[net-next-2.6.git] / drivers / staging / rt2860 / sta / assoc.c

/*
 *************************************************************************
 * Ralink Tech Inc.
 * 5F., No.36, Taiyuan St., Jhubei City,
 * Hsinchu County 302,
 * Taiwan, R.O.C.
 *
 * (c) Copyright 2002-2007, Ralink Technology, Inc.
 *
 * This program is free software; you can redistribute it and/or modify  *
 * it under the terms of the GNU General Public License as published by  *
 * the Free Software Foundation; either version 2 of the License, or     *
 * (at your option) any later version.                                   *
 *                                                                       *
 * This program is distributed in the hope that it will be useful,       *
 * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
 * GNU General Public License for more details.                          *
 *                                                                       *
 * You should have received a copy of the GNU General Public License     *
 * along with this program; if not, write to the                         *
 * Free Software Foundation, Inc.,                                       *
 * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
 *                                                                       *
 *************************************************************************

	Module Name:
	assoc.c

	Abstract:

	Revision History:
	Who			When			What
	--------	----------		----------------------------------------------
	John		2004-9-3		porting from RT2500
*/
#include "../rt_config.h"

u8 CipherWpaTemplate[] = {
	0xdd,			/* WPA IE */
	0x16,			/* Length */
	0x00, 0x50, 0xf2, 0x01,	/* oui */
	0x01, 0x00,		/* Version */
	0x00, 0x50, 0xf2, 0x02,	/* Multicast */
	0x01, 0x00,		/* Number of unicast */
	0x00, 0x50, 0xf2, 0x02,	/* unicast */
	0x01, 0x00,		/* number of authentication method */
	0x00, 0x50, 0xf2, 0x01	/* authentication */
};

u8 CipherWpa2Template[] = {
	0x30,			/* RSN IE */
	0x14,			/* Length */
	0x01, 0x00,		/* Version */
	0x00, 0x0f, 0xac, 0x02,	/* group cipher, TKIP */
	0x01, 0x00,		/* number of pairwise */
	0x00, 0x0f, 0xac, 0x02,	/* unicast */
	0x01, 0x00,		/* number of authentication method */
	0x00, 0x0f, 0xac, 0x02,	/* authentication */
	0x00, 0x00,		/* RSN capability */
};

u8 Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02 };

/*
	==========================================================================
	Description:
		association state machine init, including state transition and timer init
	Parameters:
		S - pointer to the association state machine

	IRQL = PASSIVE_LEVEL

	==========================================================================
 */
void AssocStateMachineInit(IN PRTMP_ADAPTER pAd,
			   IN STATE_MACHINE * S, OUT STATE_MACHINE_FUNC Trans[])
{
	StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG,
			 (STATE_MACHINE_FUNC) Drop, ASSOC_IDLE,
			 ASSOC_MACHINE_BASE);

	/* first column */
	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ,
			      (STATE_MACHINE_FUNC) MlmeAssocReqAction);
	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ,
			      (STATE_MACHINE_FUNC) MlmeReassocReqAction);
	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC) MlmeDisassocReqAction);
	StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC) PeerDisassocAction);

	/* second column */
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
			      (STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
			      (STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC)
			      InvalidStateWhenDisassociate);
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC) PeerDisassocAction);
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP,
			      (STATE_MACHINE_FUNC) PeerAssocRspAction);
	/* */
	/* Patch 3Com AP MOde:3CRWE454G72 */
	/* We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp. */
	/* */
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP,
			      (STATE_MACHINE_FUNC) PeerAssocRspAction);
	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT,
			      (STATE_MACHINE_FUNC) AssocTimeoutAction);

	/* third column */
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
			      (STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
			      (STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC)
			      InvalidStateWhenDisassociate);
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC) PeerDisassocAction);
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP,
			      (STATE_MACHINE_FUNC) PeerReassocRspAction);
	/* */
	/* Patch, AP doesn't send Reassociate Rsp frame to Station. */
	/* */
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP,
			      (STATE_MACHINE_FUNC) PeerReassocRspAction);
	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT,
			      (STATE_MACHINE_FUNC) ReassocTimeoutAction);

	/* fourth column */
	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
			      (STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
			      (STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC)
			      InvalidStateWhenDisassociate);
	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
			      (STATE_MACHINE_FUNC) PeerDisassocAction);
	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT,
			      (STATE_MACHINE_FUNC) DisassocTimeoutAction);

