1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * NXP Wireless LAN device driver: association and ad-hoc start/join
4  *
5  * Copyright 2011-2020 NXP
6  */
7 
8 #include "decl.h"
9 #include "ioctl.h"
10 #include "util.h"
11 #include "fw.h"
12 #include "main.h"
13 #include "wmm.h"
14 #include "11n.h"
15 #include "11ac.h"
16 
17 #define CAPINFO_MASK    (~(BIT(15) | BIT(14) | BIT(12) | BIT(11) | BIT(9)))
18 
19 /*
20  * Append a generic IE as a pass through TLV to a TLV buffer.
21  *
22  * This function is called from the network join command preparation routine.
23  *
24  * If the IE buffer has been setup by the application, this routine appends
25  * the buffer as a pass through TLV type to the request.
26  */
27 static int
28 mwifiex_cmd_append_generic_ie(struct mwifiex_private *priv, u8 **buffer)
29 {
30 	int ret_len = 0;
31 	struct mwifiex_ie_types_header ie_header;
32 
33 	/* Null Checks */
34 	if (!buffer)
35 		return 0;
36 	if (!(*buffer))
37 		return 0;
38 
39 	/*
40 	 * If there is a generic ie buffer setup, append it to the return
41 	 *   parameter buffer pointer.
42 	 */
43 	if (priv->gen_ie_buf_len) {
44 		mwifiex_dbg(priv->adapter, INFO,
45 			    "info: %s: append generic ie len %d to %p\n",
46 			    __func__, priv->gen_ie_buf_len, *buffer);
47 
48 		/* Wrap the generic IE buffer with a pass through TLV type */
49 		ie_header.type = cpu_to_le16(TLV_TYPE_PASSTHROUGH);
50 		ie_header.len = cpu_to_le16(priv->gen_ie_buf_len);
51 		memcpy(*buffer, &ie_header, sizeof(ie_header));
52 
53 		/* Increment the return size and the return buffer pointer
54 		   param */
55 		*buffer += sizeof(ie_header);
56 		ret_len += sizeof(ie_header);
57 
58 		/* Copy the generic IE buffer to the output buffer, advance
59 		   pointer */
60 		memcpy(*buffer, priv->gen_ie_buf, priv->gen_ie_buf_len);
61 
62 		/* Increment the return size and the return buffer pointer
63 		   param */
64 		*buffer += priv->gen_ie_buf_len;
65 		ret_len += priv->gen_ie_buf_len;
66 
67 		/* Reset the generic IE buffer */
68 		priv->gen_ie_buf_len = 0;
69 	}
70 
71 	/* return the length appended to the buffer */
72 	return ret_len;
73 }
74 
75 /*
76  * Append TSF tracking info from the scan table for the target AP.
77  *
78  * This function is called from the network join command preparation routine.
79  *
80  * The TSF table TSF sent to the firmware contains two TSF values:
81  *      - The TSF of the target AP from its previous beacon/probe response
82  *      - The TSF timestamp of our local MAC at the time we observed the
83  *        beacon/probe response.
84  *
85  * The firmware uses the timestamp values to set an initial TSF value
86  * in the MAC for the new association after a reassociation attempt.
87  */
88 static int
89 mwifiex_cmd_append_tsf_tlv(struct mwifiex_private *priv, u8 **buffer,
90 			   struct mwifiex_bssdescriptor *bss_desc)
91 {
92 	struct mwifiex_ie_types_tsf_timestamp tsf_tlv;
93 	__le64 tsf_val;
94 
95 	/* Null Checks */
96 	if (buffer == NULL)
97 		return 0;
98 	if (*buffer == NULL)
99 		return 0;
100 
101 	memset(&tsf_tlv, 0x00, sizeof(struct mwifiex_ie_types_tsf_timestamp));
102 
103 	tsf_tlv.header.type = cpu_to_le16(TLV_TYPE_TSFTIMESTAMP);
104 	tsf_tlv.header.len = cpu_to_le16(2 * sizeof(tsf_val));
105 
106 	memcpy(*buffer, &tsf_tlv, sizeof(tsf_tlv.header));
107 	*buffer += sizeof(tsf_tlv.header);
108 
109 	/* TSF at the time when beacon/probe_response was received */
110 	tsf_val = cpu_to_le64(bss_desc->fw_tsf);
111 	memcpy(*buffer, &tsf_val, sizeof(tsf_val));
112 	*buffer += sizeof(tsf_val);
113 
114 	tsf_val = cpu_to_le64(bss_desc->timestamp);
115 
116 	mwifiex_dbg(priv->adapter, INFO,
117 		    "info: %s: TSF offset calc: %016llx - %016llx\n",
118 		    __func__, bss_desc->timestamp, bss_desc->fw_tsf);
119 
120 	memcpy(*buffer, &tsf_val, sizeof(tsf_val));
121 	*buffer += sizeof(tsf_val);
122 
123 	return sizeof(tsf_tlv.header) + (2 * sizeof(tsf_val));
124 }
125 
126 /*
127  * This function finds out the common rates between rate1 and rate2.
