2 * Functions implementing wlan scan IOCTL and firmware command APIs
4 * IOCTL handlers as well as command preperation and response routines
5 * for sending scan commands to the firmware.
7 #include <linux/ctype.h>
9 #include <linux/netdevice.h>
10 #include <linux/wireless.h>
11 #include <linux/etherdevice.h>
13 #include <net/ieee80211.h>
14 #include <net/iw_handler.h>
16 #include <asm/unaligned.h>
24 //! Approximate amount of data needed to pass a scan result back to iwlist
25 #define MAX_SCAN_CELL_SIZE (IW_EV_ADDR_LEN \
32 + 40) /* 40 for WPAIE */
34 //! Memory needed to store a max sized channel List TLV for a firmware scan
35 #define CHAN_TLV_MAX_SIZE (sizeof(struct mrvlietypesheader) \
36 + (MRVDRV_MAX_CHANNELS_PER_SCAN \
37 * sizeof(struct chanscanparamset)))
39 //! Memory needed to store a max number/size SSID TLV for a firmware scan
40 #define SSID_TLV_MAX_SIZE (1 * sizeof(struct mrvlietypes_ssidparamset))
42 //! Maximum memory needed for a wlan_scan_cmd_config with all TLVs at max
43 #define MAX_SCAN_CFG_ALLOC (sizeof(struct wlan_scan_cmd_config) \
44 + sizeof(struct mrvlietypes_numprobes) \
48 //! The maximum number of channels the firmware can scan per command
49 #define MRVDRV_MAX_CHANNELS_PER_SCAN 14
52 * @brief Number of channels to scan per firmware scan command issuance.
54 * Number restricted to prevent hitting the limit on the amount of scan data
55 * returned in a single firmware scan command.
57 #define MRVDRV_CHANNELS_PER_SCAN_CMD 4
59 //! Scan time specified in the channel TLV for each channel for passive scans
60 #define MRVDRV_PASSIVE_SCAN_CHAN_TIME 100
62 //! Scan time specified in the channel TLV for each channel for active scans
63 #define MRVDRV_ACTIVE_SCAN_CHAN_TIME 100
65 static const u8 zeromac[ETH_ALEN] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
66 static const u8 bcastmac[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
68 static inline void clear_bss_descriptor (struct bss_descriptor * bss)
70 /* Don't blow away ->list, just BSS data */
71 memset(bss, 0, offsetof(struct bss_descriptor, list));
74 static inline int match_bss_no_security(struct wlan_802_11_security * secinfo,
75 struct bss_descriptor * match_bss)
77 if ( !secinfo->wep_enabled
78 && !secinfo->WPAenabled
79 && !secinfo->WPA2enabled
80 && match_bss->wpa_ie[0] != MFIE_TYPE_GENERIC
81 && match_bss->rsn_ie[0] != MFIE_TYPE_RSN
82 && !(match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
88 static inline int match_bss_static_wep(struct wlan_802_11_security * secinfo,
89 struct bss_descriptor * match_bss)
91 if ( secinfo->wep_enabled
92 && !secinfo->WPAenabled
93 && !secinfo->WPA2enabled
94 && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
100 static inline int match_bss_wpa(struct wlan_802_11_security * secinfo,
101 struct bss_descriptor * match_bss)
103 if ( !secinfo->wep_enabled
104 && secinfo->WPAenabled
105 && (match_bss->wpa_ie[0] == MFIE_TYPE_GENERIC)
106 /* privacy bit may NOT be set in some APs like LinkSys WRT54G
107 && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
115 static inline int match_bss_wpa2(struct wlan_802_11_security * secinfo,
116 struct bss_descriptor * match_bss)
118 if ( !secinfo->wep_enabled
119 && secinfo->WPA2enabled
120 && (match_bss->rsn_ie[0] == MFIE_TYPE_RSN)
121 /* privacy bit may NOT be set in some APs like LinkSys WRT54G
122 && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
130 static inline int match_bss_dynamic_wep(struct wlan_802_11_security * secinfo,
131 struct bss_descriptor * match_bss)
133 if ( !secinfo->wep_enabled
134 && !secinfo->WPAenabled
135 && !secinfo->WPA2enabled
136 && (match_bss->wpa_ie[0] != MFIE_TYPE_GENERIC)
137 && (match_bss->rsn_ie[0] != MFIE_TYPE_RSN)
138 && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
145 * @brief Check if a scanned network compatible with the driver settings
147 * WEP WPA WPA2 ad-hoc encrypt Network
148 * enabled enabled enabled AES mode privacy WPA WPA2 Compatible
149 * 0 0 0 0 NONE 0 0 0 yes No security
150 * 1 0 0 0 NONE 1 0 0 yes Static WEP
151 * 0 1 0 0 x 1x 1 x yes WPA
152 * 0 0 1 0 x 1x x 1 yes WPA2
153 * 0 0 0 1 NONE 1 0 0 yes Ad-hoc AES
154 * 0 0 0 0 !=NONE 1 0 0 yes Dynamic WEP
157 * @param adapter A pointer to wlan_adapter
158 * @param index Index in scantable to check against current driver settings
159 * @param mode Network mode: Infrastructure or IBSS
161 * @return Index in scantable, or error code if negative
163 static int is_network_compatible(wlan_adapter * adapter,
164 struct bss_descriptor * bss, u8 mode)
168 lbs_deb_enter(LBS_DEB_ASSOC);
170 if (bss->mode != mode)
173 if ((matched = match_bss_no_security(&adapter->secinfo, bss))) {
175 } else if ((matched = match_bss_static_wep(&adapter->secinfo, bss))) {
177 } else if ((matched = match_bss_wpa(&adapter->secinfo, bss))) {
179 "is_network_compatible() WPA: wpa_ie=%#x "
180 "wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s "
181 "privacy=%#x\n", bss->wpa_ie[0], bss->rsn_ie[0],
182 adapter->secinfo.wep_enabled ? "e" : "d",
183 adapter->secinfo.WPAenabled ? "e" : "d",
184 adapter->secinfo.WPA2enabled ? "e" : "d",
185 (bss->capability & WLAN_CAPABILITY_PRIVACY));
187 } else if ((matched = match_bss_wpa2(&adapter->secinfo, bss))) {
189 "is_network_compatible() WPA2: wpa_ie=%#x "
190 "wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s "
191 "privacy=%#x\n", bss->wpa_ie[0], bss->rsn_ie[0],
192 adapter->secinfo.wep_enabled ? "e" : "d",
193 adapter->secinfo.WPAenabled ? "e" : "d",
194 adapter->secinfo.WPA2enabled ? "e" : "d",
195 (bss->capability & WLAN_CAPABILITY_PRIVACY));
197 } else if ((matched = match_bss_dynamic_wep(&adapter->secinfo, bss))) {
199 "is_network_compatible() dynamic WEP: "
200 "wpa_ie=%#x wpa2_ie=%#x privacy=%#x\n",
201 bss->wpa_ie[0], bss->rsn_ie[0],
202 (bss->capability & WLAN_CAPABILITY_PRIVACY));
206 /* bss security settings don't match those configured on card */
208 "is_network_compatible() FAILED: wpa_ie=%#x "
209 "wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s privacy=%#x\n",
210 bss->wpa_ie[0], bss->rsn_ie[0],
211 adapter->secinfo.wep_enabled ? "e" : "d",
212 adapter->secinfo.WPAenabled ? "e" : "d",
213 adapter->secinfo.WPA2enabled ? "e" : "d",
214 (bss->capability & WLAN_CAPABILITY_PRIVACY));
217 lbs_deb_leave(LBS_DEB_SCAN);
222 * @brief Create a channel list for the driver to scan based on region info
224 * Use the driver region/band information to construct a comprehensive list
225 * of channels to scan. This routine is used for any scan that is not
226 * provided a specific channel list to scan.