	/* initialize the timer */
	RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer,
		      GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
	RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer,
		      GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
	RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer,
		      GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
}

/*
	==========================================================================
	Description:
		Association timeout procedure. After association timeout, this function
		will be called and it will put a message into the MLME queue
	Parameters:
		Standard timer parameters

	IRQL = DISPATCH_LEVEL

	==========================================================================
 */
void AssocTimeout(void *SystemSpecific1,
		  void *FunctionContext,
		  void *SystemSpecific2, void *SystemSpecific3)
{
	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *) FunctionContext;

	/* Do nothing if the driver is starting halt state. */
	/* This might happen when timer already been fired before cancel timer with mlmehalt */
	if (RTMP_TEST_FLAG
	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
		return;

	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
	RTMP_MLME_HANDLER(pAd);
}

/*
	==========================================================================
	Description:
		Reassociation timeout procedure. After reassociation timeout, this
		function will be called and put a message into the MLME queue
	Parameters:
		Standard timer parameters

	IRQL = DISPATCH_LEVEL

	==========================================================================
 */
void ReassocTimeout(void *SystemSpecific1,
		    void *FunctionContext,
		    void *SystemSpecific2, void *SystemSpecific3)
{
	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *) FunctionContext;

	/* Do nothing if the driver is starting halt state. */
	/* This might happen when timer already been fired before cancel timer with mlmehalt */
	if (RTMP_TEST_FLAG
	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
		return;

	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
	RTMP_MLME_HANDLER(pAd);
}

/*
	==========================================================================
	Description:
		Disassociation timeout procedure. After disassociation timeout, this
		function will be called and put a message into the MLME queue
	Parameters:
		Standard timer parameters

	IRQL = DISPATCH_LEVEL

	==========================================================================
 */
void DisassocTimeout(void *SystemSpecific1,
		     void *FunctionContext,
		     void *SystemSpecific2, void *SystemSpecific3)
{
	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *) FunctionContext;

	/* Do nothing if the driver is starting halt state. */
	/* This might happen when timer already been fired before cancel timer with mlmehalt */
	if (RTMP_TEST_FLAG
	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
		return;

	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
	RTMP_MLME_HANDLER(pAd);
}

/*
	==========================================================================
	Description:
		mlme assoc req handling procedure
	Parameters:
		Adapter - Adapter pointer
		Elem - MLME Queue Element
	Pre:
		the station has been authenticated and the following information is stored in the config
			-# SSID
			-# supported rates and their length
			-# listen interval (Adapter->StaCfg.default_listen_count)
			-# Transmit power  (Adapter->StaCfg.tx_power)
	Post  :
		-# An association request frame is generated and sent to the air
		-# Association timer starts
		-# Association state -> ASSOC_WAIT_RSP

	IRQL = DISPATCH_LEVEL

	==========================================================================
 */
void MlmeAssocReqAction(IN PRTMP_ADAPTER pAd, IN MLME_QUEUE_ELEM * Elem)
{
	u8 ApAddr[6];
	HEADER_802_11 AssocHdr;
	u8 WmeIe[9] =
	    { IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01,
       0x00 };
	u16 ListenIntv;
	unsigned long Timeout;
	u16 CapabilityInfo;
	BOOLEAN TimerCancelled;
	u8 *pOutBuffer = NULL;
	int NStatus;
	unsigned long FrameLen = 0;
	unsigned long tmp;
	u16 VarIesOffset;
	u16 Status;

	/* Block all authentication request durning WPA block period */
	if (pAd->StaCfg.bBlockAssoc == TRUE) {
		DBGPRINT(RT_DEBUG_TRACE,
			 ("ASSOC - Block Assoc request durning WPA block period!\n"));
		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
		Status = MLME_STATE_MACHINE_REJECT;
		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2,
			    &Status);
	}
	/* check sanity first */
	else if (MlmeAssocReqSanity
		 (pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo,
		  &Timeout, &ListenIntv)) {
		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
		COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);

