drivers/net/wireless/mwifiex/scan.c

   1 /*
   2  * Marvell Wireless LAN device driver: scan ioctl and command handling
   3  *
   4  * Copyright (C) 2011, Marvell International Ltd.
   5  *
   6  * This software file (the "File") is distributed by Marvell International
   7  * Ltd. under the terms of the GNU General Public License Version 2, June 1991
   8  * (the "License").  You may use, redistribute and/or modify this File in
   9  * accordance with the terms and conditions of the License, a copy of which
  10  * is available by writing to the Free Software Foundation, Inc.,
  11  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
  12  * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
  13  *
  14  * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
  15  * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
  16  * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
  17  * this warranty disclaimer.
  18  */
  19
  20 #include "decl.h"
  21 #include "ioctl.h"
  22 #include "util.h"
  23 #include "fw.h"
  24 #include "main.h"
  25 #include "11n.h"
  26 #include "cfg80211.h"
  27
  28 /* The maximum number of channels the firmware can scan per command */
  29 #define MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN   14
  30
  31 #define MWIFIEX_CHANNELS_PER_SCAN_CMD            4
  32
  33 /* Memory needed to store a max sized Channel List TLV for a firmware scan */
  34 #define CHAN_TLV_MAX_SIZE  (sizeof(struct mwifiex_ie_types_header)         \
  35                                 + (MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN     \
  36                                 *sizeof(struct mwifiex_chan_scan_param_set)))
  37
  38 /* Memory needed to store supported rate */
  39 #define RATE_TLV_MAX_SIZE   (sizeof(struct mwifiex_ie_types_rates_param_set) \
  40                                 + HOSTCMD_SUPPORTED_RATES)
  41
  42 /* Memory needed to store a max number/size WildCard SSID TLV for a firmware
  43         scan */
  44 #define WILDCARD_SSID_TLV_MAX_SIZE  \
  45         (MWIFIEX_MAX_SSID_LIST_LENGTH *                                 \
  46                 (sizeof(struct mwifiex_ie_types_wildcard_ssid_params)   \
  47                         + IEEE80211_MAX_SSID_LEN))
  48
  49 /* Maximum memory needed for a mwifiex_scan_cmd_config with all TLVs at max */
  50 #define MAX_SCAN_CFG_ALLOC (sizeof(struct mwifiex_scan_cmd_config)        \
  51                                 + sizeof(struct mwifiex_ie_types_num_probes)   \
  52                                 + sizeof(struct mwifiex_ie_types_htcap)       \
  53                                 + CHAN_TLV_MAX_SIZE                 \
  54                                 + RATE_TLV_MAX_SIZE                 \
  55                                 + WILDCARD_SSID_TLV_MAX_SIZE)
  56
  57
  58 union mwifiex_scan_cmd_config_tlv {
  59         /* Scan configuration (variable length) */
  60         struct mwifiex_scan_cmd_config config;
  61         /* Max allocated block */
  62         u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC];
  63 };
  64
  65 enum cipher_suite {
  66         CIPHER_SUITE_TKIP,
  67         CIPHER_SUITE_CCMP,
  68         CIPHER_SUITE_MAX
  69 };
  70 static u8 mwifiex_wpa_oui[CIPHER_SUITE_MAX][4] = {
  71         { 0x00, 0x50, 0xf2, 0x02 },     /* TKIP */
  72         { 0x00, 0x50, 0xf2, 0x04 },     /* AES  */
  73 };
  74 static u8 mwifiex_rsn_oui[CIPHER_SUITE_MAX][4] = {
  75         { 0x00, 0x0f, 0xac, 0x02 },     /* TKIP */
  76         { 0x00, 0x0f, 0xac, 0x04 },     /* AES  */
  77 };
  78
  79 /*
  80  * This function parses a given IE for a given OUI.
  81  *
  82  * This is used to parse a WPA/RSN IE to find if it has
  83  * a given oui in PTK.
  84  */
  85 static u8
  86 mwifiex_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
  87 {
  88         u8 count;
  89
  90         count = iebody->ptk_cnt[0];
  91
  92         /* There could be multiple OUIs for PTK hence
  93            1) Take the length.
  94            2) Check all the OUIs for AES.
  95            3) If one of them is AES then pass success. */
  96         while (count) {
  97                 if (!memcmp(iebody->ptk_body, oui, sizeof(iebody->ptk_body)))
  98                         return MWIFIEX_OUI_PRESENT;
  99
 100                 --count;
 101                 if (count)
 102                         iebody = (struct ie_body *) ((u8 *) iebody +
 103                                                 sizeof(iebody->ptk_body));
 104         }
 105
 106         pr_debug("info: %s: OUI is not found in PTK\n", __func__);
 107         return MWIFIEX_OUI_NOT_PRESENT;
 108 }
 109
 110 /*
 111  * This function checks if a given OUI is present in a RSN IE.
 112  *
 113  * The function first checks if a RSN IE is present or not in the
 114  * BSS descriptor. It tries to locate the OUI only if such an IE is
 115  * present.
 116  */
 117 static u8
 118 mwifiex_is_rsn_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 119 {
 120         u8 *oui;
 121         struct ie_body *iebody;
 122         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 123
 124         if (((bss_desc->bcn_rsn_ie) && ((*(bss_desc->bcn_rsn_ie)).
 125                                         ieee_hdr.element_id == WLAN_EID_RSN))) {
 126                 iebody = (struct ie_body *)
 127                          (((u8 *) bss_desc->bcn_rsn_ie->data) +
 128                          RSN_GTK_OUI_OFFSET);
 129                 oui = &mwifiex_rsn_oui[cipher][0];
 130                 ret = mwifiex_search_oui_in_ie(iebody, oui);
 131                 if (ret)
 132                         return ret;
 133         }
 134         return ret;
 135 }
 136
 137 /*
 138  * This function checks if a given OUI is present in a WPA IE.
 139  *
 140  * The function first checks if a WPA IE is present or not in the
 141  * BSS descriptor. It tries to locate the OUI only if such an IE is
 142  * present.
 143  */
 144 static u8
 145 mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 146 {
 147         u8 *oui;
 148         struct ie_body *iebody;
 149         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 150
 151         if (((bss_desc->bcn_wpa_ie) && ((*(bss_desc->bcn_wpa_ie)).
 152                                       vend_hdr.element_id == WLAN_EID_WPA))) {
 153                 iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data;
 154                 oui = &mwifiex_wpa_oui[cipher][0];
 155                 ret = mwifiex_search_oui_in_ie(iebody, oui);
 156                 if (ret)
 157                         return ret;
 158         }
 159         return ret;
 160 }
 161
 162 /*
 163  * This function compares two SSIDs and checks if they match.
 164  */
 165 s32
 166 mwifiex_ssid_cmp(struct mwifiex_802_11_ssid *ssid1,
 167                  struct mwifiex_802_11_ssid *ssid2)
 168 {
 169         if (!ssid1 || !ssid2 || (ssid1->ssid_len != ssid2->ssid_len))
 170                 return -1;
 171         return memcmp(ssid1->ssid, ssid2->ssid, ssid1->ssid_len);
 172 }
 173
 174 /*
 175  * This function checks if wapi is enabled in driver and scanned network is
 176  * compatible with it.
 177  */
 178 static bool
 179 mwifiex_is_network_compatible_for_wapi(struct mwifiex_private *priv,
 180                                        struct mwifiex_bssdescriptor *bss_desc)
 181 {
 182         if (priv->sec_info.wapi_enabled &&
 183             (bss_desc->bcn_wapi_ie &&
 184              ((*(bss_desc->bcn_wapi_ie)).ieee_hdr.element_id ==
 185                         WLAN_EID_BSS_AC_ACCESS_DELAY))) {
 186                 return true;
 187         }
 188         return false;
 189 }
 190
 191 /*
 192  * This function checks if driver is configured with no security mode and
 193  * scanned network is compatible with it.
 194  */
 195 static bool
 196 mwifiex_is_network_compatible_for_no_sec(struct mwifiex_private *priv,
 197                                        struct mwifiex_bssdescriptor *bss_desc)
 198 {
 199         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 200             !priv->sec_info.wpa2_enabled && ((!bss_desc->bcn_wpa_ie) ||
 201                 ((*(bss_desc->bcn_wpa_ie)).vend_hdr.element_id !=
 202             WLAN_EID_WPA))
 203             && ((!bss_desc->bcn_rsn_ie) ||
 204                 ((*(bss_desc->bcn_rsn_ie)).ieee_hdr.element_id !=
 205             WLAN_EID_RSN))
 206             && !priv->sec_info.encryption_mode
 207             && !bss_desc->privacy) {
 208                 return true;
 209         }
 210         return false;
 211 }
 212
 213 /*
 214  * This function checks if static WEP is enabled in driver and scanned network
 215  * is compatible with it.
 216  */
 217 static bool
 218 mwifiex_is_network_compatible_for_static_wep(struct mwifiex_private *priv,
 219                                        struct mwifiex_bssdescriptor *bss_desc)
 220 {
 221         if (priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 222             !priv->sec_info.wpa2_enabled && bss_desc->privacy) {
 223                 return true;
 224         }
 225         return false;
 226 }
 227
 228 /*
 229  * This function checks if wpa is enabled in driver and scanned network is
 230  * compatible with it.
 231  */
 232 static bool
 233 mwifiex_is_network_compatible_for_wpa(struct mwifiex_private *priv,
 234                                       struct mwifiex_bssdescriptor *bss_desc)
 235 {
 236         if (!priv->sec_info.wep_enabled && priv->sec_info.wpa_enabled &&
 237             !priv->sec_info.wpa2_enabled && ((bss_desc->bcn_wpa_ie) &&
 238             ((*(bss_desc->bcn_wpa_ie)).vend_hdr.element_id == WLAN_EID_WPA))
 239            /*
 240             * Privacy bit may NOT be set in some APs like
 241             * LinkSys WRT54G && bss_desc->privacy
 242             */
 243          ) {
 244                 dev_dbg(priv->adapter->dev, "info: %s: WPA:"
 245                         " wpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s "
 246                         "EncMode=%#x privacy=%#x\n", __func__,
 247                         (bss_desc->bcn_wpa_ie) ?
 248                         (*(bss_desc->bcn_wpa_ie)).
 249                         vend_hdr.element_id : 0,
 250                         (bss_desc->bcn_rsn_ie) ?
 251                         (*(bss_desc->bcn_rsn_ie)).