228 * @param priv A pointer to wlan_private structure
229 * @param scanchanlist Output parameter: resulting channel list to scan
230 * @param filteredscan Flag indicating whether or not a BSSID or SSID filter
231 * is being sent in the command to firmware. Used to
232 * increase the number of channels sent in a scan
233 * command and to disable the firmware channel scan
238 static void wlan_scan_create_channel_list(wlan_private * priv,
239 struct chanscanparamset * scanchanlist,
243 wlan_adapter *adapter = priv->adapter;
244 struct region_channel *scanregion;
245 struct chan_freq_power *cfp;
253 /* Set the default scan type to the user specified type, will later
254 * be changed to passive on a per channel basis if restricted by
255 * regulatory requirements (11d or 11h)
257 scantype = CMD_SCAN_TYPE_ACTIVE;
259 for (rgnidx = 0; rgnidx < ARRAY_SIZE(adapter->region_channel); rgnidx++) {
260 if (priv->adapter->enable11d &&
261 adapter->connect_status != LIBERTAS_CONNECTED) {
262 /* Scan all the supported chan for the first scan */
263 if (!adapter->universal_channel[rgnidx].valid)
265 scanregion = &adapter->universal_channel[rgnidx];
267 /* clear the parsed_region_chan for the first scan */
268 memset(&adapter->parsed_region_chan, 0x00,
269 sizeof(adapter->parsed_region_chan));
271 if (!adapter->region_channel[rgnidx].valid)
273 scanregion = &adapter->region_channel[rgnidx];
277 nextchan < scanregion->nrcfp; nextchan++, chanidx++) {
279 cfp = scanregion->CFP + nextchan;
281 if (priv->adapter->enable11d) {
283 libertas_get_scan_type_11d(cfp->channel,
288 switch (scanregion->band) {
292 scanchanlist[chanidx].radiotype =
293 CMD_SCAN_RADIO_TYPE_BG;
297 if (scantype == CMD_SCAN_TYPE_PASSIVE) {
298 scanchanlist[chanidx].maxscantime =
299 cpu_to_le16(MRVDRV_PASSIVE_SCAN_CHAN_TIME);
300 scanchanlist[chanidx].chanscanmode.passivescan =
303 scanchanlist[chanidx].maxscantime =
304 cpu_to_le16(MRVDRV_ACTIVE_SCAN_CHAN_TIME);
305 scanchanlist[chanidx].chanscanmode.passivescan =
309 scanchanlist[chanidx].channumber = cfp->channel;
312 scanchanlist[chanidx].chanscanmode.
320 /* Delayed partial scan worker */
321 void libertas_scan_worker(struct work_struct *work)
323 wlan_private *priv = container_of(work, wlan_private, scan_work.work);
325 wlan_scan_networks(priv, NULL, 0);
330 * @brief Construct a wlan_scan_cmd_config structure to use in issue scan cmds
332 * Application layer or other functions can invoke wlan_scan_networks
333 * with a scan configuration supplied in a wlan_ioctl_user_scan_cfg struct.
334 * This structure is used as the basis of one or many wlan_scan_cmd_config
335 * commands that are sent to the command processing module and sent to
338 * Create a wlan_scan_cmd_config based on the following user supplied
339 * parameters (if present):
342 * - Number of Probes to be sent
345 * If the SSID or BSSID filter is not present, disable/clear the filter.
346 * If the number of probes is not set, use the adapter default setting
347 * Qualify the channel
349 * @param priv A pointer to wlan_private structure
350 * @param puserscanin NULL or pointer to scan configuration parameters
351 * @param ppchantlvout Output parameter: Pointer to the start of the
352 * channel TLV portion of the output scan config
353 * @param pscanchanlist Output parameter: Pointer to the resulting channel
355 * @param pmaxchanperscan Output parameter: Number of channels to scan for
356 * each issuance of the firmware scan command
357 * @param pfilteredscan Output parameter: Flag indicating whether or not
358 * a BSSID or SSID filter is being sent in the
359 * command to firmware. Used to increase the number
360 * of channels sent in a scan command and to
361 * disable the firmware channel scan filter.
362 * @param pscancurrentonly Output parameter: Flag indicating whether or not
363 * we are only scanning our current active channel
365 * @return resulting scan configuration
367 static struct wlan_scan_cmd_config *
368 wlan_scan_setup_scan_config(wlan_private * priv,
369 const struct wlan_ioctl_user_scan_cfg * puserscanin,
370 struct mrvlietypes_chanlistparamset ** ppchantlvout,
371 struct chanscanparamset * pscanchanlist,
372 int *pmaxchanperscan,
374 u8 * pscancurrentonly)
376 struct mrvlietypes_numprobes *pnumprobestlv;
377 struct mrvlietypes_ssidparamset *pssidtlv;
378 struct wlan_scan_cmd_config * pscancfgout = NULL;
387 pscancfgout = kzalloc(MAX_SCAN_CFG_ALLOC, GFP_KERNEL);
388 if (pscancfgout == NULL)
391 /* The tlvbufferlen is calculated for each scan command. The TLVs added
392 * in this routine will be preserved since the routine that sends
393 * the command will append channelTLVs at *ppchantlvout. The difference
394 * between the *ppchantlvout and the tlvbuffer start will be used
395 * to calculate the size of anything we add in this routine.
397 pscancfgout->tlvbufferlen = 0;
399 /* Running tlv pointer. Assigned to ppchantlvout at end of function
400 * so later routines know where channels can be added to the command buf
402 ptlvpos = pscancfgout->tlvbuffer;
405 * Set the initial scan paramters for progressive scanning. If a specific
406 * BSSID or SSID is used, the number of channels in the scan command
407 * will be increased to the absolute maximum
409 *pmaxchanperscan = MRVDRV_CHANNELS_PER_SCAN_CMD;
411 /* Initialize the scan as un-filtered by firmware, set to TRUE below if
412 * a SSID or BSSID filter is sent in the command
416 /* Initialize the scan as not being only on the current channel. If
417 * the channel list is customized, only contains one channel, and
418 * is the active channel, this is set true and data flow is not halted.
420 *pscancurrentonly = 0;
423 /* Set the bss type scan filter, use adapter setting if unset */
424 pscancfgout->bsstype =
425 puserscanin->bsstype ? puserscanin->bsstype : CMD_BSS_TYPE_ANY;
427 /* Set the number of probes to send, use adapter setting if unset */
428 numprobes = puserscanin->numprobes ? puserscanin->numprobes : 0;
431 * Set the BSSID filter to the incoming configuration,
432 * if non-zero. If not set, it will remain disabled (all zeros).
434 memcpy(pscancfgout->bssid, puserscanin->bssid,
435 sizeof(pscancfgout->bssid));
437 if (puserscanin->ssid_len) {
439 (struct mrvlietypes_ssidparamset *) pscancfgout->
441 pssidtlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
442 pssidtlv->header.len = cpu_to_le16(puserscanin->ssid_len);
443 memcpy(pssidtlv->ssid, puserscanin->ssid,
444 puserscanin->ssid_len);
445 ptlvpos += sizeof(pssidtlv->header) + puserscanin->ssid_len;
449 * The default number of channels sent in the command is low to
450 * ensure the response buffer from the firmware does not truncate
451 * scan results. That is not an issue with an SSID or BSSID
452 * filter applied to the scan results in the firmware.
