drivers/net/wireless/marvell/mwifiex/scan.c

   1 /*
   2  * Marvell Wireless LAN device driver: scan ioctl and command handling
   3  *
   4  * Copyright (C) 2011-2014, Marvell International Ltd.
   5  *
   6  * This software file (the "File") is distributed by Marvell International
   7  * Ltd. under the terms of the GNU General Public License Version 2, June 1991
   8  * (the "License").  You may use, redistribute and/or modify this File in
   9  * accordance with the terms and conditions of the License, a copy of which
  10  * is available by writing to the Free Software Foundation, Inc.,
  11  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
  12  * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
  13  *
  14  * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
  15  * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
  16  * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
  17  * this warranty disclaimer.
  18  */
  19
  20 #include "decl.h"
  21 #include "ioctl.h"
  22 #include "util.h"
  23 #include "fw.h"
  24 #include "main.h"
  25 #include "11n.h"
  26 #include "cfg80211.h"
  27
  28 /* The maximum number of channels the firmware can scan per command */
  29 #define MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN   14
  30
  31 #define MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD       4
  32
  33 /* Memory needed to store a max sized Channel List TLV for a firmware scan */
  34 #define CHAN_TLV_MAX_SIZE  (sizeof(struct mwifiex_ie_types_header)         \
  35                                 + (MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN     \
  36                                 *sizeof(struct mwifiex_chan_scan_param_set)))
  37
  38 /* Memory needed to store supported rate */
  39 #define RATE_TLV_MAX_SIZE   (sizeof(struct mwifiex_ie_types_rates_param_set) \
  40                                 + HOSTCMD_SUPPORTED_RATES)
  41
  42 /* Memory needed to store a max number/size WildCard SSID TLV for a firmware
  43         scan */
  44 #define WILDCARD_SSID_TLV_MAX_SIZE  \
  45         (MWIFIEX_MAX_SSID_LIST_LENGTH *                                 \
  46                 (sizeof(struct mwifiex_ie_types_wildcard_ssid_params)   \
  47                         + IEEE80211_MAX_SSID_LEN))
  48
  49 /* Maximum memory needed for a mwifiex_scan_cmd_config with all TLVs at max */
  50 #define MAX_SCAN_CFG_ALLOC (sizeof(struct mwifiex_scan_cmd_config)        \
  51                                 + sizeof(struct mwifiex_ie_types_num_probes)   \
  52                                 + sizeof(struct mwifiex_ie_types_htcap)       \
  53                                 + CHAN_TLV_MAX_SIZE                 \
  54                                 + RATE_TLV_MAX_SIZE                 \
  55                                 + WILDCARD_SSID_TLV_MAX_SIZE)
  56
  57
  58 union mwifiex_scan_cmd_config_tlv {
  59         /* Scan configuration (variable length) */
  60         struct mwifiex_scan_cmd_config config;
  61         /* Max allocated block */
  62         u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC];
  63 };
  64
  65 enum cipher_suite {
  66         CIPHER_SUITE_TKIP,
  67         CIPHER_SUITE_CCMP,
  68         CIPHER_SUITE_MAX
  69 };
  70 static u8 mwifiex_wpa_oui[CIPHER_SUITE_MAX][4] = {
  71         { 0x00, 0x50, 0xf2, 0x02 },     /* TKIP */
  72         { 0x00, 0x50, 0xf2, 0x04 },     /* AES  */
  73 };
  74 static u8 mwifiex_rsn_oui[CIPHER_SUITE_MAX][4] = {
  75         { 0x00, 0x0f, 0xac, 0x02 },     /* TKIP */
  76         { 0x00, 0x0f, 0xac, 0x04 },     /* AES  */
  77 };
  78
  79 static void
  80 _dbg_security_flags(int log_level, const char *func, const char *desc,
  81                     struct mwifiex_private *priv,
  82                     struct mwifiex_bssdescriptor *bss_desc)
  83 {
  84         _mwifiex_dbg(priv->adapter, log_level,
  85                      "info: %s: %s:\twpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s\tEncMode=%#x privacy=%#x\n",
  86                      func, desc,
  87                      bss_desc->bcn_wpa_ie ?
  88                      bss_desc->bcn_wpa_ie->vend_hdr.element_id : 0,
  89                      bss_desc->bcn_rsn_ie ?
  90                      bss_desc->bcn_rsn_ie->ieee_hdr.element_id : 0,
  91                      priv->sec_info.wep_enabled ? "e" : "d",
  92                      priv->sec_info.wpa_enabled ? "e" : "d",
  93                      priv->sec_info.wpa2_enabled ? "e" : "d",
  94                      priv->sec_info.encryption_mode,
  95                      bss_desc->privacy);
  96 }
  97 #define dbg_security_flags(mask, desc, priv, bss_desc) \
  98         _dbg_security_flags(MWIFIEX_DBG_##mask, desc, __func__, priv, bss_desc)
  99
 100 static bool
 101 has_ieee_hdr(struct ieee_types_generic *ie, u8 key)
 102 {
 103         return (ie && ie->ieee_hdr.element_id == key);
 104 }
 105
 106 static bool
 107 has_vendor_hdr(struct ieee_types_vendor_specific *ie, u8 key)
 108 {
 109         return (ie && ie->vend_hdr.element_id == key);
 110 }
 111
 112 /*
 113  * This function parses a given IE for a given OUI.
 114  *
 115  * This is used to parse a WPA/RSN IE to find if it has
 116  * a given oui in PTK.
 117  */
 118 static u8
 119 mwifiex_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
 120 {
 121         u8 count;
 122
 123         count = iebody->ptk_cnt[0];
 124
 125         /* There could be multiple OUIs for PTK hence
 126            1) Take the length.
 127            2) Check all the OUIs for AES.
 128            3) If one of them is AES then pass success. */
 129         while (count) {
 130                 if (!memcmp(iebody->ptk_body, oui, sizeof(iebody->ptk_body)))
 131                         return MWIFIEX_OUI_PRESENT;
 132
 133                 --count;
 134                 if (count)
 135                         iebody = (struct ie_body *) ((u8 *) iebody +
 136                                                 sizeof(iebody->ptk_body));
 137         }
 138
 139         pr_debug("info: %s: OUI is not found in PTK\n", __func__);
 140         return MWIFIEX_OUI_NOT_PRESENT;
 141 }
 142
 143 /*
 144  * This function checks if a given OUI is present in a RSN IE.
 145  *
 146  * The function first checks if a RSN IE is present or not in the
 147  * BSS descriptor. It tries to locate the OUI only if such an IE is
 148  * present.
 149  */
 150 static u8
 151 mwifiex_is_rsn_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 152 {
 153         u8 *oui;
 154         struct ie_body *iebody;
 155         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 156
 157         if (has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN)) {
 158                 iebody = (struct ie_body *)
 159                          (((u8 *) bss_desc->bcn_rsn_ie->data) +
 160                           RSN_GTK_OUI_OFFSET);
 161                 oui = &mwifiex_rsn_oui[cipher][0];
 162                 ret = mwifiex_search_oui_in_ie(iebody, oui);
 163                 if (ret)
 164                         return ret;
 165         }
 166         return ret;
 167 }
 168
 169 /*
 170  * This function checks if a given OUI is present in a WPA IE.
 171  *
 172  * The function first checks if a WPA IE is present or not in the
 173  * BSS descriptor. It tries to locate the OUI only if such an IE is
 174  * present.
 175  */
 176 static u8
 177 mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 178 {
 179         u8 *oui;
 180         struct ie_body *iebody;
 181         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 182
 183         if (has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)) {
 184                 iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data;
 185                 oui = &mwifiex_wpa_oui[cipher][0];
 186                 ret = mwifiex_search_oui_in_ie(iebody, oui);
 187                 if (ret)
 188                         return ret;
 189         }
 190         return ret;
 191 }
 192
 193 /*
 194  * This function compares two SSIDs and checks if they match.
 195  */
 196 s32
 197 mwifiex_ssid_cmp(struct cfg80211_ssid *ssid1, struct cfg80211_ssid *ssid2)
 198 {
 199         if (!ssid1 || !ssid2 || (ssid1->ssid_len != ssid2->ssid_len))
 200                 return -1;
 201         return memcmp(ssid1->ssid, ssid2->ssid, ssid1->ssid_len);
 202 }
 203
 204 /*
 205  * This function checks if wapi is enabled in driver and scanned network is
 206  * compatible with it.
 207  */
 208 static bool
 209 mwifiex_is_bss_wapi(struct mwifiex_private *priv,
 210                     struct mwifiex_bssdescriptor *bss_desc)
 211 {
 212         if (priv->sec_info.wapi_enabled &&
 213             has_ieee_hdr(bss_desc->bcn_wapi_ie, WLAN_EID_BSS_AC_ACCESS_DELAY))
 214                 return true;
 215         return false;
 216 }
 217
 218 /*
 219  * This function checks if driver is configured with no security mode and
 220  * scanned network is compatible with it.
 221  */
 222 static bool
 223 mwifiex_is_bss_no_sec(struct mwifiex_private *priv,
 224                       struct mwifiex_bssdescriptor *bss_desc)
 225 {
 226         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 227             !priv->sec_info.wpa2_enabled &&
 228             !has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC) &&
 229             !has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN) &&
 230             !priv->sec_info.encryption_mode && !bss_desc->privacy) {
 231                 return true;
 232         }
 233         return false;
 234 }
 235
 236 /*
 237  * This function checks if static WEP is enabled in driver and scanned network
 238  * is compatible with it.
 239  */
 240 static bool
 241 mwifiex_is_bss_static_wep(struct mwifiex_private *priv,
 242                           struct mwifiex_bssdescriptor *bss_desc)
 243 {
 244         if (priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 245             !priv->sec_info.wpa2_enabled && bss_desc->privacy) {
 246                 return true;
 247         }
 248         return false;
 249 }
 250
 251 /*
 252  * This function checks if wpa is enabled in driver and scanned network is
 253  * compatible with it.
 254  */
 255 static bool
 256 mwifiex_is_bss_wpa(struct mwifiex_private *priv,
 257                    struct mwifiex_bssdescriptor *bss_desc)
 258 {
 259         if (!priv->sec_info.wep_enabled && priv->sec_info.wpa_enabled &&
 260             !priv->sec_info.wpa2_enabled &&
 261             has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)
 262            /*
 263             * Privacy bit may NOT be set in some APs like
 264             * LinkSys WRT54G && bss_desc->privacy
 265             */
 266          ) {
 267                 dbg_security_flags(INFO, "WPA", priv, bss_desc);
 268                 return true;
 269         }
 270         return false;
 271 }
 272
 273 /*
 274  * This function checks if wpa2 is enabled in driver and scanned network is
 275  * compatible with it.
 276  */
 277 static bool
 278 mwifiex_is_bss_wpa2(struct mwifiex_private *priv,
 279                     struct mwifiex_bssdescriptor *bss_desc)
 280 {
 281         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 282             priv->sec_info.wpa2_enabled &&
 283             has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN)) {
 284                 /*
 285                  * Privacy bit may NOT be set in some APs like
 286                  * LinkSys WRT54G && bss_desc->privacy
 287                  */
 288                 dbg_security_flags(INFO, "WAP2", priv, bss_desc);
 289                 return true;
 290         }
 291         return false;
 292 }
 293
 294 /*
 295  * This function checks if adhoc AES is enabled in driver and scanned network is
 296  * compatible with it.
 297  */
 298 static bool
 299 mwifiex_is_bss_adhoc_aes(struct mwifiex_private *priv,
 300                          struct mwifiex_bssdescriptor *bss_desc)
 301 {
 302         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 303             !priv->sec_info.wpa2_enabled &&
 304             !has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC) &&
 305             !has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN) &&
 306             !priv->sec_info.encryption_mode && bss_desc->privacy) {
 307                 return true;
 308         }
 309         return false;
 310 }
 311
 312 /*
 313  * This function checks if dynamic WEP is enabled in driver and scanned network
 314  * is compatible with it.
 315  */
 316 static bool
 317 mwifiex_is_bss_dynamic_wep(struct mwifiex_private *priv,
 318                            struct mwifiex_bssdescriptor *bss_desc)
 319 {
 320         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 321             !priv->sec_info.wpa2_enabled &&
 322             !has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC) &&
 323             !has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN) &&
 324             priv->sec_info.encryption_mode && bss_desc->privacy) {
 325                 dbg_security_flags(INFO, "dynamic", priv, bss_desc);
 326                 return true;
 327         }
 328         return false;
 329 }
 330
 331 /*
 332  * This function checks if a scanned network is compatible with the driver
 333  * settings.
 334  *
 335  *   WEP     WPA    WPA2   ad-hoc encrypt                  Network
 336  * enabled enabled enabled  AES    mode   Privacy WPA WPA2 Compatible
 337  *    0       0       0      0     NONE      0     0   0   yes No security
 338  *    0       1       0      0      x        1x    1   x   yes WPA (disable
 339  *                                                         HT if no AES)
 340  *    0       0       1      0      x        1x    x   1   yes WPA2 (disable
 341  *                                                         HT if no AES)
 342  *    0       0       0      1     NONE      1     0   0   yes Ad-hoc AES
 343  *    1       0       0      0     NONE      1     0   0   yes Static WEP
 344  *                                                         (disable HT)
 345  *    0       0       0      0    !=NONE     1     0   0   yes Dynamic WEP
 346  *
 347  * Compatibility is not matched while roaming, except for mode.