 252                         ieee_hdr.element_id : 0,
 253                         (priv->sec_info.wep_enabled) ? "e" : "d",
 254                         (priv->sec_info.wpa_enabled) ? "e" : "d",
 255                         (priv->sec_info.wpa2_enabled) ? "e" : "d",
 256                         priv->sec_info.encryption_mode,
 257                         bss_desc->privacy);
 258                 return true;
 259         }
 260         return false;
 261 }
 262
 263 /*
 264  * This function checks if wpa2 is enabled in driver and scanned network is
 265  * compatible with it.
 266  */
 267 static bool
 268 mwifiex_is_network_compatible_for_wpa2(struct mwifiex_private *priv,
 269                                        struct mwifiex_bssdescriptor *bss_desc)
 270 {
 271         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 272             priv->sec_info.wpa2_enabled && ((bss_desc->bcn_rsn_ie) &&
 273             ((*(bss_desc->bcn_rsn_ie)).ieee_hdr.element_id == WLAN_EID_RSN))
 274            /*
 275             * Privacy bit may NOT be set in some APs like
 276             * LinkSys WRT54G && bss_desc->privacy
 277             */
 278          ) {
 279                 dev_dbg(priv->adapter->dev, "info: %s: WPA2: "
 280                         " wpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s "
 281                         "EncMode=%#x privacy=%#x\n", __func__,
 282                         (bss_desc->bcn_wpa_ie) ?
 283                         (*(bss_desc->bcn_wpa_ie)).
 284                         vend_hdr.element_id : 0,
 285                         (bss_desc->bcn_rsn_ie) ?
 286                         (*(bss_desc->bcn_rsn_ie)).
 287                         ieee_hdr.element_id : 0,
 288                         (priv->sec_info.wep_enabled) ? "e" : "d",
 289                         (priv->sec_info.wpa_enabled) ? "e" : "d",
 290                         (priv->sec_info.wpa2_enabled) ? "e" : "d",
 291                         priv->sec_info.encryption_mode,
 292                         bss_desc->privacy);
 293                 return true;
 294         }
 295         return false;
 296 }
 297
 298 /*
 299  * This function checks if adhoc AES is enabled in driver and scanned network is
 300  * compatible with it.
 301  */
 302 static bool
 303 mwifiex_is_network_compatible_for_adhoc_aes(struct mwifiex_private *priv,
 304                                        struct mwifiex_bssdescriptor *bss_desc)
 305 {
 306         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 307             !priv->sec_info.wpa2_enabled && ((!bss_desc->bcn_wpa_ie) ||
 308             ((*(bss_desc->bcn_wpa_ie)).vend_hdr.element_id != WLAN_EID_WPA))
 309             && ((!bss_desc->bcn_rsn_ie) || ((*(bss_desc->bcn_rsn_ie)).ieee_hdr.
 310                    element_id != WLAN_EID_RSN))
 311             && !priv->sec_info.encryption_mode
 312             && bss_desc->privacy) {
 313                 return true;
 314         }
 315         return false;
 316 }
 317
 318 /*
 319  * This function checks if dynamic WEP is enabled in driver and scanned network
 320  * is compatible with it.
 321  */
 322 static bool
 323 mwifiex_is_network_compatible_for_dynamic_wep(struct mwifiex_private *priv,
 324                                        struct mwifiex_bssdescriptor *bss_desc)
 325 {
 326         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 327             !priv->sec_info.wpa2_enabled && ((!bss_desc->bcn_wpa_ie) ||
 328             ((*(bss_desc->bcn_wpa_ie)).vend_hdr.element_id != WLAN_EID_WPA))
 329             && ((!bss_desc->bcn_rsn_ie) || ((*(bss_desc->bcn_rsn_ie)).ieee_hdr.
 330                    element_id != WLAN_EID_RSN))
 331             && priv->sec_info.encryption_mode
 332             && bss_desc->privacy) {
 333                 dev_dbg(priv->adapter->dev, "info: %s: dynamic "
 334                         "WEP: wpa_ie=%#x wpa2_ie=%#x "
 335                         "EncMode=%#x privacy=%#x\n",
 336                         __func__,
 337                         (bss_desc->bcn_wpa_ie) ?
 338                         (*(bss_desc->bcn_wpa_ie)).
 339                         vend_hdr.element_id : 0,
 340                         (bss_desc->bcn_rsn_ie) ?
 341                         (*(bss_desc->bcn_rsn_ie)).
 342                         ieee_hdr.element_id : 0,
 343                         priv->sec_info.encryption_mode,
 344                         bss_desc->privacy);
 345                 return true;
 346         }
 347         return false;
 348 }
 349
 350 /*
 351  * This function checks if a scanned network is compatible with the driver
 352  * settings.
 353  *
 354  *   WEP     WPA    WPA2   ad-hoc encrypt                  Network
 355  * enabled enabled enabled  AES    mode   Privacy WPA WPA2 Compatible
 356  *    0       0       0      0     NONE      0     0   0   yes No security
 357  *    0       1       0      0      x        1x    1   x   yes WPA (disable
 358  *                                                         HT if no AES)
 359  *    0       0       1      0      x        1x    x   1   yes WPA2 (disable
 360  *                                                         HT if no AES)
 361  *    0       0       0      1     NONE      1     0   0   yes Ad-hoc AES
 362  *    1       0       0      0     NONE      1     0   0   yes Static WEP
 363  *                                                         (disable HT)
 364  *    0       0       0      0    !=NONE     1     0   0   yes Dynamic WEP
 365  *
 366  * Compatibility is not matched while roaming, except for mode.
 367  */
 368 static s32
 369 mwifiex_is_network_compatible(struct mwifiex_private *priv,
 370                               struct mwifiex_bssdescriptor *bss_desc, u32 mode)
 371 {
 372         struct mwifiex_adapter *adapter = priv->adapter;
 373
 374         bss_desc->disable_11n = false;
 375
 376         /* Don't check for compatibility if roaming */
 377         if (priv->media_connected && (priv->bss_mode == NL80211_IFTYPE_STATION)
 378             && (bss_desc->bss_mode == NL80211_IFTYPE_STATION))
 379                 return 0;
 380
 381         if (priv->wps.session_enable) {
 382                 dev_dbg(adapter->dev,
 383                         "info: return success directly in WPS period\n");
 384                 return 0;
 385         }
 386
 387         if (mwifiex_is_network_compatible_for_wapi(priv, bss_desc)) {
 388                 dev_dbg(adapter->dev, "info: return success for WAPI AP\n");
 389                 return 0;
 390         }
 391
 392         if (bss_desc->bss_mode == mode) {
 393                 if (mwifiex_is_network_compatible_for_no_sec(priv, bss_desc)) {
 394                         /* No security */
 395                         return 0;
 396                 } else if (mwifiex_is_network_compatible_for_static_wep(priv,
 397                                                                 bss_desc)) {
 398                         /* Static WEP enabled */
 399                         dev_dbg(adapter->dev, "info: Disable 11n in WEP mode.\n");
 400                         bss_desc->disable_11n = true;
 401                         return 0;
 402                 } else if (mwifiex_is_network_compatible_for_wpa(priv,
 403                                                                  bss_desc)) {
 404                         /* WPA enabled */
 405                         if (((priv->adapter->config_bands & BAND_GN
 406                               || priv->adapter->config_bands & BAND_AN)
 407                               && bss_desc->bcn_ht_cap)
 408                               && !mwifiex_is_wpa_oui_present(bss_desc,
 409                                         CIPHER_SUITE_CCMP)) {
 410
 411                                 if (mwifiex_is_wpa_oui_present(bss_desc,
 412                                             CIPHER_SUITE_TKIP)) {
 413                                         dev_dbg(adapter->dev,
 414                                                 "info: Disable 11n if AES "
 415                                                 "is not supported by AP\n");
 416                                         bss_desc->disable_11n = true;
 417                                 } else {
 418                                         return -1;
 419                                 }
 420                         }
 421                         return 0;
 422                 } else if (mwifiex_is_network_compatible_for_wpa2(priv,
 423                                                         bss_desc)) {
 424                         /* WPA2 enabled */
 425                         if (((priv->adapter->config_bands & BAND_GN
 426                               || priv->adapter->config_bands & BAND_AN)
 427                               && bss_desc->bcn_ht_cap)
 428                               && !mwifiex_is_rsn_oui_present(bss_desc,
 429                                         CIPHER_SUITE_CCMP)) {
 430
 431                                 if (mwifiex_is_rsn_oui_present(bss_desc,
 432                                             CIPHER_SUITE_TKIP)) {
 433                                         dev_dbg(adapter->dev,
 434                                                 "info: Disable 11n if AES "
 435                                                 "is not supported by AP\n");
 436                                         bss_desc->disable_11n = true;
 437                                 } else {
 438                                         return -1;
 439                                 }
 440                         }
 441                         return 0;
 442                 } else if (mwifiex_is_network_compatible_for_adhoc_aes(priv,
 443                                                                 bss_desc)) {
 444                         /* Ad-hoc AES enabled */
 445                         return 0;
 446                 } else if (mwifiex_is_network_compatible_for_dynamic_wep(priv,
 447                                                         bss_desc)) {
 448                         /* Dynamic WEP enabled */
 449                         return 0;
 450                 }
 451
 452                 /* Security doesn't match */
 453                 dev_dbg(adapter->dev, "info: %s: failed: "
 454                        "wpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s EncMode"
 455                        "=%#x privacy=%#x\n",
 456                        __func__,
 457                        (bss_desc->bcn_wpa_ie) ?
 458                        (*(bss_desc->bcn_wpa_ie)).vend_hdr.
 459                        element_id : 0,
 460                        (bss_desc->bcn_rsn_ie) ?
 461                        (*(bss_desc->bcn_rsn_ie)).ieee_hdr.
 462                        element_id : 0,
 463                        (priv->sec_info.wep_enabled) ? "e" : "d",
 464                        (priv->sec_info.wpa_enabled) ? "e" : "d",
 465                        (priv->sec_info.wpa2_enabled) ? "e" : "d",
 466                        priv->sec_info.encryption_mode, bss_desc->privacy);
 467                 return -1;
 468         }
 469
 470         /* Mode doesn't match */
 471         return -1;
 472 }
 473
 474 /*
 475  * This function creates a channel list for the driver to scan, based
 476  * on region/band information.
 477  *
 478  * This routine is used for any scan that is not provided with a
 479  * specific channel list to scan.
