OUT UCHAR *TimLen,    OUT UCHAR *BcastFlag,    OUT UCHAR *DtimCount,    OUT UCHAR *DtimPeriod,    OUT UCHAR *MessageToMe){    UCHAR          BitCntl, N1, N2, MyByte, MyBit;    CHAR          *IdxPtr;    IdxPtr = Ptr;    IdxPtr ++;    *TimLen = *IdxPtr;    // get DTIM Count from TIM element    IdxPtr ++;    *DtimCount = *IdxPtr;    // get DTIM Period from TIM element    IdxPtr++;    *DtimPeriod = *IdxPtr;    // get Bitmap Control from TIM element    IdxPtr++;    BitCntl = *IdxPtr;    if ((*DtimCount == 0) && (BitCntl & 0x01))        *BcastFlag = TRUE;    else        *BcastFlag = FALSE;    // Parse Partial Virtual Bitmap from TIM element    N1 = BitCntl & 0xfe;    // N1 is the first bitmap byte#    N2 = *TimLen - 4 + N1;  // N2 is the last bitmap byte#    if ((Aid < (N1 << 3)) || (Aid >= ((N2 + 1) << 3)))        *MessageToMe = FALSE;    else    {        MyByte = (Aid >> 3) - N1;                       // my byte position in the bitmap byte-stream        MyBit = Aid % 16 - ((MyByte & 0x01)? 8:0);        IdxPtr += (MyByte + 1);        //if (*IdxPtr)        //    DBGPRINT(RT_DEBUG_WARN, "TIM bitmap = 0x%02x\n", *IdxPtr);        if (*IdxPtr & (0x01 << MyBit))            *MessageToMe = TRUE;        else            *MessageToMe = FALSE;    }    return TRUE;}UCHAR ChannelSanity(    IN PRTMP_ADAPTER pAd,    IN UCHAR channel){    int i;    for (i = 0; i < pAd->ChannelListNum; i ++)    {        if (channel == pAd->ChannelList[i].Channel)            return 1;    }    return 0;}/*	========================================================================	Routine Description:		Sanity check NetworkType (11b, 11g or 11a)	Arguments:		Channel				Current Channel		SupRate				Peer's Supported Rate Buffer		SupRateLen			Peer's Supported Rate Length		ExtRate				Peer's Extended Rate Buffer		ExtRateLen			Peer's Extended Rate Length	Return Value:		Ndis802_11DS .......(11b)        Ndis802_11OFDM24....(11bg mixed)		Ndis802_11OFDM5.....(11a)	========================================================================*/NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(	IN UCHAR  Channel,	IN UCHAR  SupRate[],	IN UCHAR  SupRateLen,	IN UCHAR  ExtRate[],	IN UCHAR  ExtRateLen){	NDIS_802_11_NETWORK_TYPE	NetWorkType;	UCHAR						Type = 0;	//UCHAR						rate, i;	Type = PeerTxTypeInUseSanity(Channel, SupRate, SupRateLen, ExtRate, ExtRateLen);	switch (Type)	{		case CCK_RATE:			NetWorkType = Ndis802_11DS;			break;		case OFDM_RATE:			if (Channel > 14)				NetWorkType = Ndis802_11OFDM5;			else				NetWorkType = Ndis802_11OFDM24;			break;		case CCKOFDM_RATE:			NetWorkType = Ndis802_11OFDM24;			break;		default:			NetWorkType = Ndis802_11DS;			break;	}	return NetWorkType;}/*	========================================================================	Routine Description:		Get Peer TX phy mode(CCK or OFDM)	Arguments:		Channel				Current Channel		SupRate				Peer's Supported Rate Buffer		SupRateLen			Peer's Supported Rate Length		ExtRate				Peer's Extended Rate Buffer		ExtRateLen			Peer's Extended Rate Length	Return Value:    		1 - CCK    		2 - OFDM    		3 - CCK+OFDM	========================================================================*/UCHAR PeerTxTypeInUseSanity(	IN UCHAR  Channel,	IN UCHAR  SupRate[],	IN UCHAR  SupRateLen,	IN UCHAR  ExtRate[],	IN UCHAR  ExtRateLen){	UCHAR						rate, i;	UCHAR						Type = 0;	if (Channel <= 14)	{		//		// First check support Rate.		//		for (i = 0; i < SupRateLen; i++)		{			rate = SupRate[i] & 0x7f; // Mask out basic rate set bit			if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))			{				Type |= 0x01;   //CCK				continue;			}			else			{				//				// Otherwise (even rate > 108) means Ndis802_11OFDM24				//				Type |= 0x02;   // OFDM				break;			}		}		//		// Second check Extend Rate.		// Maybe OFDM rate store on Extend Rate.		