128  *
129  * It will fill common rates in rate1 as output if found.
130  *
131  * NOTE: Setting the MSB of the basic rates needs to be taken
132  * care of, either before or after calling this function.
133  */
134 static int mwifiex_get_common_rates(struct mwifiex_private *priv, u8 *rate1,
135 				    u32 rate1_size, u8 *rate2, u32 rate2_size)
136 {
137 	int ret;
138 	u8 *ptr = rate1, *tmp;
139 	u32 i, j;
140 
141 	tmp = kmemdup(rate1, rate1_size, GFP_KERNEL);
142 	if (!tmp) {
143 		mwifiex_dbg(priv->adapter, ERROR, "failed to alloc tmp buf\n");
144 		return -ENOMEM;
145 	}
146 
147 	memset(rate1, 0, rate1_size);
148 
149 	for (i = 0; i < rate2_size && rate2[i]; i++) {
150 		for (j = 0; j < rate1_size && tmp[j]; j++) {
151 			/* Check common rate, excluding the bit for
152 			   basic rate */
153 			if ((rate2[i] & 0x7F) == (tmp[j] & 0x7F)) {
154 				*rate1++ = tmp[j];
155 				break;
156 			}
157 		}
158 	}
159 
160 	mwifiex_dbg(priv->adapter, INFO, "info: Tx data rate set to %#x\n",
161 		    priv->data_rate);
162 
163 	if (!priv->is_data_rate_auto) {
164 		while (*ptr) {
165 			if ((*ptr & 0x7f) == priv->data_rate) {
166 				ret = 0;
167 				goto done;
168 			}
169 			ptr++;
170 		}
171 		mwifiex_dbg(priv->adapter, ERROR,
172 			    "previously set fixed data rate %#x\t"
173 			    "is not compatible with the network\n",
174 			    priv->data_rate);
175 
176 		ret = -1;
177 		goto done;
178 	}
179 
180 	ret = 0;
181 done:
182 	kfree(tmp);
183 	return ret;
184 }
185 
186 /*
187  * This function creates the intersection of the rates supported by a
188  * target BSS and our adapter settings for use in an assoc/join command.
189  */
190 static int
191 mwifiex_setup_rates_from_bssdesc(struct mwifiex_private *priv,
192 				 struct mwifiex_bssdescriptor *bss_desc,
193 				 u8 *out_rates, u32 *out_rates_size)
194 {
195 	u8 card_rates[MWIFIEX_SUPPORTED_RATES];
196 	u32 card_rates_size;
197 
198 	/* Copy AP supported rates */
199 	memcpy(out_rates, bss_desc->supported_rates, MWIFIEX_SUPPORTED_RATES);
200 	/* Get the STA supported rates */
201 	card_rates_size = mwifiex_get_active_data_rates(priv, card_rates);
202 	/* Get the common rates between AP and STA supported rates */
203 	if (mwifiex_get_common_rates(priv, out_rates, MWIFIEX_SUPPORTED_RATES,
204 				     card_rates, card_rates_size)) {
205 		*out_rates_size = 0;
206 		mwifiex_dbg(priv->adapter, ERROR,
207 			    "%s: cannot get common rates\n",
208 			    __func__);
209 		return -1;
210 	}
211 
212 	*out_rates_size =
213 		min_t(size_t, strlen(out_rates), MWIFIEX_SUPPORTED_RATES);
214 
215 	return 0;
216 }
217 
218 /*
219  * This function appends a WPS IE. It is called from the network join command
220  * preparation routine.
221  *
222  * If the IE buffer has been setup by the application, this routine appends
223  * the buffer as a WPS TLV type to the request.
224  */
225 static int
226 mwifiex_cmd_append_wps_ie(struct mwifiex_private *priv, u8 **buffer)
227 {
228 	int retLen = 0;
229 	struct mwifiex_ie_types_header ie_header;
230 
231 	if (!buffer || !*buffer)
232 		return 0;
233 
234 	/*
235 	 * If there is a wps ie buffer setup, append it to the return
236 	 * parameter buffer pointer.