		/* Get an unused nonpaged memory */
		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
		if (NStatus != NDIS_STATUS_SUCCESS) {
			DBGPRINT(RT_DEBUG_TRACE,
				 ("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
			Status = MLME_FAIL_NO_RESOURCE;
			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
				    MT2_ASSOC_CONF, 2, &Status);
			return;
		}
		/* Add by James 03/06/27 */
		pAd->StaCfg.AssocInfo.Length =
		    sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
		/* Association don't need to report MAC address */
		pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
		    NDIS_802_11_AI_REQFI_CAPABILITIES |
		    NDIS_802_11_AI_REQFI_LISTENINTERVAL;
		pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities =
		    CapabilityInfo;
		pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval =
		    ListenIntv;
		/* Only reassociate need this */
		/*COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr); */
		pAd->StaCfg.AssocInfo.OffsetRequestIEs =
		    sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);

		NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
		/* First add SSID */
		VarIesOffset = 0;
		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe,
			       1);
		VarIesOffset += 1;
		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
			       &pAd->MlmeAux.SsidLen, 1);
		VarIesOffset += 1;
		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
			       pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
		VarIesOffset += pAd->MlmeAux.SsidLen;

		/* Second add Supported rates */
		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe,
			       1);
		VarIesOffset += 1;
		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
			       &pAd->MlmeAux.SupRateLen, 1);
		VarIesOffset += 1;
		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
			       pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
		VarIesOffset += pAd->MlmeAux.SupRateLen;
		/* End Add by James */

		if ((pAd->CommonCfg.Channel > 14) &&
		    (pAd->CommonCfg.bIEEE80211H == TRUE))
			CapabilityInfo |= 0x0100;

		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
		MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr,
				 ApAddr);

		/* Build basic frame first */
		MakeOutgoingFrame(pOutBuffer, &FrameLen,
				  sizeof(HEADER_802_11), &AssocHdr,
				  2, &CapabilityInfo,
				  2, &ListenIntv,
				  1, &SsidIe,
				  1, &pAd->MlmeAux.SsidLen,
				  pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid,
				  1, &SupRateIe,
				  1, &pAd->MlmeAux.SupRateLen,
				  pAd->MlmeAux.SupRateLen, pAd->MlmeAux.SupRate,
				  END_OF_ARGS);

		if (pAd->MlmeAux.ExtRateLen != 0) {
			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
					  1, &ExtRateIe,
					  1, &pAd->MlmeAux.ExtRateLen,
					  pAd->MlmeAux.ExtRateLen,
					  pAd->MlmeAux.ExtRate, END_OF_ARGS);
			FrameLen += tmp;
		}
		/* HT */
		if ((pAd->MlmeAux.HtCapabilityLen > 0)
		    && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)) {
			unsigned long TmpLen;
			u8 HtLen;
			u8 BROADCOM[4] = { 0x0, 0x90, 0x4c, 0x33 };
			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE) {
				HtLen = SIZE_HT_CAP_IE + 4;
				MakeOutgoingFrame(pOutBuffer + FrameLen,
						  &TmpLen, 1, &WpaIe, 1, &HtLen,
						  4, &BROADCOM[0],
						  pAd->MlmeAux.HtCapabilityLen,
						  &pAd->MlmeAux.HtCapability,
						  END_OF_ARGS);
			} else {
				MakeOutgoingFrame(pOutBuffer + FrameLen,
						  &TmpLen, 1, &HtCapIe, 1,
						  &pAd->MlmeAux.HtCapabilityLen,
						  pAd->MlmeAux.HtCapabilityLen,
						  &pAd->MlmeAux.HtCapability,
						  END_OF_ARGS);
			}
			FrameLen += TmpLen;
		}
		/* add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION */
		/* Case I: (Aggregation + Piggy-Back) */
		/* 1. user enable aggregation, AND */
		/* 2. Mac support piggy-back */
		/* 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON */
		/* Case II: (Aggregation) */
		/* 1. user enable aggregation, AND */
		/* 2. AP annouces it's AGGREGATION-capable in BEACON */
		if (pAd->CommonCfg.bAggregationCapable) {
			if ((pAd->CommonCfg.bPiggyBackCapable)
			    && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3)) {
				unsigned long TmpLen;
				u8 RalinkIe[9] =
				    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
			    0x03, 0x00, 0x00, 0x00 };
				MakeOutgoingFrame(pOutBuffer + FrameLen,
						  &TmpLen, 9, RalinkIe,
						  END_OF_ARGS);
				FrameLen += TmpLen;
			} else if (pAd->MlmeAux.APRalinkIe & 0x00000001) {
				unsigned long TmpLen;
				u8 RalinkIe[9] =
				    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
			    0x01, 0x00, 0x00, 0x00 };
				MakeOutgoingFrame(pOutBuffer + FrameLen,
						  &TmpLen, 9, RalinkIe,
						  END_OF_ARGS);
				FrameLen += TmpLen;
			}
		} else {
			unsigned long TmpLen;
			u8 RalinkIe[9] =
			    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06,
		    0x00, 0x00, 0x00 };
			MakeOutgoingFrame(pOutBuffer + FrameLen, &TmpLen, 9,
					  RalinkIe, END_OF_ARGS);
			FrameLen += TmpLen;
		}