 348  */
 349 static s32
 350 mwifiex_is_network_compatible(struct mwifiex_private *priv,
 351                               struct mwifiex_bssdescriptor *bss_desc, u32 mode)
 352 {
 353         struct mwifiex_adapter *adapter = priv->adapter;
 354
 355         bss_desc->disable_11n = false;
 356
 357         /* Don't check for compatibility if roaming */
 358         if (priv->media_connected &&
 359             (priv->bss_mode == NL80211_IFTYPE_STATION) &&
 360             (bss_desc->bss_mode == NL80211_IFTYPE_STATION))
 361                 return 0;
 362
 363         if (priv->wps.session_enable) {
 364                 mwifiex_dbg(adapter, IOCTL,
 365                             "info: return success directly in WPS period\n");
 366                 return 0;
 367         }
 368
 369         if (bss_desc->chan_sw_ie_present) {
 370                 mwifiex_dbg(adapter, INFO,
 371                             "Don't connect to AP with WLAN_EID_CHANNEL_SWITCH\n");
 372                 return -1;
 373         }
 374
 375         if (mwifiex_is_bss_wapi(priv, bss_desc)) {
 376                 mwifiex_dbg(adapter, INFO,
 377                             "info: return success for WAPI AP\n");
 378                 return 0;
 379         }
 380
 381         if (bss_desc->bss_mode == mode) {
 382                 if (mwifiex_is_bss_no_sec(priv, bss_desc)) {
 383                         /* No security */
 384                         return 0;
 385                 } else if (mwifiex_is_bss_static_wep(priv, bss_desc)) {
 386                         /* Static WEP enabled */
 387                         mwifiex_dbg(adapter, INFO,
 388                                     "info: Disable 11n in WEP mode.\n");
 389                         bss_desc->disable_11n = true;
 390                         return 0;
 391                 } else if (mwifiex_is_bss_wpa(priv, bss_desc)) {
 392                         /* WPA enabled */
 393                         if (((priv->adapter->config_bands & BAND_GN ||
 394                               priv->adapter->config_bands & BAND_AN) &&
 395                              bss_desc->bcn_ht_cap) &&
 396                             !mwifiex_is_wpa_oui_present(bss_desc,
 397                                                          CIPHER_SUITE_CCMP)) {
 398
 399                                 if (mwifiex_is_wpa_oui_present
 400                                                 (bss_desc, CIPHER_SUITE_TKIP)) {
 401                                         mwifiex_dbg(adapter, INFO,
 402                                                     "info: Disable 11n if AES\t"
 403                                                     "is not supported by AP\n");
 404                                         bss_desc->disable_11n = true;
 405                                 } else {
 406                                         return -1;
 407                                 }
 408                         }
 409                         return 0;
 410                 } else if (mwifiex_is_bss_wpa2(priv, bss_desc)) {
 411                         /* WPA2 enabled */
 412                         if (((priv->adapter->config_bands & BAND_GN ||
 413                               priv->adapter->config_bands & BAND_AN) &&
 414                              bss_desc->bcn_ht_cap) &&
 415                             !mwifiex_is_rsn_oui_present(bss_desc,
 416                                                         CIPHER_SUITE_CCMP)) {
 417
 418                                 if (mwifiex_is_rsn_oui_present
 419                                                 (bss_desc, CIPHER_SUITE_TKIP)) {
 420                                         mwifiex_dbg(adapter, INFO,
 421                                                     "info: Disable 11n if AES\t"
 422                                                     "is not supported by AP\n");
 423                                         bss_desc->disable_11n = true;
 424                                 } else {
 425                                         return -1;
 426                                 }
 427                         }
 428                         return 0;
 429                 } else if (mwifiex_is_bss_adhoc_aes(priv, bss_desc)) {
 430                         /* Ad-hoc AES enabled */
 431                         return 0;
 432                 } else if (mwifiex_is_bss_dynamic_wep(priv, bss_desc)) {
 433                         /* Dynamic WEP enabled */
 434                         return 0;
 435                 }
 436
 437                 /* Security doesn't match */
 438                 dbg_security_flags(ERROR, "failed", priv, bss_desc);
 439                 return -1;
 440         }
 441
 442         /* Mode doesn't match */
 443         return -1;
 444 }
 445
 446 /*
 447  * This function creates a channel list for the driver to scan, based
 448  * on region/band information.
 449  *
 450  * This routine is used for any scan that is not provided with a
 451  * specific channel list to scan.
 452  */
 453 static int
 454 mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
 455                                  const struct mwifiex_user_scan_cfg
 456                                                         *user_scan_in,
 457                                  struct mwifiex_chan_scan_param_set
 458                                                         *scan_chan_list,
 459                                  u8 filtered_scan)
 460 {
 461         enum nl80211_band band;
 462         struct ieee80211_supported_band *sband;
 463         struct ieee80211_channel *ch;
 464         struct mwifiex_adapter *adapter = priv->adapter;
 465         int chan_idx = 0, i;
 466
 467         for (band = 0; (band < NUM_NL80211_BANDS) ; band++) {
 468
 469                 if (!priv->wdev.wiphy->bands[band])
 470                         continue;
 471
 472                 sband = priv->wdev.wiphy->bands[band];
 473
 474                 for (i = 0; (i < sband->n_channels) ; i++) {
 475                         ch = &sband->channels[i];
 476                         if (ch->flags & IEEE80211_CHAN_DISABLED)
 477                                 continue;
 478                         scan_chan_list[chan_idx].radio_type = band;
 479
 480                         if (user_scan_in &&
 481                             user_scan_in->chan_list[0].scan_time)
 482                                 scan_chan_list[chan_idx].max_scan_time =
 483                                         cpu_to_le16((u16) user_scan_in->
 484                                         chan_list[0].scan_time);
 485                         else if (ch->flags & IEEE80211_CHAN_NO_IR)
 486                                 scan_chan_list[chan_idx].max_scan_time =
 487                                         cpu_to_le16(adapter->passive_scan_time);
 488                         else
 489                                 scan_chan_list[chan_idx].max_scan_time =
 490                                         cpu_to_le16(adapter->active_scan_time);
 491
 492                         if (ch->flags & IEEE80211_CHAN_NO_IR)
 493                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 494                                         |= (MWIFIEX_PASSIVE_SCAN |
 495                                             MWIFIEX_HIDDEN_SSID_REPORT);
 496                         else
 497                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 498                                         &= ~MWIFIEX_PASSIVE_SCAN;
 499                         scan_chan_list[chan_idx].chan_number =
 500                                                         (u32) ch->hw_value;
 501
 502                         scan_chan_list[chan_idx].chan_scan_mode_bitmap
 503                                         |= MWIFIEX_DISABLE_CHAN_FILT;
 504
 505                         if (filtered_scan) {
 506                                 scan_chan_list[chan_idx].max_scan_time =
 507                                 cpu_to_le16(adapter->specific_scan_time);
 508                         }
 509                         chan_idx++;
 510                 }
 511
 512         }
 513         return chan_idx;
 514 }
 515
 516 /* This function creates a channel list tlv for bgscan config, based
 517  * on region/band information.
 518  */
 519 static int
 520 mwifiex_bgscan_create_channel_list(struct mwifiex_private *priv,
 521                                    const struct mwifiex_bg_scan_cfg
 522                                                 *bgscan_cfg_in,
 523                                    struct mwifiex_chan_scan_param_set
 524                                                 *scan_chan_list)
 525 {
 526         enum nl80211_band band;
 527         struct ieee80211_supported_band *sband;
 528         struct ieee80211_channel *ch;
 529         struct mwifiex_adapter *adapter = priv->adapter;
 530         int chan_idx = 0, i;
 531
 532         for (band = 0; (band < NUM_NL80211_BANDS); band++) {
 533                 if (!priv->wdev.wiphy->bands[band])
 534                         continue;
 535
 536                 sband = priv->wdev.wiphy->bands[band];
 537
 538                 for (i = 0; (i < sband->n_channels) ; i++) {
 539                         ch = &sband->channels[i];
 540                         if (ch->flags & IEEE80211_CHAN_DISABLED)
 541                                 continue;
 542                         scan_chan_list[chan_idx].radio_type = band;
 543
 544                         if (bgscan_cfg_in->chan_list[0].scan_time)
 545                                 scan_chan_list[chan_idx].max_scan_time =
 546                                         cpu_to_le16((u16)bgscan_cfg_in->
 547                                         chan_list[0].scan_time);
 548                         else if (ch->flags & IEEE80211_CHAN_NO_IR)
 549                                 scan_chan_list[chan_idx].max_scan_time =
 550                                         cpu_to_le16(adapter->passive_scan_time);
 551                         else
 552                                 scan_chan_list[chan_idx].max_scan_time =
 553                                         cpu_to_le16(adapter->
 554                                                     specific_scan_time);
 555
 556                         if (ch->flags & IEEE80211_CHAN_NO_IR)
 557                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 558                                         |= MWIFIEX_PASSIVE_SCAN;
 559                         else
 560                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 561                                         &= ~MWIFIEX_PASSIVE_SCAN;
 562
 563                         scan_chan_list[chan_idx].chan_number =
 564                                                         (u32)ch->hw_value;
 565                         chan_idx++;
 566                 }
 567         }
 568         return chan_idx;
 569 }
 570
 571 /* This function appends rate TLV to scan config command. */
 572 static int
 573 mwifiex_append_rate_tlv(struct mwifiex_private *priv,
 574                         struct mwifiex_scan_cmd_config *scan_cfg_out,
 575                         u8 radio)
 576 {
 577         struct mwifiex_ie_types_rates_param_set *rates_tlv;
 578         u8 rates[MWIFIEX_SUPPORTED_RATES], *tlv_pos;
 579         u32 rates_size;
 580
 581         memset(rates, 0, sizeof(rates));
 582
 583         tlv_pos = (u8 *)scan_cfg_out->tlv_buf + scan_cfg_out->tlv_buf_len;
 584
 585         if (priv->scan_request)
 586                 rates_size = mwifiex_get_rates_from_cfg80211(priv, rates,
 587                                                              radio);
 588         else
 589                 rates_size = mwifiex_get_supported_rates(priv, rates);
 590
 591         mwifiex_dbg(priv->adapter, CMD,
 592                     "info: SCAN_CMD: Rates size = %d\n",
 593                 rates_size);
 594         rates_tlv = (struct mwifiex_ie_types_rates_param_set *)tlv_pos;
 595         rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
 596         rates_tlv->header.len = cpu_to_le16((u16) rates_size);
 597         memcpy(rates_tlv->rates, rates, rates_size);
 598         scan_cfg_out->tlv_buf_len += sizeof(rates_tlv->header) + rates_size;
 599
 600         return rates_size;
 601 }
 602
 603 /*
 604  * This function constructs and sends multiple scan config commands to
 605  * the firmware.
 606  *
 607  * Previous routines in the code flow have created a scan command configuration
 608  * with any requested TLVs.  This function splits the channel TLV into maximum
 609  * channels supported per scan lists and sends the portion of the channel TLV,
 610  * along with the other TLVs, to the firmware.
 611  */
 612 static int
 613 mwifiex_scan_channel_list(struct mwifiex_private *priv,
 614                           u32 max_chan_per_scan, u8 filtered_scan,
 615                           struct mwifiex_scan_cmd_config *scan_cfg_out,
 616                           struct mwifiex_ie_types_chan_list_param_set
 617                           *chan_tlv_out,
 618                           struct mwifiex_chan_scan_param_set *scan_chan_list)
 619 {
 620         struct mwifiex_adapter *adapter = priv->adapter;
 621         int ret = 0;
 622         struct mwifiex_chan_scan_param_set *tmp_chan_list;
 623         struct mwifiex_chan_scan_param_set *start_chan;
 624         u32 tlv_idx, rates_size, cmd_no;
 625         u32 total_scan_time;
 626         u32 done_early;
 627         u8 radio_type;
 628
 629         if (!scan_cfg_out || !chan_tlv_out || !scan_chan_list) {
 630                 mwifiex_dbg(priv->adapter, ERROR,
 631                             "info: Scan: Null detect: %p, %p, %p\n",
 632                             scan_cfg_out, chan_tlv_out, scan_chan_list);
 633                 return -1;
 634         }
 635
 636         /* Check csa channel expiry before preparing scan list */
 637         mwifiex_11h_get_csa_closed_channel(priv);
 638
 639         chan_tlv_out->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
 640
 641         /* Set the temp channel struct pointer to the start of the desired
 642            list */
 643         tmp_chan_list = scan_chan_list;
 644
 645         /* Loop through the desired channel list, sending a new firmware scan
 646            commands for each max_chan_per_scan channels (or for 1,6,11
 647            individually if configured accordingly) */
 648         while (tmp_chan_list->chan_number) {
 649
 650                 tlv_idx = 0;
 651                 total_scan_time = 0;
 652                 radio_type = 0;
 653                 chan_tlv_out->header.len = 0;
 654                 start_chan = tmp_chan_list;
 655                 done_early = false;
 656
 657                 /*
 658                  * Construct the Channel TLV for the scan command.  Continue to
 659                  * insert channel TLVs until:
 660                  *   - the tlv_idx hits the maximum configured per scan command
 661                  *   - the next channel to insert is 0 (end of desired channel
 662                  *     list)
 663                  *   - done_early is set (controlling individual scanning of
 664                  *     1,6,11)
 665                  */
 666                 while (tlv_idx < max_chan_per_scan &&
 667                        tmp_chan_list->chan_number && !done_early) {
 668
 669                         if (tmp_chan_list->chan_number == priv->csa_chan) {
 670                                 tmp_chan_list++;
 671                                 continue;
 672                         }
 673
 674                         radio_type = tmp_chan_list->radio_type;
 675                         mwifiex_dbg(priv->adapter, INFO,
 676                                     "info: Scan: Chan(%3d), Radio(%d),\t"
 677                                     "Mode(%d, %d), Dur(%d)\n",
 678                                     tmp_chan_list->chan_number,
 679                                     tmp_chan_list->radio_type,
 680                                     tmp_chan_list->chan_scan_mode_bitmap
 681                                     & MWIFIEX_PASSIVE_SCAN,
 682                                     (tmp_chan_list->chan_scan_mode_bitmap
 683                                     & MWIFIEX_DISABLE_CHAN_FILT) >> 1,
 684                                     le16_to_cpu(tmp_chan_list->max_scan_time));
 685
 686                         /* Copy the current channel TLV to the command being
 687                            prepared */
 688                         memcpy(chan_tlv_out->chan_scan_param + tlv_idx,
 689                                tmp_chan_list,
 690                                sizeof(chan_tlv_out->chan_scan_param));
 691
 692                         /* Increment the TLV header length by the size
 693                            appended */
 694                         le16_add_cpu(&chan_tlv_out->header.len,
 695                                      sizeof(chan_tlv_out->chan_scan_param));
 696
 697                         /*
 698                          * The tlv buffer length is set to the number of bytes
 699                          * of the between the channel tlv pointer and the start
 700                          * of the tlv buffer.  This compensates for any TLVs
 701                          * that were appended before the channel list.
 702                          */
 703                         scan_cfg_out->tlv_buf_len = (u32) ((u8 *) chan_tlv_out -
 704                                                         scan_cfg_out->tlv_buf);
 705
 706                         /* Add the size of the channel tlv header and the data
 707                            length */
 708                         scan_cfg_out->tlv_buf_len +=
 709                                 (sizeof(chan_tlv_out->header)
 710                                  + le16_to_cpu(chan_tlv_out->header.len));
 711
 712                         /* Increment the index to the channel tlv we are
 713                            constructing */
 714                         tlv_idx++;
 715
 716                         /* Count the total scan time per command */
 717                         total_scan_time +=
 718                                 le16_to_cpu(tmp_chan_list->max_scan_time);
 719
 720                         done_early = false;
 721
 722                         /* Stop the loop if the *current* channel is in the
 723                            1,6,11 set and we are not filtering on a BSSID
 724                            or SSID. */
 725                         if (!filtered_scan &&
 726                             (tmp_chan_list->chan_number == 1 ||
 727                              tmp_chan_list->chan_number == 6 ||
 728                              tmp_chan_list->chan_number == 11))
 729                                 done_early = true;
 730
 731                         /* Increment the tmp pointer to the next channel to
 732                            be scanned */
 733                         tmp_chan_list++;
 734
 735                         /* Stop the loop if the *next* channel is in the 1,6,11
 736                            set.  This will cause it to be the only channel
 737                            scanned on the next interation */
 738                         if (!filtered_scan &&
 739                             (tmp_chan_list->chan_number == 1 ||
 740                              tmp_chan_list->chan_number == 6 ||
 741                              tmp_chan_list->chan_number == 11))
 742                                 done_early = true;
 743                 }
 744
 745                 /* The total scan time should be less than scan command timeout
 746                    value */
 747                 if (total_scan_time > MWIFIEX_MAX_TOTAL_SCAN_TIME) {
 748                         mwifiex_dbg(priv->adapter, ERROR,
 749                                     "total scan time %dms\t"
 750                                     "is over limit (%dms), scan skipped\n",
 751                                     total_scan_time,
 752                                     MWIFIEX_MAX_TOTAL_SCAN_TIME);
 753                         ret = -1;
 754                         break;
 755                 }
 756
 757                 rates_size = mwifiex_append_rate_tlv(priv, scan_cfg_out,
 758                                                      radio_type);
 759
 760                 priv->adapter->scan_channels = start_chan;
 761
 762                 /* Send the scan command to the firmware with the specified
 763                    cfg */
 764                 if (priv->adapter->ext_scan)
 765                         cmd_no = HostCmd_CMD_802_11_SCAN_EXT;
 766                 else
 767                         cmd_no = HostCmd_CMD_802_11_SCAN;
 768
 769                 ret = mwifiex_send_cmd(priv, cmd_no, HostCmd_ACT_GEN_SET,
 770                                        0, scan_cfg_out, false);
 771
 772                 /* rate IE is updated per scan command but same starting
 773                  * pointer is used each time so that rate IE from earlier
 774                  * scan_cfg_out->buf is overwritten with new one.
