drivers/net/wireless/marvell/mwifiex/scan.c

   1 /*
   2  * Marvell Wireless LAN device driver: scan ioctl and command handling
   3  *
   4  * Copyright (C) 2011-2014, Marvell International Ltd.
   5  *
   6  * This software file (the "File") is distributed by Marvell International
   7  * Ltd. under the terms of the GNU General Public License Version 2, June 1991
   8  * (the "License").  You may use, redistribute and/or modify this File in
   9  * accordance with the terms and conditions of the License, a copy of which
  10  * is available by writing to the Free Software Foundation, Inc.,
  11  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
  12  * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
  13  *
  14  * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
  15  * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
  16  * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
  17  * this warranty disclaimer.
  18  */
  19
  20 #include "decl.h"
  21 #include "ioctl.h"
  22 #include "util.h"
  23 #include "fw.h"
  24 #include "main.h"
  25 #include "11n.h"
  26 #include "cfg80211.h"
  27
  28 /* The maximum number of channels the firmware can scan per command */
  29 #define MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN   14
  30
  31 #define MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD       4
  32
  33 /* Memory needed to store a max sized Channel List TLV for a firmware scan */
  34 #define CHAN_TLV_MAX_SIZE  (sizeof(struct mwifiex_ie_types_header)         \
  35                                 + (MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN     \
  36                                 *sizeof(struct mwifiex_chan_scan_param_set)))
  37
  38 /* Memory needed to store supported rate */
  39 #define RATE_TLV_MAX_SIZE   (sizeof(struct mwifiex_ie_types_rates_param_set) \
  40                                 + HOSTCMD_SUPPORTED_RATES)
  41
  42 /* Memory needed to store a max number/size WildCard SSID TLV for a firmware
  43         scan */
  44 #define WILDCARD_SSID_TLV_MAX_SIZE  \
  45         (MWIFIEX_MAX_SSID_LIST_LENGTH *                                 \
  46                 (sizeof(struct mwifiex_ie_types_wildcard_ssid_params)   \
  47                         + IEEE80211_MAX_SSID_LEN))
  48
  49 /* Maximum memory needed for a mwifiex_scan_cmd_config with all TLVs at max */
  50 #define MAX_SCAN_CFG_ALLOC (sizeof(struct mwifiex_scan_cmd_config)        \
  51                                 + sizeof(struct mwifiex_ie_types_num_probes)   \
  52                                 + sizeof(struct mwifiex_ie_types_htcap)       \
  53                                 + CHAN_TLV_MAX_SIZE                 \
  54                                 + RATE_TLV_MAX_SIZE                 \
  55                                 + WILDCARD_SSID_TLV_MAX_SIZE)
  56
  57
  58 union mwifiex_scan_cmd_config_tlv {
  59         /* Scan configuration (variable length) */
  60         struct mwifiex_scan_cmd_config config;
  61         /* Max allocated block */
  62         u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC];
  63 };
  64
  65 enum cipher_suite {
  66         CIPHER_SUITE_TKIP,
  67         CIPHER_SUITE_CCMP,
  68         CIPHER_SUITE_MAX
  69 };
  70 static u8 mwifiex_wpa_oui[CIPHER_SUITE_MAX][4] = {
  71         { 0x00, 0x50, 0xf2, 0x02 },     /* TKIP */
  72         { 0x00, 0x50, 0xf2, 0x04 },     /* AES  */
  73 };
  74 static u8 mwifiex_rsn_oui[CIPHER_SUITE_MAX][4] = {
  75         { 0x00, 0x0f, 0xac, 0x02 },     /* TKIP */
  76         { 0x00, 0x0f, 0xac, 0x04 },     /* AES  */
  77 };
  78
  79 static void
  80 _dbg_security_flags(int log_level, const char *func, const char *desc,
  81                     struct mwifiex_private *priv,
  82                     struct mwifiex_bssdescriptor *bss_desc)
  83 {
  84         _mwifiex_dbg(priv->adapter, log_level,
  85                      "info: %s: %s:\twpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s\tEncMode=%#x privacy=%#x\n",
  86                      func, desc,
  87                      bss_desc->bcn_wpa_ie ?
  88                      bss_desc->bcn_wpa_ie->vend_hdr.element_id : 0,
  89                      bss_desc->bcn_rsn_ie ?
  90                      bss_desc->bcn_rsn_ie->ieee_hdr.element_id : 0,
  91                      priv->sec_info.wep_enabled ? "e" : "d",
  92                      priv->sec_info.wpa_enabled ? "e" : "d",
  93                      priv->sec_info.wpa2_enabled ? "e" : "d",
  94                      priv->sec_info.encryption_mode,
  95                      bss_desc->privacy);
  96 }
  97 #define dbg_security_flags(mask, desc, priv, bss_desc) \
  98         _dbg_security_flags(MWIFIEX_DBG_##mask, desc, __func__, priv, bss_desc)
  99
 100 static bool
 101 has_ieee_hdr(struct ieee_types_generic *ie, u8 key)
 102 {
 103         return (ie && ie->ieee_hdr.element_id == key);
 104 }
 105
 106 static bool
 107 has_vendor_hdr(struct ieee_types_vendor_specific *ie, u8 key)
 108 {
 109         return (ie && ie->vend_hdr.element_id == key);
 110 }
 111
 112 /*
 113  * This function parses a given IE for a given OUI.
 114  *
 115  * This is used to parse a WPA/RSN IE to find if it has
 116  * a given oui in PTK.
 117  */
 118 static u8
 119 mwifiex_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
 120 {
 121         u8 count;
 122
 123         count = iebody->ptk_cnt[0];
 124
 125         /* There could be multiple OUIs for PTK hence
 126            1) Take the length.
 127            2) Check all the OUIs for AES.
 128            3) If one of them is AES then pass success. */
 129         while (count) {
 130                 if (!memcmp(iebody->ptk_body, oui, sizeof(iebody->ptk_body)))
 131                         return MWIFIEX_OUI_PRESENT;
 132
 133                 --count;
 134                 if (count)
 135                         iebody = (struct ie_body *) ((u8 *) iebody +
 136                                                 sizeof(iebody->ptk_body));
 137         }
 138
 139         pr_debug("info: %s: OUI is not found in PTK\n", __func__);
 140         return MWIFIEX_OUI_NOT_PRESENT;
 141 }
 142
 143 /*
 144  * This function checks if a given OUI is present in a RSN IE.
 145  *
 146  * The function first checks if a RSN IE is present or not in the
 147  * BSS descriptor. It tries to locate the OUI only if such an IE is
 148  * present.
 149  */
 150 static u8
 151 mwifiex_is_rsn_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 152 {
 153         u8 *oui;
 154         struct ie_body *iebody;
 155         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 156
 157         if (has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN)) {
 158                 iebody = (struct ie_body *)
 159                          (((u8 *) bss_desc->bcn_rsn_ie->data) +
 160                           RSN_GTK_OUI_OFFSET);
 161                 oui = &mwifiex_rsn_oui[cipher][0];
 162                 ret = mwifiex_search_oui_in_ie(iebody, oui);
 163                 if (ret)
 164                         return ret;
 165         }
 166         return ret;
 167 }
 168
 169 /*
 170  * This function checks if a given OUI is present in a WPA IE.
 171  *
 172  * The function first checks if a WPA IE is present or not in the
 173  * BSS descriptor. It tries to locate the OUI only if such an IE is
 174  * present.
 175  */
 176 static u8
 177 mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 178 {
 179         u8 *oui;
 180         struct ie_body *iebody;
 181         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 182
 183         if (has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)) {
 184                 iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data;
 185                 oui = &mwifiex_wpa_oui[cipher][0];
 186                 ret = mwifiex_search_oui_in_ie(iebody, oui);
 187                 if (ret)
 188                         return ret;
 189         }
 190         return ret;
 191 }
 192
 193 /*
 194  * This function compares two SSIDs and checks if they match.
 195  */
 196 s32
 197 mwifiex_ssid_cmp(struct cfg80211_ssid *ssid1, struct cfg80211_ssid *ssid2)
 198 {
 199         if (!ssid1 || !ssid2 || (ssid1->ssid_len != ssid2->ssid_len))
 200                 return -1;
 201         return memcmp(ssid1->ssid, ssid2->ssid, ssid1->ssid_len);
 202 }
 203
 204 /*
 205  * This function checks if wapi is enabled in driver and scanned network is
 206  * compatible with it.
 207  */
 208 static bool
 209 mwifiex_is_bss_wapi(struct mwifiex_private *priv,
 210                     struct mwifiex_bssdescriptor *bss_desc)
 211 {
 212         if (priv->sec_info.wapi_enabled &&
 213             has_ieee_hdr(bss_desc->bcn_wapi_ie, WLAN_EID_BSS_AC_ACCESS_DELAY))
 214                 return true;
 215         return false;
 216 }
 217
 218 /*
 219  * This function checks if driver is configured with no security mode and
 220  * scanned network is compatible with it.
 221  */
 222 static bool
 223 mwifiex_is_bss_no_sec(struct mwifiex_private *priv,
 224                       struct mwifiex_bssdescriptor *bss_desc)
 225 {
 226         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 227             !priv->sec_info.wpa2_enabled &&
 228             !has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC) &&
 229             !has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN) &&
 230             !priv->sec_info.encryption_mode && !bss_desc->privacy) {
 231                 return true;
 232         }
 233         return false;
 234 }
 235
 236 /*
 237  * This function checks if static WEP is enabled in driver and scanned network
 238  * is compatible with it.
 239  */
 240 static bool
 241 mwifiex_is_bss_static_wep(struct mwifiex_private *priv,
 242                           struct mwifiex_bssdescriptor *bss_desc)
 243 {
 244         if (priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 245             !priv->sec_info.wpa2_enabled && bss_desc->privacy) {
 246                 return true;
 247         }
 248         return false;
 249 }
 250
 251 /*
 252  * This function checks if wpa is enabled in driver and scanned network is
 253  * compatible with it.
 254  */
 255 static bool
 256 mwifiex_is_bss_wpa(struct mwifiex_private *priv,
 257                    struct mwifiex_bssdescriptor *bss_desc)
 258 {
 259         if (!priv->sec_info.wep_enabled && priv->sec_info.wpa_enabled &&
 260             !priv->sec_info.wpa2_enabled &&
 261             has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)
 262            /*
 263             * Privacy bit may NOT be set in some APs like
 264             * LinkSys WRT54G && bss_desc->privacy
 265             */
 266          ) {
 267                 dbg_security_flags(INFO, "WPA", priv, bss_desc);
 268                 return true;
 269         }
 270         return false;
 271 }
 272
 273 /*
 274  * This function checks if wpa2 is enabled in driver and scanned network is
 275  * compatible with it.
 276  */
 277 static bool
 278 mwifiex_is_bss_wpa2(struct mwifiex_private *priv,
 279                     struct mwifiex_bssdescriptor *bss_desc)
 280 {
 281         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 282             priv->sec_info.wpa2_enabled &&
 283             has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN)) {
 284                 /*
 285                  * Privacy bit may NOT be set in some APs like
 286                  * LinkSys WRT54G && bss_desc->privacy
 287                  */
 288                 dbg_security_flags(INFO, "WAP2", priv, bss_desc);
 289                 return true;
 290         }
 291         return false;
 292 }
 293
 294 /*
 295  * This function checks if adhoc AES is enabled in driver and scanned network is
 296  * compatible with it.
 297  */
 298 static bool
 299 mwifiex_is_bss_adhoc_aes(struct mwifiex_private *priv,
 300                          struct mwifiex_bssdescriptor *bss_desc)
 301 {
 302         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 303             !priv->sec_info.wpa2_enabled &&
 304             !has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC) &&
 305             !has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN) &&
 306             !priv->sec_info.encryption_mode && bss_desc->privacy) {
 307                 return true;
 308         }
 309         return false;
 310 }
 311
 312 /*
 313  * This function checks if dynamic WEP is enabled in driver and scanned network
 314  * is compatible with it.
 315  */
 316 static bool
 317 mwifiex_is_bss_dynamic_wep(struct mwifiex_private *priv,
 318                            struct mwifiex_bssdescriptor *bss_desc)
 319 {
 320         if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
 321             !priv->sec_info.wpa2_enabled &&
 322             !has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC) &&
 323             !has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN) &&
 324             priv->sec_info.encryption_mode && bss_desc->privacy) {
 325                 dbg_security_flags(INFO, "dynamic", priv, bss_desc);
 326                 return true;
 327         }
 328         return false;
 329 }
 330
 331 /*
 332  * This function checks if a scanned network is compatible with the driver
 333  * settings.
 334  *
 335  *   WEP     WPA    WPA2   ad-hoc encrypt                  Network
 336  * enabled enabled enabled  AES    mode   Privacy WPA WPA2 Compatible
 337  *    0       0       0      0     NONE      0     0   0   yes No security
 338  *    0       1       0      0      x        1x    1   x   yes WPA (disable
 339  *                                                         HT if no AES)
 340  *    0       0       1      0      x        1x    x   1   yes WPA2 (disable
 341  *                                                         HT if no AES)
 342  *    0       0       0      1     NONE      1     0   0   yes Ad-hoc AES
 343  *    1       0       0      0     NONE      1     0   0   yes Static WEP
 344  *                                                         (disable HT)
 345  *    0       0       0      0    !=NONE     1     0   0   yes Dynamic WEP
 346  *
 347  * Compatibility is not matched while roaming, except for mode.