//		if ((Type & 0x02) == 0)		{			for (i = 0; i < ExtRateLen; i++)			{				rate = ExtRate[i] & 0x7f; // Mask out basic rate set bit				if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))				{					continue;				}				else				{					//					// Otherwise (even rate > 108) means Ndis802_11OFDM24					//					Type |= 0x02;  //OFDM					break;				}			}		}	}	else	{		Type |= 0x02;  //OFDM	}	return Type;}/*	========================================================================	Routine Description:		Sanity check pairwise key on Encryption::Ndis802_11Encryption1Enabled	Arguments:		pAd      - Pointer to our adapter		pBuf 	 - Pointer to NDIS_802_11_KEY structure	Return Value:		NDIS_STATUS_SUCCESS		NDIS_STATUS_FAILURE	Note:		For OID_802_11_ADD_KEY setting, on old wep stuff also need to verify		the structure of NIDS_802_11_KEY	========================================================================*/NDIS_STATUS	RTMPWPAWepKeySanity(	IN	PRTMP_ADAPTER	pAd,	IN	PVOID			pBuf){	PNDIS_802_11_KEY	pKey;	ULONG				KeyIdx;	NDIS_STATUS			Status = NDIS_STATUS_SUCCESS;	BOOLEAN 			bTxKey; 		// Set the key as transmit key	BOOLEAN 			bPairwise;		// Indicate the key is pairwise key	//UCHAR			CipherAlg;	//UINT			i;	pKey = (PNDIS_802_11_KEY) pBuf;	KeyIdx = pKey->KeyIndex & 0x0fffffff;	// Bit 31 of Add-key, Tx Key	bTxKey		   = (pKey->KeyIndex & 0x80000000) ? TRUE : FALSE;	// Bit 30 of Add-key PairwiseKey	bPairwise	   = (pKey->KeyIndex & 0x40000000) ? TRUE : FALSE;	// 1. Check Group / Pairwise Key	if (bPairwise)	// Pairwise Key	{		// 1. Check KeyIdx		// it is a shared key		if (KeyIdx > 4)			return (NDIS_STATUS_FAILURE);		// 2. Check bTx, it must be true, otherwise, return NDIS_STATUS_FAILURE		if (bTxKey == FALSE)			return(NDIS_STATUS_FAILURE);		// 3. If BSSID is all 0xff, return NDIS_STATUS_FAILURE		if (MAC_ADDR_EQUAL(pKey->BSSID, BROADCAST_ADDR))			return(NDIS_STATUS_FAILURE);		// check key length		if ((pKey->KeyLength != 5) && (pKey->KeyLength != 13))		    return(NDIS_STATUS_FAILURE);	}	else	{		// Group Key		// 1. Check BSSID, if not current BSSID or Bcast, return NDIS_STATUS_FAILURE		if ((! MAC_ADDR_EQUAL(pKey->BSSID, BROADCAST_ADDR)) &&			(! MAC_ADDR_EQUAL(pKey->BSSID, pAd->PortCfg.Bssid)))			return(NDIS_STATUS_FAILURE);		// 2. Check Key index for supported Group Key		if (KeyIdx > 4)			return(NDIS_STATUS_FAILURE);	}	if (pKey->KeyIndex & 0x80000000)	{		// Default key for tx (shared key)		pAd->PortCfg.DefaultKeyId = (UCHAR) KeyIdx;	}    //always use BSS0=0//	AsicAddSharedKeyEntry(pAd, 0, (UCHAR)KeyIdx, CipherAlg, pAd->SharedKey[KeyIdx].Key, NULL, NULL);     	pAd->PortCfg.PortSecured = WPA_802_1X_PORT_SECURED;	//For Test	return (Status);}NDIS_STATUS	RTMPRemoveKeySanity(	IN	PRTMP_ADAPTER	pAd,	IN	PVOID			pBuf){	PNDIS_802_11_REMOVE_KEY	pKey;	ULONG					KeyIdx;	NDIS_STATUS				Status = NDIS_STATUS_FAILURE;	BOOLEAN 	bTxKey; 		// Set the key as transmit key	BOOLEAN 	bPairwise;		// Indicate the key is pairwise key	BOOLEAN 	bKeyRSC;		// indicate the receive  SC set by KeyRSC value.								// Otherwise, it will set by the NIC.	BOOLEAN 	bAuthenticator; // indicate key is set by authenticator.	INT 		i;	DBGPRINT(RT_DEBUG_TRACE,"---> RTMPWPARemoveKeyProc\n");	pKey = (PNDIS_802_11_REMOVE_KEY) pBuf;	if (pAd->PortCfg.AuthMode >= Ndis802_11AuthModeWPA)	{		pKey = (PNDIS_802_11_REMOVE_KEY) pBuf;		KeyIdx = pKey->KeyIndex & 0xff;		// Bit 31 of Add-key, Tx Key		bTxKey		   = (pKey->KeyIndex & 0x80000000) ? TRUE : FALSE;		// Bit 30 of Add-key PairwiseKey		bPairwise	   = (pKey->KeyIndex & 0x40000000) ? TRUE : FALSE;		// Bit 29 of Add-key KeyRSC		bKeyRSC 	   = (pKey->KeyIndex & 0x20000000) ? TRUE : FALSE;		// Bit 28 of Add-key Authenticator		bAuthenticator = (pKey->KeyIndex & 0x10000000) ? TRUE : FALSE;		// 1. If bTx is TRUE, return failure information		if (bTxKey == TRUE)			return(NDIS_STATUS_FAILURE);		// 2. Check Pairwise Key		if (bPairwise)		{			// a. If BSSID is broadcast, remove all pairwise keys.			// b. If not broadcast, remove the pairwise specified by BSSID			for (i = 0; i < SHARE_KEY_NUM; i++)			{				if (MAC_ADDR_EQUAL(pAd->SharedKey[i].BssId, pKey->BSSID))				{					DBGPRINT(RT_DEBUG_TRACE,"RTMPWPARemoveKeyProc(KeyIdx=%d)\n", i);					pAd->SharedKey[i].KeyLen = 0;					pAd->SharedKey[i].CipherAlg = CIPHER_NONE;					Status = NDIS_STATUS_SUCCESS;					break;				}			}		}		// 3. Group Key		else		{			// a. If BSSID is broadcast, remove all group keys indexed			// b. If BSSID matched, delete the group key indexed.			