 480  */
 481 static void
 482 mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
 483                                 const struct mwifiex_user_scan_cfg
 484                                 *user_scan_in,
 485                                 struct mwifiex_chan_scan_param_set
 486                                 *scan_chan_list,
 487                                 u8 filtered_scan)
 488 {
 489         enum ieee80211_band band;
 490         struct ieee80211_supported_band *sband;
 491         struct ieee80211_channel *ch;
 492         struct mwifiex_adapter *adapter = priv->adapter;
 493         int chan_idx = 0, i;
 494
 495         for (band = 0; (band < IEEE80211_NUM_BANDS) ; band++) {
 496
 497                 if (!priv->wdev->wiphy->bands[band])
 498                         continue;
 499
 500                 sband = priv->wdev->wiphy->bands[band];
 501
 502                 for (i = 0; (i < sband->n_channels) ; i++) {
 503                         ch = &sband->channels[i];
 504                         if (ch->flags & IEEE80211_CHAN_DISABLED)
 505                                 continue;
 506                         scan_chan_list[chan_idx].radio_type = band;
 507
 508                         if (user_scan_in &&
 509                                 user_scan_in->chan_list[0].scan_time)
 510                                 scan_chan_list[chan_idx].max_scan_time =
 511                                         cpu_to_le16((u16) user_scan_in->
 512                                         chan_list[0].scan_time);
 513                         else if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 514                                 scan_chan_list[chan_idx].max_scan_time =
 515                                         cpu_to_le16(adapter->passive_scan_time);
 516                         else
 517                                 scan_chan_list[chan_idx].max_scan_time =
 518                                         cpu_to_le16(adapter->active_scan_time);
 519
 520                         if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 521                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 522                                         |= MWIFIEX_PASSIVE_SCAN;
 523                         else
 524                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 525                                         &= ~MWIFIEX_PASSIVE_SCAN;
 526                         scan_chan_list[chan_idx].chan_number =
 527                                                         (u32) ch->hw_value;
 528                         if (filtered_scan) {
 529                                 scan_chan_list[chan_idx].max_scan_time =
 530                                 cpu_to_le16(adapter->specific_scan_time);
 531                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 532                                         |= MWIFIEX_DISABLE_CHAN_FILT;
 533                         }
 534                         chan_idx++;
 535                 }
 536
 537         }
 538 }
 539
 540 /*
 541  * This function constructs and sends multiple scan config commands to
 542  * the firmware.
 543  *
 544  * Previous routines in the code flow have created a scan command configuration
 545  * with any requested TLVs.  This function splits the channel TLV into maximum
 546  * channels supported per scan lists and sends the portion of the channel TLV,
 547  * along with the other TLVs, to the firmware.
 548  */
 549 static int
 550 mwifiex_scan_channel_list(struct mwifiex_private *priv,
 551                           u32 max_chan_per_scan, u8 filtered_scan,
 552                           struct mwifiex_scan_cmd_config *scan_cfg_out,
 553                           struct mwifiex_ie_types_chan_list_param_set
 554                           *chan_tlv_out,
 555                           struct mwifiex_chan_scan_param_set *scan_chan_list)
 556 {
 557         int ret = 0;
 558         struct mwifiex_chan_scan_param_set *tmp_chan_list;
 559         struct mwifiex_chan_scan_param_set *start_chan;
 560
 561         u32 tlv_idx;
 562         u32 total_scan_time;
 563         u32 done_early;
 564
 565         if (!scan_cfg_out || !chan_tlv_out || !scan_chan_list) {
 566                 dev_dbg(priv->adapter->dev,
 567                         "info: Scan: Null detect: %p, %p, %p\n",
 568                        scan_cfg_out, chan_tlv_out, scan_chan_list);
 569                 return -1;
 570         }
 571
 572         chan_tlv_out->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
 573
 574         /* Set the temp channel struct pointer to the start of the desired
 575            list */
 576         tmp_chan_list = scan_chan_list;
 577
 578         /* Loop through the desired channel list, sending a new firmware scan
 579            commands for each max_chan_per_scan channels (or for 1,6,11
 580            individually if configured accordingly) */
 581         while (tmp_chan_list->chan_number) {
 582
 583                 tlv_idx = 0;
 584                 total_scan_time = 0;
 585                 chan_tlv_out->header.len = 0;
 586                 start_chan = tmp_chan_list;
 587                 done_early = false;
 588
 589                 /*
 590                  * Construct the Channel TLV for the scan command.  Continue to
 591                  * insert channel TLVs until:
 592                  *   - the tlv_idx hits the maximum configured per scan command
 593                  *   - the next channel to insert is 0 (end of desired channel
 594                  *     list)
 595                  *   - done_early is set (controlling individual scanning of
 596                  *     1,6,11)
 597                  */
 598                 while (tlv_idx < max_chan_per_scan
 599                        && tmp_chan_list->chan_number && !done_early) {
 600
 601                         dev_dbg(priv->adapter->dev,
 602                                 "info: Scan: Chan(%3d), Radio(%d),"
 603                                 " Mode(%d, %d), Dur(%d)\n",
 604                                tmp_chan_list->chan_number,
 605                                tmp_chan_list->radio_type,
 606                                tmp_chan_list->chan_scan_mode_bitmap
 607                                & MWIFIEX_PASSIVE_SCAN,
 608                                (tmp_chan_list->chan_scan_mode_bitmap
 609                                & MWIFIEX_DISABLE_CHAN_FILT) >> 1,
 610                                le16_to_cpu(tmp_chan_list->max_scan_time));
 611
 612                         /* Copy the current channel TLV to the command being
 613                            prepared */
 614                         memcpy(chan_tlv_out->chan_scan_param + tlv_idx,
 615                                tmp_chan_list,
 616                                sizeof(chan_tlv_out->chan_scan_param));
 617
 618                         /* Increment the TLV header length by the size
 619                            appended */
 620                         chan_tlv_out->header.len =
 621                         cpu_to_le16(le16_to_cpu(chan_tlv_out->header.len) +
 622                         (sizeof(chan_tlv_out->chan_scan_param)));
 623
 624                         /*
 625                          * The tlv buffer length is set to the number of bytes
 626                          * of the between the channel tlv pointer and the start
 627                          * of the tlv buffer.  This compensates for any TLVs
 628                          * that were appended before the channel list.
 629                          */
 630                         scan_cfg_out->tlv_buf_len = (u32) ((u8 *) chan_tlv_out -
 631                                                         scan_cfg_out->tlv_buf);
 632
 633                         /* Add the size of the channel tlv header and the data
 634                            length */
 635                         scan_cfg_out->tlv_buf_len +=
 636                                 (sizeof(chan_tlv_out->header)
 637                                  + le16_to_cpu(chan_tlv_out->header.len));
 638
 639                         /* Increment the index to the channel tlv we are
 640                            constructing */
 641                         tlv_idx++;
 642
 643                         /* Count the total scan time per command */
 644                         total_scan_time +=
 645                                 le16_to_cpu(tmp_chan_list->max_scan_time);
 646
 647                         done_early = false;
 648
 649                         /* Stop the loop if the *current* channel is in the
 650                            1,6,11 set and we are not filtering on a BSSID
 651                            or SSID. */
 652                         if (!filtered_scan && (tmp_chan_list->chan_number == 1
 653                                 || tmp_chan_list->chan_number == 6
 654                                 || tmp_chan_list->chan_number == 11))
 655                                 done_early = true;
 656
 657                         /* Increment the tmp pointer to the next channel to
 658                            be scanned */
 659                         tmp_chan_list++;
 660
 661                         /* Stop the loop if the *next* channel is in the 1,6,11
 662                            set.  This will cause it to be the only channel
 663                            scanned on the next interation */
 664                         if (!filtered_scan && (tmp_chan_list->chan_number == 1
 665                                 || tmp_chan_list->chan_number == 6
 666                                 || tmp_chan_list->chan_number == 11))
 667                                 done_early = true;
 668                 }
 669
 670                 /* The total scan time should be less than scan command timeout
 671                    value */
 672                 if (total_scan_time > MWIFIEX_MAX_TOTAL_SCAN_TIME) {
 673                         dev_err(priv->adapter->dev, "total scan time %dms"
 674                                 " is over limit (%dms), scan skipped\n",
 675                                 total_scan_time, MWIFIEX_MAX_TOTAL_SCAN_TIME);
 676                         ret = -1;
 677                         break;
 678                 }
 679
 680                 priv->adapter->scan_channels = start_chan;
 681
 682                 /* Send the scan command to the firmware with the specified
 683                    cfg */
 684                 ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11_SCAN,
 685                                              HostCmd_ACT_GEN_SET, 0,
 686                                              scan_cfg_out);
 687                 if (ret)
 688                         break;
 689         }
 690
 691         if (ret)
 692                 return -1;
 693
 694         return 0;
 695 }
 696
 697 /*
 698  * This function constructs a scan command configuration structure to use
 699  * in scan commands.
 700  *
 701  * Application layer or other functions can invoke network scanning
 702  * with a scan configuration supplied in a user scan configuration structure.
 703  * This structure is used as the basis of one or many scan command configuration
 704  * commands that are sent to the command processing module and eventually to the
 705  * firmware.
 706  *
 707  * This function creates a scan command configuration structure  based on the
 708  * following user supplied parameters (if present):
 709  *      - SSID filter
 710  *      - BSSID filter
 711  *      - Number of Probes to be sent
 712  *      - Channel list
 713  *
 714  * If the SSID or BSSID filter is not present, the filter is disabled/cleared.
 715  * If the number of probes is not set, adapter default setting is used.