454 if ( puserscanin->ssid_len
455 || (compare_ether_addr(pscancfgout->bssid, &zeromac[0]) != 0)) {
456 *pmaxchanperscan = MRVDRV_MAX_CHANNELS_PER_SCAN;
460 pscancfgout->bsstype = CMD_BSS_TYPE_ANY;
464 /* If the input config or adapter has the number of Probes set, add tlv */
466 pnumprobestlv = (struct mrvlietypes_numprobes *) ptlvpos;
467 pnumprobestlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
468 pnumprobestlv->header.len = cpu_to_le16(2);
469 pnumprobestlv->numprobes = cpu_to_le16(numprobes);
471 ptlvpos += sizeof(*pnumprobestlv);
475 * Set the output for the channel TLV to the address in the tlv buffer
476 * past any TLVs that were added in this fuction (SSID, numprobes).
477 * channel TLVs will be added past this for each scan command, preserving
478 * the TLVs that were previously added.
480 *ppchantlvout = (struct mrvlietypes_chanlistparamset *) ptlvpos;
482 if (!puserscanin || !puserscanin->chanlist[0].channumber) {
483 /* Create a default channel scan list */
484 lbs_deb_scan("Scan: Creating full region channel list\n");
485 wlan_scan_create_channel_list(priv, pscanchanlist,
490 lbs_deb_scan("Scan: Using supplied channel list\n");
492 chanidx < WLAN_IOCTL_USER_SCAN_CHAN_MAX
493 && puserscanin->chanlist[chanidx].channumber; chanidx++) {
495 channel = puserscanin->chanlist[chanidx].channumber;
496 (pscanchanlist + chanidx)->channumber = channel;
498 radiotype = puserscanin->chanlist[chanidx].radiotype;
499 (pscanchanlist + chanidx)->radiotype = radiotype;
501 scantype = puserscanin->chanlist[chanidx].scantype;
503 if (scantype == CMD_SCAN_TYPE_PASSIVE) {
505 chanidx)->chanscanmode.passivescan = 1;
508 chanidx)->chanscanmode.passivescan = 0;
511 if (puserscanin->chanlist[chanidx].scantime) {
512 scandur = puserscanin->chanlist[chanidx].scantime;
514 if (scantype == CMD_SCAN_TYPE_PASSIVE) {
515 scandur = MRVDRV_PASSIVE_SCAN_CHAN_TIME;
517 scandur = MRVDRV_ACTIVE_SCAN_CHAN_TIME;
521 (pscanchanlist + chanidx)->minscantime =
522 cpu_to_le16(scandur);
523 (pscanchanlist + chanidx)->maxscantime =
524 cpu_to_le16(scandur);
527 /* Check if we are only scanning the current channel */
528 if ((chanidx == 1) &&
529 (puserscanin->chanlist[0].channumber ==
530 priv->adapter->curbssparams.channel)) {
531 *pscancurrentonly = 1;
532 lbs_deb_scan("Scan: Scanning current channel only");
540 * @brief Construct and send multiple scan config commands to the firmware
542 * Previous routines have created a wlan_scan_cmd_config with any requested
543 * TLVs. This function splits the channel TLV into maxchanperscan lists
544 * and sends the portion of the channel TLV along with the other TLVs
545 * to the wlan_cmd routines for execution in the firmware.
547 * @param priv A pointer to wlan_private structure
548 * @param maxchanperscan Maximum number channels to be included in each
549 * scan command sent to firmware
550 * @param filteredscan Flag indicating whether or not a BSSID or SSID
551 * filter is being used for the firmware command
552 * scan command sent to firmware
553 * @param pscancfgout Scan configuration used for this scan.
554 * @param pchantlvout Pointer in the pscancfgout where the channel TLV
555 * should start. This is past any other TLVs that
556 * must be sent down in each firmware command.
557 * @param pscanchanlist List of channels to scan in maxchanperscan segments
559 * @return 0 or error return otherwise
561 static int wlan_scan_channel_list(wlan_private * priv,
564 struct wlan_scan_cmd_config * pscancfgout,
565 struct mrvlietypes_chanlistparamset * pchantlvout,
566 struct chanscanparamset * pscanchanlist,
567 const struct wlan_ioctl_user_scan_cfg * puserscanin,
570 struct chanscanparamset *ptmpchan;
571 struct chanscanparamset *pstartchan;
577 union iwreq_data wrqu;
579 lbs_deb_enter(LBS_DEB_ASSOC);
581 if (pscancfgout == 0 || pchantlvout == 0 || pscanchanlist == 0) {
582 lbs_deb_scan("Scan: Null detect: %p, %p, %p\n",
583 pscancfgout, pchantlvout, pscanchanlist);
587 pchantlvout->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
589 /* Set the temp channel struct pointer to the start of the desired list */
590 ptmpchan = pscanchanlist;
592 if (priv->adapter->last_scanned_channel && !puserscanin)
593 ptmpchan += priv->adapter->last_scanned_channel;
595 /* Loop through the desired channel list, sending a new firmware scan
596 * commands for each maxchanperscan channels (or for 1,6,11 individually
597 * if configured accordingly)
599 while (ptmpchan->channumber) {
602 pchantlvout->header.len = 0;
603 scanband = ptmpchan->radiotype;
604 pstartchan = ptmpchan;
607 /* Construct the channel TLV for the scan command. Continue to
608 * insert channel TLVs until:
609 * - the tlvidx hits the maximum configured per scan command
610 * - the next channel to insert is 0 (end of desired channel list)
611 * - doneearly is set (controlling individual scanning of 1,6,11)
613 while (tlvidx < maxchanperscan && ptmpchan->channumber
614 && !doneearly && scanned < 2) {
616 lbs_deb_scan("Scan: Chan(%3d), Radio(%d), mode(%d,%d), "
618 ptmpchan->channumber, ptmpchan->radiotype,
619 ptmpchan->chanscanmode.passivescan,
620 ptmpchan->chanscanmode.disablechanfilt,
621 ptmpchan->maxscantime);
623 /* Copy the current channel TLV to the command being prepared */
624 memcpy(pchantlvout->chanscanparam + tlvidx,
625 ptmpchan, sizeof(pchantlvout->chanscanparam));
627 /* Increment the TLV header length by the size appended */
628 /* Ew, it would be _so_ nice if we could just declare the
629 variable little-endian and let GCC handle it for us */
630 pchantlvout->header.len =
631 cpu_to_le16(le16_to_cpu(pchantlvout->header.len) +
632 sizeof(pchantlvout->chanscanparam));
635 * The tlv buffer length is set to the number of bytes of the
636 * between the channel tlv pointer and the start of the
637 * tlv buffer. This compensates for any TLVs that were appended
638 * before the channel list.
640 pscancfgout->tlvbufferlen = ((u8 *) pchantlvout
641 - pscancfgout->tlvbuffer);
643 /* Add the size of the channel tlv header and the data length */
644 pscancfgout->tlvbufferlen +=
645 (sizeof(pchantlvout->header)
646 + le16_to_cpu(pchantlvout->header.len));
648 /* Increment the index to the channel tlv we are constructing */
653 /* Stop the loop if the *current* channel is in the 1,6,11 set
654 * and we are not filtering on a BSSID or SSID.