237 	 */
238 	if (priv->wps_ie_len) {
239 		mwifiex_dbg(priv->adapter, CMD,
240 			    "cmd: append wps ie %d to %p\n",
241 			    priv->wps_ie_len, *buffer);
242 
243 		/* Wrap the generic IE buffer with a pass through TLV type */
244 		ie_header.type = cpu_to_le16(TLV_TYPE_PASSTHROUGH);
245 		ie_header.len = cpu_to_le16(priv->wps_ie_len);
246 		memcpy(*buffer, &ie_header, sizeof(ie_header));
247 		*buffer += sizeof(ie_header);
248 		retLen += sizeof(ie_header);
249 
250 		memcpy(*buffer, priv->wps_ie, priv->wps_ie_len);
251 		*buffer += priv->wps_ie_len;
252 		retLen += priv->wps_ie_len;
253 
254 	}
255 
256 	kfree(priv->wps_ie);
257 	priv->wps_ie_len = 0;
258 	return retLen;
259 }
260 
261 /*
262  * This function appends a WAPI IE.
263  *
264  * This function is called from the network join command preparation routine.
265  *
266  * If the IE buffer has been setup by the application, this routine appends
267  * the buffer as a WAPI TLV type to the request.
268  */
269 static int
270 mwifiex_cmd_append_wapi_ie(struct mwifiex_private *priv, u8 **buffer)
271 {
272 	int retLen = 0;
273 	struct mwifiex_ie_types_header ie_header;
274 
275 	/* Null Checks */
276 	if (buffer == NULL)
277 		return 0;
278 	if (*buffer == NULL)
279 		return 0;
280 
281 	/*
282 	 * If there is a wapi ie buffer setup, append it to the return
283 	 *   parameter buffer pointer.
284 	 */
285 	if (priv->wapi_ie_len) {
286 		mwifiex_dbg(priv->adapter, CMD,
287 			    "cmd: append wapi ie %d to %p\n",
288 			    priv->wapi_ie_len, *buffer);
289 
290 		/* Wrap the generic IE buffer with a pass through TLV type */
291 		ie_header.type = cpu_to_le16(TLV_TYPE_WAPI_IE);
292 		ie_header.len = cpu_to_le16(priv->wapi_ie_len);
293 		memcpy(*buffer, &ie_header, sizeof(ie_header));
294 
295 		/* Increment the return size and the return buffer pointer
296 		   param */
297 		*buffer += sizeof(ie_header);
298 		retLen += sizeof(ie_header);
299 
300 		/* Copy the wapi IE buffer to the output buffer, advance
301 		   pointer */
302 		memcpy(*buffer, priv->wapi_ie, priv->wapi_ie_len);
303 
304 		/* Increment the return size and the return buffer pointer
305 		   param */
306 		*buffer += priv->wapi_ie_len;
307 		retLen += priv->wapi_ie_len;
308 
309 	}
310 	/* return the length appended to the buffer */
311 	return retLen;
312 }
313 
314 /*
315  * This function appends rsn ie tlv for wpa/wpa2 security modes.
316  * It is called from the network join command preparation routine.
317  */
318 static int mwifiex_append_rsn_ie_wpa_wpa2(struct mwifiex_private *priv,
319 					  u8 **buffer)
320 {
321 	struct mwifiex_ie_types_rsn_param_set *rsn_ie_tlv;
322 	int rsn_ie_len;
323 
324 	if (!buffer || !(*buffer))
325 		return 0;
326 
327 	rsn_ie_tlv = (struct mwifiex_ie_types_rsn_param_set *) (*buffer);
328 	rsn_ie_tlv->header.type = cpu_to_le16((u16) priv->wpa_ie[0]);
329 	rsn_ie_tlv->header.type = cpu_to_le16(
330 				 le16_to_cpu(rsn_ie_tlv->header.type) & 0x00FF);
331 	rsn_ie_tlv->header.len = cpu_to_le16((u16) priv->wpa_ie[1]);
332 	rsn_ie_tlv->header.len = cpu_to_le16(le16_to_cpu(rsn_ie_tlv->header.len)
333 							 & 0x00FF);
334 	if (le16_to_cpu(rsn_ie_tlv->header.len) <= (sizeof(priv->wpa_ie) - 2))
335 		memcpy(rsn_ie_tlv->rsn_ie, &priv->wpa_ie[2],
336 		       le16_to_cpu(rsn_ie_tlv->header.len));
337 	else
338 		return -1;
339 
340 	rsn_ie_len = sizeof(rsn_ie_tlv->header) +
341 					le16_to_cpu(rsn_ie_tlv->header.len);
342 	*buffer += rsn_ie_len;
343 
344 	return rsn_ie_len;
345 }
346 
347 /*
348  * This function prepares command for association.