 716  */
 717 static void
 718 mwifiex_scan_setup_scan_config(struct mwifiex_private *priv,
 719                                const struct mwifiex_user_scan_cfg *user_scan_in,
 720                                struct mwifiex_scan_cmd_config *scan_cfg_out,
 721                                struct mwifiex_ie_types_chan_list_param_set
 722                                **chan_list_out,
 723                                struct mwifiex_chan_scan_param_set
 724                                *scan_chan_list,
 725                                u8 *max_chan_per_scan, u8 *filtered_scan,
 726                                u8 *scan_current_only)
 727 {
 728         struct mwifiex_adapter *adapter = priv->adapter;
 729         struct mwifiex_ie_types_num_probes *num_probes_tlv;
 730         struct mwifiex_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
 731         struct mwifiex_ie_types_rates_param_set *rates_tlv;
 732         const u8 zero_mac[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
 733         u8 *tlv_pos;
 734         u32 num_probes;
 735         u32 ssid_len;
 736         u32 chan_idx;
 737         u32 scan_type;
 738         u16 scan_dur;
 739         u8 channel;
 740         u8 radio_type;
 741         u32 ssid_idx;
 742         u8 ssid_filter;
 743         u8 rates[MWIFIEX_SUPPORTED_RATES];
 744         u32 rates_size;
 745         struct mwifiex_ie_types_htcap *ht_cap;
 746
 747         /* The tlv_buf_len is calculated for each scan command.  The TLVs added
 748            in this routine will be preserved since the routine that sends the
 749            command will append channelTLVs at *chan_list_out.  The difference
 750            between the *chan_list_out and the tlv_buf start will be used to
 751            calculate the size of anything we add in this routine. */
 752         scan_cfg_out->tlv_buf_len = 0;
 753
 754         /* Running tlv pointer.  Assigned to chan_list_out at end of function
 755            so later routines know where channels can be added to the command
 756            buf */
 757         tlv_pos = scan_cfg_out->tlv_buf;
 758
 759         /* Initialize the scan as un-filtered; the flag is later set to TRUE
 760            below if a SSID or BSSID filter is sent in the command */
 761         *filtered_scan = false;
 762
 763         /* Initialize the scan as not being only on the current channel.  If
 764            the channel list is customized, only contains one channel, and is
 765            the active channel, this is set true and data flow is not halted. */
 766         *scan_current_only = false;
 767
 768         if (user_scan_in) {
 769
 770                 /* Default the ssid_filter flag to TRUE, set false under
 771                    certain wildcard conditions and qualified by the existence
 772                    of an SSID list before marking the scan as filtered */
 773                 ssid_filter = true;
 774
 775                 /* Set the BSS type scan filter, use Adapter setting if
 776                    unset */
 777                 scan_cfg_out->bss_mode =
 778                         (user_scan_in->bss_mode ? (u8) user_scan_in->
 779                          bss_mode : (u8) adapter->scan_mode);
 780
 781                 /* Set the number of probes to send, use Adapter setting
 782                    if unset */
 783                 num_probes =
 784                         (user_scan_in->num_probes ? user_scan_in->
 785                          num_probes : adapter->scan_probes);
 786
 787                 /*
 788                  * Set the BSSID filter to the incoming configuration,
 789                  * if non-zero.  If not set, it will remain disabled
 790                  * (all zeros).
 791                  */
 792                 memcpy(scan_cfg_out->specific_bssid,
 793                        user_scan_in->specific_bssid,
 794                        sizeof(scan_cfg_out->specific_bssid));
 795
 796                 for (ssid_idx = 0;
 797                      ((ssid_idx < ARRAY_SIZE(user_scan_in->ssid_list))
 798                       && (*user_scan_in->ssid_list[ssid_idx].ssid
 799                           || user_scan_in->ssid_list[ssid_idx].max_len));
 800                      ssid_idx++) {
 801
 802                         ssid_len = strlen(user_scan_in->ssid_list[ssid_idx].
 803                                           ssid) + 1;
 804
 805                         wildcard_ssid_tlv =
 806                                 (struct mwifiex_ie_types_wildcard_ssid_params *)
 807                                 tlv_pos;
 808                         wildcard_ssid_tlv->header.type =
 809                                 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
 810                         wildcard_ssid_tlv->header.len = cpu_to_le16(
 811                                 (u16) (ssid_len + sizeof(wildcard_ssid_tlv->
 812                                                          max_ssid_length)));
 813
 814                         /* max_ssid_length = 0 tells firmware to perform
 815                            specific scan for the SSID filled */
 816                         wildcard_ssid_tlv->max_ssid_length = 0;
 817
 818                         memcpy(wildcard_ssid_tlv->ssid,
 819                                user_scan_in->ssid_list[ssid_idx].ssid,
 820                                ssid_len);
 821
 822                         tlv_pos += (sizeof(wildcard_ssid_tlv->header)
 823                                 + le16_to_cpu(wildcard_ssid_tlv->header.len));
 824
 825                         dev_dbg(adapter->dev, "info: scan: ssid_list[%d]: %s, %d\n",
 826                                 ssid_idx, wildcard_ssid_tlv->ssid,
 827                                 wildcard_ssid_tlv->max_ssid_length);
 828
 829                         /* Empty wildcard ssid with a maxlen will match many or
 830                            potentially all SSIDs (maxlen == 32), therefore do
 831                            not treat the scan as
 832                            filtered. */
 833                         if (!ssid_len && wildcard_ssid_tlv->max_ssid_length)
 834                                 ssid_filter = false;
 835
 836                 }
 837
 838                 /*
 839                  *  The default number of channels sent in the command is low to
 840                  *  ensure the response buffer from the firmware does not
 841                  *  truncate scan results.  That is not an issue with an SSID
 842                  *  or BSSID filter applied to the scan results in the firmware.
 843                  */
 844                 if ((ssid_idx && ssid_filter)
 845                     || memcmp(scan_cfg_out->specific_bssid, &zero_mac,
 846                               sizeof(zero_mac)))
 847                         *filtered_scan = true;
 848         } else {
 849                 scan_cfg_out->bss_mode = (u8) adapter->scan_mode;
 850                 num_probes = adapter->scan_probes;
 851         }
 852
 853         /*
 854          *  If a specific BSSID or SSID is used, the number of channels in the
 855          *  scan command will be increased to the absolute maximum.
 856          */
 857         if (*filtered_scan)
 858                 *max_chan_per_scan = MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN;
 859         else
 860                 *max_chan_per_scan = MWIFIEX_CHANNELS_PER_SCAN_CMD;
 861
 862         /* If the input config or adapter has the number of Probes set,
 863            add tlv */
 864         if (num_probes) {
 865
 866                 dev_dbg(adapter->dev, "info: scan: num_probes = %d\n",
 867                                                 num_probes);
 868
 869                 num_probes_tlv = (struct mwifiex_ie_types_num_probes *) tlv_pos;
 870                 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
 871                 num_probes_tlv->header.len =
 872                         cpu_to_le16(sizeof(num_probes_tlv->num_probes));
 873                 num_probes_tlv->num_probes = cpu_to_le16((u16) num_probes);
 874
 875                 tlv_pos += sizeof(num_probes_tlv->header) +
 876                         le16_to_cpu(num_probes_tlv->header.len);
 877
 878         }
 879
 880         /* Append rates tlv */
 881         memset(rates, 0, sizeof(rates));
 882
 883         rates_size = mwifiex_get_supported_rates(priv, rates);
 884
 885         rates_tlv = (struct mwifiex_ie_types_rates_param_set *) tlv_pos;
 886         rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
 887         rates_tlv->header.len = cpu_to_le16((u16) rates_size);
 888         memcpy(rates_tlv->rates, rates, rates_size);
 889         tlv_pos += sizeof(rates_tlv->header) + rates_size;
 890
 891         dev_dbg(adapter->dev, "info: SCAN_CMD: Rates size = %d\n", rates_size);
 892
 893         if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info)
 894             && (priv->adapter->config_bands & BAND_GN
 895                 || priv->adapter->config_bands & BAND_AN)) {
 896                 ht_cap = (struct mwifiex_ie_types_htcap *) tlv_pos;
 897                 memset(ht_cap, 0, sizeof(struct mwifiex_ie_types_htcap));
 898                 ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
 899                 ht_cap->header.len =
 900                                 cpu_to_le16(sizeof(struct ieee80211_ht_cap));
 901                 radio_type =
 902                         mwifiex_band_to_radio_type(priv->adapter->config_bands);
 903                 mwifiex_fill_cap_info(priv, radio_type, ht_cap);
 904                 tlv_pos += sizeof(struct mwifiex_ie_types_htcap);
 905         }
 906
 907         /* Append vendor specific IE TLV */
 908         mwifiex_cmd_append_vsie_tlv(priv, MWIFIEX_VSIE_MASK_SCAN, &tlv_pos);
 909
 910         /*
 911          * Set the output for the channel TLV to the address in the tlv buffer
 912          *   past any TLVs that were added in this function (SSID, num_probes).
 913          *   Channel TLVs will be added past this for each scan command,
 914          *   preserving the TLVs that were previously added.
 915          */
 916         *chan_list_out =
 917                 (struct mwifiex_ie_types_chan_list_param_set *) tlv_pos;
 918
 919         if (user_scan_in && user_scan_in->chan_list[0].chan_number) {
 920
 921                 dev_dbg(adapter->dev, "info: Scan: Using supplied channel list\n");
 922
 923                 for (chan_idx = 0;
 924                      chan_idx < MWIFIEX_USER_SCAN_CHAN_MAX
 925                      && user_scan_in->chan_list[chan_idx].chan_number;
 926                      chan_idx++) {
 927
 928                         channel = user_scan_in->chan_list[chan_idx].chan_number;
 929                         (scan_chan_list + chan_idx)->chan_number = channel;
 930
 931                         radio_type =
 932                                 user_scan_in->chan_list[chan_idx].radio_type;
 933                         (scan_chan_list + chan_idx)->radio_type = radio_type;
 934
 935                         scan_type = user_scan_in->chan_list[chan_idx].scan_type;
 936
 937                         if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
 938                                 (scan_chan_list +
 939                                  chan_idx)->chan_scan_mode_bitmap
 940                                         |= MWIFIEX_PASSIVE_SCAN;
 941                         else
 942                                 (scan_chan_list +
 943                                  chan_idx)->chan_scan_mode_bitmap
 944                                         &= ~MWIFIEX_PASSIVE_SCAN;
 945
 946                         if (user_scan_in->chan_list[chan_idx].scan_time) {
 947                                 scan_dur = (u16) user_scan_in->
 948                                         chan_list[chan_idx].scan_time;
 949                         } else {
 950                                 if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
 951                                         scan_dur = adapter->passive_scan_time;
 952                                 else if (*filtered_scan)
 953                                         scan_dur = adapter->specific_scan_time;
 954                                 else
 955                                         scan_dur = adapter->active_scan_time;
 956                         }
 957
 958                         (scan_chan_list + chan_idx)->min_scan_time =
 959                                 cpu_to_le16(scan_dur);
 960                         (scan_chan_list + chan_idx)->max_scan_time =
 961                                 cpu_to_le16(scan_dur);
 962                 }
 963
 964                 /* Check if we are only scanning the current channel */
 965                 if ((chan_idx == 1)
 966                     && (user_scan_in->chan_list[0].chan_number
 967                         == priv->curr_bss_params.bss_descriptor.channel)) {
 968                         *scan_current_only = true;
 969                         dev_dbg(adapter->dev,
 970                                 "info: Scan: Scanning current channel only\n");
 971                 }
 972
 973         } else {
 974                 dev_dbg(adapter->dev,
 975                                 "info: Scan: Creating full region channel list\n");
 976                 mwifiex_scan_create_channel_list(priv, user_scan_in,
 977                                                  scan_chan_list,
 978                                                  *filtered_scan);
 979         }
 980 }
 981
 982 /*
 983  * This function inspects the scan response buffer for pointers to
 984  * expected TLVs.
 985  *
 986  * TLVs can be included at the end of the scan response BSS information.
 987  *
 988  * Data in the buffer is parsed pointers to TLVs that can potentially
 989  * be passed back in the response.