 775                  */
 776                 scan_cfg_out->tlv_buf_len -=
 777                             sizeof(struct mwifiex_ie_types_header) + rates_size;
 778
 779                 if (ret) {
 780                         mwifiex_cancel_pending_scan_cmd(adapter);
 781                         break;
 782                 }
 783         }
 784
 785         if (ret)
 786                 return -1;
 787
 788         return 0;
 789 }
 790
 791 /*
 792  * This function constructs a scan command configuration structure to use
 793  * in scan commands.
 794  *
 795  * Application layer or other functions can invoke network scanning
 796  * with a scan configuration supplied in a user scan configuration structure.
 797  * This structure is used as the basis of one or many scan command configuration
 798  * commands that are sent to the command processing module and eventually to the
 799  * firmware.
 800  *
 801  * This function creates a scan command configuration structure  based on the
 802  * following user supplied parameters (if present):
 803  *      - SSID filter
 804  *      - BSSID filter
 805  *      - Number of Probes to be sent
 806  *      - Channel list
 807  *
 808  * If the SSID or BSSID filter is not present, the filter is disabled/cleared.
 809  * If the number of probes is not set, adapter default setting is used.
 810  */
 811 static void
 812 mwifiex_config_scan(struct mwifiex_private *priv,
 813                     const struct mwifiex_user_scan_cfg *user_scan_in,
 814                     struct mwifiex_scan_cmd_config *scan_cfg_out,
 815                     struct mwifiex_ie_types_chan_list_param_set **chan_list_out,
 816                     struct mwifiex_chan_scan_param_set *scan_chan_list,
 817                     u8 *max_chan_per_scan, u8 *filtered_scan,
 818                     u8 *scan_current_only)
 819 {
 820         struct mwifiex_adapter *adapter = priv->adapter;
 821         struct mwifiex_ie_types_num_probes *num_probes_tlv;
 822         struct mwifiex_ie_types_scan_chan_gap *chan_gap_tlv;
 823         struct mwifiex_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
 824         struct mwifiex_ie_types_bssid_list *bssid_tlv;
 825         u8 *tlv_pos;
 826         u32 num_probes;
 827         u32 ssid_len;
 828         u32 chan_idx;
 829         u32 chan_num;
 830         u32 scan_type;
 831         u16 scan_dur;
 832         u8 channel;
 833         u8 radio_type;
 834         int i;
 835         u8 ssid_filter;
 836         struct mwifiex_ie_types_htcap *ht_cap;
 837         struct mwifiex_ie_types_bss_mode *bss_mode;
 838
 839         /* The tlv_buf_len is calculated for each scan command.  The TLVs added
 840            in this routine will be preserved since the routine that sends the
 841            command will append channelTLVs at *chan_list_out.  The difference
 842            between the *chan_list_out and the tlv_buf start will be used to
 843            calculate the size of anything we add in this routine. */
 844         scan_cfg_out->tlv_buf_len = 0;
 845
 846         /* Running tlv pointer.  Assigned to chan_list_out at end of function
 847            so later routines know where channels can be added to the command
 848            buf */
 849         tlv_pos = scan_cfg_out->tlv_buf;
 850
 851         /* Initialize the scan as un-filtered; the flag is later set to TRUE
 852            below if a SSID or BSSID filter is sent in the command */
 853         *filtered_scan = false;
 854
 855         /* Initialize the scan as not being only on the current channel.  If
 856            the channel list is customized, only contains one channel, and is
 857            the active channel, this is set true and data flow is not halted. */
 858         *scan_current_only = false;
 859
 860         if (user_scan_in) {
 861
 862                 /* Default the ssid_filter flag to TRUE, set false under
 863                    certain wildcard conditions and qualified by the existence
 864                    of an SSID list before marking the scan as filtered */
 865                 ssid_filter = true;
 866
 867                 /* Set the BSS type scan filter, use Adapter setting if
 868                    unset */
 869                 scan_cfg_out->bss_mode =
 870                         (u8)(user_scan_in->bss_mode ?: adapter->scan_mode);
 871
 872                 /* Set the number of probes to send, use Adapter setting
 873                    if unset */
 874                 num_probes = user_scan_in->num_probes ?: adapter->scan_probes;
 875
 876                 /*
 877                  * Set the BSSID filter to the incoming configuration,
 878                  * if non-zero.  If not set, it will remain disabled
 879                  * (all zeros).
 880                  */
 881                 memcpy(scan_cfg_out->specific_bssid,
 882                        user_scan_in->specific_bssid,
 883                        sizeof(scan_cfg_out->specific_bssid));
 884
 885                 if (adapter->ext_scan &&
 886                     !is_zero_ether_addr(scan_cfg_out->specific_bssid)) {
 887                         bssid_tlv =
 888                                 (struct mwifiex_ie_types_bssid_list *)tlv_pos;
 889                         bssid_tlv->header.type = cpu_to_le16(TLV_TYPE_BSSID);
 890                         bssid_tlv->header.len = cpu_to_le16(ETH_ALEN);
 891                         memcpy(bssid_tlv->bssid, user_scan_in->specific_bssid,
 892                                ETH_ALEN);
 893                         tlv_pos += sizeof(struct mwifiex_ie_types_bssid_list);
 894                 }
 895
 896                 for (i = 0; i < user_scan_in->num_ssids; i++) {
 897                         ssid_len = user_scan_in->ssid_list[i].ssid_len;
 898
 899                         wildcard_ssid_tlv =
 900                                 (struct mwifiex_ie_types_wildcard_ssid_params *)
 901                                 tlv_pos;
 902                         wildcard_ssid_tlv->header.type =
 903                                 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
 904                         wildcard_ssid_tlv->header.len = cpu_to_le16(
 905                                 (u16) (ssid_len + sizeof(wildcard_ssid_tlv->
 906                                                          max_ssid_length)));
 907
 908                         /*
 909                          * max_ssid_length = 0 tells firmware to perform
 910                          * specific scan for the SSID filled, whereas
 911                          * max_ssid_length = IEEE80211_MAX_SSID_LEN is for
 912                          * wildcard scan.
 913                          */
 914                         if (ssid_len)
 915                                 wildcard_ssid_tlv->max_ssid_length = 0;
 916                         else
 917                                 wildcard_ssid_tlv->max_ssid_length =
 918                                                         IEEE80211_MAX_SSID_LEN;
 919
 920                         if (!memcmp(user_scan_in->ssid_list[i].ssid,
 921                                     "DIRECT-", 7))
 922                                 wildcard_ssid_tlv->max_ssid_length = 0xfe;
 923
 924                         memcpy(wildcard_ssid_tlv->ssid,
 925                                user_scan_in->ssid_list[i].ssid, ssid_len);
 926
 927                         tlv_pos += (sizeof(wildcard_ssid_tlv->header)
 928                                 + le16_to_cpu(wildcard_ssid_tlv->header.len));
 929
 930                         mwifiex_dbg(adapter, INFO,
 931                                     "info: scan: ssid[%d]: %s, %d\n",
 932                                     i, wildcard_ssid_tlv->ssid,
 933                                     wildcard_ssid_tlv->max_ssid_length);
 934
 935                         /* Empty wildcard ssid with a maxlen will match many or
 936                            potentially all SSIDs (maxlen == 32), therefore do
 937                            not treat the scan as
 938                            filtered. */
 939                         if (!ssid_len && wildcard_ssid_tlv->max_ssid_length)
 940                                 ssid_filter = false;
 941                 }
 942
 943                 /*
 944                  *  The default number of channels sent in the command is low to
 945                  *  ensure the response buffer from the firmware does not
 946                  *  truncate scan results.  That is not an issue with an SSID
 947                  *  or BSSID filter applied to the scan results in the firmware.
 948                  */
 949                 if ((i && ssid_filter) ||
 950                     !is_zero_ether_addr(scan_cfg_out->specific_bssid))
 951                         *filtered_scan = true;
 952
 953                 if (user_scan_in->scan_chan_gap) {
 954                         mwifiex_dbg(adapter, INFO,
 955                                     "info: scan: channel gap = %d\n",
 956                                     user_scan_in->scan_chan_gap);
 957                         *max_chan_per_scan =
 958                                         MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN;
 959
 960                         chan_gap_tlv = (void *)tlv_pos;
 961                         chan_gap_tlv->header.type =
 962                                          cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
 963                         chan_gap_tlv->header.len =
 964                                     cpu_to_le16(sizeof(chan_gap_tlv->chan_gap));
 965                         chan_gap_tlv->chan_gap =
 966                                      cpu_to_le16((user_scan_in->scan_chan_gap));
 967                         tlv_pos +=
 968                                   sizeof(struct mwifiex_ie_types_scan_chan_gap);
 969                 }
 970         } else {
 971                 scan_cfg_out->bss_mode = (u8) adapter->scan_mode;
 972                 num_probes = adapter->scan_probes;
 973         }
 974
 975         /*
 976          *  If a specific BSSID or SSID is used, the number of channels in the
 977          *  scan command will be increased to the absolute maximum.
 978          */
 979         if (*filtered_scan)
 980                 *max_chan_per_scan = MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN;
 981         else
 982                 *max_chan_per_scan = MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD;
 983
 984         if (adapter->ext_scan) {
 985                 bss_mode = (struct mwifiex_ie_types_bss_mode *)tlv_pos;
 986                 bss_mode->header.type = cpu_to_le16(TLV_TYPE_BSS_MODE);
 987                 bss_mode->header.len = cpu_to_le16(sizeof(bss_mode->bss_mode));
 988                 bss_mode->bss_mode = scan_cfg_out->bss_mode;
 989                 tlv_pos += sizeof(bss_mode->header) +
 990                            le16_to_cpu(bss_mode->header.len);
 991         }
 992
 993         /* If the input config or adapter has the number of Probes set,
 994            add tlv */
 995         if (num_probes) {
 996
 997                 mwifiex_dbg(adapter, INFO,
 998                             "info: scan: num_probes = %d\n",
 999                             num_probes);
1000
1001                 num_probes_tlv = (struct mwifiex_ie_types_num_probes *) tlv_pos;
1002                 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
1003                 num_probes_tlv->header.len =
1004                         cpu_to_le16(sizeof(num_probes_tlv->num_probes));
1005                 num_probes_tlv->num_probes = cpu_to_le16((u16) num_probes);
1006
1007                 tlv_pos += sizeof(num_probes_tlv->header) +
1008                         le16_to_cpu(num_probes_tlv->header.len);
1009
1010         }
1011
1012         if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
1013             (priv->adapter->config_bands & BAND_GN ||
1014              priv->adapter->config_bands & BAND_AN)) {
1015                 ht_cap = (struct mwifiex_ie_types_htcap *) tlv_pos;
1016                 memset(ht_cap, 0, sizeof(struct mwifiex_ie_types_htcap));
1017                 ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
1018                 ht_cap->header.len =
1019                                 cpu_to_le16(sizeof(struct ieee80211_ht_cap));
1020                 radio_type =
1021                         mwifiex_band_to_radio_type(priv->adapter->config_bands);
1022                 mwifiex_fill_cap_info(priv, radio_type, &ht_cap->ht_cap);
1023                 tlv_pos += sizeof(struct mwifiex_ie_types_htcap);
1024         }
1025
1026         /* Append vendor specific IE TLV */
1027         mwifiex_cmd_append_vsie_tlv(priv, MWIFIEX_VSIE_MASK_SCAN, &tlv_pos);
1028
1029         /*
1030          * Set the output for the channel TLV to the address in the tlv buffer
1031          *   past any TLVs that were added in this function (SSID, num_probes).
1032          *   Channel TLVs will be added past this for each scan command,
1033          *   preserving the TLVs that were previously added.
1034          */
1035         *chan_list_out =
1036                 (struct mwifiex_ie_types_chan_list_param_set *) tlv_pos;
1037
1038         if (user_scan_in && user_scan_in->chan_list[0].chan_number) {
1039
1040                 mwifiex_dbg(adapter, INFO,
1041                             "info: Scan: Using supplied channel list\n");
1042
1043                 for (chan_idx = 0;
1044                      chan_idx < MWIFIEX_USER_SCAN_CHAN_MAX &&
1045                      user_scan_in->chan_list[chan_idx].chan_number;
1046                      chan_idx++) {
1047
1048                         channel = user_scan_in->chan_list[chan_idx].chan_number;
1049                         scan_chan_list[chan_idx].chan_number = channel;
1050
1051                         radio_type =
1052                                 user_scan_in->chan_list[chan_idx].radio_type;
1053                         scan_chan_list[chan_idx].radio_type = radio_type;
1054
1055                         scan_type = user_scan_in->chan_list[chan_idx].scan_type;
1056
1057                         if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
1058                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
1059                                         |= (MWIFIEX_PASSIVE_SCAN |
1060                                             MWIFIEX_HIDDEN_SSID_REPORT);
1061                         else
1062                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
1063                                         &= ~MWIFIEX_PASSIVE_SCAN;
1064
1065                         scan_chan_list[chan_idx].chan_scan_mode_bitmap
1066                                 |= MWIFIEX_DISABLE_CHAN_FILT;
1067
1068                         if (user_scan_in->chan_list[chan_idx].scan_time) {
1069                                 scan_dur = (u16) user_scan_in->
1070                                         chan_list[chan_idx].scan_time;
1071                         } else {
1072                                 if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
1073                                         scan_dur = adapter->passive_scan_time;
1074                                 else if (*filtered_scan)
1075                                         scan_dur = adapter->specific_scan_time;
1076                                 else
1077                                         scan_dur = adapter->active_scan_time;
1078                         }
1079
1080                         scan_chan_list[chan_idx].min_scan_time =
1081                                 cpu_to_le16(scan_dur);
1082                         scan_chan_list[chan_idx].max_scan_time =
1083                                 cpu_to_le16(scan_dur);
1084                 }
1085
1086                 /* Check if we are only scanning the current channel */
1087                 if ((chan_idx == 1) &&
1088                     (user_scan_in->chan_list[0].chan_number ==
1089                      priv->curr_bss_params.bss_descriptor.channel)) {
1090                         *scan_current_only = true;
1091                         mwifiex_dbg(adapter, INFO,
1092                                     "info: Scan: Scanning current channel only\n");
1093                 }
1094                 chan_num = chan_idx;
1095         } else {
1096                 mwifiex_dbg(adapter, INFO,
1097                             "info: Scan: Creating full region channel list\n");
1098                 chan_num = mwifiex_scan_create_channel_list(priv, user_scan_in,
1099                                                             scan_chan_list,
1100                                                             *filtered_scan);
1101         }
1102
1103 }
1104
1105 /*
1106  * This function inspects the scan response buffer for pointers to
1107  * expected TLVs.