349  *
350  * This sets the following parameters -
351  *      - Peer MAC address
352  *      - Listen interval
353  *      - Beacon interval
354  *      - Capability information
355  *
356  * ...and the following TLVs, as required -
357  *      - SSID TLV
358  *      - PHY TLV
359  *      - SS TLV
360  *      - Rates TLV
361  *      - Authentication TLV
362  *      - Channel TLV
363  *      - WPA/WPA2 IE
364  *      - 11n TLV
365  *      - Vendor specific TLV
366  *      - WMM TLV
367  *      - WAPI IE
368  *      - Generic IE
369  *      - TSF TLV
370  *
371  * Preparation also includes -
372  *      - Setting command ID and proper size
373  *      - Ensuring correct endian-ness
374  */
375 int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
376 				 struct host_cmd_ds_command *cmd,
377 				 struct mwifiex_bssdescriptor *bss_desc)
378 {
379 	struct host_cmd_ds_802_11_associate *assoc = &cmd->params.associate;
380 	struct mwifiex_ie_types_ssid_param_set *ssid_tlv;
381 	struct mwifiex_ie_types_phy_param_set *phy_tlv;
382 	struct mwifiex_ie_types_ss_param_set *ss_tlv;
383 	struct mwifiex_ie_types_rates_param_set *rates_tlv;
384 	struct mwifiex_ie_types_auth_type *auth_tlv;
385 	struct mwifiex_ie_types_chan_list_param_set *chan_tlv;
386 	u8 rates[MWIFIEX_SUPPORTED_RATES];
387 	u32 rates_size;
388 	u16 tmp_cap;
389 	u8 *pos;
390 	int rsn_ie_len = 0;
391 
392 	pos = (u8 *) assoc;
393 
394 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_ASSOCIATE);
395 
396 	/* Save so we know which BSS Desc to use in the response handler */
397 	priv->attempted_bss_desc = bss_desc;
398 
399 	memcpy(assoc->peer_sta_addr,
400 	       bss_desc->mac_address, sizeof(assoc->peer_sta_addr));
401 	pos += sizeof(assoc->peer_sta_addr);
402 
403 	/* Set the listen interval */
404 	assoc->listen_interval = cpu_to_le16(priv->listen_interval);
405 	/* Set the beacon period */
406 	assoc->beacon_period = cpu_to_le16(bss_desc->beacon_period);
407 
408 	pos += sizeof(assoc->cap_info_bitmap);
409 	pos += sizeof(assoc->listen_interval);
410 	pos += sizeof(assoc->beacon_period);
411 	pos += sizeof(assoc->dtim_period);
412 
413 	ssid_tlv = (struct mwifiex_ie_types_ssid_param_set *) pos;
414 	ssid_tlv->header.type = cpu_to_le16(WLAN_EID_SSID);
415 	ssid_tlv->header.len = cpu_to_le16((u16) bss_desc->ssid.ssid_len);
416 	memcpy(ssid_tlv->ssid, bss_desc->ssid.ssid,
417 	       le16_to_cpu(ssid_tlv->header.len));
418 	pos += sizeof(ssid_tlv->header) + le16_to_cpu(ssid_tlv->header.len);
419 
420 	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
421 	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
422 	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
423 	memcpy(&phy_tlv->fh_ds.ds_param_set,
424 	       &bss_desc->phy_param_set.ds_param_set.current_chan,
425 	       sizeof(phy_tlv->fh_ds.ds_param_set));
426 	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
427 
428 	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
429 	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
430 	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
431 	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
432 
433 	/* Get the common rates supported between the driver and the BSS Desc */
434 	if (mwifiex_setup_rates_from_bssdesc
435 	    (priv, bss_desc, rates, &rates_size))
436 		return -1;
437 
438 	/* Save the data rates into Current BSS state structure */
439 	priv->curr_bss_params.num_of_rates = rates_size;
440 	memcpy(&priv->curr_bss_params.data_rates, rates, rates_size);
441 
442 	/* Setup the Rates TLV in the association command */
443 	rates_tlv = (struct mwifiex_ie_types_rates_param_set *) pos;
444 	rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
445 	rates_tlv->header.len = cpu_to_le16((u16) rates_size);
446 	memcpy(rates_tlv->rates, rates, rates_size);
447 	pos += sizeof(rates_tlv->header) + rates_size;
448 	mwifiex_dbg(priv->adapter, INFO, "info: ASSOC_CMD: rates size = %d\n",
449 		    rates_size);
450 
451 	/* Add the Authentication type to be used for Auth frames */
452 	auth_tlv = (struct mwifiex_ie_types_auth_type *) pos;
453 	auth_tlv->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
454 	auth_tlv->header.len = cpu_to_le16(sizeof(auth_tlv->auth_type));