		if (pAd->MlmeAux.APEdcaParm.bValid) {
			if (pAd->CommonCfg.bAPSDCapable
			    && pAd->MlmeAux.APEdcaParm.bAPSDCapable) {
				QBSS_STA_INFO_PARM QosInfo;

				NdisZeroMemory(&QosInfo,
					       sizeof(QBSS_STA_INFO_PARM));
				QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
				QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
				QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
				QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
				QosInfo.MaxSPLength =
				    pAd->CommonCfg.MaxSPLength;
				WmeIe[8] |= *(u8 *)& QosInfo;
			} else {
Commit	Line	Data
91980990 GKH	1	/*
	2	*************************************************************************
	3	* Ralink Tech Inc.
	4	* 5F., No.36, Taiyuan St., Jhubei City,
	5	* Hsinchu County 302,
	6	* Taiwan, R.O.C.
	7	*
	8	* (c) Copyright 2002-2007, Ralink Technology, Inc.
	9	*
	10	* This program is free software; you can redistribute it and/or modify *
	11	* it under the terms of the GNU General Public License as published by *
	12	* the Free Software Foundation; either version 2 of the License, or *
	13	* (at your option) any later version. *
	14	* *
	15	* This program is distributed in the hope that it will be useful, *
	16	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
	17	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
	18	* GNU General Public License for more details. *
	19	* *
	20	* You should have received a copy of the GNU General Public License *
	21	* along with this program; if not, write to the *
	22	* Free Software Foundation, Inc., *
	23	* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
	24	* *
	25	*************************************************************************
	26
	27	Module Name:
	28	assoc.c
	29
	30	Abstract:
	31
	32	Revision History:
	33	Who When What
	34	-------- ---------- ----------------------------------------------
	35	John 2004-9-3 porting from RT2500
	36	*/
	37	#include "../rt_config.h"
	38
51126deb	39	u8 CipherWpaTemplate[] = {
8281958b BZ	40	0xdd, /* WPA IE */
	41	0x16, /* Length */
	42	0x00, 0x50, 0xf2, 0x01, /* oui */
	43	0x01, 0x00, /* Version */
	44	0x00, 0x50, 0xf2, 0x02, /* Multicast */
	45	0x01, 0x00, /* Number of unicast */
	46	0x00, 0x50, 0xf2, 0x02, /* unicast */
	47	0x01, 0x00, /* number of authentication method */
	48	0x00, 0x50, 0xf2, 0x01 /* authentication */
0f65bec1 BZ	49	};
0f65bec1 BZ	50
51126deb	51	u8 CipherWpa2Template[] = {
8281958b BZ	52	0x30, /* RSN IE */
	53	0x14, /* Length */
	54	0x01, 0x00, /* Version */
	55	0x00, 0x0f, 0xac, 0x02, /* group cipher, TKIP */
	56	0x01, 0x00, /* number of pairwise */
	57	0x00, 0x0f, 0xac, 0x02, /* unicast */
	58	0x01, 0x00, /* number of authentication method */
	59	0x00, 0x0f, 0xac, 0x02, /* authentication */
	60	0x00, 0x00, /* RSN capability */
0f65bec1 BZ	61	};
0f65bec1 BZ	62
51126deb	63	u8 Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02 };
91980990 GKH	64
	65	/*
	66	==========================================================================
	67	Description:
	68	association state machine init, including state transition and timer init
	69	Parameters:
	70	S - pointer to the association state machine
	71
	72	IRQL = PASSIVE_LEVEL
	73
	74	==========================================================================
	75	*/
51126deb	76	void AssocStateMachineInit(IN PRTMP_ADAPTER pAd,
0f65bec1	77	IN STATE_MACHINE * S, OUT STATE_MACHINE_FUNC Trans[])
91980990	78	{
0f65bec1 BZ	79	StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG,
	80	(STATE_MACHINE_FUNC) Drop, ASSOC_IDLE,
	81	ASSOC_MACHINE_BASE);
91980990	82
8281958b	83	/* first column */
0f65bec1 BZ	84	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ,
	85	(STATE_MACHINE_FUNC) MlmeAssocReqAction);
	86	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ,
	87	(STATE_MACHINE_FUNC) MlmeReassocReqAction);
	88	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ,