DBGPRINT(RT_DEBUG_TRACE,"RTMPWPARemoveKeyProc(KeyIdx=%d)\n", KeyIdx);			pAd->SharedKey[KeyIdx].KeyLen = 0;			pAd->SharedKey[KeyIdx].CipherAlg = CIPHER_NONE;			Status = NDIS_STATUS_SUCCESS;		}	}	else	{		KeyIdx = pKey->KeyIndex;		if (KeyIdx & 0x80000000)		{			// Should never set default bit when remove key			Status = NDIS_STATUS_FAILURE;		}		else		{			KeyIdx = KeyIdx & 0x0fffffff;			if (KeyIdx > 4)				Status = NDIS_STATUS_FAILURE;			else			{				pAd->SharedKey[KeyIdx].KeyLen = 0;				pAd->SharedKey[KeyIdx].CipherAlg = CIPHER_NONE;				Status = NDIS_STATUS_SUCCESS;			}		}	}	return (Status);}/*    ==========================================================================    Description:        MLME message sanity check to get config data from AP    Return:        TRUE if all parameters are OK, FALSE otherwise    ========================================================================== */BOOLEAN BackDoorProbeRspSanity(    IN PRTMP_ADAPTER pAd,    IN VOID *Msg,    IN ULONG MsgLen,    OUT CHAR *pCfgDataBuf){    PFRAME_802_11       pFrame = (PFRAME_802_11)Msg;    CHAR                *Ptr, CfgData[255] = {0};    PEID_STRUCT         eid_ptr;    USHORT              cfgDataLen = 0;    Ptr = pFrame->Octet;    // timestamp from payload and advance the pointer    Ptr += TIMESTAMP_LEN;    // beacon interval from payload and advance the pointer    Ptr += 2;    // capability info from payload and advance the pointer    Ptr += 2;    eid_ptr = (PEID_STRUCT) Ptr;    // get variable fields from payload and advance the pointer    while(((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)pFrame + MsgLen))    {        memset(CfgData, 0, 255);        switch(eid_ptr->Eid)        {	        case IE_VENDOR_SPECIFIC:                if (NdisEqualMemory(eid_ptr->Octet, RALINK_OUI, 3))                {                    if ((eid_ptr->Octet[3] & 0x80) == 0x80)                    {                        if ( (cfgDataLen + eid_ptr->Len - 4) <= MAX_CFG_BUFFER_LEN)                        {                            //memcpy((pCfgDataBuf + cfgDataLen), (eid_ptr->Octet + 4), (eid_ptr->Len - 4));                            memcpy(CfgData, (eid_ptr->Octet + 4), (eid_ptr->Len - 4));                            DBGPRINT(RT_DEBUG_INFO, "%s\n", CfgData);                            KPRINT(KERN_INFO, "%s\n", CfgData);                            return TRUE;                        }                        else                        {                            DBGPRINT(RT_DEBUG_ERROR, "BackDoorProbeRspSanity: cfgDataLen > MAX_CFG_BUFFER_LEN\n");                            KPRINT(KERN_INFO,								"BackDoorProbeRspSanity: cfgDataLen > MAX_CFG_BUFFER_LEN\n");                            return FALSE;                        }                    }                    else if ((eid_ptr->Octet[3] & 0x40) == 0x40)                    {                        //memcpy((pCfgDataBuf + cfgDataLen), (eid_ptr->Octet + 4), (eid_ptr->Len - 4));                        cfgDataLen += (eid_ptr->Len - 4);                        memcpy(CfgData, (eid_ptr->Octet + 4), (eid_ptr->Len - 4));                        if (cfgDataLen > MAX_CFG_BUFFER_LEN)                        {                            DBGPRINT(RT_DEBUG_ERROR, "BackDoorProbeRspSanity: cfgDataLen > MAX_CFG_BUFFER_LEN\n");                            KPRINT(KERN_INFO,								"BackDoorProbeRspSanity: cfgDataLen > MAX_CFG_BUFFER_LEN\n");                            return FALSE;                        }                        else {                            DBGPRINT(RT_DEBUG_INFO, "%s", CfgData);                            KPRINT(KERN_INFO, "%s", CfgData);						}                    }                    break;                }            default:                break;        }        eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);    }    return FALSE;}