 990  */
 991 static void
 992 mwifiex_ret_802_11_scan_get_tlv_ptrs(struct mwifiex_adapter *adapter,
 993                                      struct mwifiex_ie_types_data *tlv,
 994                                      u32 tlv_buf_size, u32 req_tlv_type,
 995                                      struct mwifiex_ie_types_data **tlv_data)
 996 {
 997         struct mwifiex_ie_types_data *current_tlv;
 998         u32 tlv_buf_left;
 999         u32 tlv_type;
1000         u32 tlv_len;
1001
1002         current_tlv = tlv;
1003         tlv_buf_left = tlv_buf_size;
1004         *tlv_data = NULL;
1005
1006         dev_dbg(adapter->dev, "info: SCAN_RESP: tlv_buf_size = %d\n",
1007                                                 tlv_buf_size);
1008
1009         while (tlv_buf_left >= sizeof(struct mwifiex_ie_types_header)) {
1010
1011                 tlv_type = le16_to_cpu(current_tlv->header.type);
1012                 tlv_len = le16_to_cpu(current_tlv->header.len);
1013
1014                 if (sizeof(tlv->header) + tlv_len > tlv_buf_left) {
1015                         dev_err(adapter->dev, "SCAN_RESP: TLV buffer corrupt\n");
1016                         break;
1017                 }
1018
1019                 if (req_tlv_type == tlv_type) {
1020                         switch (tlv_type) {
1021                         case TLV_TYPE_TSFTIMESTAMP:
1022                                 dev_dbg(adapter->dev, "info: SCAN_RESP: TSF "
1023                                         "timestamp TLV, len = %d\n", tlv_len);
1024                                 *tlv_data = (struct mwifiex_ie_types_data *)
1025                                         current_tlv;
1026                                 break;
1027                         case TLV_TYPE_CHANNELBANDLIST:
1028                                 dev_dbg(adapter->dev, "info: SCAN_RESP: channel"
1029                                         " band list TLV, len = %d\n", tlv_len);
1030                                 *tlv_data = (struct mwifiex_ie_types_data *)
1031                                         current_tlv;
1032                                 break;
1033                         default:
1034                                 dev_err(adapter->dev,
1035                                         "SCAN_RESP: unhandled TLV = %d\n",
1036                                        tlv_type);
1037                                 /* Give up, this seems corrupted */
1038                                 return;
1039                         }
1040                 }
1041
1042                 if (*tlv_data)
1043                         break;
1044
1045
1046                 tlv_buf_left -= (sizeof(tlv->header) + tlv_len);
1047                 current_tlv =
1048                         (struct mwifiex_ie_types_data *) (current_tlv->data +
1049                                                           tlv_len);
1050
1051         }                       /* while */
1052 }
1053
1054 /*
1055  * This function parses provided beacon buffer and updates
1056  * respective fields in bss descriptor structure.
1057  */
1058 int
1059 mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
1060                                 struct mwifiex_bssdescriptor *bss_entry,
1061                                 u8 *ie_buf, u32 ie_len)
1062 {
1063         int ret = 0;
1064         u8 element_id;
1065         struct ieee_types_fh_param_set *fh_param_set;
1066         struct ieee_types_ds_param_set *ds_param_set;
1067         struct ieee_types_cf_param_set *cf_param_set;
1068         struct ieee_types_ibss_param_set *ibss_param_set;
1069         u8 *current_ptr;
1070         u8 *rate;
1071         u8 element_len;
1072         u16 total_ie_len;
1073         u8 bytes_to_copy;
1074         u8 rate_size;
1075         u8 found_data_rate_ie;
1076         u32 bytes_left;
1077         struct ieee_types_vendor_specific *vendor_ie;
1078         const u8 wpa_oui[4] = { 0x00, 0x50, 0xf2, 0x01 };
1079         const u8 wmm_oui[4] = { 0x00, 0x50, 0xf2, 0x02 };
1080
1081         found_data_rate_ie = false;
1082         rate_size = 0;
1083         current_ptr = ie_buf;
1084         bytes_left = ie_len;
1085         bss_entry->beacon_buf = ie_buf;
1086         bss_entry->beacon_buf_size = ie_len;
1087
1088         /* Process variable IE */
1089         while (bytes_left >= 2) {
1090                 element_id = *current_ptr;
1091                 element_len = *(current_ptr + 1);
1092                 total_ie_len = element_len + sizeof(struct ieee_types_header);
1093
1094                 if (bytes_left < total_ie_len) {
1095                         dev_err(adapter->dev, "err: InterpretIE: in processing"
1096                                 " IE, bytes left < IE length\n");
1097                         return -1;
1098                 }
1099                 switch (element_id) {
1100                 case WLAN_EID_SSID:
1101                         bss_entry->ssid.ssid_len = element_len;
1102                         memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
1103                                element_len);
1104                         dev_dbg(adapter->dev, "info: InterpretIE: ssid: "
1105                                               "%-32s\n", bss_entry->ssid.ssid);
1106                         break;
1107
1108                 case WLAN_EID_SUPP_RATES:
1109                         memcpy(bss_entry->data_rates, current_ptr + 2,
1110                                element_len);
1111                         memcpy(bss_entry->supported_rates, current_ptr + 2,
1112                                element_len);
1113                         rate_size = element_len;
1114                         found_data_rate_ie = true;
1115                         break;
1116
1117                 case WLAN_EID_FH_PARAMS:
1118                         fh_param_set =
1119                                 (struct ieee_types_fh_param_set *) current_ptr;
1120                         memcpy(&bss_entry->phy_param_set.fh_param_set,
1121                                fh_param_set,
1122                                sizeof(struct ieee_types_fh_param_set));
1123                         break;
1124
1125                 case WLAN_EID_DS_PARAMS:
1126                         ds_param_set =
1127                                 (struct ieee_types_ds_param_set *) current_ptr;
1128
1129                         bss_entry->channel = ds_param_set->current_chan;
1130
1131                         memcpy(&bss_entry->phy_param_set.ds_param_set,
1132                                ds_param_set,
1133                                sizeof(struct ieee_types_ds_param_set));
1134                         break;
1135
1136                 case WLAN_EID_CF_PARAMS:
1137                         cf_param_set =
1138                                 (struct ieee_types_cf_param_set *) current_ptr;
1139                         memcpy(&bss_entry->ss_param_set.cf_param_set,
1140                                cf_param_set,
1141                                sizeof(struct ieee_types_cf_param_set));
1142                         break;
1143
1144                 case WLAN_EID_IBSS_PARAMS:
1145                         ibss_param_set =
1146                                 (struct ieee_types_ibss_param_set *)
1147                                 current_ptr;
1148                         memcpy(&bss_entry->ss_param_set.ibss_param_set,
1149                                ibss_param_set,
1150                                sizeof(struct ieee_types_ibss_param_set));
1151                         break;
1152
1153                 case WLAN_EID_ERP_INFO:
1154                         bss_entry->erp_flags = *(current_ptr + 2);
1155                         break;
1156
1157                 case WLAN_EID_EXT_SUPP_RATES:
1158                         /*
1159                          * Only process extended supported rate
1160                          * if data rate is already found.
1161                          * Data rate IE should come before
1162                          * extended supported rate IE
1163                          */
1164                         if (found_data_rate_ie) {
1165                                 if ((element_len + rate_size) >
1166                                     MWIFIEX_SUPPORTED_RATES)
1167                                         bytes_to_copy =
1168                                                 (MWIFIEX_SUPPORTED_RATES -
1169                                                  rate_size);
1170                                 else
1171                                         bytes_to_copy = element_len;
1172
1173                                 rate = (u8 *) bss_entry->data_rates;
1174                                 rate += rate_size;
1175                                 memcpy(rate, current_ptr + 2, bytes_to_copy);
1176
1177                                 rate = (u8 *) bss_entry->supported_rates;
1178                                 rate += rate_size;
1179                                 memcpy(rate, current_ptr + 2, bytes_to_copy);
1180                         }
1181                         break;
1182
1183                 case WLAN_EID_VENDOR_SPECIFIC:
1184                         vendor_ie = (struct ieee_types_vendor_specific *)
1185                                         current_ptr;
1186
1187                         if (!memcmp
1188                             (vendor_ie->vend_hdr.oui, wpa_oui,
1189                              sizeof(wpa_oui))) {
1190                                 bss_entry->bcn_wpa_ie =
1191                                         (struct ieee_types_vendor_specific *)
1192                                         current_ptr;
1193                                 bss_entry->wpa_offset = (u16) (current_ptr -
1194                                                         bss_entry->beacon_buf);
1195                         } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
1196                                     sizeof(wmm_oui))) {
1197                                 if (total_ie_len ==
1198                                     sizeof(struct ieee_types_wmm_parameter)
1199                                     || total_ie_len ==
1200                                     sizeof(struct ieee_types_wmm_info))
1201                                         /*
1202                                          * Only accept and copy the WMM IE if
1203                                          * it matches the size expected for the
1204                                          * WMM Info IE or the WMM Parameter IE.
1205                                          */
1206                                         memcpy((u8 *) &bss_entry->wmm_ie,
1207                                                current_ptr, total_ie_len);
1208                         }
1209                         break;
1210                 case WLAN_EID_RSN:
1211                         bss_entry->bcn_rsn_ie =
1212                                 (struct ieee_types_generic *) current_ptr;
1213                         bss_entry->rsn_offset = (u16) (current_ptr -
1214                                                         bss_entry->beacon_buf);
1215                         break;
1216                 case WLAN_EID_BSS_AC_ACCESS_DELAY:
1217                         bss_entry->bcn_wapi_ie =
1218                                 (struct ieee_types_generic *) current_ptr;
1219                         bss_entry->wapi_offset = (u16) (current_ptr -
1220                                                         bss_entry->beacon_buf);
1221                         break;
1222                 case WLAN_EID_HT_CAPABILITY:
1223                         bss_entry->bcn_ht_cap = (struct ieee80211_ht_cap *)
1224                                         (current_ptr +
1225                                         sizeof(struct ieee_types_header));
1226                         bss_entry->ht_cap_offset = (u16) (current_ptr +
1227                                         sizeof(struct ieee_types_header) -
1228                                         bss_entry->beacon_buf);
1229                         break;
1230                 case WLAN_EID_HT_INFORMATION:
1231                         bss_entry->bcn_ht_info = (struct ieee80211_ht_info *)
1232                                         (current_ptr +
1233                                         sizeof(struct ieee_types_header));
1234                         bss_entry->ht_info_offset = (u16) (current_ptr +
1235                                         sizeof(struct ieee_types_header) -
1236                                         bss_entry->beacon_buf);
1237                         break;
1238                 case WLAN_EID_BSS_COEX_2040:
1239                         bss_entry->bcn_bss_co_2040 = (u8 *) (current_ptr +
1240                                         sizeof(struct ieee_types_header));
1241                         bss_entry->bss_co_2040_offset = (u16) (current_ptr +
1242                                         sizeof(struct ieee_types_header) -
1243                                                 bss_entry->beacon_buf);
1244                         break;
1245                 case WLAN_EID_EXT_CAPABILITY:
1246                         bss_entry->bcn_ext_cap = (u8 *) (current_ptr +
1247                                         sizeof(struct ieee_types_header));
1248                         bss_entry->ext_cap_offset = (u16) (current_ptr +
1249                                         sizeof(struct ieee_types_header) -
1250                                         bss_entry->beacon_buf);
1251                         break;
1252                 default:
1253                         break;
1254                 }
1255
1256                 current_ptr += element_len + 2;
1257
1258                 /* Need to account for IE ID and IE Len */
1259                 bytes_left -= (element_len + 2);
1260
1261         }       /* while (bytes_left > 2) */
1262         return ret;
1263 }
1264
1265 /*
1266  * This function converts radio type scan parameter to a band configuration
1267  * to be used in join command.