 348  */
 349 static s32
 350 mwifiex_is_network_compatible(struct mwifiex_private *priv,
 351                               struct mwifiex_bssdescriptor *bss_desc, u32 mode)
 352 {
 353         struct mwifiex_adapter *adapter = priv->adapter;
 354
 355         bss_desc->disable_11n = false;
 356
 357         /* Don't check for compatibility if roaming */
 358         if (priv->media_connected &&
 359             (priv->bss_mode == NL80211_IFTYPE_STATION) &&
 360             (bss_desc->bss_mode == NL80211_IFTYPE_STATION))
 361                 return 0;
 362
 363         if (priv->wps.session_enable) {
 364                 mwifiex_dbg(adapter, IOCTL,
 365                             "info: return success directly in WPS period\n");
 366                 return 0;
 367         }
 368
 369         if (bss_desc->chan_sw_ie_present) {
 370                 mwifiex_dbg(adapter, INFO,
 371                             "Don't connect to AP with WLAN_EID_CHANNEL_SWITCH\n");
 372                 return -1;
 373         }
 374
 375         if (mwifiex_is_bss_wapi(priv, bss_desc)) {
 376                 mwifiex_dbg(adapter, INFO,
 377                             "info: return success for WAPI AP\n");
 378                 return 0;
 379         }
 380
 381         if (bss_desc->bss_mode == mode) {
 382                 if (mwifiex_is_bss_no_sec(priv, bss_desc)) {
 383                         /* No security */
 384                         return 0;
 385                 } else if (mwifiex_is_bss_static_wep(priv, bss_desc)) {
 386                         /* Static WEP enabled */
 387                         mwifiex_dbg(adapter, INFO,
 388                                     "info: Disable 11n in WEP mode.\n");
 389                         bss_desc->disable_11n = true;
 390                         return 0;
 391                 } else if (mwifiex_is_bss_wpa(priv, bss_desc)) {
 392                         /* WPA enabled */
 393                         if (((priv->adapter->config_bands & BAND_GN ||
 394                               priv->adapter->config_bands & BAND_AN) &&
 395                              bss_desc->bcn_ht_cap) &&
 396                             !mwifiex_is_wpa_oui_present(bss_desc,
 397                                                          CIPHER_SUITE_CCMP)) {
 398
 399                                 if (mwifiex_is_wpa_oui_present
 400                                                 (bss_desc, CIPHER_SUITE_TKIP)) {
 401                                         mwifiex_dbg(adapter, INFO,
 402                                                     "info: Disable 11n if AES\t"
 403                                                     "is not supported by AP\n");
 404                                         bss_desc->disable_11n = true;
 405                                 } else {
 406                                         return -1;
 407                                 }
 408                         }
 409                         return 0;
 410                 } else if (mwifiex_is_bss_wpa2(priv, bss_desc)) {
 411                         /* WPA2 enabled */
 412                         if (((priv->adapter->config_bands & BAND_GN ||
 413                               priv->adapter->config_bands & BAND_AN) &&
 414                              bss_desc->bcn_ht_cap) &&
 415                             !mwifiex_is_rsn_oui_present(bss_desc,
 416                                                         CIPHER_SUITE_CCMP)) {
 417
 418                                 if (mwifiex_is_rsn_oui_present
 419                                                 (bss_desc, CIPHER_SUITE_TKIP)) {
 420                                         mwifiex_dbg(adapter, INFO,
 421                                                     "info: Disable 11n if AES\t"
 422                                                     "is not supported by AP\n");
 423                                         bss_desc->disable_11n = true;
 424                                 } else {
 425                                         return -1;
 426                                 }
 427                         }
 428                         return 0;
 429                 } else if (mwifiex_is_bss_adhoc_aes(priv, bss_desc)) {
 430                         /* Ad-hoc AES enabled */
 431                         return 0;
 432                 } else if (mwifiex_is_bss_dynamic_wep(priv, bss_desc)) {
 433                         /* Dynamic WEP enabled */
 434                         return 0;
 435                 }
 436
 437                 /* Security doesn't match */
 438                 dbg_security_flags(ERROR, "failed", priv, bss_desc);
 439                 return -1;
 440         }
 441
 442         /* Mode doesn't match */
 443         return -1;
 444 }
 445
 446 /*
 447  * This function creates a channel list for the driver to scan, based
 448  * on region/band information.
 449  *
 450  * This routine is used for any scan that is not provided with a
 451  * specific channel list to scan.
 452  */
 453 static int
 454 mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
 455                                  const struct mwifiex_user_scan_cfg
 456                                                         *user_scan_in,
 457                                  struct mwifiex_chan_scan_param_set
 458                                                         *scan_chan_list,
 459                                  u8 filtered_scan)
 460 {
 461         enum nl80211_band band;
 462         struct ieee80211_supported_band *sband;
 463         struct ieee80211_channel *ch;
 464         struct mwifiex_adapter *adapter = priv->adapter;
 465         int chan_idx = 0, i;
 466
 467         for (band = 0; (band < NUM_NL80211_BANDS) ; band++) {
 468
 469                 if (!priv->wdev.wiphy->bands[band])
 470                         continue;
 471
 472                 sband = priv->wdev.wiphy->bands[band];
 473
 474                 for (i = 0; (i < sband->n_channels) ; i++) {
 475                         ch = &sband->channels[i];
 476                         if (ch->flags & IEEE80211_CHAN_DISABLED)
 477                                 continue;
 478                         scan_chan_list[chan_idx].radio_type = band;
 479
 480                         if (user_scan_in &&
 481                             user_scan_in->chan_list[0].scan_time)
 482                                 scan_chan_list[chan_idx].max_scan_time =
 483                                         cpu_to_le16((u16) user_scan_in->
 484                                         chan_list[0].scan_time);
 485                         else if (ch->flags & IEEE80211_CHAN_NO_IR)
 486                                 scan_chan_list[chan_idx].max_scan_time =
 487                                         cpu_to_le16(adapter->passive_scan_time);
 488                         else
 489                                 scan_chan_list[chan_idx].max_scan_time =
 490                                         cpu_to_le16(adapter->active_scan_time);
 491
 492                         if (ch->flags & IEEE80211_CHAN_NO_IR)
 493                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 494                                         |= (MWIFIEX_PASSIVE_SCAN |
 495                                             MWIFIEX_HIDDEN_SSID_REPORT);
 496                         else
 497                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 498                                         &= ~MWIFIEX_PASSIVE_SCAN;
 499                         scan_chan_list[chan_idx].chan_number =
 500                                                         (u32) ch->hw_value;
 501
 502                         scan_chan_list[chan_idx].chan_scan_mode_bitmap
 503                                         |= MWIFIEX_DISABLE_CHAN_FILT;
 504
 505                         if (filtered_scan) {
 506                                 scan_chan_list[chan_idx].max_scan_time =
 507                                 cpu_to_le16(adapter->specific_scan_time);
 508                         }
 509                         chan_idx++;
 510                 }
 511
 512         }
 513         return chan_idx;
 514 }
 515
 516 /* This function creates a channel list tlv for bgscan config, based
 517  * on region/band information.
 518  */
 519 static int
 520 mwifiex_bgscan_create_channel_list(struct mwifiex_private *priv,
 521                                    const struct mwifiex_bg_scan_cfg
 522                                                 *bgscan_cfg_in,
 523                                    struct mwifiex_chan_scan_param_set
 524                                                 *scan_chan_list)
 525 {
 526         enum nl80211_band band;
 527         struct ieee80211_supported_band *sband;
 528         struct ieee80211_channel *ch;
 529         struct mwifiex_adapter *adapter = priv->adapter;
 530         int chan_idx = 0, i;
 531
 532         for (band = 0; (band < NUM_NL80211_BANDS); band++) {
 533                 if (!priv->wdev.wiphy->bands[band])
 534                         continue;
 535
 536                 sband = priv->wdev.wiphy->bands[band];
 537
 538                 for (i = 0; (i < sband->n_channels) ; i++) {
 539                         ch = &sband->channels[i];
 540                         if (ch->flags & IEEE80211_CHAN_DISABLED)
 541                                 continue;
 542                         scan_chan_list[chan_idx].radio_type = band;
 543
 544                         if (bgscan_cfg_in->chan_list[0].scan_time)
 545                                 scan_chan_list[chan_idx].max_scan_time =
 546                                         cpu_to_le16((u16)bgscan_cfg_in->
 547                                         chan_list[0].scan_time);
 548                         else if (ch->flags & IEEE80211_CHAN_NO_IR)
 549                                 scan_chan_list[chan_idx].max_scan_time =
 550                                         cpu_to_le16(adapter->passive_scan_time);
 551                         else
 552                                 scan_chan_list[chan_idx].max_scan_time =
 553                                         cpu_to_le16(adapter->
 554                                                     specific_scan_time);
 555
 556                         if (ch->flags & IEEE80211_CHAN_NO_IR)
 557                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 558                                         |= MWIFIEX_PASSIVE_SCAN;
 559                         else
 560                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
 561                                         &= ~MWIFIEX_PASSIVE_SCAN;
 562
 563                         scan_chan_list[chan_idx].chan_number =
 564                                                         (u32)ch->hw_value;
 565                         chan_idx++;
 566                 }
 567         }
 568         return chan_idx;
 569 }
 570
 571 /* This function appends rate TLV to scan config command. */
 572 static int
 573 mwifiex_append_rate_tlv(struct mwifiex_private *priv,
 574                         struct mwifiex_scan_cmd_config *scan_cfg_out,
 575                         u8 radio)
 576 {
 577         struct mwifiex_ie_types_rates_param_set *rates_tlv;
 578         u8 rates[MWIFIEX_SUPPORTED_RATES], *tlv_pos;
 579         u32 rates_size;
 580
 581         memset(rates, 0, sizeof(rates));
 582
 583         tlv_pos = (u8 *)scan_cfg_out->tlv_buf + scan_cfg_out->tlv_buf_len;
 584
 585         if (priv->scan_request)
 586                 rates_size = mwifiex_get_rates_from_cfg80211(priv, rates,
 587                                                              radio);
 588         else
 589                 rates_size = mwifiex_get_supported_rates(priv, rates);
 590
 591         mwifiex_dbg(priv->adapter, CMD,
 592                     "info: SCAN_CMD: Rates size = %d\n",
 593                 rates_size);
 594         rates_tlv = (struct mwifiex_ie_types_rates_param_set *)tlv_pos;
 595         rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
 596         rates_tlv->header.len = cpu_to_le16((u16) rates_size);
 597         memcpy(rates_tlv->rates, rates, rates_size);
 598         scan_cfg_out->tlv_buf_len += sizeof(rates_tlv->header) + rates_size;
 599
 600         return rates_size;
 601 }
 602
 603 /*
 604  * This function constructs and sends multiple scan config commands to
 605  * the firmware.
 606  *
 607  * Previous routines in the code flow have created a scan command configuration
 608  * with any requested TLVs.  This function splits the channel TLV into maximum
 609  * channels supported per scan lists and sends the portion of the channel TLV,
 610  * along with the other TLVs, to the firmware.
 611  */
 612 static int
 613 mwifiex_scan_channel_list(struct mwifiex_private *priv,
 614                           u32 max_chan_per_scan, u8 filtered_scan,
 615                           struct mwifiex_scan_cmd_config *scan_cfg_out,
 616                           struct mwifiex_ie_types_chan_list_param_set
 617                           *chan_tlv_out,
 618                           struct mwifiex_chan_scan_param_set *scan_chan_list)
 619 {
 620         struct mwifiex_adapter *adapter = priv->adapter;
 621         int ret = 0;
 622         struct mwifiex_chan_scan_param_set *tmp_chan_list;
 623         struct mwifiex_chan_scan_param_set *start_chan;
 624         u32 tlv_idx, rates_size, cmd_no;
 625         u32 total_scan_time;
 626         u32 done_early;
 627         u8 radio_type;
 628
 629         if (!scan_cfg_out || !chan_tlv_out || !scan_chan_list) {
 630                 mwifiex_dbg(priv->adapter, ERROR,
 631                             "info: Scan: Null detect: %p, %p, %p\n",
 632                             scan_cfg_out, chan_tlv_out, scan_chan_list);
 633                 return -1;
 634         }
 635
 636         /* Check csa channel expiry before preparing scan list */
 637         mwifiex_11h_get_csa_closed_channel(priv);
 638
 639         chan_tlv_out->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
 640
 641         /* Set the temp channel struct pointer to the start of the desired
 642            list */
 643         tmp_chan_list = scan_chan_list;
 644
 645         /* Loop through the desired channel list, sending a new firmware scan
 646            commands for each max_chan_per_scan channels (or for 1,6,11
 647            individually if configured accordingly) */
 648         while (tmp_chan_list->chan_number) {
 649
 650                 tlv_idx = 0;
 651                 total_scan_time = 0;
 652                 radio_type = 0;
 653                 chan_tlv_out->header.len = 0;
 654                 start_chan = tmp_chan_list;
 655                 done_early = false;
 656
 657                 /*
 658                  * Construct the Channel TLV for the scan command.  Continue to
 659                  * insert channel TLVs until:
 660                  *   - the tlv_idx hits the maximum configured per scan command
 661                  *   - the next channel to insert is 0 (end of desired channel
 662                  *     list)
 663                  *   - done_early is set (controlling individual scanning of
 664                  *     1,6,11)
 665                  */
 666                 while (tlv_idx < max_chan_per_scan &&
 667                        tmp_chan_list->chan_number && !done_early) {
 668
 669                         if (tmp_chan_list->chan_number == priv->csa_chan) {
 670                                 tmp_chan_list++;
 671                                 continue;
 672                         }
 673
 674                         radio_type = tmp_chan_list->radio_type;
 675                         mwifiex_dbg(priv->adapter, INFO,
 676                                     "info: Scan: Chan(%3d), Radio(%d),\t"
 677                                     "Mode(%d, %d), Dur(%d)\n",
 678                                     tmp_chan_list->chan_number,
 679                                     tmp_chan_list->radio_type,
 680                                     tmp_chan_list->chan_scan_mode_bitmap
 681                                     & MWIFIEX_PASSIVE_SCAN,
 682                                     (tmp_chan_list->chan_scan_mode_bitmap
 683                                     & MWIFIEX_DISABLE_CHAN_FILT) >> 1,
 684                                     le16_to_cpu(tmp_chan_list->max_scan_time));
 685
 686                         /* Copy the current channel TLV to the command being
 687                            prepared */
 688                         memcpy(chan_tlv_out->chan_scan_param + tlv_idx,
 689                                tmp_chan_list,
 690                                sizeof(chan_tlv_out->chan_scan_param));
 691
 692                         /* Increment the TLV header length by the size
 693                            appended */
 694                         le16_unaligned_add_cpu(&chan_tlv_out->header.len,
 695                                                sizeof(
 696                                                 chan_tlv_out->chan_scan_param));
 697
 698                         /*
 699                          * The tlv buffer length is set to the number of bytes
 700                          * of the between the channel tlv pointer and the start
 701                          * of the tlv buffer.  This compensates for any TLVs
 702                          * that were appended before the channel list.
 703                          */
 704                         scan_cfg_out->tlv_buf_len = (u32) ((u8 *) chan_tlv_out -
 705                                                         scan_cfg_out->tlv_buf);
 706
 707                         /* Add the size of the channel tlv header and the data
 708                            length */
 709                         scan_cfg_out->tlv_buf_len +=
 710                                 (sizeof(chan_tlv_out->header)
 711                                  + le16_to_cpu(chan_tlv_out->header.len));
 712
 713                         /* Increment the index to the channel tlv we are
 714                            constructing */
 715                         tlv_idx++;
 716
 717                         /* Count the total scan time per command */
 718                         total_scan_time +=
 719                                 le16_to_cpu(tmp_chan_list->max_scan_time);
 720
 721                         done_early = false;
 722
 723                         /* Stop the loop if the *current* channel is in the
 724                            1,6,11 set and we are not filtering on a BSSID
 725                            or SSID. */
 726                         if (!filtered_scan &&
 727                             (tmp_chan_list->chan_number == 1 ||
 728                              tmp_chan_list->chan_number == 6 ||
 729                              tmp_chan_list->chan_number == 11))
 730                                 done_early = true;
 731
 732                         /* Increment the tmp pointer to the next channel to
 733                            be scanned */
 734                         tmp_chan_list++;
 735
 736                         /* Stop the loop if the *next* channel is in the 1,6,11
 737                            set.  This will cause it to be the only channel
 738                            scanned on the next interation */
 739                         if (!filtered_scan &&
 740                             (tmp_chan_list->chan_number == 1 ||
 741                              tmp_chan_list->chan_number == 6 ||
 742                              tmp_chan_list->chan_number == 11))
 743                                 done_early = true;
 744                 }
 745
 746                 /* The total scan time should be less than scan command timeout
 747                    value */
 748                 if (total_scan_time > MWIFIEX_MAX_TOTAL_SCAN_TIME) {
 749                         mwifiex_dbg(priv->adapter, ERROR,
 750                                     "total scan time %dms\t"
 751                                     "is over limit (%dms), scan skipped\n",
 752                                     total_scan_time,
 753                                     MWIFIEX_MAX_TOTAL_SCAN_TIME);
 754                         ret = -1;
 755                         break;
 756                 }
 757
 758                 rates_size = mwifiex_append_rate_tlv(priv, scan_cfg_out,
 759                                                      radio_type);
 760
 761                 priv->adapter->scan_channels = start_chan;
 762
 763                 /* Send the scan command to the firmware with the specified
 764                    cfg */
 765                 if (priv->adapter->ext_scan)
 766                         cmd_no = HostCmd_CMD_802_11_SCAN_EXT;
 767                 else
 768                         cmd_no = HostCmd_CMD_802_11_SCAN;
 769
 770                 ret = mwifiex_send_cmd(priv, cmd_no, HostCmd_ACT_GEN_SET,
 771                                        0, scan_cfg_out, false);
 772
 773                 /* rate IE is updated per scan command but same starting
 774                  * pointer is used each time so that rate IE from earlier
 775                  * scan_cfg_out->buf is overwritten with new one.