455 	if (priv->sec_info.wep_enabled)
456 		auth_tlv->auth_type = cpu_to_le16(
457 				(u16) priv->sec_info.authentication_mode);
458 	else
459 		auth_tlv->auth_type = cpu_to_le16(NL80211_AUTHTYPE_OPEN_SYSTEM);
460 
461 	pos += sizeof(auth_tlv->header) + le16_to_cpu(auth_tlv->header.len);
462 
463 	if (IS_SUPPORT_MULTI_BANDS(priv->adapter) &&
464 	    !(ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
465 	    (!bss_desc->disable_11n) &&
466 	    (priv->adapter->config_bands & BAND_GN ||
467 	     priv->adapter->config_bands & BAND_AN) &&
468 	    (bss_desc->bcn_ht_cap)
469 	    )
470 		) {
471 		/* Append a channel TLV for the channel the attempted AP was
472 		   found on */
473 		chan_tlv = (struct mwifiex_ie_types_chan_list_param_set *) pos;
474 		chan_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
475 		chan_tlv->header.len =
476 			cpu_to_le16(sizeof(struct mwifiex_chan_scan_param_set));
477 
478 		memset(chan_tlv->chan_scan_param, 0x00,
479 		       sizeof(struct mwifiex_chan_scan_param_set));
480 		chan_tlv->chan_scan_param[0].chan_number =
481 			(bss_desc->phy_param_set.ds_param_set.current_chan);
482 		mwifiex_dbg(priv->adapter, INFO, "info: Assoc: TLV Chan = %d\n",
483 			    chan_tlv->chan_scan_param[0].chan_number);
484 
485 		chan_tlv->chan_scan_param[0].radio_type =
486 			mwifiex_band_to_radio_type((u8) bss_desc->bss_band);
487 
488 		mwifiex_dbg(priv->adapter, INFO, "info: Assoc: TLV Band = %d\n",
489 			    chan_tlv->chan_scan_param[0].radio_type);
490 		pos += sizeof(chan_tlv->header) +
491 			sizeof(struct mwifiex_chan_scan_param_set);
492 	}
493 
494 	if (!priv->wps.session_enable) {
495 		if (priv->sec_info.wpa_enabled || priv->sec_info.wpa2_enabled)
496 			rsn_ie_len = mwifiex_append_rsn_ie_wpa_wpa2(priv, &pos);
497 
498 		if (rsn_ie_len == -1)
499 			return -1;
500 	}
501 
502 	if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
503 	    (!bss_desc->disable_11n) &&
504 	    (priv->adapter->config_bands & BAND_GN ||
505 	     priv->adapter->config_bands & BAND_AN))
506 		mwifiex_cmd_append_11n_tlv(priv, bss_desc, &pos);
507 
508 	if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
509 	    !bss_desc->disable_11n && !bss_desc->disable_11ac &&
510 	    priv->adapter->config_bands & BAND_AAC)
511 		mwifiex_cmd_append_11ac_tlv(priv, bss_desc, &pos);
512 
513 	/* Append vendor specific IE TLV */
514 	mwifiex_cmd_append_vsie_tlv(priv, MWIFIEX_VSIE_MASK_ASSOC, &pos);
515 
516 	mwifiex_wmm_process_association_req(priv, &pos, &bss_desc->wmm_ie,
517 					    bss_desc->bcn_ht_cap);
518 	if (priv->sec_info.wapi_enabled && priv->wapi_ie_len)
519 		mwifiex_cmd_append_wapi_ie(priv, &pos);
520 
521 	if (priv->wps.session_enable && priv->wps_ie_len)
522 		mwifiex_cmd_append_wps_ie(priv, &pos);
523 
524 	mwifiex_cmd_append_generic_ie(priv, &pos);
525 
526 	mwifiex_cmd_append_tsf_tlv(priv, &pos, bss_desc);
527 
528 	mwifiex_11h_process_join(priv, &pos, bss_desc);
529 
530 	cmd->size = cpu_to_le16((u16) (pos - (u8 *) assoc) + S_DS_GEN);
531 
532 	/* Set the Capability info at last */
533 	tmp_cap = bss_desc->cap_info_bitmap;
534 
535 	if (priv->adapter->config_bands == BAND_B)
536 		tmp_cap &= ~WLAN_CAPABILITY_SHORT_SLOT_TIME;
537 
538 	tmp_cap &= CAPINFO_MASK;
539 	mwifiex_dbg(priv->adapter, INFO,
540 		    "info: ASSOC_CMD: tmp_cap=%4X CAPINFO_MASK=%4lX\n",
541 		    tmp_cap, CAPINFO_MASK);
542 	assoc->cap_info_bitmap = cpu_to_le16(tmp_cap);
543 
544 	return 0;
545 }
546 
547 static const char *assoc_failure_reason_to_str(u16 cap_info)
548 {
549 	switch (cap_info) {
550 	case CONNECT_ERR_AUTH_ERR_STA_FAILURE:
551 		return "CONNECT_ERR_AUTH_ERR_STA_FAILURE";
552 	case CONNECT_ERR_AUTH_MSG_UNHANDLED:
553 		return "CONNECT_ERR_AUTH_MSG_UNHANDLED";
554 	case CONNECT_ERR_ASSOC_ERR_TIMEOUT:
555 		return "CONNECT_ERR_ASSOC_ERR_TIMEOUT";
556 	case CONNECT_ERR_ASSOC_ERR_AUTH_REFUSED:
557 		return "CONNECT_ERR_ASSOC_ERR_AUTH_REFUSED";
558 	case CONNECT_ERR_STA_FAILURE:
559 		return "CONNECT_ERR_STA_FAILURE";
560 	}
561 
562 	return "Unknown connect failure";
563 }
564 /*
565  * Association firmware command response handler
566  *
567  * The response buffer for the association command has the following
568  * memory layout.