656 if (!filteredscan && (ptmpchan->channumber == 1
657 || ptmpchan->channumber == 6
658 || ptmpchan->channumber == 11)) {
662 /* Increment the tmp pointer to the next channel to be scanned */
666 /* Stop the loop if the *next* channel is in the 1,6,11 set.
667 * This will cause it to be the only channel scanned on the next
670 if (!filteredscan && (ptmpchan->channumber == 1
671 || ptmpchan->channumber == 6
672 || ptmpchan->channumber == 11)) {
677 /* Send the scan command to the firmware with the specified cfg */
678 ret = libertas_prepare_and_send_command(priv, CMD_802_11_SCAN, 0,
680 if (scanned >= 2 && !full_scan) {
688 priv->adapter->last_scanned_channel = ptmpchan->channumber;
690 if (priv->adapter->last_scanned_channel) {
691 /* Schedule the next part of the partial scan */
692 if (!full_scan && !priv->adapter->surpriseremoved) {
693 cancel_delayed_work(&priv->scan_work);
694 queue_delayed_work(priv->work_thread, &priv->scan_work,
695 msecs_to_jiffies(300));
698 /* All done, tell userspace the scan table has been updated */
699 memset(&wrqu, 0, sizeof(union iwreq_data));
700 wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
703 lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
708 clear_selected_scan_list_entries(wlan_adapter * adapter,
709 const struct wlan_ioctl_user_scan_cfg * scan_cfg)
711 struct bss_descriptor * bss;
712 struct bss_descriptor * safe;
713 u32 clear_ssid_flag = 0, clear_bssid_flag = 0;
718 if (scan_cfg->clear_ssid && scan_cfg->ssid_len)
721 if (scan_cfg->clear_bssid
722 && (compare_ether_addr(scan_cfg->bssid, &zeromac[0]) != 0)
723 && (compare_ether_addr(scan_cfg->bssid, &bcastmac[0]) != 0)) {
724 clear_bssid_flag = 1;
727 if (!clear_ssid_flag && !clear_bssid_flag)
730 mutex_lock(&adapter->lock);
731 list_for_each_entry_safe (bss, safe, &adapter->network_list, list) {
734 /* Check for an SSID match */
736 && (bss->ssid_len == scan_cfg->ssid_len)
737 && !memcmp(bss->ssid, scan_cfg->ssid, bss->ssid_len))
740 /* Check for a BSSID match */
741 if ( clear_bssid_flag
742 && !compare_ether_addr(bss->bssid, scan_cfg->bssid))
746 list_move_tail (&bss->list, &adapter->network_free_list);
747 clear_bss_descriptor(bss);
750 mutex_unlock(&adapter->lock);
755 * @brief Internal function used to start a scan based on an input config
757 * Use the input user scan configuration information when provided in
758 * order to send the appropriate scan commands to firmware to populate or
759 * update the internal driver scan table
761 * @param priv A pointer to wlan_private structure
762 * @param puserscanin Pointer to the input configuration for the requested
765 * @return 0 or < 0 if error
767 int wlan_scan_networks(wlan_private * priv,
768 const struct wlan_ioctl_user_scan_cfg * puserscanin,
771 wlan_adapter * adapter = priv->adapter;
772 struct mrvlietypes_chanlistparamset *pchantlvout;
773 struct chanscanparamset * scan_chan_list = NULL;
774 struct wlan_scan_cmd_config * scan_cfg = NULL;
776 u8 scancurrentchanonly;
779 #ifdef CONFIG_LIBERTAS_DEBUG
780 struct bss_descriptor * iter_bss;
782 DECLARE_MAC_BUF(mac);
785 lbs_deb_enter(LBS_DEB_SCAN);
787 /* Cancel any partial outstanding partial scans if this scan
790 if (full_scan && delayed_work_pending(&priv->scan_work))
791 cancel_delayed_work(&priv->scan_work);
793 scan_chan_list = kzalloc(sizeof(struct chanscanparamset) *
794 WLAN_IOCTL_USER_SCAN_CHAN_MAX, GFP_KERNEL);
795 if (scan_chan_list == NULL) {
800 scan_cfg = wlan_scan_setup_scan_config(priv,
806 &scancurrentchanonly);
807 if (scan_cfg == NULL) {
812 clear_selected_scan_list_entries(adapter, puserscanin);
814 /* Keep the data path active if we are only scanning our current channel */
815 if (!scancurrentchanonly) {
816 netif_stop_queue(priv->dev);
817 netif_carrier_off(priv->dev);
818 if (priv->mesh_dev) {
819 netif_stop_queue(priv->mesh_dev);
820 netif_carrier_off(priv->mesh_dev);
824 ret = wlan_scan_channel_list(priv,
833 #ifdef CONFIG_LIBERTAS_DEBUG
834 /* Dump the scan table */
835 mutex_lock(&adapter->lock);
836 list_for_each_entry (iter_bss, &adapter->network_list, list) {
837 lbs_deb_scan("Scan:(%02d) %s, RSSI[%03d], SSID[%s]\n",
838 i++, print_mac(mac, iter_bss->bssid), (s32) iter_bss->rssi,
839 escape_essid(iter_bss->ssid, iter_bss->ssid_len));
841 mutex_unlock(&adapter->lock);
844 if (priv->adapter->connect_status == LIBERTAS_CONNECTED) {
845 netif_carrier_on(priv->dev);
846 netif_wake_queue(priv->dev);
847 if (priv->mesh_dev) {
848 netif_carrier_on(priv->mesh_dev);
849 netif_wake_queue(priv->mesh_dev);
858 kfree(scan_chan_list);
860 lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
865 * @brief Interpret a BSS scan response returned from the firmware
867 * Parse the various fixed fields and IEs passed back for a a BSS probe
868 * response or beacon from the scan command. Record information as needed
869 * in the scan table struct bss_descriptor for that entry.