 776                  */
 777                 scan_cfg_out->tlv_buf_len -=
 778                             sizeof(struct mwifiex_ie_types_header) + rates_size;
 779
 780                 if (ret) {
 781                         mwifiex_cancel_pending_scan_cmd(adapter);
 782                         break;
 783                 }
 784         }
 785
 786         if (ret)
 787                 return -1;
 788
 789         return 0;
 790 }
 791
 792 /*
 793  * This function constructs a scan command configuration structure to use
 794  * in scan commands.
 795  *
 796  * Application layer or other functions can invoke network scanning
 797  * with a scan configuration supplied in a user scan configuration structure.
 798  * This structure is used as the basis of one or many scan command configuration
 799  * commands that are sent to the command processing module and eventually to the
 800  * firmware.
 801  *
 802  * This function creates a scan command configuration structure  based on the
 803  * following user supplied parameters (if present):
 804  *      - SSID filter
 805  *      - BSSID filter
 806  *      - Number of Probes to be sent
 807  *      - Channel list
 808  *
 809  * If the SSID or BSSID filter is not present, the filter is disabled/cleared.
 810  * If the number of probes is not set, adapter default setting is used.
 811  */
 812 static void
 813 mwifiex_config_scan(struct mwifiex_private *priv,
 814                     const struct mwifiex_user_scan_cfg *user_scan_in,
 815                     struct mwifiex_scan_cmd_config *scan_cfg_out,
 816                     struct mwifiex_ie_types_chan_list_param_set **chan_list_out,
 817                     struct mwifiex_chan_scan_param_set *scan_chan_list,
 818                     u8 *max_chan_per_scan, u8 *filtered_scan,
 819                     u8 *scan_current_only)
 820 {
 821         struct mwifiex_adapter *adapter = priv->adapter;
 822         struct mwifiex_ie_types_num_probes *num_probes_tlv;
 823         struct mwifiex_ie_types_scan_chan_gap *chan_gap_tlv;
 824         struct mwifiex_ie_types_random_mac *random_mac_tlv;
 825         struct mwifiex_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
 826         struct mwifiex_ie_types_bssid_list *bssid_tlv;
 827         u8 *tlv_pos;
 828         u32 num_probes;
 829         u32 ssid_len;
 830         u32 chan_idx;
 831         u32 scan_type;
 832         u16 scan_dur;
 833         u8 channel;
 834         u8 radio_type;
 835         int i;
 836         u8 ssid_filter;
 837         struct mwifiex_ie_types_htcap *ht_cap;
 838         struct mwifiex_ie_types_bss_mode *bss_mode;
 839         const u8 zero_mac[6] = {0, 0, 0, 0, 0, 0};
 840
 841         /* The tlv_buf_len is calculated for each scan command.  The TLVs added
 842            in this routine will be preserved since the routine that sends the
 843            command will append channelTLVs at *chan_list_out.  The difference
 844            between the *chan_list_out and the tlv_buf start will be used to
 845            calculate the size of anything we add in this routine. */
 846         scan_cfg_out->tlv_buf_len = 0;
 847
 848         /* Running tlv pointer.  Assigned to chan_list_out at end of function
 849            so later routines know where channels can be added to the command
 850            buf */
 851         tlv_pos = scan_cfg_out->tlv_buf;
 852
 853         /* Initialize the scan as un-filtered; the flag is later set to TRUE
 854            below if a SSID or BSSID filter is sent in the command */
 855         *filtered_scan = false;
 856
 857         /* Initialize the scan as not being only on the current channel.  If
 858            the channel list is customized, only contains one channel, and is
 859            the active channel, this is set true and data flow is not halted. */
 860         *scan_current_only = false;
 861
 862         if (user_scan_in) {
 863                 u8 tmpaddr[ETH_ALEN];
 864
 865                 /* Default the ssid_filter flag to TRUE, set false under
 866                    certain wildcard conditions and qualified by the existence
 867                    of an SSID list before marking the scan as filtered */
 868                 ssid_filter = true;
 869
 870                 /* Set the BSS type scan filter, use Adapter setting if
 871                    unset */
 872                 scan_cfg_out->bss_mode =
 873                         (u8)(user_scan_in->bss_mode ?: adapter->scan_mode);
 874
 875                 /* Set the number of probes to send, use Adapter setting
 876                    if unset */
 877                 num_probes = user_scan_in->num_probes ?: adapter->scan_probes;
 878
 879                 /*
 880                  * Set the BSSID filter to the incoming configuration,
 881                  * if non-zero.  If not set, it will remain disabled
 882                  * (all zeros).
 883                  */
 884                 memcpy(scan_cfg_out->specific_bssid,
 885                        user_scan_in->specific_bssid,
 886                        sizeof(scan_cfg_out->specific_bssid));
 887
 888                 memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
 889
 890                 if (adapter->ext_scan &&
 891                     !is_zero_ether_addr(tmpaddr)) {
 892                         bssid_tlv =
 893                                 (struct mwifiex_ie_types_bssid_list *)tlv_pos;
 894                         bssid_tlv->header.type = cpu_to_le16(TLV_TYPE_BSSID);
 895                         bssid_tlv->header.len = cpu_to_le16(ETH_ALEN);
 896                         memcpy(bssid_tlv->bssid, user_scan_in->specific_bssid,
 897                                ETH_ALEN);
 898                         tlv_pos += sizeof(struct mwifiex_ie_types_bssid_list);
 899                 }
 900
 901                 for (i = 0; i < user_scan_in->num_ssids; i++) {
 902                         ssid_len = user_scan_in->ssid_list[i].ssid_len;
 903
 904                         wildcard_ssid_tlv =
 905                                 (struct mwifiex_ie_types_wildcard_ssid_params *)
 906                                 tlv_pos;
 907                         wildcard_ssid_tlv->header.type =
 908                                 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
 909                         wildcard_ssid_tlv->header.len = cpu_to_le16(
 910                                 (u16) (ssid_len + sizeof(wildcard_ssid_tlv->
 911                                                          max_ssid_length)));
 912
 913                         /*
 914                          * max_ssid_length = 0 tells firmware to perform
 915                          * specific scan for the SSID filled, whereas
 916                          * max_ssid_length = IEEE80211_MAX_SSID_LEN is for
 917                          * wildcard scan.
 918                          */
 919                         if (ssid_len)
 920                                 wildcard_ssid_tlv->max_ssid_length = 0;
 921                         else
 922                                 wildcard_ssid_tlv->max_ssid_length =
 923                                                         IEEE80211_MAX_SSID_LEN;
 924
 925                         if (!memcmp(user_scan_in->ssid_list[i].ssid,
 926                                     "DIRECT-", 7))
 927                                 wildcard_ssid_tlv->max_ssid_length = 0xfe;
 928
 929                         memcpy(wildcard_ssid_tlv->ssid,
 930                                user_scan_in->ssid_list[i].ssid, ssid_len);
 931
 932                         tlv_pos += (sizeof(wildcard_ssid_tlv->header)
 933                                 + le16_to_cpu(wildcard_ssid_tlv->header.len));
 934
 935                         mwifiex_dbg(adapter, INFO,
 936                                     "info: scan: ssid[%d]: %s, %d\n",
 937                                     i, wildcard_ssid_tlv->ssid,
 938                                     wildcard_ssid_tlv->max_ssid_length);
 939
 940                         /* Empty wildcard ssid with a maxlen will match many or
 941                            potentially all SSIDs (maxlen == 32), therefore do
 942                            not treat the scan as
 943                            filtered. */
 944                         if (!ssid_len && wildcard_ssid_tlv->max_ssid_length)
 945                                 ssid_filter = false;
 946                 }
 947
 948                 /*
 949                  *  The default number of channels sent in the command is low to
 950                  *  ensure the response buffer from the firmware does not
 951                  *  truncate scan results.  That is not an issue with an SSID
 952                  *  or BSSID filter applied to the scan results in the firmware.
 953                  */
 954                 memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
 955                 if ((i && ssid_filter) ||
 956                     !is_zero_ether_addr(tmpaddr))
 957                         *filtered_scan = true;
 958
 959                 if (user_scan_in->scan_chan_gap) {
 960                         mwifiex_dbg(adapter, INFO,
 961                                     "info: scan: channel gap = %d\n",
 962                                     user_scan_in->scan_chan_gap);
 963                         *max_chan_per_scan =
 964                                         MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN;
 965
 966                         chan_gap_tlv = (void *)tlv_pos;
 967                         chan_gap_tlv->header.type =
 968                                          cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
 969                         chan_gap_tlv->header.len =
 970                                     cpu_to_le16(sizeof(chan_gap_tlv->chan_gap));
 971                         chan_gap_tlv->chan_gap =
 972                                      cpu_to_le16((user_scan_in->scan_chan_gap));
 973                         tlv_pos +=
 974                                   sizeof(struct mwifiex_ie_types_scan_chan_gap);
 975                 }
 976
 977                 if (!ether_addr_equal(user_scan_in->random_mac, zero_mac)) {
 978                         random_mac_tlv = (void *)tlv_pos;
 979                         random_mac_tlv->header.type =
 980                                          cpu_to_le16(TLV_TYPE_RANDOM_MAC);
 981                         random_mac_tlv->header.len =
 982                                     cpu_to_le16(sizeof(random_mac_tlv->mac));
 983                         ether_addr_copy(random_mac_tlv->mac,
 984                                         user_scan_in->random_mac);
 985                         tlv_pos +=
 986                                   sizeof(struct mwifiex_ie_types_random_mac);
 987                 }
 988         } else {
 989                 scan_cfg_out->bss_mode = (u8) adapter->scan_mode;
 990                 num_probes = adapter->scan_probes;
 991         }
 992
 993         /*
 994          *  If a specific BSSID or SSID is used, the number of channels in the
 995          *  scan command will be increased to the absolute maximum.
 996          */
 997         if (*filtered_scan) {
 998                 *max_chan_per_scan = MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN;
 999         } else {
1000                 if (!priv->media_connected)
1001                         *max_chan_per_scan = MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD;
1002                 else
1003                         *max_chan_per_scan =
1004                                         MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD / 2;
1005         }
1006
1007         if (adapter->ext_scan) {
1008                 bss_mode = (struct mwifiex_ie_types_bss_mode *)tlv_pos;
1009                 bss_mode->header.type = cpu_to_le16(TLV_TYPE_BSS_MODE);
1010                 bss_mode->header.len = cpu_to_le16(sizeof(bss_mode->bss_mode));
1011                 bss_mode->bss_mode = scan_cfg_out->bss_mode;
1012                 tlv_pos += sizeof(bss_mode->header) +
1013                            le16_to_cpu(bss_mode->header.len);
1014         }
1015
1016         /* If the input config or adapter has the number of Probes set,
1017            add tlv */
1018         if (num_probes) {
1019
1020                 mwifiex_dbg(adapter, INFO,
1021                             "info: scan: num_probes = %d\n",
1022                             num_probes);
1023
1024                 num_probes_tlv = (struct mwifiex_ie_types_num_probes *) tlv_pos;
1025                 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
1026                 num_probes_tlv->header.len =
1027                         cpu_to_le16(sizeof(num_probes_tlv->num_probes));
1028                 num_probes_tlv->num_probes = cpu_to_le16((u16) num_probes);
1029
1030                 tlv_pos += sizeof(num_probes_tlv->header) +
1031                         le16_to_cpu(num_probes_tlv->header.len);
1032
1033         }
1034
1035         if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
1036             (priv->adapter->config_bands & BAND_GN ||
1037              priv->adapter->config_bands & BAND_AN)) {
1038                 ht_cap = (struct mwifiex_ie_types_htcap *) tlv_pos;
1039                 memset(ht_cap, 0, sizeof(struct mwifiex_ie_types_htcap));
1040                 ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
1041                 ht_cap->header.len =
1042                                 cpu_to_le16(sizeof(struct ieee80211_ht_cap));
1043                 radio_type =
1044                         mwifiex_band_to_radio_type(priv->adapter->config_bands);
1045                 mwifiex_fill_cap_info(priv, radio_type, &ht_cap->ht_cap);
1046                 tlv_pos += sizeof(struct mwifiex_ie_types_htcap);
1047         }
1048
1049         /* Append vendor specific IE TLV */
1050         mwifiex_cmd_append_vsie_tlv(priv, MWIFIEX_VSIE_MASK_SCAN, &tlv_pos);
1051
1052         /*
1053          * Set the output for the channel TLV to the address in the tlv buffer
1054          *   past any TLVs that were added in this function (SSID, num_probes).
1055          *   Channel TLVs will be added past this for each scan command,
1056          *   preserving the TLVs that were previously added.
1057          */
1058         *chan_list_out =
1059                 (struct mwifiex_ie_types_chan_list_param_set *) tlv_pos;
1060
1061         if (user_scan_in && user_scan_in->chan_list[0].chan_number) {
1062
1063                 mwifiex_dbg(adapter, INFO,
1064                             "info: Scan: Using supplied channel list\n");
1065
1066                 for (chan_idx = 0;
1067                      chan_idx < MWIFIEX_USER_SCAN_CHAN_MAX &&
1068                      user_scan_in->chan_list[chan_idx].chan_number;
1069                      chan_idx++) {
1070
1071                         channel = user_scan_in->chan_list[chan_idx].chan_number;
1072                         scan_chan_list[chan_idx].chan_number = channel;
1073
1074                         radio_type =
1075                                 user_scan_in->chan_list[chan_idx].radio_type;
1076                         scan_chan_list[chan_idx].radio_type = radio_type;
1077
1078                         scan_type = user_scan_in->chan_list[chan_idx].scan_type;
1079
1080                         if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
1081                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
1082                                         |= (MWIFIEX_PASSIVE_SCAN |
1083                                             MWIFIEX_HIDDEN_SSID_REPORT);
1084                         else
1085                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
1086                                         &= ~MWIFIEX_PASSIVE_SCAN;
1087
1088                         scan_chan_list[chan_idx].chan_scan_mode_bitmap
1089                                 |= MWIFIEX_DISABLE_CHAN_FILT;
1090
1091                         if (user_scan_in->chan_list[chan_idx].scan_time) {
1092                                 scan_dur = (u16) user_scan_in->
1093                                         chan_list[chan_idx].scan_time;
1094                         } else {
1095                                 if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
1096                                         scan_dur = adapter->passive_scan_time;
1097                                 else if (*filtered_scan)
1098                                         scan_dur = adapter->specific_scan_time;
1099                                 else
1100                                         scan_dur = adapter->active_scan_time;
1101                         }
1102
1103                         scan_chan_list[chan_idx].min_scan_time =
1104                                 cpu_to_le16(scan_dur);
1105                         scan_chan_list[chan_idx].max_scan_time =
1106                                 cpu_to_le16(scan_dur);
1107                 }
1108
1109                 /* Check if we are only scanning the current channel */
1110                 if ((chan_idx == 1) &&
1111                     (user_scan_in->chan_list[0].chan_number ==
1112                      priv->curr_bss_params.bss_descriptor.channel)) {
1113                         *scan_current_only = true;
1114                         mwifiex_dbg(adapter, INFO,
1115                                     "info: Scan: Scanning current channel only\n");
1116                 }
1117         } else {
1118                 mwifiex_dbg(adapter, INFO,
1119                             "info: Scan: Creating full region channel list\n");
1120                 mwifiex_scan_create_channel_list(priv, user_scan_in,
1121                                                  scan_chan_list,
1122                                                  *filtered_scan);
1123         }
1124
1125 }
1126
1127 /*
1128  * This function inspects the scan response buffer for pointers to
1129  * expected TLVs.