1268  */
1269 static u8
1270 mwifiex_radio_type_to_band(u8 radio_type)
1271 {
1272         switch (radio_type) {
1273         case HostCmd_SCAN_RADIO_TYPE_A:
1274                 return BAND_A;
1275         case HostCmd_SCAN_RADIO_TYPE_BG:
1276         default:
1277                 return BAND_G;
1278         }
1279 }
1280
1281 /*
1282  * This is an internal function used to start a scan based on an input
1283  * configuration.
1284  *
1285  * This uses the input user scan configuration information when provided in
1286  * order to send the appropriate scan commands to firmware to populate or
1287  * update the internal driver scan table.
1288  */
1289 static int mwifiex_scan_networks(struct mwifiex_private *priv,
1290                 const struct mwifiex_user_scan_cfg *user_scan_in)
1291 {
1292         int ret = 0;
1293         struct mwifiex_adapter *adapter = priv->adapter;
1294         struct cmd_ctrl_node *cmd_node;
1295         union mwifiex_scan_cmd_config_tlv *scan_cfg_out;
1296         struct mwifiex_ie_types_chan_list_param_set *chan_list_out;
1297         u32 buf_size;
1298         struct mwifiex_chan_scan_param_set *scan_chan_list;
1299         u8 filtered_scan;
1300         u8 scan_current_chan_only;
1301         u8 max_chan_per_scan;
1302         unsigned long flags;
1303
1304         if (adapter->scan_processing) {
1305                 dev_dbg(adapter->dev, "cmd: Scan already in process...\n");
1306                 return ret;
1307         }
1308
1309         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1310         adapter->scan_processing = true;
1311         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1312
1313         if (priv->scan_block) {
1314                 dev_dbg(adapter->dev,
1315                         "cmd: Scan is blocked during association...\n");
1316                 return ret;
1317         }
1318
1319         scan_cfg_out = kzalloc(sizeof(union mwifiex_scan_cmd_config_tlv),
1320                                         GFP_KERNEL);
1321         if (!scan_cfg_out) {
1322                 dev_err(adapter->dev, "failed to alloc scan_cfg_out\n");
1323                 return -ENOMEM;
1324         }
1325
1326         buf_size = sizeof(struct mwifiex_chan_scan_param_set) *
1327                         MWIFIEX_USER_SCAN_CHAN_MAX;
1328         scan_chan_list = kzalloc(buf_size, GFP_KERNEL);
1329         if (!scan_chan_list) {
1330                 dev_err(adapter->dev, "failed to alloc scan_chan_list\n");
1331                 kfree(scan_cfg_out);
1332                 return -ENOMEM;
1333         }
1334
1335         mwifiex_scan_setup_scan_config(priv, user_scan_in,
1336                                        &scan_cfg_out->config, &chan_list_out,
1337                                        scan_chan_list, &max_chan_per_scan,
1338                                        &filtered_scan, &scan_current_chan_only);
1339
1340         ret = mwifiex_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
1341                                         &scan_cfg_out->config, chan_list_out,
1342                                         scan_chan_list);
1343
1344         /* Get scan command from scan_pending_q and put to cmd_pending_q */
1345         if (!ret) {
1346                 spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1347                 if (!list_empty(&adapter->scan_pending_q)) {
1348                         cmd_node = list_first_entry(&adapter->scan_pending_q,
1349                                                 struct cmd_ctrl_node, list);
1350                         list_del(&cmd_node->list);
1351                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
1352                                                                         flags);
1353                         adapter->cmd_queued = cmd_node;
1354                         mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
1355                                                         true);
1356                 } else {
1357                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
1358                                                flags);
1359                 }
1360         } else {
1361                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1362                 adapter->scan_processing = true;
1363                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1364         }
1365
1366         kfree(scan_cfg_out);
1367         kfree(scan_chan_list);
1368         return ret;
1369 }
1370
1371 /*
1372  * Sends IOCTL request to start a scan with user configurations.
1373  *
1374  * This function allocates the IOCTL request buffer, fills it
1375  * with requisite parameters and calls the IOCTL handler.
1376  *
1377  * Upon completion, it also generates a wireless event to notify
1378  * applications.
1379  */
1380 int mwifiex_set_user_scan_ioctl(struct mwifiex_private *priv,
1381                                 struct mwifiex_user_scan_cfg *scan_req)
1382 {
1383         int status;
1384
1385         status = mwifiex_scan_networks(priv, scan_req);
1386         queue_work(priv->adapter->workqueue, &priv->adapter->main_work);
1387
1388         return status;
1389 }
1390
1391 /*
1392  * This function prepares a scan command to be sent to the firmware.
1393  *
1394  * This uses the scan command configuration sent to the command processing
1395  * module in command preparation stage to configure a scan command structure
1396  * to send to firmware.
1397  *
1398  * The fixed fields specifying the BSS type and BSSID filters as well as a
1399  * variable number/length of TLVs are sent in the command to firmware.
1400  *
1401  * Preparation also includes -
1402  *      - Setting command ID, and proper size
1403  *      - Ensuring correct endian-ness
1404  */
1405 int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
1406                             struct mwifiex_scan_cmd_config *scan_cfg)
1407 {
1408         struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;
1409
1410         /* Set fixed field variables in scan command */
1411         scan_cmd->bss_mode = scan_cfg->bss_mode;
1412         memcpy(scan_cmd->bssid, scan_cfg->specific_bssid,
1413                sizeof(scan_cmd->bssid));
1414         memcpy(scan_cmd->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
1415
1416         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SCAN);
1417
1418         /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
1419         cmd->size = cpu_to_le16((u16) (sizeof(scan_cmd->bss_mode)
1420                                           + sizeof(scan_cmd->bssid)
1421                                           + scan_cfg->tlv_buf_len + S_DS_GEN));
1422
1423         return 0;
1424 }
1425
1426 /*
1427  * This function checks compatibility of requested network with current
1428  * driver settings.
1429  */
1430 int mwifiex_check_network_compatibility(struct mwifiex_private *priv,
1431                                         struct mwifiex_bssdescriptor *bss_desc)
1432 {
1433         int ret = -1;
1434
1435         if (!bss_desc)
1436                 return -1;
1437
1438         if ((mwifiex_get_cfp_by_band_and_channel_from_cfg80211(priv,
1439                         (u8) bss_desc->bss_band, (u16) bss_desc->channel))) {
1440                 switch (priv->bss_mode) {
1441                 case NL80211_IFTYPE_STATION:
1442                 case NL80211_IFTYPE_ADHOC:
1443                         ret = mwifiex_is_network_compatible(priv, bss_desc,
1444                                                             priv->bss_mode);
1445                         if (ret)
1446                                 dev_err(priv->adapter->dev, "cannot find ssid "
1447                                         "%s\n", bss_desc->ssid.ssid);
1448                                 break;
1449                 default:
1450                                 ret = 0;
1451                 }
1452         }
1453
1454         return ret;
1455 }
1456
1457 static int
1458 mwifiex_update_curr_bss_params(struct mwifiex_private *priv, u8 *bssid,
1459                                s32 rssi, const u8 *ie_buf, size_t ie_len,
1460                                u16 beacon_period, u16 cap_info_bitmap, u8 band)
1461 {
1462         struct mwifiex_bssdescriptor *bss_desc;
1463         int ret;
1464         unsigned long flags;
1465         u8 *beacon_ie;
1466
1467         /* Allocate and fill new bss descriptor */
1468         bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
1469                         GFP_KERNEL);
1470         if (!bss_desc) {
1471                 dev_err(priv->adapter->dev, " failed to alloc bss_desc\n");
1472                 return -ENOMEM;
1473         }
1474
1475         beacon_ie = kmemdup(ie_buf, ie_len, GFP_KERNEL);
1476         if (!beacon_ie) {
1477                 kfree(bss_desc);
1478                 dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
1479                 return -ENOMEM;
1480         }
1481
1482         ret = mwifiex_fill_new_bss_desc(priv, bssid, rssi, beacon_ie,
1483                                         ie_len, beacon_period,
1484                                         cap_info_bitmap, band, bss_desc);
1485         if (ret)
1486                 goto done;
1487
1488         ret = mwifiex_check_network_compatibility(priv, bss_desc);
1489         if (ret)
1490                 goto done;
1491
1492         /* Update current bss descriptor parameters */
1493         spin_lock_irqsave(&priv->curr_bcn_buf_lock, flags);
1494         priv->curr_bss_params.bss_descriptor.bcn_wpa_ie = NULL;
1495         priv->curr_bss_params.bss_descriptor.wpa_offset = 0;
1496         priv->curr_bss_params.bss_descriptor.bcn_rsn_ie = NULL;
1497         priv->curr_bss_params.bss_descriptor.rsn_offset = 0;
1498         priv->curr_bss_params.bss_descriptor.bcn_wapi_ie = NULL;
1499         priv->curr_bss_params.bss_descriptor.wapi_offset = 0;
1500         priv->curr_bss_params.bss_descriptor.bcn_ht_cap = NULL;
1501         priv->curr_bss_params.bss_descriptor.ht_cap_offset =
1502                 0;
1503         priv->curr_bss_params.bss_descriptor.bcn_ht_info = NULL;
1504         priv->curr_bss_params.bss_descriptor.ht_info_offset =
1505                 0;
1506         priv->curr_bss_params.bss_descriptor.bcn_bss_co_2040 =
1507                 NULL;
1508         priv->curr_bss_params.bss_descriptor.