871 * @param bss Output parameter: Pointer to the BSS Entry
875 static int libertas_process_bss(struct bss_descriptor * bss,
876 u8 ** pbeaconinfo, int *bytesleft)
878 struct ieeetypes_fhparamset *pFH;
879 struct ieeetypes_dsparamset *pDS;
880 struct ieeetypes_cfparamset *pCF;
881 struct ieeetypes_ibssparamset *pibss;
882 DECLARE_MAC_BUF(mac);
883 struct ieeetypes_countryinfoset *pcountryinfo;
885 u8 n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
889 lbs_deb_enter(LBS_DEB_ASSOC);
891 if (*bytesleft >= sizeof(beaconsize)) {
892 /* Extract & convert beacon size from the command buffer */
893 beaconsize = le16_to_cpu(get_unaligned((u16 *)*pbeaconinfo));
894 *bytesleft -= sizeof(beaconsize);
895 *pbeaconinfo += sizeof(beaconsize);
898 if (beaconsize == 0 || beaconsize > *bytesleft) {
899 *pbeaconinfo += *bytesleft;
904 /* Initialize the current working beacon pointer for this BSS iteration */
906 end = pos + beaconsize;
908 /* Advance the return beacon pointer past the current beacon */
909 *pbeaconinfo += beaconsize;
910 *bytesleft -= beaconsize;
912 memcpy(bss->bssid, pos, ETH_ALEN);
913 lbs_deb_scan("process_bss: AP BSSID %s\n", print_mac(mac, bss->bssid));
916 if ((end - pos) < 12) {
917 lbs_deb_scan("process_bss: Not enough bytes left\n");
922 * next 4 fields are RSSI, time stamp, beacon interval,
923 * and capability information
926 /* RSSI is 1 byte long */
928 lbs_deb_scan("process_bss: RSSI=%02X\n", *pos);
931 /* time stamp is 8 bytes long */
934 /* beacon interval is 2 bytes long */
935 bss->beaconperiod = le16_to_cpup((void *) pos);
938 /* capability information is 2 bytes long */
939 bss->capability = le16_to_cpup((void *) pos);
940 lbs_deb_scan("process_bss: capabilities = 0x%4X\n", bss->capability);
943 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
944 lbs_deb_scan("process_bss: AP WEP enabled\n");
945 if (bss->capability & WLAN_CAPABILITY_IBSS)
946 bss->mode = IW_MODE_ADHOC;
948 bss->mode = IW_MODE_INFRA;
950 /* rest of the current buffer are IE's */
951 lbs_deb_scan("process_bss: IE length for this AP = %zd\n", end - pos);
952 lbs_deb_hex(LBS_DEB_SCAN, "process_bss: IE info", pos, end - pos);
954 /* process variable IE */
955 while (pos <= end - 2) {
956 struct ieee80211_info_element * elem =
957 (struct ieee80211_info_element *) pos;
959 if (pos + elem->len > end) {
960 lbs_deb_scan("process_bss: error in processing IE, "
961 "bytes left < IE length\n");
967 bss->ssid_len = elem->len;
968 memcpy(bss->ssid, elem->data, elem->len);
969 lbs_deb_scan("ssid '%s', ssid length %u\n",
970 escape_essid(bss->ssid, bss->ssid_len),
974 case MFIE_TYPE_RATES:
975 n_basic_rates = min_t(u8, MAX_RATES, elem->len);
976 memcpy(bss->rates, elem->data, n_basic_rates);
980 case MFIE_TYPE_FH_SET:
981 pFH = (struct ieeetypes_fhparamset *) pos;
982 memmove(&bss->phyparamset.fhparamset, pFH,
983 sizeof(struct ieeetypes_fhparamset));
984 #if 0 /* I think we can store these LE */
985 bss->phyparamset.fhparamset.dwelltime
986 = le16_to_cpu(bss->phyparamset.fhparamset.dwelltime);
990 case MFIE_TYPE_DS_SET:
991 pDS = (struct ieeetypes_dsparamset *) pos;
992 bss->channel = pDS->currentchan;
993 memcpy(&bss->phyparamset.dsparamset, pDS,
994 sizeof(struct ieeetypes_dsparamset));
997 case MFIE_TYPE_CF_SET:
998 pCF = (struct ieeetypes_cfparamset *) pos;
999 memcpy(&bss->ssparamset.cfparamset, pCF,
1000 sizeof(struct ieeetypes_cfparamset));
1003 case MFIE_TYPE_IBSS_SET:
1004 pibss = (struct ieeetypes_ibssparamset *) pos;
1005 bss->atimwindow = le32_to_cpu(pibss->atimwindow);
1006 memmove(&bss->ssparamset.ibssparamset, pibss,
1007 sizeof(struct ieeetypes_ibssparamset));
1009 bss->ssparamset.ibssparamset.atimwindow
1010 = le16_to_cpu(bss->ssparamset.ibssparamset.atimwindow);
1014 case MFIE_TYPE_COUNTRY:
1015 pcountryinfo = (struct ieeetypes_countryinfoset *) pos;
1016 if (pcountryinfo->len < sizeof(pcountryinfo->countrycode)
1017 || pcountryinfo->len > 254) {
1018 lbs_deb_scan("process_bss: 11D- Err "
1019 "CountryInfo len =%d min=%zd max=254\n",
1021 sizeof(pcountryinfo->countrycode));
1026 memcpy(&bss->countryinfo,
1027 pcountryinfo, pcountryinfo->len + 2);
1028 lbs_deb_hex(LBS_DEB_SCAN, "process_bss: 11d countryinfo",
1029 (u8 *) pcountryinfo,
1030 (u32) (pcountryinfo->len + 2));
1033 case MFIE_TYPE_RATES_EX:
1034 /* only process extended supported rate if data rate is
1035 * already found. Data rate IE should come before
1036 * extended supported rate IE
1038 if (!got_basic_rates)
1041 n_ex_rates = elem->len;
1042 if (n_basic_rates + n_ex_rates > MAX_RATES)
1043 n_ex_rates = MAX_RATES - n_basic_rates;
1045 p = bss->rates + n_basic_rates;
1046 memcpy(p, elem->data, n_ex_rates);
1049 case MFIE_TYPE_GENERIC:
1050 if (elem->len >= 4 &&
1051 elem->data[0] == 0x00 &&
1052 elem->data[1] == 0x50 &&
1053 elem->data[2] == 0xf2 &&
1054 elem->data[3] == 0x01) {
1055 bss->wpa_ie_len = min(elem->len + 2,
1057 memcpy(bss->wpa_ie, elem, bss->wpa_ie_len);
1058 lbs_deb_hex(LBS_DEB_SCAN, "process_bss: WPA IE", bss->wpa_ie,
1060 } else if (elem->len >= MARVELL_MESH_IE_LENGTH &&
1061 elem->data[0] == 0x00 &&
1062 elem->data[1] == 0x50 &&
1063 elem->data[2] == 0x43 &&
1064 elem->data[3] == 0x04) {
1070 bss->rsn_ie_len = min(elem->len + 2, MAX_WPA_IE_LEN);
1071 memcpy(bss->rsn_ie, elem, bss->rsn_ie_len);
1072 lbs_deb_hex(LBS_DEB_SCAN, "process_bss: RSN_IE", bss->rsn_ie, elem->len);
1079 pos += elem->len + 2;
1083 bss->last_scanned = jiffies;
1084 libertas_unset_basic_rate_flags(bss->rates, sizeof(bss->rates));
1089 lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
1094 * @brief Compare two SSIDs
1096 * @param ssid1 A pointer to ssid to compare
1097 * @param ssid2 A pointer to ssid to compare
1099 * @return 0--ssid is same, otherwise is different
1101 int libertas_ssid_cmp(u8 *ssid1, u8 ssid1_len, u8 *ssid2, u8 ssid2_len)
1103 if (ssid1_len != ssid2_len)
1106 return memcmp(ssid1, ssid2, ssid1_len);
1110 * @brief This function finds a specific compatible BSSID in the scan list
1112 * @param adapter A pointer to wlan_adapter
1113 * @param bssid BSSID to find in the scan list
1114 * @param mode Network mode: Infrastructure or IBSS
1116 * @return index in BSSID list, or error return code (< 0)
1118 struct bss_descriptor * libertas_find_bssid_in_list(wlan_adapter * adapter,
1119 u8 * bssid, u8 mode)
1121 struct bss_descriptor * iter_bss;
1122 struct bss_descriptor * found_bss = NULL;
1127 lbs_deb_hex(LBS_DEB_SCAN, "looking for",
1130 /* Look through the scan table for a compatible match. The loop will
1131 * continue past a matched bssid that is not compatible in case there
1132 * is an AP with multiple SSIDs assigned to the same BSSID
1134 mutex_lock(&adapter->lock);
1135 list_for_each_entry (iter_bss, &adapter->network_list, list) {
1136 if (compare_ether_addr(iter_bss->bssid, bssid))
1137 continue; /* bssid doesn't match */
1141 if (!is_network_compatible(adapter, iter_bss, mode))
1143 found_bss = iter_bss;
1146 found_bss = iter_bss;
1150 mutex_unlock(&adapter->lock);
1156 * @brief This function finds ssid in ssid list.