	89	(STATE_MACHINE_FUNC) MlmeDisassocReqAction);
	90	StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ,
	91	(STATE_MACHINE_FUNC) PeerDisassocAction);
91980990	92
8281958b	93	/* second column */
0f65bec1 BZ	94	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
	95	(STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
	96	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
	97	(STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
	98	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
	99	(STATE_MACHINE_FUNC)
	100	InvalidStateWhenDisassociate);
	101	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
	102	(STATE_MACHINE_FUNC) PeerDisassocAction);
	103	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP,
	104	(STATE_MACHINE_FUNC) PeerAssocRspAction);
8281958b BZ	105	/* */
	106	/* Patch 3Com AP MOde:3CRWE454G72 */
	107	/* We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp. */
	108	/* */
0f65bec1 BZ	109	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP,
	110	(STATE_MACHINE_FUNC) PeerAssocRspAction);
	111	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT,
	112	(STATE_MACHINE_FUNC) AssocTimeoutAction);
91980990	113
8281958b	114	/* third column */
0f65bec1 BZ	115	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
	116	(STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
	117	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
	118	(STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
	119	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
	120	(STATE_MACHINE_FUNC)
	121	InvalidStateWhenDisassociate);
	122	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
	123	(STATE_MACHINE_FUNC) PeerDisassocAction);
	124	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP,
	125	(STATE_MACHINE_FUNC) PeerReassocRspAction);
8281958b BZ	126	/* */
	127	/* Patch, AP doesn't send Reassociate Rsp frame to Station. */
	128	/* */
0f65bec1 BZ	129	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP,
	130	(STATE_MACHINE_FUNC) PeerReassocRspAction);
	131	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT,
	132	(STATE_MACHINE_FUNC) ReassocTimeoutAction);
91980990	133
8281958b	134	/* fourth column */
0f65bec1 BZ	135	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
	136	(STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
	137	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
	138	(STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
	139	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
	140	(STATE_MACHINE_FUNC)
	141	InvalidStateWhenDisassociate);
	142	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
	143	(STATE_MACHINE_FUNC) PeerDisassocAction);
	144	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT,
	145	(STATE_MACHINE_FUNC) DisassocTimeoutAction);
91980990	146
8281958b	147	/* initialize the timer */
0f65bec1 BZ	148	RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer,
	149	GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
	150	RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer,
	151	GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
	152	RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer,
	153	GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
91980990 GKH	154	}
	155
	156	/*
	157	==========================================================================
	158	Description:
	159	Association timeout procedure. After association timeout, this function
	160	will be called and it will put a message into the MLME queue
	161	Parameters:
	162	Standard timer parameters
	163
	164	IRQL = DISPATCH_LEVEL
	165
	166	==========================================================================
	167	*/
51126deb BZ	168	void AssocTimeout(void *SystemSpecific1,
	169	void *FunctionContext,
	170	void SystemSpecific2, void SystemSpecific3)
91980990	171	{
0f65bec1	172	RTMP_ADAPTER pAd = (RTMP_ADAPTER ) FunctionContext;