1509                 bss_co_2040_offset = 0;
1510         priv->curr_bss_params.bss_descriptor.bcn_ext_cap = NULL;
1511         priv->curr_bss_params.bss_descriptor.ext_cap_offset = 0;
1512         priv->curr_bss_params.bss_descriptor.beacon_buf = NULL;
1513         priv->curr_bss_params.bss_descriptor.beacon_buf_size =
1514                 0;
1515
1516         /* Make a copy of current BSSID descriptor */
1517         memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
1518                 sizeof(priv->curr_bss_params.bss_descriptor));
1519         mwifiex_save_curr_bcn(priv);
1520         spin_unlock_irqrestore(&priv->curr_bcn_buf_lock, flags);
1521
1522 done:
1523         kfree(bss_desc);
1524         kfree(beacon_ie);
1525         return 0;
1526 }
1527
1528 /*
1529  * This function handles the command response of scan.
1530  *
1531  * The response buffer for the scan command has the following
1532  * memory layout:
1533  *
1534  *      .-------------------------------------------------------------.
1535  *      |  Header (4 * sizeof(t_u16)):  Standard command response hdr |
1536  *      .-------------------------------------------------------------.
1537  *      |  BufSize (t_u16) : sizeof the BSS Description data          |
1538  *      .-------------------------------------------------------------.
1539  *      |  NumOfSet (t_u8) : Number of BSS Descs returned             |
1540  *      .-------------------------------------------------------------.
1541  *      |  BSSDescription data (variable, size given in BufSize)      |
1542  *      .-------------------------------------------------------------.
1543  *      |  TLV data (variable, size calculated using Header->Size,    |
1544  *      |            BufSize and sizeof the fixed fields above)       |
1545  *      .-------------------------------------------------------------.
1546  */
1547 int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
1548                             struct host_cmd_ds_command *resp)
1549 {
1550         int ret = 0;
1551         struct mwifiex_adapter *adapter = priv->adapter;
1552         struct cmd_ctrl_node *cmd_node;
1553         struct host_cmd_ds_802_11_scan_rsp *scan_rsp;
1554         struct mwifiex_ie_types_data *tlv_data;
1555         struct mwifiex_ie_types_tsf_timestamp *tsf_tlv;
1556         u8 *bss_info;
1557         u32 scan_resp_size;
1558         u32 bytes_left;
1559         u32 idx;
1560         u32 tlv_buf_size;
1561         struct mwifiex_chan_freq_power *cfp;
1562         struct mwifiex_ie_types_chan_band_list_param_set *chan_band_tlv;
1563         struct chan_band_param_set *chan_band;
1564         u8 is_bgscan_resp;
1565         unsigned long flags;
1566         struct cfg80211_bss *bss;
1567
1568         is_bgscan_resp = (le16_to_cpu(resp->command)
1569                 == HostCmd_CMD_802_11_BG_SCAN_QUERY);
1570         if (is_bgscan_resp)
1571                 scan_rsp = &resp->params.bg_scan_query_resp.scan_resp;
1572         else
1573                 scan_rsp = &resp->params.scan_resp;
1574
1575
1576         if (scan_rsp->number_of_sets > MWIFIEX_MAX_AP) {
1577                 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
1578                        scan_rsp->number_of_sets);
1579                 ret = -1;
1580                 goto done;
1581         }
1582
1583         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
1584         dev_dbg(adapter->dev, "info: SCAN_RESP: bss_descript_size %d\n",
1585                                                 bytes_left);
1586
1587         scan_resp_size = le16_to_cpu(resp->size);
1588
1589         dev_dbg(adapter->dev,
1590                 "info: SCAN_RESP: returned %d APs before parsing\n",
1591                scan_rsp->number_of_sets);
1592
1593         bss_info = scan_rsp->bss_desc_and_tlv_buffer;
1594
1595         /*
1596          * The size of the TLV buffer is equal to the entire command response
1597          *   size (scan_resp_size) minus the fixed fields (sizeof()'s), the
1598          *   BSS Descriptions (bss_descript_size as bytesLef) and the command
1599          *   response header (S_DS_GEN)
1600          */
1601         tlv_buf_size = scan_resp_size - (bytes_left
1602                                          + sizeof(scan_rsp->bss_descript_size)
1603                                          + sizeof(scan_rsp->number_of_sets)
1604                                          + S_DS_GEN);
1605
1606         tlv_data = (struct mwifiex_ie_types_data *) (scan_rsp->
1607                                                  bss_desc_and_tlv_buffer +
1608                                                  bytes_left);
1609
1610         /* Search the TLV buffer space in the scan response for any valid
1611            TLVs */
1612         mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
1613                                              TLV_TYPE_TSFTIMESTAMP,
1614                                              (struct mwifiex_ie_types_data **)
1615                                              &tsf_tlv);
1616
1617         /* Search the TLV buffer space in the scan response for any valid
1618            TLVs */
1619         mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
1620                                              TLV_TYPE_CHANNELBANDLIST,
1621                                              (struct mwifiex_ie_types_data **)
1622                                              &chan_band_tlv);
1623
1624         for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
1625                 u8 bssid[ETH_ALEN];
1626                 s32 rssi;
1627                 const u8 *ie_buf;
1628                 size_t ie_len;
1629                 int channel = -1;
1630                 u64 network_tsf = 0;
1631                 u16 beacon_size = 0;
1632                 u32 curr_bcn_bytes;
1633                 u32 freq;
1634                 u16 beacon_period;
1635                 u16 cap_info_bitmap;
1636                 u8 *current_ptr;
1637                 struct mwifiex_bcn_param *bcn_param;
1638
1639                 if (bytes_left >= sizeof(beacon_size)) {
1640                         /* Extract & convert beacon size from command buffer */
1641                         memcpy(&beacon_size, bss_info, sizeof(beacon_size));
1642                         bytes_left -= sizeof(beacon_size);
1643                         bss_info += sizeof(beacon_size);
1644                 }
1645
1646                 if (!beacon_size || beacon_size > bytes_left) {
1647                         bss_info += bytes_left;
1648                         bytes_left = 0;
1649                         return -1;
1650                 }
1651
1652                 /* Initialize the current working beacon pointer for this BSS
1653                  * iteration */
1654                 current_ptr = bss_info;
1655
1656                 /* Advance the return beacon pointer past the current beacon */
1657                 bss_info += beacon_size;
1658                 bytes_left -= beacon_size;
1659
1660                 curr_bcn_bytes = beacon_size;
1661
1662                 /*
1663                  * First 5 fields are bssid, RSSI, time stamp, beacon interval,
1664                  *   and capability information
1665                  */
1666                 if (curr_bcn_bytes < sizeof(struct mwifiex_bcn_param)) {
1667                         dev_err(adapter->dev, "InterpretIE: not enough bytes left\n");
1668                         continue;
1669                 }
1670                 bcn_param = (struct mwifiex_bcn_param *)current_ptr;
1671                 current_ptr += sizeof(*bcn_param);
1672                 curr_bcn_bytes -= sizeof(*bcn_param);
1673
1674                 memcpy(bssid, bcn_param->bssid, ETH_ALEN);
1675
1676                 rssi = (s32) (bcn_param->rssi);
1677                 dev_dbg(adapter->dev, "info: InterpretIE: RSSI=%02X\n",
1678                                         rssi);
1679
1680                 beacon_period = le16_to_cpu(bcn_param->beacon_period);
1681
1682                 cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
1683                 dev_dbg(adapter->dev, "info: InterpretIE: capabilities=0x%X\n",
1684                                 cap_info_bitmap);
1685
1686                 /* Rest of the current buffer are IE's */
1687                 ie_buf = current_ptr;
1688                 ie_len = curr_bcn_bytes;
1689                 dev_dbg(adapter->dev, "info: InterpretIE: IELength for this AP"
1690                                       " = %d\n", curr_bcn_bytes);
1691
1692                 while (curr_bcn_bytes >= sizeof(struct ieee_types_header)) {
1693                         u8 element_id, element_len;
1694
1695                         element_id = *current_ptr;
1696                         element_len = *(current_ptr + 1);
1697                         if (curr_bcn_bytes < element_len +
1698                                         sizeof(struct ieee_types_header)) {
1699                                 dev_err(priv->adapter->dev, "%s: in processing"
1700                                         " IE, bytes left < IE length\n",
1701                                         __func__);
1702                                 goto done;
1703                         }
1704                         if (element_id == WLAN_EID_DS_PARAMS) {
1705                                 channel = *(u8 *) (current_ptr +
1706                                         sizeof(struct ieee_types_header));
1707                                 break;
1708                         }
1709
1710                         current_ptr += element_len +
1711                                         sizeof(struct ieee_types_header);
1712                         curr_bcn_bytes -= element_len +
1713                                         sizeof(struct ieee_types_header);
1714                 }
1715
1716                 /*
1717                  * If the TSF TLV was appended to the scan results, save this
1718                  * entry's TSF value in the networkTSF field.The networkTSF is
1719                  * the firmware's TSF value at the time the beacon or probe
1720                  * response was received.
1721                  */
1722                 if (tsf_tlv)
1723                         memcpy(&network_tsf,
1724                                         &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
1725                                         sizeof(network_tsf));
1726
1727                 if (channel != -1) {
1728                         struct ieee80211_channel *chan;
1729                         u8 band;
1730
1731                         band = BAND_G;
1732                         if (chan_band_tlv) {
1733                                 chan_band =
1734                                         &chan_band_tlv->chan_band_param[idx];
1735                                 band = mwifiex_radio_type_to_band(
1736                                                 chan_band->radio_type
1737                                                 & (BIT(0) | BIT(1)));
1738                         }
1739
1740                         cfp = mwifiex_get_cfp_by_band_and_channel_from_cfg80211(
1741                                                 priv, (u8)band, (u16)channel);
1742
1743                         freq = cfp ? cfp->freq : 0;
1744
1745                         chan = ieee80211_get_channel(priv->wdev->wiphy, freq);
1746
1747                         if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
1748                                 bss = cfg80211_inform_bss(priv->wdev->wiphy,
1749                                               chan, bssid, network_tsf,
1750                                               cap_info_bitmap, beacon_period,
1751                                               ie_buf, ie_len, rssi, GFP_KERNEL);
1752                                 *(u8 *)bss->priv = band;
1753                                 cfg80211_put_bss(bss);
1754
1755                                 if (priv->media_connected && !memcmp(bssid,
1756                                         priv->curr_bss_params.bss_descriptor
1757                                                      .mac_address, ETH_ALEN))
1758                                         mwifiex_update_curr_bss_params(priv,
1759                                                         bssid, rssi, ie_buf,
1760                                                         ie_len, beacon_period,
1761                                                         cap_info_bitmap, band);
1762                         }
1763                 } else {
1764                         dev_dbg(adapter->dev, "missing BSS channel IE\n");
1765                 }
1766         }
1767
1768         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1769         if (list_empty(&adapter->scan_pending_q)) {
1770                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
1771                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1772                 adapter->scan_processing = false;
1773                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1774
1775                 /* Need to indicate IOCTL complete */
1776                 if (adapter->curr_cmd->wait_q_enabled) {
1777                         adapter->cmd_wait_q.status = 0;
1778                         mwifiex_complete_cmd(adapter, adapter->curr_cmd);
1779                 }
1780                 if (priv->report_scan_result)
1781                         priv->report_scan_result = false;
1782                 if (priv->scan_pending_on_block) {
1783                         priv->scan_pending_on_block = false;
1784                         up(&priv->async_sem);
1785                 }
1786
1787                 if (priv->user_scan_cfg) {
1788                         dev_dbg(priv->adapter->dev, "info: %s: sending scan "
1789                                                         "results\n", __func__);
1790                         cfg80211_scan_done(priv->scan_request, 0);
1791                         priv->scan_request = NULL;
1792                         kfree(priv->user_scan_cfg);
1793                         priv->user_scan_cfg = NULL;
1794                 }
1795         } else {
1796                 /* Get scan command from scan_pending_q and put to
1797                    cmd_pending_q */
1798                 cmd_node = list_first_entry(&adapter->scan_pending_q,
1799                                             struct cmd_ctrl_node, list);
1800                 list_del(&cmd_node->list);
1801                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
1802
1803                 mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
1804         }
1805
1806 done:
1807         return ret;
1808 }
1809
1810 /*
1811  * This function prepares command for background scan query.