569  *
570  * For cases where an association response was not received (indicated
571  * by the CapInfo and AId field):
572  *
573  *     .------------------------------------------------------------.
574  *     |  Header(4 * sizeof(t_u16)):  Standard command response hdr |
575  *     .------------------------------------------------------------.
576  *     |  cap_info/Error Return(t_u16):                             |
577  *     |           0xFFFF(-1): Internal error                       |
578  *     |           0xFFFE(-2): Authentication unhandled message     |
579  *     |           0xFFFD(-3): Authentication refused               |
580  *     |           0xFFFC(-4): Timeout waiting for AP response      |
581  *     .------------------------------------------------------------.
582  *     |  status_code(t_u16):                                       |
583  *     |        If cap_info is -1:                                  |
584  *     |           An internal firmware failure prevented the       |
585  *     |           command from being processed.  The status_code   |
586  *     |           will be set to 1.                                |
587  *     |                                                            |
588  *     |        If cap_info is -2:                                  |
589  *     |           An authentication frame was received but was     |
590  *     |           not handled by the firmware.  IEEE Status        |
591  *     |           code for the failure is returned.                |
592  *     |                                                            |
593  *     |        If cap_info is -3:                                  |
594  *     |           An authentication frame was received and the     |
595  *     |           status_code is the IEEE Status reported in the   |
596  *     |           response.                                        |
597  *     |                                                            |
598  *     |        If cap_info is -4:                                  |
599  *     |           (1) Association response timeout                 |
600  *     |           (2) Authentication response timeout              |
601  *     .------------------------------------------------------------.
602  *     |  a_id(t_u16): 0xFFFF                                       |
603  *     .------------------------------------------------------------.
604  *
605  *
606  * For cases where an association response was received, the IEEE
607  * standard association response frame is returned:
608  *
609  *     .------------------------------------------------------------.
610  *     |  Header(4 * sizeof(t_u16)):  Standard command response hdr |
611  *     .------------------------------------------------------------.
612  *     |  cap_info(t_u16): IEEE Capability                          |
613  *     .------------------------------------------------------------.
614  *     |  status_code(t_u16): IEEE Status Code                      |
615  *     .------------------------------------------------------------.
616  *     |  a_id(t_u16): IEEE Association ID                          |
617  *     .------------------------------------------------------------.
618  *     |  IEEE IEs(variable): Any received IEs comprising the       |
619  *     |                      remaining portion of a received       |
620  *     |                      association response frame.           |
621  *     .------------------------------------------------------------.
622  *
623  * For simplistic handling, the status_code field can be used to determine
624  * an association success (0) or failure (non-zero).
625  */
626 int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
627 			     struct host_cmd_ds_command *resp)
628 {
629 	struct mwifiex_adapter *adapter = priv->adapter;
630 	int ret = 0;
631 	struct ieee_types_assoc_rsp *assoc_rsp;
632 	struct mwifiex_bssdescriptor *bss_desc;
633 	bool enable_data = true;
634 	u16 cap_info, status_code, aid;
635 	const u8 *ie_ptr;
636 	struct ieee80211_ht_operation *assoc_resp_ht_oper;