1158 * @param adapter A pointer to wlan_adapter
1159 * @param ssid SSID to find in the list
1160 * @param bssid BSSID to qualify the SSID selection (if provided)
1161 * @param mode Network mode: Infrastructure or IBSS
1163 * @return index in BSSID list
1165 struct bss_descriptor * libertas_find_ssid_in_list(wlan_adapter * adapter,
1166 u8 *ssid, u8 ssid_len, u8 * bssid, u8 mode,
1170 struct bss_descriptor * iter_bss = NULL;
1171 struct bss_descriptor * found_bss = NULL;
1172 struct bss_descriptor * tmp_oldest = NULL;
1174 mutex_lock(&adapter->lock);
1176 list_for_each_entry (iter_bss, &adapter->network_list, list) {
1178 || (iter_bss->last_scanned < tmp_oldest->last_scanned))
1179 tmp_oldest = iter_bss;
1181 if (libertas_ssid_cmp(iter_bss->ssid, iter_bss->ssid_len,
1182 ssid, ssid_len) != 0)
1183 continue; /* ssid doesn't match */
1184 if (bssid && compare_ether_addr(iter_bss->bssid, bssid) != 0)
1185 continue; /* bssid doesn't match */
1186 if ((channel > 0) && (iter_bss->channel != channel))
1187 continue; /* channel doesn't match */
1192 if (!is_network_compatible(adapter, iter_bss, mode))
1196 /* Found requested BSSID */
1197 found_bss = iter_bss;
1201 if (SCAN_RSSI(iter_bss->rssi) > bestrssi) {
1202 bestrssi = SCAN_RSSI(iter_bss->rssi);
1203 found_bss = iter_bss;
1208 if (SCAN_RSSI(iter_bss->rssi) > bestrssi) {
1209 bestrssi = SCAN_RSSI(iter_bss->rssi);
1210 found_bss = iter_bss;
1217 mutex_unlock(&adapter->lock);
1222 * @brief This function finds the best SSID in the Scan List
1224 * Search the scan table for the best SSID that also matches the current
1225 * adapter network preference (infrastructure or adhoc)
1227 * @param adapter A pointer to wlan_adapter
1229 * @return index in BSSID list
1231 static struct bss_descriptor * libertas_find_best_ssid_in_list(wlan_adapter * adapter,
1235 struct bss_descriptor * iter_bss;
1236 struct bss_descriptor * best_bss = NULL;
1238 mutex_lock(&adapter->lock);
1240 list_for_each_entry (iter_bss, &adapter->network_list, list) {
1244 if (!is_network_compatible(adapter, iter_bss, mode))
1246 if (SCAN_RSSI(iter_bss->rssi) <= bestrssi)
1248 bestrssi = SCAN_RSSI(iter_bss->rssi);
1249 best_bss = iter_bss;
1253 if (SCAN_RSSI(iter_bss->rssi) <= bestrssi)
1255 bestrssi = SCAN_RSSI(iter_bss->rssi);
1256 best_bss = iter_bss;
1261 mutex_unlock(&adapter->lock);
1266 * @brief Find the AP with specific ssid in the scan list
1268 * @param priv A pointer to wlan_private structure
1269 * @param pSSID A pointer to AP's ssid
1271 * @return 0--success, otherwise--fail
1273 int libertas_find_best_network_ssid(wlan_private * priv,
1274 u8 *out_ssid, u8 *out_ssid_len, u8 preferred_mode, u8 *out_mode)
1276 wlan_adapter *adapter = priv->adapter;
1278 struct bss_descriptor * found;
1280 lbs_deb_enter(LBS_DEB_ASSOC);
1282 wlan_scan_networks(priv, NULL, 1);
1283 if (adapter->surpriseremoved)
1286 wait_event_interruptible(adapter->cmd_pending, !adapter->nr_cmd_pending);
1288 found = libertas_find_best_ssid_in_list(adapter, preferred_mode);
1289 if (found && (found->ssid_len > 0)) {
1290 memcpy(out_ssid, &found->ssid, IW_ESSID_MAX_SIZE);
1291 *out_ssid_len = found->ssid_len;
1292 *out_mode = found->mode;
1296 lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
1301 * @brief Scan Network
1303 * @param dev A pointer to net_device structure
1304 * @param info A pointer to iw_request_info structure
1305 * @param vwrq A pointer to iw_param structure
1306 * @param extra A pointer to extra data buf
1308 * @return 0 --success, otherwise fail
1310 int libertas_set_scan(struct net_device *dev, struct iw_request_info *info,
1311 struct iw_param *vwrq, char *extra)
1313 wlan_private *priv = dev->priv;
1314 wlan_adapter *adapter = priv->adapter;
1316 lbs_deb_enter(LBS_DEB_SCAN);
1318 if (!delayed_work_pending(&priv->scan_work)) {
1319 queue_delayed_work(priv->work_thread, &priv->scan_work,
1320 msecs_to_jiffies(50));
1323 if (adapter->surpriseremoved)
1326 lbs_deb_leave(LBS_DEB_SCAN);
1331 * @brief Send a scan command for all available channels filtered on a spec
1333 * @param priv A pointer to wlan_private structure
1334 * @param prequestedssid A pointer to AP's ssid
1335 * @param keeppreviousscan Flag used to save/clear scan table before scan
1337 * @return 0-success, otherwise fail
1339 int libertas_send_specific_ssid_scan(wlan_private * priv,
1340 u8 *ssid, u8 ssid_len, u8 clear_ssid)
1342 wlan_adapter *adapter = priv->adapter;
1343 struct wlan_ioctl_user_scan_cfg scancfg;
1346 lbs_deb_enter(LBS_DEB_ASSOC);
1351 memset(&scancfg, 0x00, sizeof(scancfg));
1352 memcpy(scancfg.ssid, ssid, ssid_len);
1353 scancfg.ssid_len = ssid_len;
1354 scancfg.clear_ssid = clear_ssid;
1356 wlan_scan_networks(priv, &scancfg, 1);
1357 if (adapter->surpriseremoved)
1359 wait_event_interruptible(adapter->cmd_pending, !adapter->nr_cmd_pending);
1362 lbs_deb_leave(LBS_DEB_ASSOC);
1366 #define MAX_CUSTOM_LEN 64
1368 static inline char *libertas_translate_scan(wlan_private *priv,
1369 char *start, char *stop,
1370 struct bss_descriptor *bss)
1372 wlan_adapter *adapter = priv->adapter;
1373 struct chan_freq_power *cfp;
1374 char *current_val; /* For rates */
1375 struct iw_event iwe; /* Temporary buffer */
1377 #define PERFECT_RSSI ((u8)50)
1378 #define WORST_RSSI ((u8)0)
1379 #define RSSI_DIFF ((u8)(PERFECT_RSSI - WORST_RSSI))
1382 cfp = libertas_find_cfp_by_band_and_channel(adapter, 0, bss->channel);
1384 lbs_deb_scan("Invalid channel number %d\n", bss->channel);
1388 /* First entry *MUST* be the AP BSSID */
1389 iwe.cmd = SIOCGIWAP;
1390 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
1391 memcpy(iwe.u.ap_addr.sa_data, &bss->bssid, ETH_ALEN);
1392 start = iwe_stream_add_event(start, stop, &iwe, IW_EV_ADDR_LEN);
1395 iwe.cmd = SIOCGIWESSID;
1396 iwe.u.data.flags = 1;
1397 iwe.u.data.length = min((u32) bss->ssid_len, (u32) IW_ESSID_MAX_SIZE);
1398 start = iwe_stream_add_point(start, stop, &iwe, bss->ssid);
1401 iwe.cmd = SIOCGIWMODE;
1402 iwe.u.mode = bss->mode;
1403 start = iwe_stream_add_event(start, stop, &iwe, IW_EV_UINT_LEN);
1406 iwe.cmd = SIOCGIWFREQ;
1407 iwe.u.freq.m = (long)cfp->freq * 100000;
1409 start = iwe_stream_add_event(start, stop, &iwe, IW_EV_FREQ_LEN);
1411 /* Add quality statistics */
1413 iwe.u.qual.updated = IW_QUAL_ALL_UPDATED;
1414 iwe.u.qual.level = SCAN_RSSI(bss->rssi);
1416 rssi = iwe.u.qual.level - MRVDRV_NF_DEFAULT_SCAN_VALUE;
1418 (100 * RSSI_DIFF * RSSI_DIFF - (PERFECT_RSSI - rssi) *
1419 (15 * (RSSI_DIFF) + 62 * (PERFECT_RSSI - rssi))) /
1420 (RSSI_DIFF * RSSI_DIFF);
1421 if (iwe.u.qual.qual > 100)
1422 iwe.u.qual.qual = 100;
1424 if (adapter->NF[TYPE_BEACON][TYPE_NOAVG] == 0) {
1425 iwe.u.qual.noise = MRVDRV_NF_DEFAULT_SCAN_VALUE;
1428 CAL_NF(adapter->NF[TYPE_BEACON][TYPE_NOAVG]);
1431 /* Locally created ad-hoc BSSs won't have beacons if this is the
1432 * only station in the adhoc network; so get signal strength
1433 * from receive statistics.