91980990	173
8281958b BZ	174	/* Do nothing if the driver is starting halt state. */
8281958b BZ	175	/* This might happen when timer already been fired before cancel timer with mlmehalt */
0f65bec1 BZ	176	if (RTMP_TEST_FLAG
0f65bec1 BZ	177	(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS \| fRTMP_ADAPTER_NIC_NOT_EXIST))
91980990 GKH	178	return;
	179
	180	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
ca97b838	181	RTMP_MLME_HANDLER(pAd);
91980990 GKH	182	}
	183
	184	/*
	185	==========================================================================
	186	Description:
	187	Reassociation timeout procedure. After reassociation timeout, this
	188	function will be called and put a message into the MLME queue
	189	Parameters:
	190	Standard timer parameters
	191
	192	IRQL = DISPATCH_LEVEL
	193
	194	==========================================================================
	195	*/
51126deb BZ	196	void ReassocTimeout(void *SystemSpecific1,
	197	void *FunctionContext,
	198	void SystemSpecific2, void SystemSpecific3)
91980990	199	{
0f65bec1	200	RTMP_ADAPTER pAd = (RTMP_ADAPTER ) FunctionContext;
91980990	201
8281958b BZ	202	/* Do nothing if the driver is starting halt state. */
8281958b BZ	203	/* This might happen when timer already been fired before cancel timer with mlmehalt */
0f65bec1 BZ	204	if (RTMP_TEST_FLAG
0f65bec1 BZ	205	(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS \| fRTMP_ADAPTER_NIC_NOT_EXIST))
91980990 GKH	206	return;
	207
	208	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
ca97b838	209	RTMP_MLME_HANDLER(pAd);
91980990 GKH	210	}
	211
	212	/*
	213	==========================================================================
	214	Description:
	215	Disassociation timeout procedure. After disassociation timeout, this
	216	function will be called and put a message into the MLME queue
	217	Parameters:
	218	Standard timer parameters
	219
	220	IRQL = DISPATCH_LEVEL
	221
	222	==========================================================================
	223	*/
51126deb BZ	224	void DisassocTimeout(void *SystemSpecific1,
	225	void *FunctionContext,
	226	void SystemSpecific2, void SystemSpecific3)
91980990	227	{
0f65bec1	228	RTMP_ADAPTER pAd = (RTMP_ADAPTER ) FunctionContext;
91980990	229
8281958b BZ	230	/* Do nothing if the driver is starting halt state. */
8281958b BZ	231	/* This might happen when timer already been fired before cancel timer with mlmehalt */
0f65bec1 BZ	232	if (RTMP_TEST_FLAG
0f65bec1 BZ	233	(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS \| fRTMP_ADAPTER_NIC_NOT_EXIST))
91980990 GKH	234	return;
	235
	236	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
ca97b838	237	RTMP_MLME_HANDLER(pAd);
91980990 GKH	238	}
	239
	240	/*
	241	==========================================================================
	242	Description:
	243	mlme assoc req handling procedure
	244	Parameters:
	245	Adapter - Adapter pointer
	246	Elem - MLME Queue Element
	247	Pre:
	248	the station has been authenticated and the following information is stored in the config
	249	-# SSID
	250	-# supported rates and their length
	251	-# listen interval (Adapter->StaCfg.default_listen_count)
	252	-# Transmit power (Adapter->StaCfg.tx_power)
	253	Post :
	254	-# An association request frame is generated and sent to the air
	255	-# Association timer starts
	256	-# Association state -> ASSOC_WAIT_RSP
	257
	258	IRQL = DISPATCH_LEVEL
	259
	260	==========================================================================
	261	*/
51126deb	262	void MlmeAssocReqAction(IN PRTMP_ADAPTER pAd, IN MLME_QUEUE_ELEM * Elem)
91980990	263	{
51126deb	264	u8 ApAddr[6];
0f65bec1	265	HEADER_802_11 AssocHdr;
51126deb	266	u8 WmeIe[9] =
0f65bec1 BZ	267	{ IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01,
0f65bec1 BZ	268	0x00 };
51126deb BZ	269	u16 ListenIntv;
	270	unsigned long Timeout;