1108  *
1109  * TLVs can be included at the end of the scan response BSS information.
1110  *
1111  * Data in the buffer is parsed pointers to TLVs that can potentially
1112  * be passed back in the response.
1113  */
1114 static void
1115 mwifiex_ret_802_11_scan_get_tlv_ptrs(struct mwifiex_adapter *adapter,
1116                                      struct mwifiex_ie_types_data *tlv,
1117                                      u32 tlv_buf_size, u32 req_tlv_type,
1118                                      struct mwifiex_ie_types_data **tlv_data)
1119 {
1120         struct mwifiex_ie_types_data *current_tlv;
1121         u32 tlv_buf_left;
1122         u32 tlv_type;
1123         u32 tlv_len;
1124
1125         current_tlv = tlv;
1126         tlv_buf_left = tlv_buf_size;
1127         *tlv_data = NULL;
1128
1129         mwifiex_dbg(adapter, INFO,
1130                     "info: SCAN_RESP: tlv_buf_size = %d\n",
1131                     tlv_buf_size);
1132
1133         while (tlv_buf_left >= sizeof(struct mwifiex_ie_types_header)) {
1134
1135                 tlv_type = le16_to_cpu(current_tlv->header.type);
1136                 tlv_len = le16_to_cpu(current_tlv->header.len);
1137
1138                 if (sizeof(tlv->header) + tlv_len > tlv_buf_left) {
1139                         mwifiex_dbg(adapter, ERROR,
1140                                     "SCAN_RESP: TLV buffer corrupt\n");
1141                         break;
1142                 }
1143
1144                 if (req_tlv_type == tlv_type) {
1145                         switch (tlv_type) {
1146                         case TLV_TYPE_TSFTIMESTAMP:
1147                                 mwifiex_dbg(adapter, INFO,
1148                                             "info: SCAN_RESP: TSF\t"
1149                                             "timestamp TLV, len = %d\n",
1150                                             tlv_len);
1151                                 *tlv_data = current_tlv;
1152                                 break;
1153                         case TLV_TYPE_CHANNELBANDLIST:
1154                                 mwifiex_dbg(adapter, INFO,
1155                                             "info: SCAN_RESP: channel\t"
1156                                             "band list TLV, len = %d\n",
1157                                             tlv_len);
1158                                 *tlv_data = current_tlv;
1159                                 break;
1160                         default:
1161                                 mwifiex_dbg(adapter, ERROR,
1162                                             "SCAN_RESP: unhandled TLV = %d\n",
1163                                             tlv_type);
1164                                 /* Give up, this seems corrupted */
1165                                 return;
1166                         }
1167                 }
1168
1169                 if (*tlv_data)
1170                         break;
1171
1172
1173                 tlv_buf_left -= (sizeof(tlv->header) + tlv_len);
1174                 current_tlv =
1175                         (struct mwifiex_ie_types_data *) (current_tlv->data +
1176                                                           tlv_len);
1177
1178         }                       /* while */
1179 }
1180
1181 /*
1182  * This function parses provided beacon buffer and updates
1183  * respective fields in bss descriptor structure.
1184  */
1185 int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
1186                                     struct mwifiex_bssdescriptor *bss_entry)
1187 {
1188         int ret = 0;
1189         u8 element_id;
1190         struct ieee_types_fh_param_set *fh_param_set;
1191         struct ieee_types_ds_param_set *ds_param_set;
1192         struct ieee_types_cf_param_set *cf_param_set;
1193         struct ieee_types_ibss_param_set *ibss_param_set;
1194         u8 *current_ptr;
1195         u8 *rate;
1196         u8 element_len;
1197         u16 total_ie_len;
1198         u8 bytes_to_copy;
1199         u8 rate_size;
1200         u8 found_data_rate_ie;
1201         u32 bytes_left;
1202         struct ieee_types_vendor_specific *vendor_ie;
1203         const u8 wpa_oui[4] = { 0x00, 0x50, 0xf2, 0x01 };
1204         const u8 wmm_oui[4] = { 0x00, 0x50, 0xf2, 0x02 };
1205
1206         found_data_rate_ie = false;
1207         rate_size = 0;
1208         current_ptr = bss_entry->beacon_buf;
1209         bytes_left = bss_entry->beacon_buf_size;
1210
1211         /* Process variable IE */
1212         while (bytes_left >= 2) {
1213                 element_id = *current_ptr;
1214                 element_len = *(current_ptr + 1);
1215                 total_ie_len = element_len + sizeof(struct ieee_types_header);
1216
1217                 if (bytes_left < total_ie_len) {
1218                         mwifiex_dbg(adapter, ERROR,
1219                                     "err: InterpretIE: in processing\t"
1220                                     "IE, bytes left < IE length\n");
1221                         return -1;
1222                 }
1223                 switch (element_id) {
1224                 case WLAN_EID_SSID:
1225                         bss_entry->ssid.ssid_len = element_len;
1226                         memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
1227                                element_len);
1228                         mwifiex_dbg(adapter, INFO,
1229                                     "info: InterpretIE: ssid: %-32s\n",
1230                                     bss_entry->ssid.ssid);
1231                         break;
1232
1233                 case WLAN_EID_SUPP_RATES:
1234                         memcpy(bss_entry->data_rates, current_ptr + 2,
1235                                element_len);
1236                         memcpy(bss_entry->supported_rates, current_ptr + 2,
1237                                element_len);
1238                         rate_size = element_len;
1239                         found_data_rate_ie = true;
1240                         break;
1241
1242                 case WLAN_EID_FH_PARAMS:
1243                         fh_param_set =
1244                                 (struct ieee_types_fh_param_set *) current_ptr;
1245                         memcpy(&bss_entry->phy_param_set.fh_param_set,
1246                                fh_param_set,
1247                                sizeof(struct ieee_types_fh_param_set));
1248                         break;
1249
1250                 case WLAN_EID_DS_PARAMS:
1251                         ds_param_set =
1252                                 (struct ieee_types_ds_param_set *) current_ptr;
1253
1254                         bss_entry->channel = ds_param_set->current_chan;
1255
1256                         memcpy(&bss_entry->phy_param_set.ds_param_set,
1257                                ds_param_set,
1258                                sizeof(struct ieee_types_ds_param_set));
1259                         break;
1260
1261                 case WLAN_EID_CF_PARAMS:
1262                         cf_param_set =
1263                                 (struct ieee_types_cf_param_set *) current_ptr;
1264                         memcpy(&bss_entry->ss_param_set.cf_param_set,
1265                                cf_param_set,
1266                                sizeof(struct ieee_types_cf_param_set));
1267                         break;
1268
1269                 case WLAN_EID_IBSS_PARAMS:
1270                         ibss_param_set =
1271                                 (struct ieee_types_ibss_param_set *)
1272                                 current_ptr;
1273                         memcpy(&bss_entry->ss_param_set.ibss_param_set,
1274                                ibss_param_set,
1275                                sizeof(struct ieee_types_ibss_param_set));
1276                         break;
1277
1278                 case WLAN_EID_ERP_INFO:
1279                         bss_entry->erp_flags = *(current_ptr + 2);
1280                         break;
1281
1282                 case WLAN_EID_PWR_CONSTRAINT:
1283                         bss_entry->local_constraint = *(current_ptr + 2);
1284                         bss_entry->sensed_11h = true;
1285                         break;
1286
1287                 case WLAN_EID_CHANNEL_SWITCH:
1288                         bss_entry->chan_sw_ie_present = true;
1289                 case WLAN_EID_PWR_CAPABILITY:
1290                 case WLAN_EID_TPC_REPORT:
1291                 case WLAN_EID_QUIET:
1292                         bss_entry->sensed_11h = true;
1293                     break;
1294
1295                 case WLAN_EID_EXT_SUPP_RATES:
1296                         /*
1297                          * Only process extended supported rate
1298                          * if data rate is already found.
1299                          * Data rate IE should come before
1300                          * extended supported rate IE
1301                          */
1302                         if (found_data_rate_ie) {
1303                                 if ((element_len + rate_size) >
1304                                     MWIFIEX_SUPPORTED_RATES)
1305                                         bytes_to_copy =
1306                                                 (MWIFIEX_SUPPORTED_RATES -
1307                                                  rate_size);
1308                                 else
1309                                         bytes_to_copy = element_len;
1310
1311                                 rate = (u8 *) bss_entry->data_rates;
1312                                 rate += rate_size;
1313                                 memcpy(rate, current_ptr + 2, bytes_to_copy);
1314
1315                                 rate = (u8 *) bss_entry->supported_rates;
1316                                 rate += rate_size;
1317                                 memcpy(rate, current_ptr + 2, bytes_to_copy);
1318                         }
1319                         break;
1320
1321                 case WLAN_EID_VENDOR_SPECIFIC:
1322                         vendor_ie = (struct ieee_types_vendor_specific *)
1323                                         current_ptr;
1324
1325                         if (!memcmp
1326                             (vendor_ie->vend_hdr.oui, wpa_oui,
1327                              sizeof(wpa_oui))) {
1328                                 bss_entry->bcn_wpa_ie =
1329                                         (struct ieee_types_vendor_specific *)
1330                                         current_ptr;
1331                                 bss_entry->wpa_offset = (u16)
1332                                         (current_ptr - bss_entry->beacon_buf);
1333                         } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
1334                                     sizeof(wmm_oui))) {
1335                                 if (total_ie_len ==
1336                                     sizeof(struct ieee_types_wmm_parameter) ||
1337                                     total_ie_len ==
1338                                     sizeof(struct ieee_types_wmm_info))
1339                                         /*
1340                                          * Only accept and copy the WMM IE if
1341                                          * it matches the size expected for the
1342                                          * WMM Info IE or the WMM Parameter IE.
1343                                          */
1344                                         memcpy((u8 *) &bss_entry->wmm_ie,
1345                                                current_ptr, total_ie_len);
1346                         }
1347                         break;
1348                 case WLAN_EID_RSN:
1349                         bss_entry->bcn_rsn_ie =
1350                                 (struct ieee_types_generic *) current_ptr;
1351                         bss_entry->rsn_offset = (u16) (current_ptr -
1352                                                         bss_entry->beacon_buf);
1353                         break;
1354                 case WLAN_EID_BSS_AC_ACCESS_DELAY:
1355                         bss_entry->bcn_wapi_ie =
1356                                 (struct ieee_types_generic *) current_ptr;
1357                         bss_entry->wapi_offset = (u16) (current_ptr -
1358                                                         bss_entry->beacon_buf);
1359                         break;
1360                 case WLAN_EID_HT_CAPABILITY:
1361                         bss_entry->bcn_ht_cap = (struct ieee80211_ht_cap *)
1362                                         (current_ptr +
1363                                         sizeof(struct ieee_types_header));
1364                         bss_entry->ht_cap_offset = (u16) (current_ptr +
1365                                         sizeof(struct ieee_types_header) -
1366                                         bss_entry->beacon_buf);
1367                         break;
1368                 case WLAN_EID_HT_OPERATION:
1369                         bss_entry->bcn_ht_oper =
1370                                 (struct ieee80211_ht_operation *)(current_ptr +
1371                                         sizeof(struct ieee_types_header));
1372                         bss_entry->ht_info_offset = (u16) (current_ptr +
1373                                         sizeof(struct ieee_types_header) -
1374                                         bss_entry->beacon_buf);
1375                         break;
1376                 case WLAN_EID_VHT_CAPABILITY:
1377                         bss_entry->disable_11ac = false;
1378                         bss_entry->bcn_vht_cap =
1379                                 (void *)(current_ptr +
1380                                          sizeof(struct ieee_types_header));
1381                         bss_entry->vht_cap_offset =
1382                                         (u16)((u8 *)bss_entry->bcn_vht_cap -
1383                                               bss_entry->beacon_buf);
1384                         break;
1385                 case WLAN_EID_VHT_OPERATION:
1386                         bss_entry->bcn_vht_oper =
1387                                 (void *)(current_ptr +
1388                                          sizeof(struct ieee_types_header));
1389                         bss_entry->vht_info_offset =
1390                                         (u16)((u8 *)bss_entry->bcn_vht_oper -
1391                                               bss_entry->beacon_buf);
1392                         break;
1393                 case WLAN_EID_BSS_COEX_2040:
1394                         bss_entry->bcn_bss_co_2040 = current_ptr;
1395                         bss_entry->bss_co_2040_offset =
1396                                 (u16) (current_ptr - bss_entry->beacon_buf);
1397                         break;
1398                 case WLAN_EID_EXT_CAPABILITY:
1399                         bss_entry->bcn_ext_cap = current_ptr;
1400                         bss_entry->ext_cap_offset =
1401                                 (u16) (current_ptr - bss_entry->beacon_buf);
1402                         break;
1403                 case WLAN_EID_OPMODE_NOTIF:
1404                         bss_entry->oper_mode = (void *)current_ptr;
1405                         bss_entry->oper_mode_offset =
1406                                         (u16)((u8 *)bss_entry->oper_mode -
1407                                               bss_entry->beacon_buf);
1408                         break;
1409                 default:
1410                         break;
1411                 }
1412
1413                 current_ptr += element_len + 2;
1414
1415                 /* Need to account for IE ID and IE Len */
1416                 bytes_left -= (element_len + 2);
1417
1418         }       /* while (bytes_left > 2) */
1419         return ret;
1420 }
1421
1422 /*
1423  * This function converts radio type scan parameter to a band configuration
1424  * to be used in join command.
1425  */
1426 static u8
1427 mwifiex_radio_type_to_band(u8 radio_type)
1428 {
1429         switch (radio_type) {
1430         case HostCmd_SCAN_RADIO_TYPE_A:
1431                 return BAND_A;
1432         case HostCmd_SCAN_RADIO_TYPE_BG:
1433         default:
1434                 return BAND_G;
1435         }
1436 }
1437
1438 /*
1439  * This is an internal function used to start a scan based on an input
1440  * configuration.
1441  *
1442  * This uses the input user scan configuration information when provided in
1443  * order to send the appropriate scan commands to firmware to populate or
1444  * update the internal driver scan table.