1435 if ((adapter->mode == IW_MODE_ADHOC)
1436 && adapter->adhoccreate
1437 && !libertas_ssid_cmp(adapter->curbssparams.ssid,
1438 adapter->curbssparams.ssid_len,
1439 bss->ssid, bss->ssid_len)) {
1441 snr = adapter->SNR[TYPE_RXPD][TYPE_AVG] / AVG_SCALE;
1442 nf = adapter->NF[TYPE_RXPD][TYPE_AVG] / AVG_SCALE;
1443 iwe.u.qual.level = CAL_RSSI(snr, nf);
1445 start = iwe_stream_add_event(start, stop, &iwe, IW_EV_QUAL_LEN);
1447 /* Add encryption capability */
1448 iwe.cmd = SIOCGIWENCODE;
1449 if (bss->capability & WLAN_CAPABILITY_PRIVACY) {
1450 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1452 iwe.u.data.flags = IW_ENCODE_DISABLED;
1454 iwe.u.data.length = 0;
1455 start = iwe_stream_add_point(start, stop, &iwe, bss->ssid);
1457 current_val = start + IW_EV_LCP_LEN;
1459 iwe.cmd = SIOCGIWRATE;
1460 iwe.u.bitrate.fixed = 0;
1461 iwe.u.bitrate.disabled = 0;
1462 iwe.u.bitrate.value = 0;
1464 for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
1465 /* Bit rate given in 500 kb/s units */
1466 iwe.u.bitrate.value = bss->rates[j] * 500000;
1467 current_val = iwe_stream_add_value(start, current_val,
1468 stop, &iwe, IW_EV_PARAM_LEN);
1470 if ((bss->mode == IW_MODE_ADHOC)
1471 && !libertas_ssid_cmp(adapter->curbssparams.ssid,
1472 adapter->curbssparams.ssid_len,
1473 bss->ssid, bss->ssid_len)
1474 && adapter->adhoccreate) {
1475 iwe.u.bitrate.value = 22 * 500000;
1476 current_val = iwe_stream_add_value(start, current_val,
1477 stop, &iwe, IW_EV_PARAM_LEN);
1479 /* Check if we added any event */
1480 if((current_val - start) > IW_EV_LCP_LEN)
1481 start = current_val;
1483 memset(&iwe, 0, sizeof(iwe));
1484 if (bss->wpa_ie_len) {
1485 char buf[MAX_WPA_IE_LEN];
1486 memcpy(buf, bss->wpa_ie, bss->wpa_ie_len);
1487 iwe.cmd = IWEVGENIE;
1488 iwe.u.data.length = bss->wpa_ie_len;
1489 start = iwe_stream_add_point(start, stop, &iwe, buf);
1492 memset(&iwe, 0, sizeof(iwe));
1493 if (bss->rsn_ie_len) {
1494 char buf[MAX_WPA_IE_LEN];
1495 memcpy(buf, bss->rsn_ie, bss->rsn_ie_len);
1496 iwe.cmd = IWEVGENIE;
1497 iwe.u.data.length = bss->rsn_ie_len;
1498 start = iwe_stream_add_point(start, stop, &iwe, buf);
1502 char custom[MAX_CUSTOM_LEN];
1505 iwe.cmd = IWEVCUSTOM;
1506 p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
1508 iwe.u.data.length = p - custom;
1509 if (iwe.u.data.length)
1510 start = iwe_stream_add_point(start, stop, &iwe, custom);
1517 * @brief Retrieve the scan table entries via wireless tools IOCTL call
1519 * @param dev A pointer to net_device structure
1520 * @param info A pointer to iw_request_info structure
1521 * @param dwrq A pointer to iw_point structure
1522 * @param extra A pointer to extra data buf
1524 * @return 0 --success, otherwise fail
1526 int libertas_get_scan(struct net_device *dev, struct iw_request_info *info,
1527 struct iw_point *dwrq, char *extra)
1529 #define SCAN_ITEM_SIZE 128
1530 wlan_private *priv = dev->priv;
1531 wlan_adapter *adapter = priv->adapter;
1534 char *stop = ev + dwrq->length;
1535 struct bss_descriptor * iter_bss;
1536 struct bss_descriptor * safe;
1538 lbs_deb_enter(LBS_DEB_ASSOC);
1540 /* Update RSSI if current BSS is a locally created ad-hoc BSS */
1541 if ((adapter->mode == IW_MODE_ADHOC) && adapter->adhoccreate) {
1542 libertas_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
1543 CMD_OPTION_WAITFORRSP, 0, NULL);
1546 mutex_lock(&adapter->lock);
1547 list_for_each_entry_safe (iter_bss, safe, &adapter->network_list, list) {
1549 unsigned long stale_time;
1551 if (stop - ev < SCAN_ITEM_SIZE) {
1556 /* For mesh device, list only mesh networks */
1557 if (dev == priv->mesh_dev && !iter_bss->mesh)
1560 /* Prune old an old scan result */
1561 stale_time = iter_bss->last_scanned + DEFAULT_MAX_SCAN_AGE;
1562 if (time_after(jiffies, stale_time)) {
1563 list_move_tail (&iter_bss->list,
1564 &adapter->network_free_list);
1565 clear_bss_descriptor(iter_bss);
1569 /* Translate to WE format this entry */
1570 next_ev = libertas_translate_scan(priv, ev, stop, iter_bss);
1571 if (next_ev == NULL)
1575 mutex_unlock(&adapter->lock);
1577 dwrq->length = (ev - extra);
1580 lbs_deb_leave(LBS_DEB_ASSOC);
1585 * @brief Prepare a scan command to be sent to the firmware
1587 * Use the wlan_scan_cmd_config sent to the command processing module in
1588 * the libertas_prepare_and_send_command to configure a cmd_ds_802_11_scan command
1589 * struct to send to firmware.