1130  *
1131  * TLVs can be included at the end of the scan response BSS information.
1132  *
1133  * Data in the buffer is parsed pointers to TLVs that can potentially
1134  * be passed back in the response.
1135  */
1136 static void
1137 mwifiex_ret_802_11_scan_get_tlv_ptrs(struct mwifiex_adapter *adapter,
1138                                      struct mwifiex_ie_types_data *tlv,
1139                                      u32 tlv_buf_size, u32 req_tlv_type,
1140                                      struct mwifiex_ie_types_data **tlv_data)
1141 {
1142         struct mwifiex_ie_types_data *current_tlv;
1143         u32 tlv_buf_left;
1144         u32 tlv_type;
1145         u32 tlv_len;
1146
1147         current_tlv = tlv;
1148         tlv_buf_left = tlv_buf_size;
1149         *tlv_data = NULL;
1150
1151         mwifiex_dbg(adapter, INFO,
1152                     "info: SCAN_RESP: tlv_buf_size = %d\n",
1153                     tlv_buf_size);
1154
1155         while (tlv_buf_left >= sizeof(struct mwifiex_ie_types_header)) {
1156
1157                 tlv_type = le16_to_cpu(current_tlv->header.type);
1158                 tlv_len = le16_to_cpu(current_tlv->header.len);
1159
1160                 if (sizeof(tlv->header) + tlv_len > tlv_buf_left) {
1161                         mwifiex_dbg(adapter, ERROR,
1162                                     "SCAN_RESP: TLV buffer corrupt\n");
1163                         break;
1164                 }
1165
1166                 if (req_tlv_type == tlv_type) {
1167                         switch (tlv_type) {
1168                         case TLV_TYPE_TSFTIMESTAMP:
1169                                 mwifiex_dbg(adapter, INFO,
1170                                             "info: SCAN_RESP: TSF\t"
1171                                             "timestamp TLV, len = %d\n",
1172                                             tlv_len);
1173                                 *tlv_data = current_tlv;
1174                                 break;
1175                         case TLV_TYPE_CHANNELBANDLIST:
1176                                 mwifiex_dbg(adapter, INFO,
1177                                             "info: SCAN_RESP: channel\t"
1178                                             "band list TLV, len = %d\n",
1179                                             tlv_len);
1180                                 *tlv_data = current_tlv;
1181                                 break;
1182                         default:
1183                                 mwifiex_dbg(adapter, ERROR,
1184                                             "SCAN_RESP: unhandled TLV = %d\n",
1185                                             tlv_type);
1186                                 /* Give up, this seems corrupted */
1187                                 return;
1188                         }
1189                 }
1190
1191                 if (*tlv_data)
1192                         break;
1193
1194
1195                 tlv_buf_left -= (sizeof(tlv->header) + tlv_len);
1196                 current_tlv =
1197                         (struct mwifiex_ie_types_data *) (current_tlv->data +
1198                                                           tlv_len);
1199
1200         }                       /* while */
1201 }
1202
1203 /*
1204  * This function parses provided beacon buffer and updates
1205  * respective fields in bss descriptor structure.
1206  */
1207 int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
1208                                     struct mwifiex_bssdescriptor *bss_entry)
1209 {
1210         int ret = 0;
1211         u8 element_id;
1212         struct ieee_types_fh_param_set *fh_param_set;
1213         struct ieee_types_ds_param_set *ds_param_set;
1214         struct ieee_types_cf_param_set *cf_param_set;
1215         struct ieee_types_ibss_param_set *ibss_param_set;
1216         u8 *current_ptr;
1217         u8 *rate;
1218         u8 element_len;
1219         u16 total_ie_len;
1220         u8 bytes_to_copy;
1221         u8 rate_size;
1222         u8 found_data_rate_ie;
1223         u32 bytes_left;
1224         struct ieee_types_vendor_specific *vendor_ie;
1225         const u8 wpa_oui[4] = { 0x00, 0x50, 0xf2, 0x01 };
1226         const u8 wmm_oui[4] = { 0x00, 0x50, 0xf2, 0x02 };
1227
1228         found_data_rate_ie = false;
1229         rate_size = 0;
1230         current_ptr = bss_entry->beacon_buf;
1231         bytes_left = bss_entry->beacon_buf_size;
1232
1233         /* Process variable IE */
1234         while (bytes_left >= 2) {
1235                 element_id = *current_ptr;
1236                 element_len = *(current_ptr + 1);
1237                 total_ie_len = element_len + sizeof(struct ieee_types_header);
1238
1239                 if (bytes_left < total_ie_len) {
1240                         mwifiex_dbg(adapter, ERROR,
1241                                     "err: InterpretIE: in processing\t"
1242                                     "IE, bytes left < IE length\n");
1243                         return -1;
1244                 }
1245                 switch (element_id) {
1246                 case WLAN_EID_SSID:
1247                         bss_entry->ssid.ssid_len = element_len;
1248                         memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
1249                                element_len);
1250                         mwifiex_dbg(adapter, INFO,
1251                                     "info: InterpretIE: ssid: %-32s\n",
1252                                     bss_entry->ssid.ssid);
1253                         break;
1254
1255                 case WLAN_EID_SUPP_RATES:
1256                         memcpy(bss_entry->data_rates, current_ptr + 2,
1257                                element_len);
1258                         memcpy(bss_entry->supported_rates, current_ptr + 2,
1259                                element_len);
1260                         rate_size = element_len;
1261                         found_data_rate_ie = true;
1262                         break;
1263
1264                 case WLAN_EID_FH_PARAMS:
1265                         fh_param_set =
1266                                 (struct ieee_types_fh_param_set *) current_ptr;
1267                         memcpy(&bss_entry->phy_param_set.fh_param_set,
1268                                fh_param_set,
1269                                sizeof(struct ieee_types_fh_param_set));
1270                         break;
1271
1272                 case WLAN_EID_DS_PARAMS:
1273                         ds_param_set =
1274                                 (struct ieee_types_ds_param_set *) current_ptr;
1275
1276                         bss_entry->channel = ds_param_set->current_chan;
1277
1278                         memcpy(&bss_entry->phy_param_set.ds_param_set,
1279                                ds_param_set,
1280                                sizeof(struct ieee_types_ds_param_set));
1281                         break;
1282
1283                 case WLAN_EID_CF_PARAMS:
1284                         cf_param_set =
1285                                 (struct ieee_types_cf_param_set *) current_ptr;
1286                         memcpy(&bss_entry->ss_param_set.cf_param_set,
1287                                cf_param_set,
1288                                sizeof(struct ieee_types_cf_param_set));
1289                         break;
1290
1291                 case WLAN_EID_IBSS_PARAMS:
1292                         ibss_param_set =
1293                                 (struct ieee_types_ibss_param_set *)
1294                                 current_ptr;
1295                         memcpy(&bss_entry->ss_param_set.ibss_param_set,
1296                                ibss_param_set,
1297                                sizeof(struct ieee_types_ibss_param_set));
1298                         break;
1299
1300                 case WLAN_EID_ERP_INFO:
1301                         bss_entry->erp_flags = *(current_ptr + 2);
1302                         break;
1303
1304                 case WLAN_EID_PWR_CONSTRAINT:
1305                         bss_entry->local_constraint = *(current_ptr + 2);
1306                         bss_entry->sensed_11h = true;
1307                         break;
1308
1309                 case WLAN_EID_CHANNEL_SWITCH:
1310                         bss_entry->chan_sw_ie_present = true;
1311                 case WLAN_EID_PWR_CAPABILITY:
1312                 case WLAN_EID_TPC_REPORT:
1313                 case WLAN_EID_QUIET:
1314                         bss_entry->sensed_11h = true;
1315                     break;
1316
1317                 case WLAN_EID_EXT_SUPP_RATES:
1318                         /*
1319                          * Only process extended supported rate
1320                          * if data rate is already found.
1321                          * Data rate IE should come before
1322                          * extended supported rate IE
1323                          */
1324                         if (found_data_rate_ie) {
1325                                 if ((element_len + rate_size) >
1326                                     MWIFIEX_SUPPORTED_RATES)
1327                                         bytes_to_copy =
1328                                                 (MWIFIEX_SUPPORTED_RATES -
1329                                                  rate_size);
1330                                 else
1331                                         bytes_to_copy = element_len;
1332
1333                                 rate = (u8 *) bss_entry->data_rates;
1334                                 rate += rate_size;
1335                                 memcpy(rate, current_ptr + 2, bytes_to_copy);
1336
1337                                 rate = (u8 *) bss_entry->supported_rates;
1338                                 rate += rate_size;
1339                                 memcpy(rate, current_ptr + 2, bytes_to_copy);
1340                         }
1341                         break;
1342
1343                 case WLAN_EID_VENDOR_SPECIFIC:
1344                         vendor_ie = (struct ieee_types_vendor_specific *)
1345                                         current_ptr;
1346
1347                         if (!memcmp
1348                             (vendor_ie->vend_hdr.oui, wpa_oui,
1349                              sizeof(wpa_oui))) {
1350                                 bss_entry->bcn_wpa_ie =
1351                                         (struct ieee_types_vendor_specific *)
1352                                         current_ptr;
1353                                 bss_entry->wpa_offset = (u16)
1354                                         (current_ptr - bss_entry->beacon_buf);
1355                         } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
1356                                     sizeof(wmm_oui))) {
1357                                 if (total_ie_len ==
1358                                     sizeof(struct ieee_types_wmm_parameter) ||
1359                                     total_ie_len ==
1360                                     sizeof(struct ieee_types_wmm_info))
1361                                         /*
1362                                          * Only accept and copy the WMM IE if
1363                                          * it matches the size expected for the
1364                                          * WMM Info IE or the WMM Parameter IE.
1365                                          */
1366                                         memcpy((u8 *) &bss_entry->wmm_ie,
1367                                                current_ptr, total_ie_len);
1368                         }
1369                         break;
1370                 case WLAN_EID_RSN:
1371                         bss_entry->bcn_rsn_ie =
1372                                 (struct ieee_types_generic *) current_ptr;
1373                         bss_entry->rsn_offset = (u16) (current_ptr -
1374                                                         bss_entry->beacon_buf);
1375                         break;
1376                 case WLAN_EID_BSS_AC_ACCESS_DELAY:
1377                         bss_entry->bcn_wapi_ie =
1378                                 (struct ieee_types_generic *) current_ptr;
1379                         bss_entry->wapi_offset = (u16) (current_ptr -
1380                                                         bss_entry->beacon_buf);
1381                         break;
1382                 case WLAN_EID_HT_CAPABILITY:
1383                         bss_entry->bcn_ht_cap = (struct ieee80211_ht_cap *)
1384                                         (current_ptr +
1385                                         sizeof(struct ieee_types_header));
1386                         bss_entry->ht_cap_offset = (u16) (current_ptr +
1387                                         sizeof(struct ieee_types_header) -
1388                                         bss_entry->beacon_buf);
1389                         break;
1390                 case WLAN_EID_HT_OPERATION:
1391                         bss_entry->bcn_ht_oper =
1392                                 (struct ieee80211_ht_operation *)(current_ptr +
1393                                         sizeof(struct ieee_types_header));
1394                         bss_entry->ht_info_offset = (u16) (current_ptr +
1395                                         sizeof(struct ieee_types_header) -
1396                                         bss_entry->beacon_buf);
1397                         break;
1398                 case WLAN_EID_VHT_CAPABILITY:
1399                         bss_entry->disable_11ac = false;
1400                         bss_entry->bcn_vht_cap =
1401                                 (void *)(current_ptr +
1402                                          sizeof(struct ieee_types_header));
1403                         bss_entry->vht_cap_offset =
1404                                         (u16)((u8 *)bss_entry->bcn_vht_cap -
1405                                               bss_entry->beacon_buf);
1406                         break;
1407                 case WLAN_EID_VHT_OPERATION:
1408                         bss_entry->bcn_vht_oper =
1409                                 (void *)(current_ptr +
1410                                          sizeof(struct ieee_types_header));
1411                         bss_entry->vht_info_offset =
1412                                         (u16)((u8 *)bss_entry->bcn_vht_oper -
1413                                               bss_entry->beacon_buf);
1414                         break;
1415                 case WLAN_EID_BSS_COEX_2040:
1416                         bss_entry->bcn_bss_co_2040 = current_ptr;
1417                         bss_entry->bss_co_2040_offset =
1418                                 (u16) (current_ptr - bss_entry->beacon_buf);
1419                         break;
1420                 case WLAN_EID_EXT_CAPABILITY:
1421                         bss_entry->bcn_ext_cap = current_ptr;
1422                         bss_entry->ext_cap_offset =
1423                                 (u16) (current_ptr - bss_entry->beacon_buf);
1424                         break;
1425                 case WLAN_EID_OPMODE_NOTIF:
1426                         bss_entry->oper_mode = (void *)current_ptr;
1427                         bss_entry->oper_mode_offset =
1428                                         (u16)((u8 *)bss_entry->oper_mode -
1429                                               bss_entry->beacon_buf);
1430                         break;
1431                 default:
1432                         break;
1433                 }
1434
1435                 current_ptr += element_len + 2;
1436
1437                 /* Need to account for IE ID and IE Len */
1438                 bytes_left -= (element_len + 2);
1439
1440         }       /* while (bytes_left > 2) */
1441         return ret;
1442 }
1443
1444 /*
1445  * This function converts radio type scan parameter to a band configuration
1446  * to be used in join command.
1447  */
1448 static u8
1449 mwifiex_radio_type_to_band(u8 radio_type)
1450 {
1451         switch (radio_type) {
1452         case HostCmd_SCAN_RADIO_TYPE_A:
1453                 return BAND_A;
1454         case HostCmd_SCAN_RADIO_TYPE_BG:
1455         default:
1456                 return BAND_G;
1457         }
1458 }
1459
1460 /*
1461  * This is an internal function used to start a scan based on an input
1462  * configuration.