1445  */
1446 int mwifiex_scan_networks(struct mwifiex_private *priv,
1447                           const struct mwifiex_user_scan_cfg *user_scan_in)
1448 {
1449         int ret;
1450         struct mwifiex_adapter *adapter = priv->adapter;
1451         struct cmd_ctrl_node *cmd_node;
1452         union mwifiex_scan_cmd_config_tlv *scan_cfg_out;
1453         struct mwifiex_ie_types_chan_list_param_set *chan_list_out;
1454         struct mwifiex_chan_scan_param_set *scan_chan_list;
1455         u8 filtered_scan;
1456         u8 scan_current_chan_only;
1457         u8 max_chan_per_scan;
1458         unsigned long flags;
1459
1460         if (adapter->scan_processing) {
1461                 mwifiex_dbg(adapter, WARN,
1462                             "cmd: Scan already in process...\n");
1463                 return -EBUSY;
1464         }
1465
1466         if (priv->scan_block) {
1467                 mwifiex_dbg(adapter, WARN,
1468                             "cmd: Scan is blocked during association...\n");
1469                 return -EBUSY;
1470         }
1471
1472         if (adapter->surprise_removed || adapter->is_cmd_timedout) {
1473                 mwifiex_dbg(adapter, ERROR,
1474                             "Ignore scan. Card removed or firmware in bad state\n");
1475                 return -EFAULT;
1476         }
1477
1478         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1479         adapter->scan_processing = true;
1480         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1481
1482         scan_cfg_out = kzalloc(sizeof(union mwifiex_scan_cmd_config_tlv),
1483                                GFP_KERNEL);
1484         if (!scan_cfg_out) {
1485                 ret = -ENOMEM;
1486                 goto done;
1487         }
1488
1489         scan_chan_list = kcalloc(MWIFIEX_USER_SCAN_CHAN_MAX,
1490                                  sizeof(struct mwifiex_chan_scan_param_set),
1491                                  GFP_KERNEL);
1492         if (!scan_chan_list) {
1493                 kfree(scan_cfg_out);
1494                 ret = -ENOMEM;
1495                 goto done;
1496         }
1497
1498         mwifiex_config_scan(priv, user_scan_in, &scan_cfg_out->config,
1499                             &chan_list_out, scan_chan_list, &max_chan_per_scan,
1500                             &filtered_scan, &scan_current_chan_only);
1501
1502         ret = mwifiex_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
1503                                         &scan_cfg_out->config, chan_list_out,
1504                                         scan_chan_list);
1505
1506         /* Get scan command from scan_pending_q and put to cmd_pending_q */
1507         if (!ret) {
1508                 spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1509                 if (!list_empty(&adapter->scan_pending_q)) {
1510                         cmd_node = list_first_entry(&adapter->scan_pending_q,
1511                                                     struct cmd_ctrl_node, list);
1512                         list_del(&cmd_node->list);
1513                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
1514                                                flags);
1515                         mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
1516                                                         true);
1517                         queue_work(adapter->workqueue, &adapter->main_work);
1518
1519                         /* Perform internal scan synchronously */
1520                         if (!priv->scan_request) {
1521                                 mwifiex_dbg(adapter, INFO,
1522                                             "wait internal scan\n");
1523                                 mwifiex_wait_queue_complete(adapter, cmd_node);
1524                         }
1525                 } else {
1526                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
1527                                                flags);
1528                 }
1529         }
1530
1531         kfree(scan_cfg_out);
1532         kfree(scan_chan_list);
1533 done:
1534         if (ret) {
1535                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1536                 adapter->scan_processing = false;
1537                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1538         }
1539         return ret;
1540 }
1541
1542 /*
1543  * This function prepares a scan command to be sent to the firmware.
1544  *
1545  * This uses the scan command configuration sent to the command processing
1546  * module in command preparation stage to configure a scan command structure
1547  * to send to firmware.
1548  *
1549  * The fixed fields specifying the BSS type and BSSID filters as well as a
1550  * variable number/length of TLVs are sent in the command to firmware.
1551  *
1552  * Preparation also includes -
1553  *      - Setting command ID, and proper size
1554  *      - Ensuring correct endian-ness
1555  */
1556 int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
1557                             struct mwifiex_scan_cmd_config *scan_cfg)
1558 {
1559         struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;
1560
1561         /* Set fixed field variables in scan command */
1562         scan_cmd->bss_mode = scan_cfg->bss_mode;
1563         memcpy(scan_cmd->bssid, scan_cfg->specific_bssid,
1564                sizeof(scan_cmd->bssid));
1565         memcpy(scan_cmd->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
1566
1567         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SCAN);
1568
1569         /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
1570         cmd->size = cpu_to_le16((u16) (sizeof(scan_cmd->bss_mode)
1571                                           + sizeof(scan_cmd->bssid)
1572                                           + scan_cfg->tlv_buf_len + S_DS_GEN));
1573
1574         return 0;
1575 }
1576
1577 /*
1578  * This function checks compatibility of requested network with current
1579  * driver settings.
1580  */
1581 int mwifiex_check_network_compatibility(struct mwifiex_private *priv,
1582                                         struct mwifiex_bssdescriptor *bss_desc)
1583 {
1584         int ret = -1;
1585
1586         if (!bss_desc)
1587                 return -1;
1588
1589         if ((mwifiex_get_cfp(priv, (u8) bss_desc->bss_band,
1590                              (u16) bss_desc->channel, 0))) {
1591                 switch (priv->bss_mode) {
1592                 case NL80211_IFTYPE_STATION:
1593                 case NL80211_IFTYPE_ADHOC:
1594                         ret = mwifiex_is_network_compatible(priv, bss_desc,
1595                                                             priv->bss_mode);
1596                         if (ret)
1597                                 mwifiex_dbg(priv->adapter, ERROR,
1598                                             "Incompatible network settings\n");
1599                         break;
1600                 default:
1601                         ret = 0;
1602                 }
1603         }
1604
1605         return ret;
1606 }
1607
1608 /* This function checks if SSID string contains all zeroes or length is zero */
1609 static bool mwifiex_is_hidden_ssid(struct cfg80211_ssid *ssid)
1610 {
1611         int idx;
1612
1613         for (idx = 0; idx < ssid->ssid_len; idx++) {
1614                 if (ssid->ssid[idx])
1615                         return false;
1616         }
1617
1618         return true;
1619 }
1620
1621 /* This function checks if any hidden SSID found in passive scan channels
1622  * and save those channels for specific SSID active scan
1623  */
1624 static int mwifiex_save_hidden_ssid_channels(struct mwifiex_private *priv,
1625                                              struct cfg80211_bss *bss)
1626 {
1627         struct mwifiex_bssdescriptor *bss_desc;
1628         int ret;
1629         int chid;
1630
1631         /* Allocate and fill new bss descriptor */
1632         bss_desc = kzalloc(sizeof(*bss_desc), GFP_KERNEL);
1633         if (!bss_desc)
1634                 return -ENOMEM;
1635
1636         ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
1637         if (ret)
1638                 goto done;
1639
1640         if (mwifiex_is_hidden_ssid(&bss_desc->ssid)) {
1641                 mwifiex_dbg(priv->adapter, INFO, "found hidden SSID\n");
1642                 for (chid = 0 ; chid < MWIFIEX_USER_SCAN_CHAN_MAX; chid++) {
1643                         if (priv->hidden_chan[chid].chan_number ==
1644                             bss->channel->hw_value)
1645                                 break;
1646
1647                         if (!priv->hidden_chan[chid].chan_number) {
1648                                 priv->hidden_chan[chid].chan_number =
1649                                         bss->channel->hw_value;
1650                                 priv->hidden_chan[chid].radio_type =
1651                                         bss->channel->band;
1652                                 priv->hidden_chan[chid].scan_type =
1653                                         MWIFIEX_SCAN_TYPE_ACTIVE;
1654                                 break;
1655                         }
1656                 }
1657         }
1658
1659 done:
1660         kfree(bss_desc);
1661         return 0;
1662 }
1663
1664 static int mwifiex_update_curr_bss_params(struct mwifiex_private *priv,
1665                                           struct cfg80211_bss *bss)
1666 {
1667         struct mwifiex_bssdescriptor *bss_desc;
1668         int ret;
1669         unsigned long flags;
1670
1671         /* Allocate and fill new bss descriptor */
1672         bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), GFP_KERNEL);
1673         if (!bss_desc)
1674                 return -ENOMEM;
1675
1676         ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
1677         if (ret)
1678                 goto done;
1679
1680         ret = mwifiex_check_network_compatibility(priv, bss_desc);
1681         if (ret)
1682                 goto done;
1683
1684         spin_lock_irqsave(&priv->curr_bcn_buf_lock, flags);
1685         /* Make a copy of current BSSID descriptor */
1686         memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
1687                sizeof(priv->curr_bss_params.bss_descriptor));
1688
1689         /* The contents of beacon_ie will be copied to its own buffer
1690          * in mwifiex_save_curr_bcn()
1691          */
1692         mwifiex_save_curr_bcn(priv);
1693         spin_unlock_irqrestore(&priv->curr_bcn_buf_lock, flags);
1694
1695 done:
1696         /* beacon_ie buffer was allocated in function
1697          * mwifiex_fill_new_bss_desc(). Free it now.
1698          */
1699         kfree(bss_desc->beacon_buf);
1700         kfree(bss_desc);
1701         return 0;
1702 }
1703
1704 static int
1705 mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
1706                                   u32 *bytes_left, u64 fw_tsf, u8 *radio_type,
1707                                   bool ext_scan, s32 rssi_val)
1708 {
1709         struct mwifiex_adapter *adapter = priv->adapter;
1710         struct mwifiex_chan_freq_power *cfp;
1711         struct cfg80211_bss *bss;
1712         u8 bssid[ETH_ALEN];
1713         s32 rssi;
1714         const u8 *ie_buf;
1715         size_t ie_len;
1716         u16 channel = 0;
1717         u16 beacon_size = 0;
1718         u32 curr_bcn_bytes;
1719         u32 freq;
1720         u16 beacon_period;
1721         u16 cap_info_bitmap;
1722         u8 *current_ptr;
1723         u64 timestamp;
1724         struct mwifiex_fixed_bcn_param *bcn_param;
1725         struct mwifiex_bss_priv *bss_priv;
1726
1727         if (*bytes_left >= sizeof(beacon_size)) {
1728                 /* Extract & convert beacon size from command buffer */
1729                 beacon_size = le16_to_cpu(*(__le16 *)(*bss_info));
1730                 *bytes_left -= sizeof(beacon_size);
1731                 *bss_info += sizeof(beacon_size);
1732         }
1733
1734         if (!beacon_size || beacon_size > *bytes_left) {
1735                 *bss_info += *bytes_left;
1736                 *bytes_left = 0;
1737                 return -EFAULT;
1738         }
1739
1740         /* Initialize the current working beacon pointer for this BSS
1741          * iteration
1742          */
1743         current_ptr = *bss_info;
1744
1745         /* Advance the return beacon pointer past the current beacon */
1746         *bss_info += beacon_size;
1747         *bytes_left -= beacon_size;
1748
1749         curr_bcn_bytes = beacon_size;
1750
1751         /* First 5 fields are bssid, RSSI(for legacy scan only),
1752          * time stamp, beacon interval, and capability information
1753          */
1754         if (curr_bcn_bytes < ETH_ALEN + sizeof(u8) +
1755             sizeof(struct mwifiex_fixed_bcn_param)) {
1756                 mwifiex_dbg(adapter, ERROR,
1757                             "InterpretIE: not enough bytes left\n");
1758                 return -EFAULT;
1759         }
1760
1761         memcpy(bssid, current_ptr, ETH_ALEN);
1762         current_ptr += ETH_ALEN;
1763         curr_bcn_bytes -= ETH_ALEN;
1764
1765         if (!ext_scan) {
1766                 rssi = (s32) *current_ptr;
1767                 rssi = (-rssi) * 100;           /* Convert dBm to mBm */
1768                 current_ptr += sizeof(u8);
1769                 curr_bcn_bytes -= sizeof(u8);
1770                 mwifiex_dbg(adapter, INFO,
1771                             "info: InterpretIE: RSSI=%d\n", rssi);
1772         } else {
1773                 rssi = rssi_val;
1774         }
1775
1776         bcn_param = (struct mwifiex_fixed_bcn_param *)current_ptr;
1777         current_ptr += sizeof(*bcn_param);
1778         curr_bcn_bytes -= sizeof(*bcn_param);
1779
1780         timestamp = le64_to_cpu(bcn_param->timestamp);
1781         beacon_period = le16_to_cpu(bcn_param->beacon_period);
1782
1783         cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
1784         mwifiex_dbg(adapter, INFO,
1785                     "info: InterpretIE: capabilities=0x%X\n",
1786                     cap_info_bitmap);
1787
1788         /* Rest of the current buffer are IE's */
1789         ie_buf = current_ptr;
1790         ie_len = curr_bcn_bytes;
1791         mwifiex_dbg(adapter, INFO,
1792                     "info: InterpretIE: IELength for this AP = %d\n",
1793                     curr_bcn_bytes);
1794
1795         while (curr_bcn_bytes >= sizeof(struct ieee_types_header)) {
1796                 u8 element_id, element_len;
1797
1798                 element_id = *current_ptr;
1799                 element_len = *(current_ptr + 1);
1800                 if (curr_bcn_bytes < element_len +
1801                                 sizeof(struct ieee_types_header)) {
1802                         mwifiex_dbg(adapter, ERROR,
1803                                     "%s: bytes left < IE length\n", __func__);
1804                         return -EFAULT;
1805                 }
1806                 if (element_id == WLAN_EID_DS_PARAMS) {
1807                         channel = *(current_ptr +
1808                                     sizeof(struct ieee_types_header));
1809                         break;
1810                 }
1811
1812                 current_ptr += element_len + sizeof(struct ieee_types_header);
1813                 curr_bcn_bytes -= element_len +
1814                                         sizeof(struct ieee_types_header);
1815         }
1816
1817         if (channel) {
1818                 struct ieee80211_channel *chan;
1819                 u8 band;
1820
1821                 /* Skip entry if on csa closed channel */
1822                 if (channel == priv->csa_chan) {
1823                         mwifiex_dbg(adapter, WARN,
1824                                     "Dropping entry on csa closed channel\n");
1825                         return 0;
1826                 }
1827
1828                 band = BAND_G;
1829                 if (radio_type)
1830                         band = mwifiex_radio_type_to_band(*radio_type &
1831                                                           (BIT(0) | BIT(1)));
1832
1833                 cfp = mwifiex_get_cfp(priv, band, channel, 0);
1834
1835                 freq = cfp ? cfp->freq : 0;
1836
1837                 chan = ieee80211_get_channel(priv->wdev.wiphy, freq);
1838
1839                 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
1840                         bss = cfg80211_inform_bss(priv->wdev.wiphy,
1841                                             chan, CFG80211_BSS_FTYPE_UNKNOWN,
1842                                             bssid, timestamp,
1843                                             cap_info_bitmap, beacon_period,
1844                                             ie_buf, ie_len, rssi, GFP_KERNEL);
1845                         if (bss) {
1846                                 bss_priv = (struct mwifiex_bss_priv *)bss->priv;
1847                                 bss_priv->band = band;
1848                                 bss_priv->fw_tsf = fw_tsf;
1849                                 if (priv->media_connected &&
1850                                     !memcmp(bssid, priv->curr_bss_params.