	271	u16 CapabilityInfo;
0f65bec1	272	BOOLEAN TimerCancelled;
51126deb BZ	273	u8 *pOutBuffer = NULL;
	274	int NStatus;
	275	unsigned long FrameLen = 0;
	276	unsigned long tmp;
	277	u16 VarIesOffset;
	278	u16 Status;
91980990	279
8281958b	280	/* Block all authentication request durning WPA block period */
0f65bec1 BZ	281	if (pAd->StaCfg.bBlockAssoc == TRUE) {
	282	DBGPRINT(RT_DEBUG_TRACE,
	283	("ASSOC - Block Assoc request durning WPA block period!\n"));
91980990 GKH	284	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
91980990 GKH	285	Status = MLME_STATE_MACHINE_REJECT;
0f65bec1 BZ	286	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2,
0f65bec1 BZ	287	&Status);
91980990	288	}
8281958b	289	/* check sanity first */
0f65bec1 BZ	290	else if (MlmeAssocReqSanity
	291	(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo,
	292	&Timeout, &ListenIntv)) {
91980990 GKH	293	RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
	294	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
	295
8281958b	296	/* Get an unused nonpaged memory */
91980990	297	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
0f65bec1 BZ	298	if (NStatus != NDIS_STATUS_SUCCESS) {
	299	DBGPRINT(RT_DEBUG_TRACE,
	300	("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
91980990 GKH	301	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
91980990 GKH	302	Status = MLME_FAIL_NO_RESOURCE;
0f65bec1 BZ	303	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
0f65bec1 BZ	304	MT2_ASSOC_CONF, 2, &Status);
91980990 GKH	305	return;
91980990 GKH	306	}
8281958b	307	/* Add by James 03/06/27 */
0f65bec1 BZ	308	pAd->StaCfg.AssocInfo.Length =
0f65bec1 BZ	309	sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
8281958b	310	/* Association don't need to report MAC address */
91980990	311	pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
0f65bec1 BZ	312	NDIS_802_11_AI_REQFI_CAPABILITIES \|
	313	NDIS_802_11_AI_REQFI_LISTENINTERVAL;
	314	pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities =
	315	CapabilityInfo;
	316	pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval =
	317	ListenIntv;
8281958b BZ	318	/* Only reassociate need this */
8281958b BZ	319	/COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr); /
0f65bec1 BZ	320	pAd->StaCfg.AssocInfo.OffsetRequestIEs =
0f65bec1 BZ	321	sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
91980990	322
0f65bec1	323	NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
8281958b	324	/* First add SSID */
91980990	325	VarIesOffset = 0;
0f65bec1 BZ	326	NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe,
0f65bec1 BZ	327	1);
91980990	328	VarIesOffset += 1;
0f65bec1 BZ	329	NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
0f65bec1 BZ	330	&pAd->MlmeAux.SsidLen, 1);
91980990	331	VarIesOffset += 1;
0f65bec1 BZ	332	NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
0f65bec1 BZ	333	pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
91980990 GKH	334	VarIesOffset += pAd->MlmeAux.SsidLen;
91980990 GKH	335
8281958b	336	/* Second add Supported rates */
0f65bec1 BZ	337	NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe,
0f65bec1 BZ	338	1);
91980990	339	VarIesOffset += 1;
0f65bec1 BZ	340	NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
0f65bec1 BZ	341	&pAd->MlmeAux.SupRateLen, 1);
91980990	342	VarIesOffset += 1;
0f65bec1 BZ	343	NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
0f65bec1 BZ	344	pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
91980990	345	VarIesOffset += pAd->MlmeAux.SupRateLen;
8281958b	346	/* End Add by James */
91980990	347
0f65bec1 BZ	348	if ((pAd->CommonCfg.Channel > 14) &&
	349	(pAd->CommonCfg.bIEEE80211H == TRUE))
	350	CapabilityInfo \|= 0x0100;
91980990 GKH	351
91980990 GKH	352	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
0f65bec1 BZ	353	MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr,
0f65bec1 BZ	354	ApAddr);