1463  *
1464  * This uses the input user scan configuration information when provided in
1465  * order to send the appropriate scan commands to firmware to populate or
1466  * update the internal driver scan table.
1467  */
1468 int mwifiex_scan_networks(struct mwifiex_private *priv,
1469                           const struct mwifiex_user_scan_cfg *user_scan_in)
1470 {
1471         int ret;
1472         struct mwifiex_adapter *adapter = priv->adapter;
1473         struct cmd_ctrl_node *cmd_node;
1474         union mwifiex_scan_cmd_config_tlv *scan_cfg_out;
1475         struct mwifiex_ie_types_chan_list_param_set *chan_list_out;
1476         struct mwifiex_chan_scan_param_set *scan_chan_list;
1477         u8 filtered_scan;
1478         u8 scan_current_chan_only;
1479         u8 max_chan_per_scan;
1480         unsigned long flags;
1481
1482         if (adapter->scan_processing) {
1483                 mwifiex_dbg(adapter, WARN,
1484                             "cmd: Scan already in process...\n");
1485                 return -EBUSY;
1486         }
1487
1488         if (priv->scan_block) {
1489                 mwifiex_dbg(adapter, WARN,
1490                             "cmd: Scan is blocked during association...\n");
1491                 return -EBUSY;
1492         }
1493
1494         if (adapter->surprise_removed || adapter->is_cmd_timedout) {
1495                 mwifiex_dbg(adapter, ERROR,
1496                             "Ignore scan. Card removed or firmware in bad state\n");
1497                 return -EFAULT;
1498         }
1499
1500         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1501         adapter->scan_processing = true;
1502         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1503
1504         scan_cfg_out = kzalloc(sizeof(union mwifiex_scan_cmd_config_tlv),
1505                                GFP_KERNEL);
1506         if (!scan_cfg_out) {
1507                 ret = -ENOMEM;
1508                 goto done;
1509         }
1510
1511         scan_chan_list = kcalloc(MWIFIEX_USER_SCAN_CHAN_MAX,
1512                                  sizeof(struct mwifiex_chan_scan_param_set),
1513                                  GFP_KERNEL);
1514         if (!scan_chan_list) {
1515                 kfree(scan_cfg_out);
1516                 ret = -ENOMEM;
1517                 goto done;
1518         }
1519
1520         mwifiex_config_scan(priv, user_scan_in, &scan_cfg_out->config,
1521                             &chan_list_out, scan_chan_list, &max_chan_per_scan,
1522                             &filtered_scan, &scan_current_chan_only);
1523
1524         ret = mwifiex_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
1525                                         &scan_cfg_out->config, chan_list_out,
1526                                         scan_chan_list);
1527
1528         /* Get scan command from scan_pending_q and put to cmd_pending_q */
1529         if (!ret) {
1530                 spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1531                 if (!list_empty(&adapter->scan_pending_q)) {
1532                         cmd_node = list_first_entry(&adapter->scan_pending_q,
1533                                                     struct cmd_ctrl_node, list);
1534                         list_del(&cmd_node->list);
1535                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
1536                                                flags);
1537                         mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
1538                                                         true);
1539                         queue_work(adapter->workqueue, &adapter->main_work);
1540
1541                         /* Perform internal scan synchronously */
1542                         if (!priv->scan_request) {
1543                                 mwifiex_dbg(adapter, INFO,
1544                                             "wait internal scan\n");
1545                                 mwifiex_wait_queue_complete(adapter, cmd_node);
1546                         }
1547                 } else {
1548                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
1549                                                flags);
1550                 }
1551         }
1552
1553         kfree(scan_cfg_out);
1554         kfree(scan_chan_list);
1555 done:
1556         if (ret) {
1557                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1558                 adapter->scan_processing = false;
1559                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1560         }
1561         return ret;
1562 }
1563
1564 /*
1565  * This function prepares a scan command to be sent to the firmware.
1566  *
1567  * This uses the scan command configuration sent to the command processing
1568  * module in command preparation stage to configure a scan command structure
1569  * to send to firmware.
1570  *
1571  * The fixed fields specifying the BSS type and BSSID filters as well as a
1572  * variable number/length of TLVs are sent in the command to firmware.
1573  *
1574  * Preparation also includes -
1575  *      - Setting command ID, and proper size
1576  *      - Ensuring correct endian-ness
1577  */
1578 int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
1579                             struct mwifiex_scan_cmd_config *scan_cfg)
1580 {
1581         struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;
1582
1583         /* Set fixed field variables in scan command */
1584         scan_cmd->bss_mode = scan_cfg->bss_mode;
1585         memcpy(scan_cmd->bssid, scan_cfg->specific_bssid,
1586                sizeof(scan_cmd->bssid));
1587         memcpy(scan_cmd->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
1588
1589         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SCAN);
1590
1591         /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
1592         cmd->size = cpu_to_le16((u16) (sizeof(scan_cmd->bss_mode)
1593                                           + sizeof(scan_cmd->bssid)
1594                                           + scan_cfg->tlv_buf_len + S_DS_GEN));
1595
1596         return 0;
1597 }
1598
1599 /*
1600  * This function checks compatibility of requested network with current
1601  * driver settings.
1602  */
1603 int mwifiex_check_network_compatibility(struct mwifiex_private *priv,
1604                                         struct mwifiex_bssdescriptor *bss_desc)
1605 {
1606         int ret = -1;
1607
1608         if (!bss_desc)
1609                 return -1;
1610
1611         if ((mwifiex_get_cfp(priv, (u8) bss_desc->bss_band,
1612                              (u16) bss_desc->channel, 0))) {
1613                 switch (priv->bss_mode) {
1614                 case NL80211_IFTYPE_STATION:
1615                 case NL80211_IFTYPE_ADHOC:
1616                         ret = mwifiex_is_network_compatible(priv, bss_desc,
1617                                                             priv->bss_mode);
1618                         if (ret)
1619                                 mwifiex_dbg(priv->adapter, ERROR,
1620                                             "Incompatible network settings\n");
1621                         break;
1622                 default:
1623                         ret = 0;
1624                 }
1625         }
1626
1627         return ret;
1628 }
1629
1630 /* This function checks if SSID string contains all zeroes or length is zero */
1631 static bool mwifiex_is_hidden_ssid(struct cfg80211_ssid *ssid)
1632 {
1633         int idx;
1634
1635         for (idx = 0; idx < ssid->ssid_len; idx++) {
1636                 if (ssid->ssid[idx])
1637                         return false;
1638         }
1639
1640         return true;
1641 }
1642
1643 /* This function checks if any hidden SSID found in passive scan channels
1644  * and save those channels for specific SSID active scan
1645  */
1646 static int mwifiex_save_hidden_ssid_channels(struct mwifiex_private *priv,
1647                                              struct cfg80211_bss *bss)
1648 {
1649         struct mwifiex_bssdescriptor *bss_desc;
1650         int ret;
1651         int chid;
1652
1653         /* Allocate and fill new bss descriptor */
1654         bss_desc = kzalloc(sizeof(*bss_desc), GFP_KERNEL);
1655         if (!bss_desc)
1656                 return -ENOMEM;
1657
1658         ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
1659         if (ret)
1660                 goto done;
1661
1662         if (mwifiex_is_hidden_ssid(&bss_desc->ssid)) {
1663                 mwifiex_dbg(priv->adapter, INFO, "found hidden SSID\n");
1664                 for (chid = 0 ; chid < MWIFIEX_USER_SCAN_CHAN_MAX; chid++) {
1665                         if (priv->hidden_chan[chid].chan_number ==
1666                             bss->channel->hw_value)
1667                                 break;
1668
1669                         if (!priv->hidden_chan[chid].chan_number) {
1670                                 priv->hidden_chan[chid].chan_number =
1671                                         bss->channel->hw_value;
1672                                 priv->hidden_chan[chid].radio_type =
1673                                         bss->channel->band;
1674                                 priv->hidden_chan[chid].scan_type =
1675                                         MWIFIEX_SCAN_TYPE_ACTIVE;
1676                                 break;
1677                         }
1678                 }
1679         }
1680
1681 done:
1682         /* beacon_ie buffer was allocated in function
1683          * mwifiex_fill_new_bss_desc(). Free it now.
1684          */
1685         kfree(bss_desc->beacon_buf);
1686         kfree(bss_desc);
1687         return 0;
1688 }
1689
1690 static int mwifiex_update_curr_bss_params(struct mwifiex_private *priv,
1691                                           struct cfg80211_bss *bss)
1692 {
1693         struct mwifiex_bssdescriptor *bss_desc;
1694         int ret;
1695         unsigned long flags;
1696
1697         /* Allocate and fill new bss descriptor */
1698         bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), GFP_KERNEL);
1699         if (!bss_desc)
1700                 return -ENOMEM;
1701
1702         ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
1703         if (ret)
1704                 goto done;
1705
1706         ret = mwifiex_check_network_compatibility(priv, bss_desc);
1707         if (ret)
1708                 goto done;
1709
1710         spin_lock_irqsave(&priv->curr_bcn_buf_lock, flags);
1711         /* Make a copy of current BSSID descriptor */
1712         memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
1713                sizeof(priv->curr_bss_params.bss_descriptor));
1714
1715         /* The contents of beacon_ie will be copied to its own buffer
1716          * in mwifiex_save_curr_bcn()
1717          */
1718         mwifiex_save_curr_bcn(priv);
1719         spin_unlock_irqrestore(&priv->curr_bcn_buf_lock, flags);
1720
1721 done:
1722         /* beacon_ie buffer was allocated in function
1723          * mwifiex_fill_new_bss_desc(). Free it now.
1724          */
1725         kfree(bss_desc->beacon_buf);
1726         kfree(bss_desc);
1727         return 0;
1728 }
1729
1730 static int
1731 mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
1732                                   u32 *bytes_left, u64 fw_tsf, u8 *radio_type,
1733                                   bool ext_scan, s32 rssi_val)
1734 {
1735         struct mwifiex_adapter *adapter = priv->adapter;
1736         struct mwifiex_chan_freq_power *cfp;
1737         struct cfg80211_bss *bss;
1738         u8 bssid[ETH_ALEN];
1739         s32 rssi;
1740         const u8 *ie_buf;
1741         size_t ie_len;
1742         u16 channel = 0;
1743         u16 beacon_size = 0;
1744         u32 curr_bcn_bytes;
1745         u32 freq;
1746         u16 beacon_period;
1747         u16 cap_info_bitmap;
1748         u8 *current_ptr;
1749         u64 timestamp;
1750         struct mwifiex_fixed_bcn_param *bcn_param;
1751         struct mwifiex_bss_priv *bss_priv;
1752
1753         if (*bytes_left >= sizeof(beacon_size)) {
1754                 /* Extract & convert beacon size from command buffer */
1755                 beacon_size = get_unaligned_le16((*bss_info));
1756                 *bytes_left -= sizeof(beacon_size);
1757                 *bss_info += sizeof(beacon_size);
1758         }
1759
1760         if (!beacon_size || beacon_size > *bytes_left) {
1761                 *bss_info += *bytes_left;
1762                 *bytes_left = 0;
1763                 return -EFAULT;
1764         }
1765
1766         /* Initialize the current working beacon pointer for this BSS
1767          * iteration
1768          */
1769         current_ptr = *bss_info;
1770
1771         /* Advance the return beacon pointer past the current beacon */
1772         *bss_info += beacon_size;
1773         *bytes_left -= beacon_size;
1774
1775         curr_bcn_bytes = beacon_size;
1776
1777         /* First 5 fields are bssid, RSSI(for legacy scan only),
1778          * time stamp, beacon interval, and capability information
1779          */
1780         if (curr_bcn_bytes < ETH_ALEN + sizeof(u8) +
1781             sizeof(struct mwifiex_fixed_bcn_param)) {
1782                 mwifiex_dbg(adapter, ERROR,
1783                             "InterpretIE: not enough bytes left\n");
1784                 return -EFAULT;
1785         }
1786
1787         memcpy(bssid, current_ptr, ETH_ALEN);
1788         current_ptr += ETH_ALEN;
1789         curr_bcn_bytes -= ETH_ALEN;
1790
1791         if (!ext_scan) {
1792                 rssi = (s32) *current_ptr;
1793                 rssi = (-rssi) * 100;           /* Convert dBm to mBm */
1794                 current_ptr += sizeof(u8);
1795                 curr_bcn_bytes -= sizeof(u8);
1796                 mwifiex_dbg(adapter, INFO,
1797                             "info: InterpretIE: RSSI=%d\n", rssi);
1798         } else {
1799                 rssi = rssi_val;
1800         }
1801
1802         bcn_param = (struct mwifiex_fixed_bcn_param *)current_ptr;
1803         current_ptr += sizeof(*bcn_param);
1804         curr_bcn_bytes -= sizeof(*bcn_param);
1805
1806         timestamp = le64_to_cpu(bcn_param->timestamp);
1807         beacon_period = le16_to_cpu(bcn_param->beacon_period);
1808
1809         cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
1810         mwifiex_dbg(adapter, INFO,
1811                     "info: InterpretIE: capabilities=0x%X\n",
1812                     cap_info_bitmap);
1813
1814         /* Rest of the current buffer are IE's */
1815         ie_buf = current_ptr;
1816         ie_len = curr_bcn_bytes;
1817         mwifiex_dbg(adapter, INFO,
1818                     "info: InterpretIE: IELength for this AP = %d\n",
1819                     curr_bcn_bytes);
1820
1821         while (curr_bcn_bytes >= sizeof(struct ieee_types_header)) {
1822                 u8 element_id, element_len;
1823
1824                 element_id = *current_ptr;
1825                 element_len = *(current_ptr + 1);
1826                 if (curr_bcn_bytes < element_len +
1827                                 sizeof(struct ieee_types_header)) {
1828                         mwifiex_dbg(adapter, ERROR,
1829                                     "%s: bytes left < IE length\n", __func__);
1830                         return -EFAULT;
1831                 }
1832                 if (element_id == WLAN_EID_DS_PARAMS) {
1833                         channel = *(current_ptr +
1834                                     sizeof(struct ieee_types_header));
1835                         break;
1836                 }
1837
1838                 current_ptr += element_len + sizeof(struct ieee_types_header);
1839                 curr_bcn_bytes -= element_len +
1840                                         sizeof(struct ieee_types_header);
1841         }
1842
1843         if (channel) {
1844                 struct ieee80211_channel *chan;
1845                 u8 band;
1846
1847                 /* Skip entry if on csa closed channel */
1848                 if (channel == priv->csa_chan) {
1849                         mwifiex_dbg(adapter, WARN,
1850                                     "Dropping entry on csa closed channel\n");
1851                         return 0;
1852                 }
1853
1854                 band = BAND_G;
1855                 if (radio_type)
1856                         band = mwifiex_radio_type_to_band(*radio_type &
1857                                                           (BIT(0) | BIT(1)));
1858
1859                 cfp = mwifiex_get_cfp(priv, band, channel, 0);
1860
1861                 freq = cfp ? cfp->freq : 0;
1862
1863                 chan = ieee80211_get_channel(priv->wdev.wiphy, freq);
1864
1865                 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
1866                         bss = cfg80211_inform_bss(priv->wdev.wiphy,
1867                                             chan, CFG80211_BSS_FTYPE_UNKNOWN,
1868                                             bssid, timestamp,
1869                                             cap_info_bitmap, beacon_period,
1870                                             ie_buf, ie_len, rssi, GFP_KERNEL);
1871                         if (bss) {
1872                                 bss_priv = (struct mwifiex_bss_priv *)bss->priv;
1873                                 bss_priv->band = band;
1874                                 bss_priv->fw_tsf = fw_tsf;
1875                                 if (priv->media_connected &&
1876                                     !memcmp(bssid, priv->curr_bss_params.