1851                                             bss_descriptor.mac_address,
1852                                             ETH_ALEN))
1853                                         mwifiex_update_curr_bss_params(priv,
1854                                                                        bss);
1855                                 cfg80211_put_bss(priv->wdev.wiphy, bss);
1856                         }
1857
1858                         if ((chan->flags & IEEE80211_CHAN_RADAR) ||
1859                             (chan->flags & IEEE80211_CHAN_NO_IR)) {
1860                                 mwifiex_dbg(adapter, INFO,
1861                                             "radar or passive channel %d\n",
1862                                             channel);
1863                                 mwifiex_save_hidden_ssid_channels(priv, bss);
1864                         }
1865                 }
1866         } else {
1867                 mwifiex_dbg(adapter, WARN, "missing BSS channel IE\n");
1868         }
1869
1870         return 0;
1871 }
1872
1873 static void mwifiex_complete_scan(struct mwifiex_private *priv)
1874 {
1875         struct mwifiex_adapter *adapter = priv->adapter;
1876
1877         adapter->survey_idx = 0;
1878         if (adapter->curr_cmd->wait_q_enabled) {
1879                 adapter->cmd_wait_q.status = 0;
1880                 if (!priv->scan_request) {
1881                         mwifiex_dbg(adapter, INFO,
1882                                     "complete internal scan\n");
1883                         mwifiex_complete_cmd(adapter, adapter->curr_cmd);
1884                 }
1885         }
1886 }
1887
1888 /* This function checks if any hidden SSID found in passive scan channels
1889  * and do specific SSID active scan for those channels
1890  */
1891 static int
1892 mwifiex_active_scan_req_for_passive_chan(struct mwifiex_private *priv)
1893 {
1894         int ret;
1895         struct mwifiex_adapter *adapter = priv->adapter;
1896         u8 id = 0;
1897         struct mwifiex_user_scan_cfg  *user_scan_cfg;
1898
1899         if (adapter->active_scan_triggered || !priv->scan_request ||
1900             priv->scan_aborting) {
1901                 adapter->active_scan_triggered = false;
1902                 return 0;
1903         }
1904
1905         if (!priv->hidden_chan[0].chan_number) {
1906                 mwifiex_dbg(adapter, INFO, "No BSS with hidden SSID found on DFS channels\n");
1907                 return 0;
1908         }
1909         user_scan_cfg = kzalloc(sizeof(*user_scan_cfg), GFP_KERNEL);
1910
1911         if (!user_scan_cfg)
1912                 return -ENOMEM;
1913
1914         memset(user_scan_cfg, 0, sizeof(*user_scan_cfg));
1915
1916         for (id = 0; id < MWIFIEX_USER_SCAN_CHAN_MAX; id++) {
1917                 if (!priv->hidden_chan[id].chan_number)
1918                         break;
1919                 memcpy(&user_scan_cfg->chan_list[id],
1920                        &priv->hidden_chan[id],
1921                        sizeof(struct mwifiex_user_scan_chan));
1922         }
1923
1924         adapter->active_scan_triggered = true;
1925         user_scan_cfg->num_ssids = priv->scan_request->n_ssids;
1926         user_scan_cfg->ssid_list = priv->scan_request->ssids;
1927
1928         ret = mwifiex_scan_networks(priv, user_scan_cfg);
1929         kfree(user_scan_cfg);
1930
1931         memset(&priv->hidden_chan, 0, sizeof(priv->hidden_chan));
1932
1933         if (ret) {
1934                 dev_err(priv->adapter->dev, "scan failed: %d\n", ret);
1935                 return ret;
1936         }
1937
1938         return 0;
1939 }
1940 static void mwifiex_check_next_scan_command(struct mwifiex_private *priv)
1941 {
1942         struct mwifiex_adapter *adapter = priv->adapter;
1943         struct cmd_ctrl_node *cmd_node;
1944         unsigned long flags;
1945
1946         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1947         if (list_empty(&adapter->scan_pending_q)) {
1948                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
1949
1950                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1951                 adapter->scan_processing = false;
1952                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1953
1954                 mwifiex_active_scan_req_for_passive_chan(priv);
1955
1956                 if (!adapter->ext_scan)
1957                         mwifiex_complete_scan(priv);
1958
1959                 if (priv->scan_request) {
1960                         struct cfg80211_scan_info info = {
1961                                 .aborted = false,
1962                         };
1963
1964                         mwifiex_dbg(adapter, INFO,
1965                                     "info: notifying scan done\n");
1966                         cfg80211_scan_done(priv->scan_request, &info);
1967                         priv->scan_request = NULL;
1968                         priv->scan_aborting = false;
1969                 } else {
1970                         priv->scan_aborting = false;
1971                         mwifiex_dbg(adapter, INFO,
1972                                     "info: scan already aborted\n");
1973                 }
1974         } else if ((priv->scan_aborting && !priv->scan_request) ||
1975                    priv->scan_block) {
1976                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
1977
1978                 mwifiex_cancel_pending_scan_cmd(adapter);
1979
1980                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1981                 adapter->scan_processing = false;
1982                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1983
1984                 if (!adapter->active_scan_triggered) {
1985                         if (priv->scan_request) {
1986                                 struct cfg80211_scan_info info = {
1987                                         .aborted = true,
1988                                 };
1989
1990                                 mwifiex_dbg(adapter, INFO,
1991                                             "info: aborting scan\n");
1992                                 cfg80211_scan_done(priv->scan_request, &info);
1993                                 priv->scan_request = NULL;
1994                                 priv->scan_aborting = false;
1995                         } else {
1996                                 priv->scan_aborting = false;
1997                                 mwifiex_dbg(adapter, INFO,
1998                                             "info: scan already aborted\n");
1999                         }
2000                 }
2001         } else {
2002                 /* Get scan command from scan_pending_q and put to
2003                  * cmd_pending_q
2004                  */
2005                 cmd_node = list_first_entry(&adapter->scan_pending_q,
2006                                             struct cmd_ctrl_node, list);
2007                 list_del(&cmd_node->list);
2008                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
2009                 mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
2010         }
2011
2012         return;
2013 }
2014
2015 void mwifiex_cancel_scan(struct mwifiex_adapter *adapter)
2016 {
2017         struct mwifiex_private *priv;
2018         unsigned long cmd_flags;
2019         int i;
2020
2021         mwifiex_cancel_pending_scan_cmd(adapter);
2022
2023         if (adapter->scan_processing) {
2024                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, cmd_flags);
2025                 adapter->scan_processing = false;
2026                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
2027                 for (i = 0; i < adapter->priv_num; i++) {
2028                         priv = adapter->priv[i];
2029                         if (!priv)
2030                                 continue;
2031                         if (priv->scan_request) {
2032                                 struct cfg80211_scan_info info = {
2033                                         .aborted = true,
2034                                 };
2035
2036                                 mwifiex_dbg(adapter, INFO,
2037                                             "info: aborting scan\n");
2038                                 cfg80211_scan_done(priv->scan_request, &info);
2039                                 priv->scan_request = NULL;
2040                                 priv->scan_aborting = false;
2041                         }
2042                 }
2043         }
2044 }
2045
2046 /*
2047  * This function handles the command response of scan.
2048  *
2049  * The response buffer for the scan command has the following
2050  * memory layout:
2051  *
2052  *      .-------------------------------------------------------------.
2053  *      |  Header (4 * sizeof(t_u16)):  Standard command response hdr |
2054  *      .-------------------------------------------------------------.
2055  *      |  BufSize (t_u16) : sizeof the BSS Description data          |
2056  *      .-------------------------------------------------------------.
2057  *      |  NumOfSet (t_u8) : Number of BSS Descs returned             |
2058  *      .-------------------------------------------------------------.
2059  *      |  BSSDescription data (variable, size given in BufSize)      |
2060  *      .-------------------------------------------------------------.
2061  *      |  TLV data (variable, size calculated using Header->Size,    |
2062  *      |            BufSize and sizeof the fixed fields above)       |
2063  *      .-------------------------------------------------------------.
2064  */
2065 int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
2066                             struct host_cmd_ds_command *resp)
2067 {
2068         int ret = 0;
2069         struct mwifiex_adapter *adapter = priv->adapter;
2070         struct host_cmd_ds_802_11_scan_rsp *scan_rsp;
2071         struct mwifiex_ie_types_data *tlv_data;
2072         struct mwifiex_ie_types_tsf_timestamp *tsf_tlv;
2073         u8 *bss_info;
2074         u32 scan_resp_size;
2075         u32 bytes_left;
2076         u32 idx;
2077         u32 tlv_buf_size;
2078         struct mwifiex_ie_types_chan_band_list_param_set *chan_band_tlv;
2079         struct chan_band_param_set *chan_band;
2080         u8 is_bgscan_resp;
2081         __le64 fw_tsf = 0;
2082         u8 *radio_type;
2083         struct cfg80211_wowlan_nd_match *pmatch;
2084         struct cfg80211_sched_scan_request *nd_config = NULL;
2085
2086         is_bgscan_resp = (le16_to_cpu(resp->command)
2087                           == HostCmd_CMD_802_11_BG_SCAN_QUERY);
2088         if (is_bgscan_resp)
2089                 scan_rsp = &resp->params.bg_scan_query_resp.scan_resp;
2090         else
2091                 scan_rsp = &resp->params.scan_resp;
2092
2093
2094         if (scan_rsp->number_of_sets > MWIFIEX_MAX_AP) {
2095                 mwifiex_dbg(adapter, ERROR,
2096                             "SCAN_RESP: too many AP returned (%d)\n",
2097                             scan_rsp->number_of_sets);
2098                 ret = -1;
2099                 goto check_next_scan;
2100         }
2101
2102         /* Check csa channel expiry before parsing scan response */
2103         mwifiex_11h_get_csa_closed_channel(priv);
2104
2105         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
2106         mwifiex_dbg(adapter, INFO,
2107                     "info: SCAN_RESP: bss_descript_size %d\n",
2108                     bytes_left);
2109
2110         scan_resp_size = le16_to_cpu(resp->size);
2111
2112         mwifiex_dbg(adapter, INFO,
2113                     "info: SCAN_RESP: returned %d APs before parsing\n",
2114                     scan_rsp->number_of_sets);
2115
2116         bss_info = scan_rsp->bss_desc_and_tlv_buffer;
2117
2118         /*
2119          * The size of the TLV buffer is equal to the entire command response
2120          *   size (scan_resp_size) minus the fixed fields (sizeof()'s), the
2121          *   BSS Descriptions (bss_descript_size as bytesLef) and the command
2122          *   response header (S_DS_GEN)
2123          */
2124         tlv_buf_size = scan_resp_size - (bytes_left
2125                                          + sizeof(scan_rsp->bss_descript_size)
2126                                          + sizeof(scan_rsp->number_of_sets)
2127                                          + S_DS_GEN);
2128
2129         tlv_data = (struct mwifiex_ie_types_data *) (scan_rsp->
2130                                                  bss_desc_and_tlv_buffer +
2131                                                  bytes_left);
2132
2133         /* Search the TLV buffer space in the scan response for any valid
2134            TLVs */
2135         mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
2136                                              TLV_TYPE_TSFTIMESTAMP,
2137                                              (struct mwifiex_ie_types_data **)
2138                                              &tsf_tlv);
2139
2140         /* Search the TLV buffer space in the scan response for any valid
2141            TLVs */
2142         mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
2143                                              TLV_TYPE_CHANNELBANDLIST,
2144                                              (struct mwifiex_ie_types_data **)
2145                                              &chan_band_tlv);
2146
2147 #ifdef CONFIG_PM
2148         if (priv->wdev.wiphy->wowlan_config)
2149                 nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
2150 #endif
2151
2152         if (nd_config) {
2153                 adapter->nd_info =
2154                         kzalloc(sizeof(struct cfg80211_wowlan_nd_match) +
2155                                 sizeof(struct cfg80211_wowlan_nd_match *) *
2156                                 scan_rsp->number_of_sets, GFP_ATOMIC);
2157
2158                 if (adapter->nd_info)
2159                         adapter->nd_info->n_matches = scan_rsp->number_of_sets;
2160         }
2161
2162         for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
2163                 /*
2164                  * If the TSF TLV was appended to the scan results, save this
2165                  * entry's TSF value in the fw_tsf field. It is the firmware's
2166                  * TSF value at the time the beacon or probe response was
2167                  * received.
2168                  */
2169                 if (tsf_tlv)
2170                         memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
2171                                sizeof(fw_tsf));
2172
2173                 if (chan_band_tlv) {
2174                         chan_band = &chan_band_tlv->chan_band_param[idx];
2175                         radio_type = &chan_band->radio_type;
2176                 } else {
2177                         radio_type = NULL;
2178                 }
2179
2180                 if (chan_band_tlv && adapter->nd_info) {
2181                         adapter->nd_info->matches[idx] =
2182                                 kzalloc(sizeof(*pmatch) +
2183                                 sizeof(u32), GFP_ATOMIC);
2184
2185                         pmatch = adapter->nd_info->matches[idx];
2186
2187                         if (pmatch) {
2188                                 memset(pmatch, 0, sizeof(*pmatch));
2189                                 if (chan_band_tlv) {
2190                                         pmatch->n_channels = 1;
2191                                         pmatch->channels[0] =
2192                                                 chan_band->chan_number;
2193                                 }
2194                         }
2195                 }
2196
2197                 ret = mwifiex_parse_single_response_buf(priv, &bss_info,
2198                                                         &bytes_left,
2199                                                         le64_to_cpu(fw_tsf),
2200                                                         radio_type, false, 0);
2201                 if (ret)
2202                         goto check_next_scan;
2203         }
2204
2205 check_next_scan:
2206         mwifiex_check_next_scan_command(priv);
2207         return ret;
2208 }
2209
2210 /*
2211  * This function prepares an extended scan command to be sent to the firmware
2212  *
2213  * This uses the scan command configuration sent to the command processing
2214  * module in command preparation stage to configure a extended scan command
2215  * structure to send to firmware.