91980990	355
8281958b	356	/* Build basic frame first */
0f65bec1 BZ	357	MakeOutgoingFrame(pOutBuffer, &FrameLen,
	358	sizeof(HEADER_802_11), &AssocHdr,
	359	2, &CapabilityInfo,
	360	2, &ListenIntv,
	361	1, &SsidIe,
	362	1, &pAd->MlmeAux.SsidLen,
	363	pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid,
	364	1, &SupRateIe,
	365	1, &pAd->MlmeAux.SupRateLen,
	366	pAd->MlmeAux.SupRateLen, pAd->MlmeAux.SupRate,
	367	END_OF_ARGS);
	368
	369	if (pAd->MlmeAux.ExtRateLen != 0) {
	370	MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
	371	1, &ExtRateIe,
	372	1, &pAd->MlmeAux.ExtRateLen,
	373	pAd->MlmeAux.ExtRateLen,
	374	pAd->MlmeAux.ExtRate, END_OF_ARGS);
91980990 GKH	375	FrameLen += tmp;
91980990 GKH	376	}
8281958b	377	/* HT */
0f65bec1 BZ	378	if ((pAd->MlmeAux.HtCapabilityLen > 0)
0f65bec1 BZ	379	&& (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)) {
51126deb BZ	380	unsigned long TmpLen;
	381	u8 HtLen;
	382	u8 BROADCOM[4] = { 0x0, 0x90, 0x4c, 0x33 };
0f65bec1	383	if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE) {
91980990	384	HtLen = SIZE_HT_CAP_IE + 4;
0f65bec1 BZ	385	MakeOutgoingFrame(pOutBuffer + FrameLen,
	386	&TmpLen, 1, &WpaIe, 1, &HtLen,
	387	4, &BROADCOM[0],
	388	pAd->MlmeAux.HtCapabilityLen,
	389	&pAd->MlmeAux.HtCapability,
	390	END_OF_ARGS);
	391	} else {
	392	MakeOutgoingFrame(pOutBuffer + FrameLen,
	393	&TmpLen, 1, &HtCapIe, 1,
	394	&pAd->MlmeAux.HtCapabilityLen,
	395	pAd->MlmeAux.HtCapabilityLen,
	396	&pAd->MlmeAux.HtCapability,
	397	END_OF_ARGS);
91980990 GKH	398	}
	399	FrameLen += TmpLen;
	400	}
8281958b BZ	401	/* add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION */
	402	/* Case I: (Aggregation + Piggy-Back) */
	403	/* 1. user enable aggregation, AND */
	404	/* 2. Mac support piggy-back */
	405	/* 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON */
	406	/* Case II: (Aggregation) */
	407	/* 1. user enable aggregation, AND */
	408	/* 2. AP annouces it's AGGREGATION-capable in BEACON */
0f65bec1 BZ	409	if (pAd->CommonCfg.bAggregationCapable) {
	410	if ((pAd->CommonCfg.bPiggyBackCapable)
	411	&& ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3)) {
51126deb BZ	412	unsigned long TmpLen;
51126deb BZ	413	u8 RalinkIe[9] =
0f65bec1 BZ	414	{ IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
	415	0x03, 0x00, 0x00, 0x00 };
	416	MakeOutgoingFrame(pOutBuffer + FrameLen,
	417	&TmpLen, 9, RalinkIe,
	418	END_OF_ARGS);
91980990	419	FrameLen += TmpLen;
0f65bec1	420	} else if (pAd->MlmeAux.APRalinkIe & 0x00000001) {
51126deb BZ	421	unsigned long TmpLen;
51126deb BZ	422	u8 RalinkIe[9] =
0f65bec1 BZ	423	{ IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
	424	0x01, 0x00, 0x00, 0x00 };
	425	MakeOutgoingFrame(pOutBuffer + FrameLen,
	426	&TmpLen, 9, RalinkIe,
	427	END_OF_ARGS);
91980990 GKH	428	FrameLen += TmpLen;
91980990 GKH	429	}
0f65bec1	430	} else {
51126deb BZ	431	unsigned long TmpLen;
51126deb BZ	432	u8 RalinkIe[9] =
0f65bec1 BZ	433	{ IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06,
	434	0x00, 0x00, 0x00 };
	435	MakeOutgoingFrame(pOutBuffer + FrameLen, &TmpLen, 9,
	436	RalinkIe, END_OF_ARGS);
91980990 GKH	437	FrameLen += TmpLen;
	438	}
	439
0f65bec1 BZ	440	if (pAd->MlmeAux.APEdcaParm.bValid) {
	441	if (pAd->CommonCfg.bAPSDCapable
	442	&& pAd->MlmeAux.APEdcaParm.bAPSDCapable) {
91980990 GKH	443	QBSS_STA_INFO_PARM QosInfo;
91980990 GKH	444
0f65bec1 BZ	445	NdisZeroMemory(&QosInfo,
0f65bec1 BZ	446	sizeof(QBSS_STA_INFO_PARM));
91980990 GKH	447	QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
	448	QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
	449	QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
	450	QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
0f65bec1 BZ	451	QosInfo.MaxSPLength =
0f65bec1 BZ	452	pAd->CommonCfg.MaxSPLength;
51126deb	453	WmeIe[8] \|= (u8 )& QosInfo;
0f65bec1	454	} else {
8281958b BZ	455