1877                                             bss_descriptor.mac_address,
1878                                             ETH_ALEN))
1879                                         mwifiex_update_curr_bss_params(priv,
1880                                                                        bss);
1881                                 cfg80211_put_bss(priv->wdev.wiphy, bss);
1882                         }
1883
1884                         if ((chan->flags & IEEE80211_CHAN_RADAR) ||
1885                             (chan->flags & IEEE80211_CHAN_NO_IR)) {
1886                                 mwifiex_dbg(adapter, INFO,
1887                                             "radar or passive channel %d\n",
1888                                             channel);
1889                                 mwifiex_save_hidden_ssid_channels(priv, bss);
1890                         }
1891                 }
1892         } else {
1893                 mwifiex_dbg(adapter, WARN, "missing BSS channel IE\n");
1894         }
1895
1896         return 0;
1897 }
1898
1899 static void mwifiex_complete_scan(struct mwifiex_private *priv)
1900 {
1901         struct mwifiex_adapter *adapter = priv->adapter;
1902
1903         adapter->survey_idx = 0;
1904         if (adapter->curr_cmd->wait_q_enabled) {
1905                 adapter->cmd_wait_q.status = 0;
1906                 if (!priv->scan_request) {
1907                         mwifiex_dbg(adapter, INFO,
1908                                     "complete internal scan\n");
1909                         mwifiex_complete_cmd(adapter, adapter->curr_cmd);
1910                 }
1911         }
1912 }
1913
1914 /* This function checks if any hidden SSID found in passive scan channels
1915  * and do specific SSID active scan for those channels
1916  */
1917 static int
1918 mwifiex_active_scan_req_for_passive_chan(struct mwifiex_private *priv)
1919 {
1920         int ret;
1921         struct mwifiex_adapter *adapter = priv->adapter;
1922         u8 id = 0;
1923         struct mwifiex_user_scan_cfg  *user_scan_cfg;
1924
1925         if (adapter->active_scan_triggered || !priv->scan_request ||
1926             priv->scan_aborting) {
1927                 adapter->active_scan_triggered = false;
1928                 return 0;
1929         }
1930
1931         if (!priv->hidden_chan[0].chan_number) {
1932                 mwifiex_dbg(adapter, INFO, "No BSS with hidden SSID found on DFS channels\n");
1933                 return 0;
1934         }
1935         user_scan_cfg = kzalloc(sizeof(*user_scan_cfg), GFP_KERNEL);
1936
1937         if (!user_scan_cfg)
1938                 return -ENOMEM;
1939
1940         memset(user_scan_cfg, 0, sizeof(*user_scan_cfg));
1941
1942         for (id = 0; id < MWIFIEX_USER_SCAN_CHAN_MAX; id++) {
1943                 if (!priv->hidden_chan[id].chan_number)
1944                         break;
1945                 memcpy(&user_scan_cfg->chan_list[id],
1946                        &priv->hidden_chan[id],
1947                        sizeof(struct mwifiex_user_scan_chan));
1948         }
1949
1950         adapter->active_scan_triggered = true;
1951         ether_addr_copy(user_scan_cfg->random_mac, priv->random_mac);
1952         user_scan_cfg->num_ssids = priv->scan_request->n_ssids;
1953         user_scan_cfg->ssid_list = priv->scan_request->ssids;
1954
1955         ret = mwifiex_scan_networks(priv, user_scan_cfg);
1956         kfree(user_scan_cfg);
1957
1958         memset(&priv->hidden_chan, 0, sizeof(priv->hidden_chan));
1959
1960         if (ret) {
1961                 dev_err(priv->adapter->dev, "scan failed: %d\n", ret);
1962                 return ret;
1963         }
1964
1965         return 0;
1966 }
1967 static void mwifiex_check_next_scan_command(struct mwifiex_private *priv)
1968 {
1969         struct mwifiex_adapter *adapter = priv->adapter;
1970         struct cmd_ctrl_node *cmd_node;
1971         unsigned long flags;
1972
1973         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1974         if (list_empty(&adapter->scan_pending_q)) {
1975                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
1976
1977                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
1978                 adapter->scan_processing = false;
1979                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
1980
1981                 mwifiex_active_scan_req_for_passive_chan(priv);
1982
1983                 if (!adapter->ext_scan)
1984                         mwifiex_complete_scan(priv);
1985
1986                 if (priv->scan_request) {
1987                         struct cfg80211_scan_info info = {
1988                                 .aborted = false,
1989                         };
1990
1991                         mwifiex_dbg(adapter, INFO,
1992                                     "info: notifying scan done\n");
1993                         cfg80211_scan_done(priv->scan_request, &info);
1994                         priv->scan_request = NULL;
1995                         priv->scan_aborting = false;
1996                 } else {
1997                         priv->scan_aborting = false;
1998                         mwifiex_dbg(adapter, INFO,
1999                                     "info: scan already aborted\n");
2000                 }
2001         } else if ((priv->scan_aborting && !priv->scan_request) ||
2002                    priv->scan_block) {
2003                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
2004
2005                 mwifiex_cancel_pending_scan_cmd(adapter);
2006
2007                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
2008                 adapter->scan_processing = false;
2009                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
2010
2011                 if (!adapter->active_scan_triggered) {
2012                         if (priv->scan_request) {
2013                                 struct cfg80211_scan_info info = {
2014                                         .aborted = true,
2015                                 };
2016
2017                                 mwifiex_dbg(adapter, INFO,
2018                                             "info: aborting scan\n");
2019                                 cfg80211_scan_done(priv->scan_request, &info);
2020                                 priv->scan_request = NULL;
2021                                 priv->scan_aborting = false;
2022                         } else {
2023                                 priv->scan_aborting = false;
2024                                 mwifiex_dbg(adapter, INFO,
2025                                             "info: scan already aborted\n");
2026                         }
2027                 }
2028         } else {
2029                 /* Get scan command from scan_pending_q and put to
2030                  * cmd_pending_q
2031                  */
2032                 cmd_node = list_first_entry(&adapter->scan_pending_q,
2033                                             struct cmd_ctrl_node, list);
2034                 list_del(&cmd_node->list);
2035                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
2036                 mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
2037         }
2038
2039         return;
2040 }
2041
2042 void mwifiex_cancel_scan(struct mwifiex_adapter *adapter)
2043 {
2044         struct mwifiex_private *priv;
2045         unsigned long cmd_flags;
2046         int i;
2047
2048         mwifiex_cancel_pending_scan_cmd(adapter);
2049
2050         if (adapter->scan_processing) {
2051                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, cmd_flags);
2052                 adapter->scan_processing = false;
2053                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
2054                 for (i = 0; i < adapter->priv_num; i++) {
2055                         priv = adapter->priv[i];
2056                         if (!priv)
2057                                 continue;
2058                         if (priv->scan_request) {
2059                                 struct cfg80211_scan_info info = {
2060                                         .aborted = true,
2061                                 };
2062
2063                                 mwifiex_dbg(adapter, INFO,
2064                                             "info: aborting scan\n");
2065                                 cfg80211_scan_done(priv->scan_request, &info);
2066                                 priv->scan_request = NULL;
2067                                 priv->scan_aborting = false;
2068                         }
2069                 }
2070         }
2071 }
2072
2073 /*
2074  * This function handles the command response of scan.
2075  *
2076  * The response buffer for the scan command has the following
2077  * memory layout:
2078  *
2079  *      .-------------------------------------------------------------.
2080  *      |  Header (4 * sizeof(t_u16)):  Standard command response hdr |
2081  *      .-------------------------------------------------------------.
2082  *      |  BufSize (t_u16) : sizeof the BSS Description data          |
2083  *      .-------------------------------------------------------------.
2084  *      |  NumOfSet (t_u8) : Number of BSS Descs returned             |
2085  *      .-------------------------------------------------------------.
2086  *      |  BSSDescription data (variable, size given in BufSize)      |
2087  *      .-------------------------------------------------------------.
2088  *      |  TLV data (variable, size calculated using Header->Size,    |
2089  *      |            BufSize and sizeof the fixed fields above)       |
2090  *      .-------------------------------------------------------------.
2091  */
2092 int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
2093                             struct host_cmd_ds_command *resp)
2094 {
2095         int ret = 0;
2096         struct mwifiex_adapter *adapter = priv->adapter;
2097         struct host_cmd_ds_802_11_scan_rsp *scan_rsp;
2098         struct mwifiex_ie_types_data *tlv_data;
2099         struct mwifiex_ie_types_tsf_timestamp *tsf_tlv;
2100         u8 *bss_info;
2101         u32 scan_resp_size;
2102         u32 bytes_left;
2103         u32 idx;
2104         u32 tlv_buf_size;
2105         struct mwifiex_ie_types_chan_band_list_param_set *chan_band_tlv;
2106         struct chan_band_param_set *chan_band;
2107         u8 is_bgscan_resp;
2108         __le64 fw_tsf = 0;
2109         u8 *radio_type;
2110         struct cfg80211_wowlan_nd_match *pmatch;
2111         struct cfg80211_sched_scan_request *nd_config = NULL;
2112
2113         is_bgscan_resp = (le16_to_cpu(resp->command)
2114                           == HostCmd_CMD_802_11_BG_SCAN_QUERY);
2115         if (is_bgscan_resp)
2116                 scan_rsp = &resp->params.bg_scan_query_resp.scan_resp;
2117         else
2118                 scan_rsp = &resp->params.scan_resp;
2119
2120
2121         if (scan_rsp->number_of_sets > MWIFIEX_MAX_AP) {
2122                 mwifiex_dbg(adapter, ERROR,
2123                             "SCAN_RESP: too many AP returned (%d)\n",
2124                             scan_rsp->number_of_sets);
2125                 ret = -1;
2126                 goto check_next_scan;
2127         }
2128
2129         /* Check csa channel expiry before parsing scan response */
2130         mwifiex_11h_get_csa_closed_channel(priv);
2131
2132         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
2133         mwifiex_dbg(adapter, INFO,
2134                     "info: SCAN_RESP: bss_descript_size %d\n",
2135                     bytes_left);
2136
2137         scan_resp_size = le16_to_cpu(resp->size);
2138
2139         mwifiex_dbg(adapter, INFO,
2140                     "info: SCAN_RESP: returned %d APs before parsing\n",
2141                     scan_rsp->number_of_sets);
2142
2143         bss_info = scan_rsp->bss_desc_and_tlv_buffer;
2144
2145         /*
2146          * The size of the TLV buffer is equal to the entire command response
2147          *   size (scan_resp_size) minus the fixed fields (sizeof()'s), the
2148          *   BSS Descriptions (bss_descript_size as bytesLef) and the command
2149          *   response header (S_DS_GEN)
2150          */
2151         tlv_buf_size = scan_resp_size - (bytes_left
2152                                          + sizeof(scan_rsp->bss_descript_size)
2153                                          + sizeof(scan_rsp->number_of_sets)
2154                                          + S_DS_GEN);
2155
2156         tlv_data = (struct mwifiex_ie_types_data *) (scan_rsp->
2157                                                  bss_desc_and_tlv_buffer +
2158                                                  bytes_left);
2159
2160         /* Search the TLV buffer space in the scan response for any valid
2161            TLVs */
2162         mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
2163                                              TLV_TYPE_TSFTIMESTAMP,
2164                                              (struct mwifiex_ie_types_data **)
2165                                              &tsf_tlv);
2166
2167         /* Search the TLV buffer space in the scan response for any valid
2168            TLVs */
2169         mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
2170                                              TLV_TYPE_CHANNELBANDLIST,
2171                                              (struct mwifiex_ie_types_data **)
2172                                              &chan_band_tlv);
2173
2174 #ifdef CONFIG_PM
2175         if (priv->wdev.wiphy->wowlan_config)
2176                 nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
2177 #endif
2178
2179         if (nd_config) {
2180                 adapter->nd_info =
2181                         kzalloc(sizeof(struct cfg80211_wowlan_nd_match) +
2182                                 sizeof(struct cfg80211_wowlan_nd_match *) *
2183                                 scan_rsp->number_of_sets, GFP_ATOMIC);
2184
2185                 if (adapter->nd_info)
2186                         adapter->nd_info->n_matches = scan_rsp->number_of_sets;
2187         }
2188
2189         for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
2190                 /*
2191                  * If the TSF TLV was appended to the scan results, save this
2192                  * entry's TSF value in the fw_tsf field. It is the firmware's
2193                  * TSF value at the time the beacon or probe response was
2194                  * received.
2195                  */
2196                 if (tsf_tlv)
2197                         memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
2198                                sizeof(fw_tsf));
2199
2200                 if (chan_band_tlv) {
2201                         chan_band = &chan_band_tlv->chan_band_param[idx];
2202                         radio_type = &chan_band->radio_type;
2203                 } else {
2204                         radio_type = NULL;
2205                 }
2206
2207                 if (chan_band_tlv && adapter->nd_info) {
2208                         adapter->nd_info->matches[idx] =
2209                                 kzalloc(sizeof(*pmatch) + sizeof(u32),
2210                                         GFP_ATOMIC);
2211
2212                         pmatch = adapter->nd_info->matches[idx];
2213
2214                         if (pmatch) {
2215                                 pmatch->n_channels = 1;
2216                                 pmatch->channels[0] = chan_band->chan_number;
2217                         }
2218                 }
2219
2220                 ret = mwifiex_parse_single_response_buf(priv, &bss_info,
2221                                                         &bytes_left,
2222                                                         le64_to_cpu(fw_tsf),
2223                                                         radio_type, false, 0);
2224                 if (ret)
2225                         goto check_next_scan;
2226         }
2227
2228 check_next_scan:
2229         mwifiex_check_next_scan_command(priv);
2230         return ret;
2231 }
2232
2233 /*
2234  * This function prepares an extended scan command to be sent to the firmware
2235  *
2236  * This uses the scan command configuration sent to the command processing
2237  * module in command preparation stage to configure a extended scan command
2238  * structure to send to firmware.