2216  */
2217 int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
2218                                 struct host_cmd_ds_command *cmd,
2219                                 void *data_buf)
2220 {
2221         struct host_cmd_ds_802_11_scan_ext *ext_scan = &cmd->params.ext_scan;
2222         struct mwifiex_scan_cmd_config *scan_cfg = data_buf;
2223
2224         memcpy(ext_scan->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
2225
2226         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SCAN_EXT);
2227
2228         /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
2229         cmd->size = cpu_to_le16((u16)(sizeof(ext_scan->reserved)
2230                                       + scan_cfg->tlv_buf_len + S_DS_GEN));
2231
2232         return 0;
2233 }
2234
2235 /* This function prepares an background scan config command to be sent
2236  * to the firmware
2237  */
2238 int mwifiex_cmd_802_11_bg_scan_config(struct mwifiex_private *priv,
2239                                       struct host_cmd_ds_command *cmd,
2240                                       void *data_buf)
2241 {
2242         struct host_cmd_ds_802_11_bg_scan_config *bgscan_config =
2243                                         &cmd->params.bg_scan_config;
2244         struct mwifiex_bg_scan_cfg *bgscan_cfg_in = data_buf;
2245         u8 *tlv_pos = bgscan_config->tlv;
2246         u8 num_probes;
2247         u32 ssid_len, chan_idx, scan_type, scan_dur, chan_num;
2248         int i;
2249         struct mwifiex_ie_types_num_probes *num_probes_tlv;
2250         struct mwifiex_ie_types_repeat_count *repeat_count_tlv;
2251         struct mwifiex_ie_types_min_rssi_threshold *rssi_threshold_tlv;
2252         struct mwifiex_ie_types_bgscan_start_later *start_later_tlv;
2253         struct mwifiex_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
2254         struct mwifiex_ie_types_chan_list_param_set *chan_list_tlv;
2255         struct mwifiex_chan_scan_param_set *temp_chan;
2256
2257         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_CONFIG);
2258         cmd->size = cpu_to_le16(sizeof(*bgscan_config) + S_DS_GEN);
2259
2260         bgscan_config->action = cpu_to_le16(bgscan_cfg_in->action);
2261         bgscan_config->enable = bgscan_cfg_in->enable;
2262         bgscan_config->bss_type = bgscan_cfg_in->bss_type;
2263         bgscan_config->scan_interval =
2264                 cpu_to_le32(bgscan_cfg_in->scan_interval);
2265         bgscan_config->report_condition =
2266                 cpu_to_le32(bgscan_cfg_in->report_condition);
2267
2268         /*  stop sched scan  */
2269         if (!bgscan_config->enable)
2270                 return 0;
2271
2272         bgscan_config->chan_per_scan = bgscan_cfg_in->chan_per_scan;
2273
2274         num_probes = (bgscan_cfg_in->num_probes ? bgscan_cfg_in->
2275                       num_probes : priv->adapter->scan_probes);
2276
2277         if (num_probes) {
2278                 num_probes_tlv = (struct mwifiex_ie_types_num_probes *)tlv_pos;
2279                 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
2280                 num_probes_tlv->header.len =
2281                         cpu_to_le16(sizeof(num_probes_tlv->num_probes));
2282                 num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);
2283
2284                 tlv_pos += sizeof(num_probes_tlv->header) +
2285                         le16_to_cpu(num_probes_tlv->header.len);
2286         }
2287
2288         if (bgscan_cfg_in->repeat_count) {
2289                 repeat_count_tlv =
2290                         (struct mwifiex_ie_types_repeat_count *)tlv_pos;
2291                 repeat_count_tlv->header.type =
2292                         cpu_to_le16(TLV_TYPE_REPEAT_COUNT);
2293                 repeat_count_tlv->header.len =
2294                         cpu_to_le16(sizeof(repeat_count_tlv->repeat_count));
2295                 repeat_count_tlv->repeat_count =
2296                         cpu_to_le16(bgscan_cfg_in->repeat_count);
2297
2298                 tlv_pos += sizeof(repeat_count_tlv->header) +
2299                         le16_to_cpu(repeat_count_tlv->header.len);
2300         }
2301
2302         if (bgscan_cfg_in->rssi_threshold) {
2303                 rssi_threshold_tlv =
2304                         (struct mwifiex_ie_types_min_rssi_threshold *)tlv_pos;
2305                 rssi_threshold_tlv->header.type =
2306                         cpu_to_le16(TLV_TYPE_RSSI_LOW);
2307                 rssi_threshold_tlv->header.len =
2308                         cpu_to_le16(sizeof(rssi_threshold_tlv->rssi_threshold));
2309                 rssi_threshold_tlv->rssi_threshold =
2310                         cpu_to_le16(bgscan_cfg_in->rssi_threshold);
2311
2312                 tlv_pos += sizeof(rssi_threshold_tlv->header) +
2313                         le16_to_cpu(rssi_threshold_tlv->header.len);
2314         }
2315
2316         for (i = 0; i < bgscan_cfg_in->num_ssids; i++) {
2317                 ssid_len = bgscan_cfg_in->ssid_list[i].ssid.ssid_len;
2318
2319                 wildcard_ssid_tlv =
2320                         (struct mwifiex_ie_types_wildcard_ssid_params *)tlv_pos;
2321                 wildcard_ssid_tlv->header.type =
2322                                 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
2323                 wildcard_ssid_tlv->header.len = cpu_to_le16(
2324                                 (u16)(ssid_len + sizeof(wildcard_ssid_tlv->
2325                                                          max_ssid_length)));
2326
2327                 /* max_ssid_length = 0 tells firmware to perform
2328                  * specific scan for the SSID filled, whereas
2329                  * max_ssid_length = IEEE80211_MAX_SSID_LEN is for
2330                  * wildcard scan.
2331                  */
2332                 if (ssid_len)
2333                         wildcard_ssid_tlv->max_ssid_length = 0;
2334                 else
2335                         wildcard_ssid_tlv->max_ssid_length =
2336                                                 IEEE80211_MAX_SSID_LEN;
2337
2338                 memcpy(wildcard_ssid_tlv->ssid,
2339                        bgscan_cfg_in->ssid_list[i].ssid.ssid, ssid_len);
2340
2341                 tlv_pos += (sizeof(wildcard_ssid_tlv->header)
2342                                 + le16_to_cpu(wildcard_ssid_tlv->header.len));
2343         }
2344
2345         chan_list_tlv = (struct mwifiex_ie_types_chan_list_param_set *)tlv_pos;
2346
2347         if (bgscan_cfg_in->chan_list[0].chan_number) {
2348                 dev_dbg(priv->adapter->dev, "info: bgscan: Using supplied channel list\n");
2349
2350                 chan_list_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
2351
2352                 for (chan_idx = 0;
2353                      chan_idx < MWIFIEX_BG_SCAN_CHAN_MAX &&
2354                      bgscan_cfg_in->chan_list[chan_idx].chan_number;
2355                      chan_idx++) {
2356                         temp_chan = chan_list_tlv->chan_scan_param + chan_idx;
2357
2358                         /* Increment the TLV header length by size appended */
2359                         le16_add_cpu(&chan_list_tlv->header.len,
2360                                      sizeof(chan_list_tlv->chan_scan_param));
2361
2362                         temp_chan->chan_number =
2363                                 bgscan_cfg_in->chan_list[chan_idx].chan_number;
2364                         temp_chan->radio_type =
2365                                 bgscan_cfg_in->chan_list[chan_idx].radio_type;
2366
2367                         scan_type =
2368                                 bgscan_cfg_in->chan_list[chan_idx].scan_type;
2369
2370                         if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
2371                                 temp_chan->chan_scan_mode_bitmap
2372                                         |= MWIFIEX_PASSIVE_SCAN;
2373                         else
2374                                 temp_chan->chan_scan_mode_bitmap
2375                                         &= ~MWIFIEX_PASSIVE_SCAN;
2376
2377                         if (bgscan_cfg_in->chan_list[chan_idx].scan_time) {
2378                                 scan_dur = (u16)bgscan_cfg_in->
2379                                         chan_list[chan_idx].scan_time;
2380                         } else {
2381                                 scan_dur = (scan_type ==
2382                                             MWIFIEX_SCAN_TYPE_PASSIVE) ?
2383                                             priv->adapter->passive_scan_time :
2384                                             priv->adapter->specific_scan_time;
2385                         }
2386
2387                         temp_chan->min_scan_time = cpu_to_le16(scan_dur);
2388                         temp_chan->max_scan_time = cpu_to_le16(scan_dur);
2389                 }
2390         } else {
2391                 dev_dbg(priv->adapter->dev,
2392                         "info: bgscan: Creating full region channel list\n");
2393                 chan_num =
2394                         mwifiex_bgscan_create_channel_list(priv, bgscan_cfg_in,
2395                                                            chan_list_tlv->
2396                                                            chan_scan_param);
2397                 le16_add_cpu(&chan_list_tlv->header.len,
2398                              chan_num *
2399                              sizeof(chan_list_tlv->chan_scan_param[0]));
2400         }
2401
2402         tlv_pos += (sizeof(chan_list_tlv->header)
2403                         + le16_to_cpu(chan_list_tlv->header.len));
2404
2405         if (bgscan_cfg_in->start_later) {
2406                 start_later_tlv =
2407                         (struct mwifiex_ie_types_bgscan_start_later *)tlv_pos;
2408                 start_later_tlv->header.type =
2409                         cpu_to_le16(TLV_TYPE_BGSCAN_START_LATER);
2410                 start_later_tlv->header.len =
2411                         cpu_to_le16(sizeof(start_later_tlv->start_later));
2412                 start_later_tlv->start_later =
2413                         cpu_to_le16(bgscan_cfg_in->start_later);
2414
2415                 tlv_pos += sizeof(start_later_tlv->header) +
2416                         le16_to_cpu(start_later_tlv->header.len);
2417         }
2418
2419         /* Append vendor specific IE TLV */
2420         mwifiex_cmd_append_vsie_tlv(priv, MWIFIEX_VSIE_MASK_BGSCAN, &tlv_pos);
2421
2422         le16_add_cpu(&cmd->size, tlv_pos - bgscan_config->tlv);
2423
2424         return 0;
2425 }
2426
2427 int mwifiex_stop_bg_scan(struct mwifiex_private *priv)
2428 {
2429         struct mwifiex_bg_scan_cfg *bgscan_cfg;
2430
2431         if (!priv->sched_scanning) {
2432                 dev_dbg(priv->adapter->dev, "bgscan already stopped!\n");
2433                 return 0;
2434         }
2435
2436         bgscan_cfg = kzalloc(sizeof(*bgscan_cfg), GFP_KERNEL);
2437         if (!bgscan_cfg)
2438                 return -ENOMEM;
2439
2440         bgscan_cfg->bss_type = MWIFIEX_BSS_MODE_INFRA;
2441         bgscan_cfg->action = MWIFIEX_BGSCAN_ACT_SET;
2442         bgscan_cfg->enable = false;
2443
2444         if (mwifiex_send_cmd(priv, HostCmd_CMD_802_11_BG_SCAN_CONFIG,
2445                              HostCmd_ACT_GEN_SET, 0, bgscan_cfg, true)) {
2446                 kfree(bgscan_cfg);
2447                 return -EFAULT;
2448         }
2449
2450         kfree(bgscan_cfg);
2451         priv->sched_scanning = false;
2452
2453         return 0;
2454 }
2455
2456 static void
2457 mwifiex_update_chan_statistics(struct mwifiex_private *priv,
2458                                struct mwifiex_ietypes_chanstats *tlv_stat)
2459 {
2460         struct mwifiex_adapter *adapter = priv->adapter;
2461         u8 i, num_chan;
2462         struct mwifiex_fw_chan_stats *fw_chan_stats;
2463         struct mwifiex_chan_stats chan_stats;
2464
2465         fw_chan_stats = (void *)((u8 *)tlv_stat +
2466                               sizeof(struct mwifiex_ie_types_header));
2467         num_chan = le16_to_cpu(tlv_stat->header.len) /
2468                                               sizeof(struct mwifiex_chan_stats);
2469
2470         for (i = 0 ; i < num_chan; i++) {
2471                 chan_stats.chan_num = fw_chan_stats->chan_num;
2472                 chan_stats.bandcfg = fw_chan_stats->bandcfg;
2473                 chan_stats.flags = fw_chan_stats->flags;
2474                 chan_stats.noise = fw_chan_stats->noise;
2475                 chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
2476                 chan_stats.cca_scan_dur =
2477                                        le16_to_cpu(fw_chan_stats->cca_scan_dur);
2478                 chan_stats.cca_busy_dur =
2479                                        le16_to_cpu(fw_chan_stats->cca_busy_dur);
2480                 mwifiex_dbg(adapter, INFO,
2481                             "chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
2482                             chan_stats.chan_num,
2483                             chan_stats.noise,
2484                             chan_stats.total_bss,
2485                             chan_stats.cca_scan_dur,
2486                             chan_stats.cca_busy_dur);
2487                 memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
2488                        sizeof(struct mwifiex_chan_stats));
2489                 fw_chan_stats++;
2490         }
2491 }
2492
2493 /* This function handles the command response of extended scan */
2494 int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
2495                                 struct host_cmd_ds_command *resp)
2496 {
2497         struct mwifiex_adapter *adapter = priv->adapter;
2498         struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
2499         struct mwifiex_ie_types_header *tlv;
2500         struct mwifiex_ietypes_chanstats *tlv_stat;
2501         u16 buf_left, type, len;
2502
2503         struct host_cmd_ds_command *cmd_ptr;
2504         struct cmd_ctrl_node *cmd_node;
2505         unsigned long cmd_flags, scan_flags;
2506         bool complete_scan = false;
2507
2508         mwifiex_dbg(adapter, INFO, "info: EXT scan returns successfully\n");
2509
2510         ext_scan_resp = &resp->params.ext_scan;
2511
2512         tlv = (void *)ext_scan_resp->tlv_buffer;
2513         buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN
2514                                               - 1);
2515
2516         while (buf_left >= sizeof(struct mwifiex_ie_types_header)) {
2517                 type = le16_to_cpu(tlv->type);
2518                 len = le16_to_cpu(tlv->len);
2519
2520                 if (buf_left < (sizeof(struct mwifiex_ie_types_header) + len)) {
2521                         mwifiex_dbg(adapter, ERROR,
2522                                     "error processing scan response TLVs");
2523                         break;
2524                 }
2525
2526                 switch (type) {
2527                 case TLV_TYPE_CHANNEL_STATS:
2528                         tlv_stat = (void *)tlv;
2529                         mwifiex_update_chan_statistics(priv, tlv_stat);
2530                         break;
2531                 default:
2532                         break;
2533                 }
2534
2535                 buf_left -= len + sizeof(struct mwifiex_ie_types_header);
2536                 tlv = (void *)((u8 *)tlv + len +
2537                                sizeof(struct mwifiex_ie_types_header));
2538         }
2539
2540         spin_lock_irqsave(&adapter->cmd_pending_q_lock, cmd_flags);
2541         spin_lock_irqsave(&adapter->scan_pending_q_lock, scan_flags);
2542         if (list_empty(&adapter->scan_pending_q)) {
2543                 complete_scan = true;
2544                 list_for_each_entry(cmd_node, &adapter->cmd_pending_q, list) {
2545                         cmd_ptr = (void *)cmd_node->cmd_skb->data;
2546                         if (le16_to_cpu(cmd_ptr->command) ==
2547                             HostCmd_CMD_802_11_SCAN_EXT) {
2548                                 mwifiex_dbg(adapter, INFO,
2549                                             "Scan pending in command pending list");
2550                                 complete_scan = false;
2551                                 break;
2552                         }
2553                 }
2554         }
2555         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, scan_flags);
2556         spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, cmd_flags);
2557
2558         if (complete_scan)
2559                 mwifiex_complete_scan(priv);
2560
2561         return 0;
2562 }
2563
2564 /* This function This function handles the event extended scan report. It
2565  * parses extended scan results and informs to cfg80211 stack.
