sizeof(wpa_Result.ifname));
613 		wpa_Result.proto = 0;
614 		wpa_Result.key_mgmt = 0;
615 		wpa_Result.eap_type = 0;
616 		wpa_Result.authenticated = FALSE;
617 		pDevice->fWPA_Authened = FALSE;
618 		if (copy_from_user(&wpa_Result, pReq->data, sizeof(wpa_Result))) {
619 			result = -EFAULT;
620 			break;
621 		}
622 		/* for some AP maybe good authenticate */
623 		if (wpa_Result.key_mgmt == 0x20)
624 			pMgmt->Cisco_cckm = 1;
625 		else
626 			pMgmt->Cisco_cckm = 0;
627 
628 		if (wpa_Result.authenticated == TRUE) {
629 			{
630 				union iwreq_data wrqu;
631 
632 				pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
633 				memset(&wrqu, 0, sizeof(wrqu));
634 				wrqu.data.flags = RT_WPACONNECTED_EVENT_FLAG;
635 				wrqu.data.length = pItemSSID->len;
636 				wireless_send_event(pDevice->dev, IWEVCUSTOM, &wrqu, pItemSSID->abySSID);
637 			}
638 
639 			pDevice->fWPA_Authened = TRUE; /* is successful peer to wpa_Result.authenticated? */
640 		}
641 
642 		pReq->wResult = 0;
643 		break;
644 
645 	default:
646 		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Private command not support..\n");
647 	}
648 
649 	return result;
650 }
651