637 
638 	if (!priv->attempted_bss_desc) {
639 		mwifiex_dbg(priv->adapter, ERROR,
640 			    "ASSOC_RESP: failed, association terminated by host\n");
641 		goto done;
642 	}
643 
644 	assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
645 
646 	cap_info = le16_to_cpu(assoc_rsp->cap_info_bitmap);
647 	status_code = le16_to_cpu(assoc_rsp->status_code);
648 	aid = le16_to_cpu(assoc_rsp->a_id);
649 
650 	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
651 		dev_err(priv->adapter->dev,
652 			"invalid AID value 0x%x; bits 15:14 not set\n",
653 			aid);
654 
655 	aid &= ~(BIT(15) | BIT(14));
656 
657 	priv->assoc_rsp_size = min(le16_to_cpu(resp->size) - S_DS_GEN,
658 				   sizeof(priv->assoc_rsp_buf));
659 
660 	assoc_rsp->a_id = cpu_to_le16(aid);
661 	memcpy(priv->assoc_rsp_buf, &resp->params, priv->assoc_rsp_size);
662 
663 	if (status_code) {
664 		priv->adapter->dbg.num_cmd_assoc_failure++;
665 		mwifiex_dbg(priv->adapter, ERROR,
666 			    "ASSOC_RESP: failed,\t"
667 			    "status code=%d err=%#x a_id=%#x\n",
668 			    status_code, cap_info,
669 			    le16_to_cpu(assoc_rsp->a_id));
670 
671 		mwifiex_dbg(priv->adapter, ERROR, "assoc failure: reason %s\n",
672 			    assoc_failure_reason_to_str(cap_info));
673 		if (cap_info == CONNECT_ERR_ASSOC_ERR_TIMEOUT) {
674 			if (status_code == MWIFIEX_ASSOC_CMD_FAILURE_AUTH) {
675 				ret = WLAN_STATUS_AUTH_TIMEOUT;
676 				mwifiex_dbg(priv->adapter, ERROR,
677 					    "ASSOC_RESP: AUTH timeout\n");
678 			} else {
679 				ret = WLAN_STATUS_UNSPECIFIED_FAILURE;
680 				mwifiex_dbg(priv->adapter, ERROR,
681 					    "ASSOC_RESP: UNSPECIFIED failure\n");
682 			}
683 		} else {
684 			ret = status_code;
685 		}
686 
687 		goto done;
688 	}
689 
690 	/* Send a Media Connected event, according to the Spec */
691 	priv->media_connected = true;
692 
693 	priv->adapter->ps_state = PS_STATE_AWAKE;
694 	priv->adapter->pps_uapsd_mode = false;
695 	priv->adapter->tx_lock_flag = false;
696 
697 	/* Set the attempted BSSID Index to current */
698 	bss_desc = priv->attempted_bss_desc;
699 
700 	mwifiex_dbg(priv->adapter, INFO, "info: ASSOC_RESP: %s\n",
701 		    bss_desc->ssid.ssid);
702 
703 	/* Make a copy of current BSSID descriptor */
704 	memcpy(&priv->curr_bss_params.bss_descriptor,
705 	       bss_desc, sizeof(struct mwifiex_bssdescriptor));
706 
707 	/* Update curr_bss_params */
708 	priv->curr_bss_params.bss_descriptor.channel
709 		= bss_desc->phy_param_set.ds_param_set.current_chan;
710 
711 	priv->curr_bss_params.band = (u8) bss_desc->bss_band;
712 
713 	if (bss_desc->wmm_ie.vend_hdr.element_id == WLAN_EID_VENDOR_SPECIFIC)
714 		priv->curr_bss_params.wmm_enabled = true;
715 	else
716 		priv->curr_bss_params.wmm_enabled = false;
717 
718 	if ((priv->wmm_required || bss_desc->bcn_ht_cap) &&
719 	    priv->curr_bss_params.wmm_enabled)
720 		priv->wmm_enabled = true;
721 	else
722 		priv->wmm_enabled = false;
723 
724 	priv->curr_bss_params.wmm_uapsd_enabled = false;
725 
726 	if (priv->wmm_enabled)
727 		priv->curr_bss_params.wmm_uapsd_enabled
728 			= ((bss_desc->wmm_ie.qos_info_bitmap &
729 				IEEE80211_WMM_IE_AP_QOSINFO_UAPSD) ? 1 : 0);
730 
731 	/* Store the bandwidth information from assoc response */
732 	ie_ptr = cfg80211_find_ie(WLAN_EID_HT_OPERATION, assoc_rsp->ie_buffer,
733 				  priv->assoc_rsp_size
734 				  - sizeof(struct ieee_types_assoc_rsp));
735 	if (ie_ptr) {
736 		assoc_resp_ht_oper = (struct ieee80211_ht_operation *)(ie_ptr
737 					+ sizeof(struct ieee_types_header));
738 		priv->assoc_resp_ht_param = assoc_resp_ht_oper->ht_param;
739 		priv->ht_param_present = true;
740 	} else {
741 		priv->ht_param_present = false;
742 	}
743 
744 	mwifiex_dbg(priv->adapter, INFO,
745 		    "info: ASSOC_RESP: curr_pkt_filter is %#x\n",
746 		    priv->curr_pkt_filter);
747 	if (priv->sec_info.wpa_enabled || priv->sec_info.wpa2_enabled)
748 		priv->wpa_is_gtk_set = false;
749 
750 	if (priv->wmm_enabled) {
751 		/* Don't re-enable carrier until we get the WMM_GET_STATUS
752 		   event */
753 		enable_data = false;