1591 * The fixed fields specifying the BSS type and BSSID filters as well as a
1592 * variable number/length of TLVs are sent in the command to firmware.
1594 * @param priv A pointer to wlan_private structure
1595 * @param cmd A pointer to cmd_ds_command structure to be sent to
1596 * firmware with the cmd_DS_801_11_SCAN structure
1597 * @param pdata_buf Void pointer cast of a wlan_scan_cmd_config struct used
1598 * to set the fields/TLVs for the command sent to firmware
1602 * @sa wlan_scan_create_channel_list
1604 int libertas_cmd_80211_scan(wlan_private * priv,
1605 struct cmd_ds_command *cmd, void *pdata_buf)
1607 struct cmd_ds_802_11_scan *pscan = &cmd->params.scan;
1608 struct wlan_scan_cmd_config *pscancfg;
1610 lbs_deb_enter(LBS_DEB_ASSOC);
1612 pscancfg = pdata_buf;
1614 /* Set fixed field variables in scan command */
1615 pscan->bsstype = pscancfg->bsstype;
1616 memcpy(pscan->bssid, pscancfg->bssid, ETH_ALEN);
1617 memcpy(pscan->tlvbuffer, pscancfg->tlvbuffer, pscancfg->tlvbufferlen);
1619 cmd->command = cpu_to_le16(CMD_802_11_SCAN);
1621 /* size is equal to the sizeof(fixed portions) + the TLV len + header */
1622 cmd->size = cpu_to_le16(sizeof(pscan->bsstype) + ETH_ALEN
1623 + pscancfg->tlvbufferlen + S_DS_GEN);
1625 lbs_deb_scan("SCAN_CMD: command=%x, size=%x, seqnum=%x\n",
1626 le16_to_cpu(cmd->command), le16_to_cpu(cmd->size),
1627 le16_to_cpu(cmd->seqnum));
1629 lbs_deb_leave(LBS_DEB_ASSOC);
1633 static inline int is_same_network(struct bss_descriptor *src,
1634 struct bss_descriptor *dst)
1636 /* A network is only a duplicate if the channel, BSSID, and ESSID
1637 * all match. We treat all <hidden> with the same BSSID and channel
1639 return ((src->ssid_len == dst->ssid_len) &&
1640 (src->channel == dst->channel) &&
1641 !compare_ether_addr(src->bssid, dst->bssid) &&
1642 !memcmp(src->ssid, dst->ssid, src->ssid_len));
1646 * @brief This function handles the command response of scan
1648 * The response buffer for the scan command has the following
1651 * .-----------------------------------------------------------.
1652 * | header (4 * sizeof(u16)): Standard command response hdr |
1653 * .-----------------------------------------------------------.
1654 * | bufsize (u16) : sizeof the BSS Description data |
1655 * .-----------------------------------------------------------.
1656 * | NumOfSet (u8) : Number of BSS Descs returned |
1657 * .-----------------------------------------------------------.
1658 * | BSSDescription data (variable, size given in bufsize) |
1659 * .-----------------------------------------------------------.
1660 * | TLV data (variable, size calculated using header->size, |
1661 * | bufsize and sizeof the fixed fields above) |
1662 * .-----------------------------------------------------------.
1664 * @param priv A pointer to wlan_private structure
1665 * @param resp A pointer to cmd_ds_command
1669 int libertas_ret_80211_scan(wlan_private * priv, struct cmd_ds_command *resp)
1671 wlan_adapter *adapter = priv->adapter;
1672 struct cmd_ds_802_11_scan_rsp *pscan;
1673 struct bss_descriptor * iter_bss;
1674 struct bss_descriptor * safe;
1682 lbs_deb_enter(LBS_DEB_ASSOC);
1684 /* Prune old entries from scan table */
1685 list_for_each_entry_safe (iter_bss, safe, &adapter->network_list, list) {
1686 unsigned long stale_time = iter_bss->last_scanned + DEFAULT_MAX_SCAN_AGE;
1687 if (time_before(jiffies, stale_time))
1689 list_move_tail (&iter_bss->list, &adapter->network_free_list);
1690 clear_bss_descriptor(iter_bss);
1693 pscan = &resp->params.scanresp;
1695 if (pscan->nr_sets > MAX_NETWORK_COUNT) {
1697 "SCAN_RESP: too many scan results (%d, max %d)!!\n",
1698 pscan->nr_sets, MAX_NETWORK_COUNT);
1703 bytesleft = le16_to_cpu(get_unaligned((u16*)&pscan->bssdescriptsize));
1704 lbs_deb_scan("SCAN_RESP: bssdescriptsize %d\n", bytesleft);
1706 scanrespsize = le16_to_cpu(get_unaligned((u16*)&resp->size));
1707 lbs_deb_scan("SCAN_RESP: returned %d AP before parsing\n",
1710 pbssinfo = pscan->bssdesc_and_tlvbuffer;
1712 /* The size of the TLV buffer is equal to the entire command response
1713 * size (scanrespsize) minus the fixed fields (sizeof()'s), the
1714 * BSS Descriptions (bssdescriptsize as bytesLef) and the command
1715 * response header (S_DS_GEN)
1717 tlvbufsize = scanrespsize - (bytesleft + sizeof(pscan->bssdescriptsize)
1718 + sizeof(pscan->nr_sets)
1722 * Process each scan response returned (pscan->nr_sets). Save
1723 * the information in the newbssentry and then insert into the
1724 * driver scan table either as an update to an existing entry
1725 * or as an addition at the end of the table
1727 for (idx = 0; idx < pscan->nr_sets && bytesleft; idx++) {
1728 struct bss_descriptor new;
1729 struct bss_descriptor * found = NULL;
1730 struct bss_descriptor * oldest = NULL;
1731 DECLARE_MAC_BUF(mac);
1733 /* Process the data fields and IEs returned for this BSS */
1734 memset(&new, 0, sizeof (struct bss_descriptor));
1735 if (libertas_process_bss(&new, &pbssinfo, &bytesleft) != 0) {
1736 /* error parsing the scan response, skipped */
1737 lbs_deb_scan("SCAN_RESP: process_bss returned ERROR\n");
1741 /* Try to find this bss in the scan table */
1742 list_for_each_entry (iter_bss, &adapter->network_list, list) {
1743 if (is_same_network(iter_bss, &new)) {
1748 if ((oldest == NULL) ||
1749 (iter_bss->last_scanned < oldest->last_scanned))
1754 /* found, clear it */
1755 clear_bss_descriptor(found);
1756 } else if (!list_empty(&adapter->network_free_list)) {
1757 /* Pull one from the free list */
1758 found = list_entry(adapter->network_free_list.next,
1759 struct bss_descriptor, list);
1760 list_move_tail(&found->list, &adapter->network_list);
1761 } else if (oldest) {
1762 /* If there are no more slots, expire the oldest */
1764 clear_bss_descriptor(found);
1765 list_move_tail(&found->list, &adapter->network_list);
1770 lbs_deb_scan("SCAN_RESP: BSSID = %s\n",
1771 print_mac(mac, new.bssid));
1773 /* Copy the locally created newbssentry to the scan table */
1774 memcpy(found, &new, offsetof(struct bss_descriptor, list));
1780 lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);