2239  */
2240 int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
2241                                 struct host_cmd_ds_command *cmd,
2242                                 void *data_buf)
2243 {
2244         struct host_cmd_ds_802_11_scan_ext *ext_scan = &cmd->params.ext_scan;
2245         struct mwifiex_scan_cmd_config *scan_cfg = data_buf;
2246
2247         memcpy(ext_scan->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
2248
2249         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SCAN_EXT);
2250
2251         /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
2252         cmd->size = cpu_to_le16((u16)(sizeof(ext_scan->reserved)
2253                                       + scan_cfg->tlv_buf_len + S_DS_GEN));
2254
2255         return 0;
2256 }
2257
2258 /* This function prepares an background scan config command to be sent
2259  * to the firmware
2260  */
2261 int mwifiex_cmd_802_11_bg_scan_config(struct mwifiex_private *priv,
2262                                       struct host_cmd_ds_command *cmd,
2263                                       void *data_buf)
2264 {
2265         struct host_cmd_ds_802_11_bg_scan_config *bgscan_config =
2266                                         &cmd->params.bg_scan_config;
2267         struct mwifiex_bg_scan_cfg *bgscan_cfg_in = data_buf;
2268         u8 *tlv_pos = bgscan_config->tlv;
2269         u8 num_probes;
2270         u32 ssid_len, chan_idx, scan_type, scan_dur, chan_num;
2271         int i;
2272         struct mwifiex_ie_types_num_probes *num_probes_tlv;
2273         struct mwifiex_ie_types_repeat_count *repeat_count_tlv;
2274         struct mwifiex_ie_types_min_rssi_threshold *rssi_threshold_tlv;
2275         struct mwifiex_ie_types_bgscan_start_later *start_later_tlv;
2276         struct mwifiex_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
2277         struct mwifiex_ie_types_chan_list_param_set *chan_list_tlv;
2278         struct mwifiex_chan_scan_param_set *temp_chan;
2279
2280         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_CONFIG);
2281         cmd->size = cpu_to_le16(sizeof(*bgscan_config) + S_DS_GEN);
2282
2283         bgscan_config->action = cpu_to_le16(bgscan_cfg_in->action);
2284         bgscan_config->enable = bgscan_cfg_in->enable;
2285         bgscan_config->bss_type = bgscan_cfg_in->bss_type;
2286         bgscan_config->scan_interval =
2287                 cpu_to_le32(bgscan_cfg_in->scan_interval);
2288         bgscan_config->report_condition =
2289                 cpu_to_le32(bgscan_cfg_in->report_condition);
2290
2291         /*  stop sched scan  */
2292         if (!bgscan_config->enable)
2293                 return 0;
2294
2295         bgscan_config->chan_per_scan = bgscan_cfg_in->chan_per_scan;
2296
2297         num_probes = (bgscan_cfg_in->num_probes ? bgscan_cfg_in->
2298                       num_probes : priv->adapter->scan_probes);
2299
2300         if (num_probes) {
2301                 num_probes_tlv = (struct mwifiex_ie_types_num_probes *)tlv_pos;
2302                 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
2303                 num_probes_tlv->header.len =
2304                         cpu_to_le16(sizeof(num_probes_tlv->num_probes));
2305                 num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);
2306
2307                 tlv_pos += sizeof(num_probes_tlv->header) +
2308                         le16_to_cpu(num_probes_tlv->header.len);
2309         }
2310
2311         if (bgscan_cfg_in->repeat_count) {
2312                 repeat_count_tlv =
2313                         (struct mwifiex_ie_types_repeat_count *)tlv_pos;
2314                 repeat_count_tlv->header.type =
2315                         cpu_to_le16(TLV_TYPE_REPEAT_COUNT);
2316                 repeat_count_tlv->header.len =
2317                         cpu_to_le16(sizeof(repeat_count_tlv->repeat_count));
2318                 repeat_count_tlv->repeat_count =
2319                         cpu_to_le16(bgscan_cfg_in->repeat_count);
2320
2321                 tlv_pos += sizeof(repeat_count_tlv->header) +
2322                         le16_to_cpu(repeat_count_tlv->header.len);
2323         }
2324
2325         if (bgscan_cfg_in->rssi_threshold) {
2326                 rssi_threshold_tlv =
2327                         (struct mwifiex_ie_types_min_rssi_threshold *)tlv_pos;
2328                 rssi_threshold_tlv->header.type =
2329                         cpu_to_le16(TLV_TYPE_RSSI_LOW);
2330                 rssi_threshold_tlv->header.len =
2331                         cpu_to_le16(sizeof(rssi_threshold_tlv->rssi_threshold));
2332                 rssi_threshold_tlv->rssi_threshold =
2333                         cpu_to_le16(bgscan_cfg_in->rssi_threshold);
2334
2335                 tlv_pos += sizeof(rssi_threshold_tlv->header) +
2336                         le16_to_cpu(rssi_threshold_tlv->header.len);
2337         }
2338
2339         for (i = 0; i < bgscan_cfg_in->num_ssids; i++) {
2340                 ssid_len = bgscan_cfg_in->ssid_list[i].ssid.ssid_len;
2341
2342                 wildcard_ssid_tlv =
2343                         (struct mwifiex_ie_types_wildcard_ssid_params *)tlv_pos;
2344                 wildcard_ssid_tlv->header.type =
2345                                 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
2346                 wildcard_ssid_tlv->header.len = cpu_to_le16(
2347                                 (u16)(ssid_len + sizeof(wildcard_ssid_tlv->
2348                                                          max_ssid_length)));
2349
2350                 /* max_ssid_length = 0 tells firmware to perform
2351                  * specific scan for the SSID filled, whereas
2352                  * max_ssid_length = IEEE80211_MAX_SSID_LEN is for
2353                  * wildcard scan.
2354                  */
2355                 if (ssid_len)
2356                         wildcard_ssid_tlv->max_ssid_length = 0;
2357                 else
2358                         wildcard_ssid_tlv->max_ssid_length =
2359                                                 IEEE80211_MAX_SSID_LEN;
2360
2361                 memcpy(wildcard_ssid_tlv->ssid,
2362                        bgscan_cfg_in->ssid_list[i].ssid.ssid, ssid_len);
2363
2364                 tlv_pos += (sizeof(wildcard_ssid_tlv->header)
2365                                 + le16_to_cpu(wildcard_ssid_tlv->header.len));
2366         }
2367
2368         chan_list_tlv = (struct mwifiex_ie_types_chan_list_param_set *)tlv_pos;
2369
2370         if (bgscan_cfg_in->chan_list[0].chan_number) {
2371                 dev_dbg(priv->adapter->dev, "info: bgscan: Using supplied channel list\n");
2372
2373                 chan_list_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
2374
2375                 for (chan_idx = 0;
2376                      chan_idx < MWIFIEX_BG_SCAN_CHAN_MAX &&
2377                      bgscan_cfg_in->chan_list[chan_idx].chan_number;
2378                      chan_idx++) {
2379                         temp_chan = chan_list_tlv->chan_scan_param + chan_idx;
2380
2381                         /* Increment the TLV header length by size appended */
2382                         le16_unaligned_add_cpu(&chan_list_tlv->header.len,
2383                                                sizeof(
2384                                                chan_list_tlv->chan_scan_param));
2385
2386                         temp_chan->chan_number =
2387                                 bgscan_cfg_in->chan_list[chan_idx].chan_number;
2388                         temp_chan->radio_type =
2389                                 bgscan_cfg_in->chan_list[chan_idx].radio_type;
2390
2391                         scan_type =
2392                                 bgscan_cfg_in->chan_list[chan_idx].scan_type;
2393
2394                         if (scan_type == MWIFIEX_SCAN_TYPE_PASSIVE)
2395                                 temp_chan->chan_scan_mode_bitmap
2396                                         |= MWIFIEX_PASSIVE_SCAN;
2397                         else
2398                                 temp_chan->chan_scan_mode_bitmap
2399                                         &= ~MWIFIEX_PASSIVE_SCAN;
2400
2401                         if (bgscan_cfg_in->chan_list[chan_idx].scan_time) {
2402                                 scan_dur = (u16)bgscan_cfg_in->
2403                                         chan_list[chan_idx].scan_time;
2404                         } else {
2405                                 scan_dur = (scan_type ==
2406                                             MWIFIEX_SCAN_TYPE_PASSIVE) ?
2407                                             priv->adapter->passive_scan_time :
2408                                             priv->adapter->specific_scan_time;
2409                         }
2410
2411                         temp_chan->min_scan_time = cpu_to_le16(scan_dur);
2412                         temp_chan->max_scan_time = cpu_to_le16(scan_dur);
2413                 }
2414         } else {
2415                 dev_dbg(priv->adapter->dev,
2416                         "info: bgscan: Creating full region channel list\n");
2417                 chan_num =
2418                         mwifiex_bgscan_create_channel_list(priv, bgscan_cfg_in,
2419                                                            chan_list_tlv->
2420                                                            chan_scan_param);
2421                 le16_unaligned_add_cpu(&chan_list_tlv->header.len,
2422                                        chan_num *
2423                              sizeof(chan_list_tlv->chan_scan_param[0]));
2424         }
2425
2426         tlv_pos += (sizeof(chan_list_tlv->header)
2427                         + le16_to_cpu(chan_list_tlv->header.len));
2428
2429         if (bgscan_cfg_in->start_later) {
2430                 start_later_tlv =
2431                         (struct mwifiex_ie_types_bgscan_start_later *)tlv_pos;
2432                 start_later_tlv->header.type =
2433                         cpu_to_le16(TLV_TYPE_BGSCAN_START_LATER);
2434                 start_later_tlv->header.len =
2435                         cpu_to_le16(sizeof(start_later_tlv->start_later));
2436                 start_later_tlv->start_later =
2437                         cpu_to_le16(bgscan_cfg_in->start_later);
2438
2439                 tlv_pos += sizeof(start_later_tlv->header) +
2440                         le16_to_cpu(start_later_tlv->header.len);
2441         }
2442
2443         /* Append vendor specific IE TLV */
2444         mwifiex_cmd_append_vsie_tlv(priv, MWIFIEX_VSIE_MASK_BGSCAN, &tlv_pos);
2445
2446         le16_unaligned_add_cpu(&cmd->size, tlv_pos - bgscan_config->tlv);
2447
2448         return 0;
2449 }
2450
2451 int mwifiex_stop_bg_scan(struct mwifiex_private *priv)
2452 {
2453         struct mwifiex_bg_scan_cfg *bgscan_cfg;
2454
2455         if (!priv->sched_scanning) {
2456                 dev_dbg(priv->adapter->dev, "bgscan already stopped!\n");
2457                 return 0;
2458         }
2459
2460         bgscan_cfg = kzalloc(sizeof(*bgscan_cfg), GFP_KERNEL);
2461         if (!bgscan_cfg)
2462                 return -ENOMEM;
2463
2464         bgscan_cfg->bss_type = MWIFIEX_BSS_MODE_INFRA;
2465         bgscan_cfg->action = MWIFIEX_BGSCAN_ACT_SET;
2466         bgscan_cfg->enable = false;
2467
2468         if (mwifiex_send_cmd(priv, HostCmd_CMD_802_11_BG_SCAN_CONFIG,
2469                              HostCmd_ACT_GEN_SET, 0, bgscan_cfg, true)) {
2470                 kfree(bgscan_cfg);
2471                 return -EFAULT;
2472         }
2473
2474         kfree(bgscan_cfg);
2475         priv->sched_scanning = false;
2476
2477         return 0;
2478 }
2479
2480 static void
2481 mwifiex_update_chan_statistics(struct mwifiex_private *priv,
2482                                struct mwifiex_ietypes_chanstats *tlv_stat)
2483 {
2484         struct mwifiex_adapter *adapter = priv->adapter;
2485         u8 i, num_chan;
2486         struct mwifiex_fw_chan_stats *fw_chan_stats;
2487         struct mwifiex_chan_stats chan_stats;
2488
2489         fw_chan_stats = (void *)((u8 *)tlv_stat +
2490                               sizeof(struct mwifiex_ie_types_header));
2491         num_chan = le16_to_cpu(tlv_stat->header.len) /
2492                                               sizeof(struct mwifiex_chan_stats);
2493
2494         for (i = 0 ; i < num_chan; i++) {
2495                 chan_stats.chan_num = fw_chan_stats->chan_num;
2496                 chan_stats.bandcfg = fw_chan_stats->bandcfg;
2497                 chan_stats.flags = fw_chan_stats->flags;
2498                 chan_stats.noise = fw_chan_stats->noise;
2499                 chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
2500                 chan_stats.cca_scan_dur =
2501                                        le16_to_cpu(fw_chan_stats->cca_scan_dur);
2502                 chan_stats.cca_busy_dur =
2503                                        le16_to_cpu(fw_chan_stats->cca_busy_dur);
2504                 mwifiex_dbg(adapter, INFO,
2505                             "chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
2506                             chan_stats.chan_num,
2507                             chan_stats.noise,
2508                             chan_stats.total_bss,
2509                             chan_stats.cca_scan_dur,
2510                             chan_stats.cca_busy_dur);
2511                 memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
2512                        sizeof(struct mwifiex_chan_stats));
2513                 fw_chan_stats++;
2514         }
2515 }
2516
2517 /* This function handles the command response of extended scan */
2518 int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
2519                                 struct host_cmd_ds_command *resp)
2520 {
2521         struct mwifiex_adapter *adapter = priv->adapter;
2522         struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
2523         struct mwifiex_ie_types_header *tlv;
2524         struct mwifiex_ietypes_chanstats *tlv_stat;
2525         u16 buf_left, type, len;
2526
2527         struct host_cmd_ds_command *cmd_ptr;
2528         struct cmd_ctrl_node *cmd_node;
2529         unsigned long cmd_flags, scan_flags;
2530         bool complete_scan = false;
2531
2532         mwifiex_dbg(adapter, INFO, "info: EXT scan returns successfully\n");
2533
2534         ext_scan_resp = &resp->params.ext_scan;
2535
2536         tlv = (void *)ext_scan_resp->tlv_buffer;
2537         buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN
2538                                               - 1);
2539
2540         while (buf_left >= sizeof(struct mwifiex_ie_types_header)) {
2541                 type = le16_to_cpu(tlv->type);
2542                 len = le16_to_cpu(tlv->len);
2543
2544                 if (buf_left < (sizeof(struct mwifiex_ie_types_header) + len)) {
2545                         mwifiex_dbg(adapter, ERROR,
2546                                     "error processing scan response TLVs");
2547                         break;
2548                 }
2549
2550                 switch (type) {
2551                 case TLV_TYPE_CHANNEL_STATS:
2552                         tlv_stat = (void *)tlv;
2553                         mwifiex_update_chan_statistics(priv, tlv_stat);
2554                         break;
2555                 default:
2556                         break;
2557                 }
2558
2559                 buf_left -= len + sizeof(struct mwifiex_ie_types_header);
2560                 tlv = (void *)((u8 *)tlv + len +
2561                                sizeof(struct mwifiex_ie_types_header));
2562         }
2563
2564         spin_lock_irqsave(&adapter->cmd_pending_q_lock, cmd_flags);
2565         spin_lock_irqsave(&adapter->scan_pending_q_lock, scan_flags);
2566         if (list_empty(&adapter->scan_pending_q)) {
2567                 complete_scan = true;
2568                 list_for_each_entry(cmd_node, &adapter->cmd_pending_q, list) {
2569                         cmd_ptr = (void *)cmd_node->cmd_skb->data;
2570                         if (le16_to_cpu(cmd_ptr->command) ==
2571                             HostCmd_CMD_802_11_SCAN_EXT) {
2572                                 mwifiex_dbg(adapter, INFO,
2573                                             "Scan pending in command pending list");
2574                                 complete_scan = false;
2575                                 break;
2576                         }
2577                 }
2578         }
2579         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, scan_flags);
2580         spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, cmd_flags);
2581
2582         if (complete_scan)
2583                 mwifiex_complete_scan(priv);
2584
2585         return 0;
2586 }
2587
2588 /* This function This function handles the event extended scan report. It
2589  * parses extended scan results and informs to cfg80211 stack.