1812  *
1813  * Preparation includes -
1814  *      - Setting command ID and proper size
1815  *      - Setting background scan flush parameter
1816  *      - Ensuring correct endian-ness
1817  */
1818 int mwifiex_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
1819 {
1820         struct host_cmd_ds_802_11_bg_scan_query *bg_query =
1821                 &cmd->params.bg_scan_query;
1822
1823         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_QUERY);
1824         cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_bg_scan_query)
1825                                 + S_DS_GEN);
1826
1827         bg_query->flush = 1;
1828
1829         return 0;
1830 }
1831
1832 /*
1833  * This function inserts scan command node to the scan pending queue.
1834  */
1835 void
1836 mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
1837                        struct cmd_ctrl_node *cmd_node)
1838 {
1839         struct mwifiex_adapter *adapter = priv->adapter;
1840         unsigned long flags;
1841
1842         cmd_node->wait_q_enabled = true;
1843         cmd_node->condition = &adapter->scan_wait_q_woken;
1844         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1845         list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
1846         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
1847 }
1848
1849 /*
1850  * This function sends a scan command for all available channels to the
1851  * firmware, filtered on a specific SSID.
1852  */
1853 static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
1854                                       struct mwifiex_802_11_ssid *req_ssid)
1855 {
1856         struct mwifiex_adapter *adapter = priv->adapter;
1857         int ret = 0;
1858         struct mwifiex_user_scan_cfg *scan_cfg;
1859
1860         if (!req_ssid)
1861                 return -1;
1862
1863         if (adapter->scan_processing) {
1864                 dev_dbg(adapter->dev, "cmd: Scan already in process...\n");
1865                 return ret;
1866         }
1867
1868         if (priv->scan_block) {
1869                 dev_dbg(adapter->dev,
1870                         "cmd: Scan is blocked during association...\n");
1871                 return ret;
1872         }
1873
1874         scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg), GFP_KERNEL);
1875         if (!scan_cfg) {
1876                 dev_err(adapter->dev, "failed to alloc scan_cfg\n");
1877                 return -ENOMEM;
1878         }
1879
1880         memcpy(scan_cfg->ssid_list[0].ssid, req_ssid->ssid,
1881                req_ssid->ssid_len);
1882
1883         ret = mwifiex_scan_networks(priv, scan_cfg);
1884
1885         kfree(scan_cfg);
1886         return ret;
1887 }
1888
1889 /*
1890  * Sends IOCTL request to start a scan.
1891  *
1892  * This function allocates the IOCTL request buffer, fills it
1893  * with requisite parameters and calls the IOCTL handler.
1894  *
1895  * Scan command can be issued for both normal scan and specific SSID
1896  * scan, depending upon whether an SSID is provided or not.
1897  */
1898 int mwifiex_request_scan(struct mwifiex_private *priv,
1899                          struct mwifiex_802_11_ssid *req_ssid)
1900 {
1901         int ret;
1902
1903         if (down_interruptible(&priv->async_sem)) {
1904                 dev_err(priv->adapter->dev, "%s: acquire semaphore\n",
1905                                                 __func__);
1906                 return -1;
1907         }
1908         priv->scan_pending_on_block = true;
1909
1910         priv->adapter->scan_wait_q_woken = false;
1911
1912         if (req_ssid && req_ssid->ssid_len != 0)
1913                 /* Specific SSID scan */
1914                 ret = mwifiex_scan_specific_ssid(priv, req_ssid);
1915         else
1916                 /* Normal scan */
1917                 ret = mwifiex_scan_networks(priv, NULL);
1918
1919         if (!ret)
1920                 ret = mwifiex_wait_queue_complete(priv->adapter);
1921
1922         if (ret == -1) {
1923                 priv->scan_pending_on_block = false;
1924                 up(&priv->async_sem);
1925         }
1926
1927         return ret;
1928 }
1929
1930 /*
1931  * This function appends the vendor specific IE TLV to a buffer.
1932  */
1933 int
1934 mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,
1935                             u16 vsie_mask, u8 **buffer)
1936 {
1937         int id, ret_len = 0;
1938         struct mwifiex_ie_types_vendor_param_set *vs_param_set;
1939
1940         if (!buffer)
1941                 return 0;
1942         if (!(*buffer))
1943                 return 0;
1944
1945         /*
1946          * Traverse through the saved vendor specific IE array and append
1947          * the selected(scan/assoc/adhoc) IE as TLV to the command
1948          */
1949         for (id = 0; id < MWIFIEX_MAX_VSIE_NUM; id++) {
1950                 if (priv->vs_ie[id].mask & vsie_mask) {
1951                         vs_param_set =
1952                                 (struct mwifiex_ie_types_vendor_param_set *)
1953                                 *buffer;
1954                         vs_param_set->header.type =
1955                                 cpu_to_le16(TLV_TYPE_PASSTHROUGH);
1956                         vs_param_set->header.len =
1957                                 cpu_to_le16((((u16) priv->vs_ie[id].ie[1])
1958                                 & 0x00FF) + 2);
1959                         memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
1960                                le16_to_cpu(vs_param_set->header.len));
1961                         *buffer += le16_to_cpu(vs_param_set->header.len) +
1962                                    sizeof(struct mwifiex_ie_types_header);
1963                         ret_len += le16_to_cpu(vs_param_set->header.len) +
1964                                    sizeof(struct mwifiex_ie_types_header);
1965                 }
1966         }
1967         return ret_len;
1968 }
1969
1970 /*
1971  * This function saves a beacon buffer of the current BSS descriptor.
1972  *
1973  * The current beacon buffer is saved so that it can be restored in the
1974  * following cases that makes the beacon buffer not to contain the current
1975  * ssid's beacon buffer.
1976  *      - The current ssid was not found somehow in the last scan.
1977  *      - The current ssid was the last entry of the scan table and overloaded.
1978  */
1979 void
1980 mwifiex_save_curr_bcn(struct mwifiex_private *priv)
1981 {
1982         struct mwifiex_bssdescriptor *curr_bss =
1983                 &priv->curr_bss_params.bss_descriptor;
1984
1985         if (!curr_bss->beacon_buf_size)
1986                 return;
1987
1988         /* allocate beacon buffer at 1st time; or if it's size has changed */
1989         if (!priv->curr_bcn_buf ||
1990                         priv->curr_bcn_size != curr_bss->beacon_buf_size) {
1991                 priv->curr_bcn_size = curr_bss->beacon_buf_size;
1992
1993                 kfree(priv->curr_bcn_buf);
1994                 priv->curr_bcn_buf = kmalloc(curr_bss->beacon_buf_size,
1995                                                 GFP_ATOMIC);
1996                 if (!priv->curr_bcn_buf) {
1997                         dev_err(priv->adapter->dev,
1998                                         "failed to alloc curr_bcn_buf\n");
1999                         return;
2000                 }
2001         }
2002
2003         memcpy(priv->curr_bcn_buf, curr_bss->beacon_buf,
2004                 curr_bss->beacon_buf_size);
2005         dev_dbg(priv->adapter->dev, "info: current beacon saved %d\n",
2006                 priv->curr_bcn_size);
2007
2008         curr_bss->beacon_buf = priv->curr_bcn_buf;
2009
2010         /* adjust the pointers in the current BSS descriptor */
2011         if (curr_bss->bcn_wpa_ie)
2012                 curr_bss->bcn_wpa_ie =
2013                         (struct ieee_types_vendor_specific *)
2014                         (curr_bss->beacon_buf +
2015                          curr_bss->wpa_offset);
2016
2017         if (curr_bss->bcn_rsn_ie)
2018                 curr_bss->bcn_rsn_ie = (struct ieee_types_generic *)
2019                         (curr_bss->beacon_buf +
2020                          curr_bss->rsn_offset);
2021
2022         if (curr_bss->bcn_ht_cap)
2023                 curr_bss->bcn_ht_cap = (struct ieee80211_ht_cap *)
2024                         (curr_bss->beacon_buf +
2025                          curr_bss->ht_cap_offset);
2026
2027         if (curr_bss->bcn_ht_info)
2028                 curr_bss->bcn_ht_info = (struct ieee80211_ht_info *)
2029                         (curr_bss->beacon_buf +
2030                          curr_bss->ht_info_offset);
2031
2032         if (curr_bss->bcn_bss_co_2040)
2033                 curr_bss->bcn_bss_co_2040 =
2034                         (u8 *) (curr_bss->beacon_buf +
2035                                         curr_bss->bss_co_2040_offset);
2036
2037         if (curr_bss->bcn_ext_cap)
2038                 curr_bss->bcn_ext_cap = (u8 *) (curr_bss->beacon_buf +
2039                                 curr_bss->ext_cap_offset);
2040 }
2041
2042 /*
2043  * This function frees the current BSS descriptor beacon buffer.
2044  */
2045 void
2046 mwifiex_free_curr_bcn(struct mwifiex_private *priv)
2047 {
2048         kfree(priv->curr_bcn_buf);
2049         priv->curr_bcn_buf = NULL;
2050 }