2566  */
2567 int mwifiex_handle_event_ext_scan_report(struct mwifiex_private *priv,
2568                                          void *buf)
2569 {
2570         int ret = 0;
2571         struct mwifiex_adapter *adapter = priv->adapter;
2572         u8 *bss_info;
2573         u32 bytes_left, bytes_left_for_tlv, idx;
2574         u16 type, len;
2575         struct mwifiex_ie_types_data *tlv;
2576         struct mwifiex_ie_types_bss_scan_rsp *scan_rsp_tlv;
2577         struct mwifiex_ie_types_bss_scan_info *scan_info_tlv;
2578         u8 *radio_type;
2579         u64 fw_tsf = 0;
2580         s32 rssi = 0;
2581         struct mwifiex_event_scan_result *event_scan = buf;
2582         u8 num_of_set = event_scan->num_of_set;
2583         u8 *scan_resp = buf + sizeof(struct mwifiex_event_scan_result);
2584         u16 scan_resp_size = le16_to_cpu(event_scan->buf_size);
2585
2586         if (num_of_set > MWIFIEX_MAX_AP) {
2587                 mwifiex_dbg(adapter, ERROR,
2588                             "EXT_SCAN: Invalid number of AP returned (%d)!!\n",
2589                             num_of_set);
2590                 ret = -1;
2591                 goto check_next_scan;
2592         }
2593
2594         bytes_left = scan_resp_size;
2595         mwifiex_dbg(adapter, INFO,
2596                     "EXT_SCAN: size %d, returned %d APs...",
2597                     scan_resp_size, num_of_set);
2598         mwifiex_dbg_dump(adapter, CMD_D, "EXT_SCAN buffer:", buf,
2599                          scan_resp_size +
2600                          sizeof(struct mwifiex_event_scan_result));
2601
2602         tlv = (struct mwifiex_ie_types_data *)scan_resp;
2603
2604         for (idx = 0; idx < num_of_set && bytes_left; idx++) {
2605                 type = le16_to_cpu(tlv->header.type);
2606                 len = le16_to_cpu(tlv->header.len);
2607                 if (bytes_left < sizeof(struct mwifiex_ie_types_header) + len) {
2608                         mwifiex_dbg(adapter, ERROR,
2609                                     "EXT_SCAN: Error bytes left < TLV length\n");
2610                         break;
2611                 }
2612                 scan_rsp_tlv = NULL;
2613                 scan_info_tlv = NULL;
2614                 bytes_left_for_tlv = bytes_left;
2615
2616                 /* BSS response TLV with beacon or probe response buffer
2617                  * at the initial position of each descriptor
2618                  */
2619                 if (type != TLV_TYPE_BSS_SCAN_RSP)
2620                         break;
2621
2622                 bss_info = (u8 *)tlv;
2623                 scan_rsp_tlv = (struct mwifiex_ie_types_bss_scan_rsp *)tlv;
2624                 tlv = (struct mwifiex_ie_types_data *)(tlv->data + len);
2625                 bytes_left_for_tlv -=
2626                                 (len + sizeof(struct mwifiex_ie_types_header));
2627
2628                 while (bytes_left_for_tlv >=
2629                        sizeof(struct mwifiex_ie_types_header) &&
2630                        le16_to_cpu(tlv->header.type) != TLV_TYPE_BSS_SCAN_RSP) {
2631                         type = le16_to_cpu(tlv->header.type);
2632                         len = le16_to_cpu(tlv->header.len);
2633                         if (bytes_left_for_tlv <
2634                             sizeof(struct mwifiex_ie_types_header) + len) {
2635                                 mwifiex_dbg(adapter, ERROR,
2636                                             "EXT_SCAN: Error in processing TLV,\t"
2637                                             "bytes left < TLV length\n");
2638                                 scan_rsp_tlv = NULL;
2639                                 bytes_left_for_tlv = 0;
2640                                 continue;
2641                         }
2642                         switch (type) {
2643                         case TLV_TYPE_BSS_SCAN_INFO:
2644                                 scan_info_tlv =
2645                                   (struct mwifiex_ie_types_bss_scan_info *)tlv;
2646                                 if (len !=
2647                                  sizeof(struct mwifiex_ie_types_bss_scan_info) -
2648                                  sizeof(struct mwifiex_ie_types_header)) {
2649                                         bytes_left_for_tlv = 0;
2650                                         continue;
2651                                 }
2652                                 break;
2653                         default:
2654                                 break;
2655                         }
2656                         tlv = (struct mwifiex_ie_types_data *)(tlv->data + len);
2657                         bytes_left -=
2658                                 (len + sizeof(struct mwifiex_ie_types_header));
2659                         bytes_left_for_tlv -=
2660                                 (len + sizeof(struct mwifiex_ie_types_header));
2661                 }
2662
2663                 if (!scan_rsp_tlv)
2664                         break;
2665
2666                 /* Advance pointer to the beacon buffer length and
2667                  * update the bytes count so that the function
2668                  * wlan_interpret_bss_desc_with_ie() can handle the
2669                  * scan buffer withut any change
2670                  */
2671                 bss_info += sizeof(u16);
2672                 bytes_left -= sizeof(u16);
2673
2674                 if (scan_info_tlv) {
2675                         rssi = (s32)(s16)(le16_to_cpu(scan_info_tlv->rssi));
2676                         rssi *= 100;           /* Convert dBm to mBm */
2677                         mwifiex_dbg(adapter, INFO,
2678                                     "info: InterpretIE: RSSI=%d\n", rssi);
2679                         fw_tsf = le64_to_cpu(scan_info_tlv->tsf);
2680                         radio_type = &scan_info_tlv->radio_type;
2681                 } else {
2682                         radio_type = NULL;
2683                 }
2684                 ret = mwifiex_parse_single_response_buf(priv, &bss_info,
2685                                                         &bytes_left, fw_tsf,
2686                                                         radio_type, true, rssi);
2687                 if (ret)
2688                         goto check_next_scan;
2689         }
2690
2691 check_next_scan:
2692         if (!event_scan->more_event)
2693                 mwifiex_check_next_scan_command(priv);
2694
2695         return ret;
2696 }
2697
2698 /*
2699  * This function prepares command for background scan query.
2700  *
2701  * Preparation includes -
2702  *      - Setting command ID and proper size
2703  *      - Setting background scan flush parameter
2704  *      - Ensuring correct endian-ness
2705  */
2706 int mwifiex_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
2707 {
2708         struct host_cmd_ds_802_11_bg_scan_query *bg_query =
2709                 &cmd->params.bg_scan_query;
2710
2711         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_QUERY);
2712         cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_bg_scan_query)
2713                                 + S_DS_GEN);
2714
2715         bg_query->flush = 1;
2716
2717         return 0;
2718 }
2719
2720 /*
2721  * This function inserts scan command node to the scan pending queue.
2722  */
2723 void
2724 mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
2725                        struct cmd_ctrl_node *cmd_node)
2726 {
2727         struct mwifiex_adapter *adapter = priv->adapter;
2728         unsigned long flags;
2729
2730         cmd_node->wait_q_enabled = true;
2731         cmd_node->condition = &adapter->scan_wait_q_woken;
2732         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
2733         list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
2734         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
2735 }
2736
2737 /*
2738  * This function sends a scan command for all available channels to the
2739  * firmware, filtered on a specific SSID.
2740  */
2741 static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
2742                                       struct cfg80211_ssid *req_ssid)
2743 {
2744         struct mwifiex_adapter *adapter = priv->adapter;
2745         int ret;
2746         struct mwifiex_user_scan_cfg *scan_cfg;
2747
2748         if (adapter->scan_processing) {
2749                 mwifiex_dbg(adapter, WARN,
2750                             "cmd: Scan already in process...\n");
2751                 return -EBUSY;
2752         }
2753
2754         if (priv->scan_block) {
2755                 mwifiex_dbg(adapter, WARN,
2756                             "cmd: Scan is blocked during association...\n");
2757                 return -EBUSY;
2758         }
2759
2760         scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg), GFP_KERNEL);
2761         if (!scan_cfg)
2762                 return -ENOMEM;
2763
2764         scan_cfg->ssid_list = req_ssid;
2765         scan_cfg->num_ssids = 1;
2766
2767         ret = mwifiex_scan_networks(priv, scan_cfg);
2768
2769         kfree(scan_cfg);
2770         return ret;
2771 }
2772
2773 /*
2774  * Sends IOCTL request to start a scan.
2775  *
2776  * This function allocates the IOCTL request buffer, fills it
2777  * with requisite parameters and calls the IOCTL handler.
2778  *
2779  * Scan command can be issued for both normal scan and specific SSID
2780  * scan, depending upon whether an SSID is provided or not.
2781  */
2782 int mwifiex_request_scan(struct mwifiex_private *priv,
2783                          struct cfg80211_ssid *req_ssid)
2784 {
2785         int ret;
2786
2787         if (down_interruptible(&priv->async_sem)) {
2788                 mwifiex_dbg(priv->adapter, ERROR,
2789                             "%s: acquire semaphore fail\n",
2790                             __func__);
2791                 return -1;
2792         }
2793
2794         priv->adapter->scan_wait_q_woken = false;
2795
2796         if (req_ssid && req_ssid->ssid_len != 0)
2797                 /* Specific SSID scan */
2798                 ret = mwifiex_scan_specific_ssid(priv, req_ssid);
2799         else
2800                 /* Normal scan */
2801                 ret = mwifiex_scan_networks(priv, NULL);
2802
2803         up(&priv->async_sem);
2804
2805         return ret;
2806 }
2807
2808 /*
2809  * This function appends the vendor specific IE TLV to a buffer.
2810  */
2811 int
2812 mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,
2813                             u16 vsie_mask, u8 **buffer)
2814 {
2815         int id, ret_len = 0;
2816         struct mwifiex_ie_types_vendor_param_set *vs_param_set;
2817
2818         if (!buffer)
2819                 return 0;
2820         if (!(*buffer))
2821                 return 0;
2822
2823         /*
2824          * Traverse through the saved vendor specific IE array and append
2825          * the selected(scan/assoc/adhoc) IE as TLV to the command
2826          */
2827         for (id = 0; id < MWIFIEX_MAX_VSIE_NUM; id++) {
2828                 if (priv->vs_ie[id].mask & vsie_mask) {
2829                         vs_param_set =
2830                                 (struct mwifiex_ie_types_vendor_param_set *)
2831                                 *buffer;
2832                         vs_param_set->header.type =
2833                                 cpu_to_le16(TLV_TYPE_PASSTHROUGH);
2834                         vs_param_set->header.len =
2835                                 cpu_to_le16((((u16) priv->vs_ie[id].ie[1])
2836                                 & 0x00FF) + 2);
2837                         memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
2838                                le16_to_cpu(vs_param_set->header.len));
2839                         *buffer += le16_to_cpu(vs_param_set->header.len) +
2840                                    sizeof(struct mwifiex_ie_types_header);
2841                         ret_len += le16_to_cpu(vs_param_set->header.len) +
2842                                    sizeof(struct mwifiex_ie_types_header);
2843                 }
2844         }
2845         return ret_len;
2846 }
2847
2848 /*
2849  * This function saves a beacon buffer of the current BSS descriptor.
2850  *
2851  * The current beacon buffer is saved so that it can be restored in the
2852  * following cases that makes the beacon buffer not to contain the current
2853  * ssid's beacon buffer.
2854  *      - The current ssid was not found somehow in the last scan.
2855  *      - The current ssid was the last entry of the scan table and overloaded.
2856  */
2857 void
2858 mwifiex_save_curr_bcn(struct mwifiex_private *priv)
2859 {
2860         struct mwifiex_bssdescriptor *curr_bss =
2861                 &priv->curr_bss_params.bss_descriptor;
2862
2863         if (!curr_bss->beacon_buf_size)
2864                 return;
2865
2866         /* allocate beacon buffer at 1st time; or if it's size has changed */
2867         if (!priv->curr_bcn_buf ||
2868             priv->curr_bcn_size != curr_bss->beacon_buf_size) {
2869                 priv->curr_bcn_size = curr_bss->beacon_buf_size;
2870
2871                 kfree(priv->curr_bcn_buf);
2872                 priv->curr_bcn_buf = kmalloc(curr_bss->beacon_buf_size,
2873                                              GFP_ATOMIC);
2874                 if (!priv->curr_bcn_buf)
2875                         return;
2876         }
2877
2878         memcpy(priv->curr_bcn_buf, curr_bss->beacon_buf,
2879                curr_bss->beacon_buf_size);
2880         mwifiex_dbg(priv->adapter, INFO,
2881                     "info: current beacon saved %d\n",
2882                     priv->curr_bcn_size);
2883
2884         curr_bss->beacon_buf = priv->curr_bcn_buf;
2885
2886         /* adjust the pointers in the current BSS descriptor */
2887         if (curr_bss->bcn_wpa_ie)
2888                 curr_bss->bcn_wpa_ie =
2889                         (struct ieee_types_vendor_specific *)
2890                         (curr_bss->beacon_buf +
2891                          curr_bss->wpa_offset);
2892
2893         if (curr_bss->bcn_rsn_ie)
2894                 curr_bss->bcn_rsn_ie = (struct ieee_types_generic *)
2895                         (curr_bss->beacon_buf +
2896                          curr_bss->rsn_offset);
2897
2898         if (curr_bss->bcn_ht_cap)
2899                 curr_bss->bcn_ht_cap = (struct ieee80211_ht_cap *)
2900                         (curr_bss->beacon_buf +
2901                          curr_bss->ht_cap_offset);
2902
2903         if (curr_bss->bcn_ht_oper)
2904                 curr_bss->bcn_ht_oper = (struct ieee80211_ht_operation *)
2905                         (curr_bss->beacon_buf +
2906                          curr_bss->ht_info_offset);
2907
2908         if (curr_bss->bcn_vht_cap)
2909                 curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
2910                                                  curr_bss->vht_cap_offset);
2911
2912         if (curr_bss->bcn_vht_oper)
2913                 curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
2914                                                   curr_bss->vht_info_offset);
2915
2916         if (curr_bss->bcn_bss_co_2040)
2917                 curr_bss->bcn_bss_co_2040 =
2918                         (curr_bss->beacon_buf + curr_bss->bss_co_2040_offset);
2919
2920         if (curr_bss->bcn_ext_cap)
2921                 curr_bss->bcn_ext_cap = curr_bss->beacon_buf +
2922                         curr_bss->ext_cap_offset;
2923
2924         if (curr_bss->oper_mode)
2925                 curr_bss->oper_mode = (void *)(curr_bss->beacon_buf +
2926                                                curr_bss->oper_mode_offset);
2927 }
2928
2929 /*
2930  * This function frees the current BSS descriptor beacon buffer.
2931  */
2932 void
2933 mwifiex_free_curr_bcn(struct mwifiex_private *priv)
2934 {
2935         kfree(priv->curr_bcn_buf);
2936         priv->curr_bcn_buf = NULL;
2937 }