2590  */
2591 int mwifiex_handle_event_ext_scan_report(struct mwifiex_private *priv,
2592                                          void *buf)
2593 {
2594         int ret = 0;
2595         struct mwifiex_adapter *adapter = priv->adapter;
2596         u8 *bss_info;
2597         u32 bytes_left, bytes_left_for_tlv, idx;
2598         u16 type, len;
2599         struct mwifiex_ie_types_data *tlv;
2600         struct mwifiex_ie_types_bss_scan_rsp *scan_rsp_tlv;
2601         struct mwifiex_ie_types_bss_scan_info *scan_info_tlv;
2602         u8 *radio_type;
2603         u64 fw_tsf = 0;
2604         s32 rssi = 0;
2605         struct mwifiex_event_scan_result *event_scan = buf;
2606         u8 num_of_set = event_scan->num_of_set;
2607         u8 *scan_resp = buf + sizeof(struct mwifiex_event_scan_result);
2608         u16 scan_resp_size = le16_to_cpu(event_scan->buf_size);
2609
2610         if (num_of_set > MWIFIEX_MAX_AP) {
2611                 mwifiex_dbg(adapter, ERROR,
2612                             "EXT_SCAN: Invalid number of AP returned (%d)!!\n",
2613                             num_of_set);
2614                 ret = -1;
2615                 goto check_next_scan;
2616         }
2617
2618         bytes_left = scan_resp_size;
2619         mwifiex_dbg(adapter, INFO,
2620                     "EXT_SCAN: size %d, returned %d APs...",
2621                     scan_resp_size, num_of_set);
2622         mwifiex_dbg_dump(adapter, CMD_D, "EXT_SCAN buffer:", buf,
2623                          scan_resp_size +
2624                          sizeof(struct mwifiex_event_scan_result));
2625
2626         tlv = (struct mwifiex_ie_types_data *)scan_resp;
2627
2628         for (idx = 0; idx < num_of_set && bytes_left; idx++) {
2629                 type = le16_to_cpu(tlv->header.type);
2630                 len = le16_to_cpu(tlv->header.len);
2631                 if (bytes_left < sizeof(struct mwifiex_ie_types_header) + len) {
2632                         mwifiex_dbg(adapter, ERROR,
2633                                     "EXT_SCAN: Error bytes left < TLV length\n");
2634                         break;
2635                 }
2636                 scan_rsp_tlv = NULL;
2637                 scan_info_tlv = NULL;
2638                 bytes_left_for_tlv = bytes_left;
2639
2640                 /* BSS response TLV with beacon or probe response buffer
2641                  * at the initial position of each descriptor
2642                  */
2643                 if (type != TLV_TYPE_BSS_SCAN_RSP)
2644                         break;
2645
2646                 bss_info = (u8 *)tlv;
2647                 scan_rsp_tlv = (struct mwifiex_ie_types_bss_scan_rsp *)tlv;
2648                 tlv = (struct mwifiex_ie_types_data *)(tlv->data + len);
2649                 bytes_left_for_tlv -=
2650                                 (len + sizeof(struct mwifiex_ie_types_header));
2651
2652                 while (bytes_left_for_tlv >=
2653                        sizeof(struct mwifiex_ie_types_header) &&
2654                        le16_to_cpu(tlv->header.type) != TLV_TYPE_BSS_SCAN_RSP) {
2655                         type = le16_to_cpu(tlv->header.type);
2656                         len = le16_to_cpu(tlv->header.len);
2657                         if (bytes_left_for_tlv <
2658                             sizeof(struct mwifiex_ie_types_header) + len) {
2659                                 mwifiex_dbg(adapter, ERROR,
2660                                             "EXT_SCAN: Error in processing TLV,\t"
2661                                             "bytes left < TLV length\n");
2662                                 scan_rsp_tlv = NULL;
2663                                 bytes_left_for_tlv = 0;
2664                                 continue;
2665                         }
2666                         switch (type) {
2667                         case TLV_TYPE_BSS_SCAN_INFO:
2668                                 scan_info_tlv =
2669                                   (struct mwifiex_ie_types_bss_scan_info *)tlv;
2670                                 if (len !=
2671                                  sizeof(struct mwifiex_ie_types_bss_scan_info) -
2672                                  sizeof(struct mwifiex_ie_types_header)) {
2673                                         bytes_left_for_tlv = 0;
2674                                         continue;
2675                                 }
2676                                 break;
2677                         default:
2678                                 break;
2679                         }
2680                         tlv = (struct mwifiex_ie_types_data *)(tlv->data + len);
2681                         bytes_left -=
2682                                 (len + sizeof(struct mwifiex_ie_types_header));
2683                         bytes_left_for_tlv -=
2684                                 (len + sizeof(struct mwifiex_ie_types_header));
2685                 }
2686
2687                 if (!scan_rsp_tlv)
2688                         break;
2689
2690                 /* Advance pointer to the beacon buffer length and
2691                  * update the bytes count so that the function
2692                  * wlan_interpret_bss_desc_with_ie() can handle the
2693                  * scan buffer withut any change
2694                  */
2695                 bss_info += sizeof(u16);
2696                 bytes_left -= sizeof(u16);
2697
2698                 if (scan_info_tlv) {
2699                         rssi = (s32)(s16)(le16_to_cpu(scan_info_tlv->rssi));
2700                         rssi *= 100;           /* Convert dBm to mBm */
2701                         mwifiex_dbg(adapter, INFO,
2702                                     "info: InterpretIE: RSSI=%d\n", rssi);
2703                         fw_tsf = le64_to_cpu(scan_info_tlv->tsf);
2704                         radio_type = &scan_info_tlv->radio_type;
2705                 } else {
2706                         radio_type = NULL;
2707                 }
2708                 ret = mwifiex_parse_single_response_buf(priv, &bss_info,
2709                                                         &bytes_left, fw_tsf,
2710                                                         radio_type, true, rssi);
2711                 if (ret)
2712                         goto check_next_scan;
2713         }
2714
2715 check_next_scan:
2716         if (!event_scan->more_event)
2717                 mwifiex_check_next_scan_command(priv);
2718
2719         return ret;
2720 }
2721
2722 /*
2723  * This function prepares command for background scan query.
2724  *
2725  * Preparation includes -
2726  *      - Setting command ID and proper size
2727  *      - Setting background scan flush parameter
2728  *      - Ensuring correct endian-ness
2729  */
2730 int mwifiex_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
2731 {
2732         struct host_cmd_ds_802_11_bg_scan_query *bg_query =
2733                 &cmd->params.bg_scan_query;
2734
2735         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_QUERY);
2736         cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_bg_scan_query)
2737                                 + S_DS_GEN);
2738
2739         bg_query->flush = 1;
2740
2741         return 0;
2742 }
2743
2744 /*
2745  * This function inserts scan command node to the scan pending queue.
2746  */
2747 void
2748 mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
2749                        struct cmd_ctrl_node *cmd_node)
2750 {
2751         struct mwifiex_adapter *adapter = priv->adapter;
2752         unsigned long flags;
2753
2754         cmd_node->wait_q_enabled = true;
2755         cmd_node->condition = &adapter->scan_wait_q_woken;
2756         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
2757         list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
2758         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
2759 }
2760
2761 /*
2762  * This function sends a scan command for all available channels to the
2763  * firmware, filtered on a specific SSID.
2764  */
2765 static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
2766                                       struct cfg80211_ssid *req_ssid)
2767 {
2768         struct mwifiex_adapter *adapter = priv->adapter;
2769         int ret;
2770         struct mwifiex_user_scan_cfg *scan_cfg;
2771
2772         if (adapter->scan_processing) {
2773                 mwifiex_dbg(adapter, WARN,
2774                             "cmd: Scan already in process...\n");
2775                 return -EBUSY;
2776         }
2777
2778         if (priv->scan_block) {
2779                 mwifiex_dbg(adapter, WARN,
2780                             "cmd: Scan is blocked during association...\n");
2781                 return -EBUSY;
2782         }
2783
2784         scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg), GFP_KERNEL);
2785         if (!scan_cfg)
2786                 return -ENOMEM;
2787
2788         ether_addr_copy(scan_cfg->random_mac, priv->random_mac);
2789         scan_cfg->ssid_list = req_ssid;
2790         scan_cfg->num_ssids = 1;
2791
2792         ret = mwifiex_scan_networks(priv, scan_cfg);
2793
2794         kfree(scan_cfg);
2795         return ret;
2796 }
2797
2798 /*
2799  * Sends IOCTL request to start a scan.
2800  *
2801  * This function allocates the IOCTL request buffer, fills it
2802  * with requisite parameters and calls the IOCTL handler.
2803  *
2804  * Scan command can be issued for both normal scan and specific SSID
2805  * scan, depending upon whether an SSID is provided or not.
2806  */
2807 int mwifiex_request_scan(struct mwifiex_private *priv,
2808                          struct cfg80211_ssid *req_ssid)
2809 {
2810         int ret;
2811
2812         if (mutex_lock_interruptible(&priv->async_mutex)) {
2813                 mwifiex_dbg(priv->adapter, ERROR,
2814                             "%s: acquire semaphore fail\n",
2815                             __func__);
2816                 return -1;
2817         }
2818
2819         priv->adapter->scan_wait_q_woken = false;
2820
2821         if (req_ssid && req_ssid->ssid_len != 0)
2822                 /* Specific SSID scan */
2823                 ret = mwifiex_scan_specific_ssid(priv, req_ssid);
2824         else
2825                 /* Normal scan */
2826                 ret = mwifiex_scan_networks(priv, NULL);
2827
2828         mutex_unlock(&priv->async_mutex);
2829
2830         return ret;
2831 }
2832
2833 /*
2834  * This function appends the vendor specific IE TLV to a buffer.
2835  */
2836 int
2837 mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,
2838                             u16 vsie_mask, u8 **buffer)
2839 {
2840         int id, ret_len = 0;
2841         struct mwifiex_ie_types_vendor_param_set *vs_param_set;
2842
2843         if (!buffer)
2844                 return 0;
2845         if (!(*buffer))
2846                 return 0;
2847
2848         /*
2849          * Traverse through the saved vendor specific IE array and append
2850          * the selected(scan/assoc/adhoc) IE as TLV to the command
2851          */
2852         for (id = 0; id < MWIFIEX_MAX_VSIE_NUM; id++) {
2853                 if (priv->vs_ie[id].mask & vsie_mask) {
2854                         vs_param_set =
2855                                 (struct mwifiex_ie_types_vendor_param_set *)
2856                                 *buffer;
2857                         vs_param_set->header.type =
2858                                 cpu_to_le16(TLV_TYPE_PASSTHROUGH);
2859                         vs_param_set->header.len =
2860                                 cpu_to_le16((((u16) priv->vs_ie[id].ie[1])
2861                                 & 0x00FF) + 2);
2862                         memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
2863                                le16_to_cpu(vs_param_set->header.len));
2864                         *buffer += le16_to_cpu(vs_param_set->header.len) +
2865                                    sizeof(struct mwifiex_ie_types_header);
2866                         ret_len += le16_to_cpu(vs_param_set->header.len) +
2867                                    sizeof(struct mwifiex_ie_types_header);
2868                 }
2869         }
2870         return ret_len;
2871 }
2872
2873 /*
2874  * This function saves a beacon buffer of the current BSS descriptor.
2875  *
2876  * The current beacon buffer is saved so that it can be restored in the
2877  * following cases that makes the beacon buffer not to contain the current
2878  * ssid's beacon buffer.
2879  *      - The current ssid was not found somehow in the last scan.
2880  *      - The current ssid was the last entry of the scan table and overloaded.
2881  */
2882 void
2883 mwifiex_save_curr_bcn(struct mwifiex_private *priv)
2884 {
2885         struct mwifiex_bssdescriptor *curr_bss =
2886                 &priv->curr_bss_params.bss_descriptor;
2887
2888         if (!curr_bss->beacon_buf_size)
2889                 return;
2890
2891         /* allocate beacon buffer at 1st time; or if it's size has changed */
2892         if (!priv->curr_bcn_buf ||
2893             priv->curr_bcn_size != curr_bss->beacon_buf_size) {
2894                 priv->curr_bcn_size = curr_bss->beacon_buf_size;
2895
2896                 kfree(priv->curr_bcn_buf);
2897                 priv->curr_bcn_buf = kmalloc(curr_bss->beacon_buf_size,
2898                                              GFP_ATOMIC);
2899                 if (!priv->curr_bcn_buf)
2900                         return;
2901         }
2902
2903         memcpy(priv->curr_bcn_buf, curr_bss->beacon_buf,
2904                curr_bss->beacon_buf_size);
2905         mwifiex_dbg(priv->adapter, INFO,
2906                     "info: current beacon saved %d\n",
2907                     priv->curr_bcn_size);
2908
2909         curr_bss->beacon_buf = priv->curr_bcn_buf;
2910
2911         /* adjust the pointers in the current BSS descriptor */
2912         if (curr_bss->bcn_wpa_ie)
2913                 curr_bss->bcn_wpa_ie =
2914                         (struct ieee_types_vendor_specific *)
2915                         (curr_bss->beacon_buf +
2916                          curr_bss->wpa_offset);
2917
2918         if (curr_bss->bcn_rsn_ie)
2919                 curr_bss->bcn_rsn_ie = (struct ieee_types_generic *)
2920                         (curr_bss->beacon_buf +
2921                          curr_bss->rsn_offset);
2922
2923         if (curr_bss->bcn_ht_cap)
2924                 curr_bss->bcn_ht_cap = (struct ieee80211_ht_cap *)
2925                         (curr_bss->beacon_buf +
2926                          curr_bss->ht_cap_offset);
2927
2928         if (curr_bss->bcn_ht_oper)
2929                 curr_bss->bcn_ht_oper = (struct ieee80211_ht_operation *)
2930                         (curr_bss->beacon_buf +
2931                          curr_bss->ht_info_offset);
2932
2933         if (curr_bss->bcn_vht_cap)
2934                 curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
2935                                                  curr_bss->vht_cap_offset);
2936
2937         if (curr_bss->bcn_vht_oper)
2938                 curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
2939                                                   curr_bss->vht_info_offset);
2940
2941         if (curr_bss->bcn_bss_co_2040)
2942                 curr_bss->bcn_bss_co_2040 =
2943                         (curr_bss->beacon_buf + curr_bss->bss_co_2040_offset);
2944
2945         if (curr_bss->bcn_ext_cap)
2946                 curr_bss->bcn_ext_cap = curr_bss->beacon_buf +
2947                         curr_bss->ext_cap_offset;
2948
2949         if (curr_bss->oper_mode)
2950                 curr_bss->oper_mode = (void *)(curr_bss->beacon_buf +
2951                                                curr_bss->oper_mode_offset);
2952 }
2953
2954 /*
2955  * This function frees the current BSS descriptor beacon buffer.
2956  */
2957 void
2958 mwifiex_free_curr_bcn(struct mwifiex_private *priv)
2959 {
2960         kfree(priv->curr_bcn_buf);
2961         priv->curr_bcn_buf = NULL;
2962 }