754 	} else {
755 		/* Since WMM is not enabled, setup the queues with the
756 		   defaults */
757 		mwifiex_wmm_setup_queue_priorities(priv, NULL);
758 		mwifiex_wmm_setup_ac_downgrade(priv);
759 	}
760 
761 	if (enable_data)
762 		mwifiex_dbg(priv->adapter, INFO,
763 			    "info: post association, re-enabling data flow\n");
764 
765 	/* Reset SNR/NF/RSSI values */
766 	priv->data_rssi_last = 0;
767 	priv->data_nf_last = 0;
768 	priv->data_rssi_avg = 0;
769 	priv->data_nf_avg = 0;
770 	priv->bcn_rssi_last = 0;
771 	priv->bcn_nf_last = 0;
772 	priv->bcn_rssi_avg = 0;
773 	priv->bcn_nf_avg = 0;
774 	priv->rxpd_rate = 0;
775 	priv->rxpd_htinfo = 0;
776 
777 	mwifiex_save_curr_bcn(priv);
778 
779 	priv->adapter->dbg.num_cmd_assoc_success++;
780 
781 	mwifiex_dbg(priv->adapter, INFO, "info: ASSOC_RESP: associated\n");
782 
783 	/* Add the ra_list here for infra mode as there will be only 1 ra
784 	   always */
785 	mwifiex_ralist_add(priv,
786 			   priv->curr_bss_params.bss_descriptor.mac_address);
787 
788 	if (!netif_carrier_ok(priv->netdev))
789 		netif_carrier_on(priv->netdev);
790 	mwifiex_wake_up_net_dev_queue(priv->netdev, adapter);
791 
792 	if (priv->sec_info.wpa_enabled || priv->sec_info.wpa2_enabled)
793 		priv->scan_block = true;
794 	else
795 		priv->port_open = true;
796 
797 done:
798 	/* Need to indicate IOCTL complete */
799 	if (adapter->curr_cmd->wait_q_enabled) {
800 		if (ret)
801 			adapter->cmd_wait_q.status = -1;
802 		else
803 			adapter->cmd_wait_q.status = 0;
804 	}
805 
806 	return ret;
807 }
808 
809 /*
810  * This function prepares command for ad-hoc start.
811  *
812  * Driver will fill up SSID, BSS mode, IBSS parameters, physical
813  * parameters, probe delay, and capability information. Firmware
814  * will fill up beacon period, basic rates and operational rates.
815  *
816  * In addition, the following TLVs are added -
817  *      - Channel TLV
818  *      - Vendor specific IE
819  *      - WPA/WPA2 IE
820  *      - HT Capabilities IE
821  *      - HT Information IE
822  *
823  * Preparation also includes -
824  *      - Setting command ID and proper size
825  *      - Ensuring correct endian-ness
826  */
827 int
828 mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
829 				struct host_cmd_ds_command *cmd,
830 				struct cfg80211_ssid *req_ssid)
831 {
832 	int rsn_ie_len = 0;
833 	struct mwifiex_adapter *adapter = priv->adapter;
834 	struct host_cmd_ds_802_11_ad_hoc_start *adhoc_start =
835 		&cmd->params.adhoc_start;
836 	struct mwifiex_bssdescriptor *bss_desc;
837 	u32 cmd_append_size = 0;
838 	u32 i;
839 	u16 tmp_cap;
840 	struct mwifiex_ie_types_chan_list_param_set *chan_tlv;
841 	u8 radio_type;
842 
843 	struct mwifiex_ie_types_htcap *ht_cap;
844 	struct mwifiex_ie_types_htinfo *ht_info;
845 	u8 *pos = (u8 *) adhoc_start +
846 			sizeof(struct host_cmd_ds_802_11_ad_hoc_start);
847 
848 	if (!adapter)
849 		return -1;
850 
851 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_AD_HOC_START);
852 
853 	bss_desc = &priv->curr_bss_params.bss_descriptor;
854 	priv->attempted_bss_desc = bss_desc;
855 
856 	/*
857 	 * Fill in the parameters for 2 data structures:
858 	 *   1. struct host_cmd_ds_802_11_ad_hoc_start command
859 	 *   2. bss_desc
860 	 * Driver will fill up SSID, bss_mode,IBSS param, Physical Param,
861 	 * probe delay, and Cap info.
862 	 * Firmware will fill up beacon period, Basic rates
863 	 * and operational rates.
864 	 */
865 
866 	memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
867 
868 	if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
869 		req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
870 	memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
871 
872 	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
873 		    adhoc_start->ssid);
874 
875 	memset(bss_desc->ssid.ssid, 0, IEEE80211_MAX_SSID_LEN);
876 	memcpy(bss_desc->ssid.ssid, req_ssid->ssid, req_ssid->ssid_len);
877 
878 	bss_desc->ssid.ssid_len = req_ssid->ssid_len;
879 
880 	/* Set the BSS mode */
881 	adhoc_start->bss_mode = HostCmd_BSS_MODE_IBSS;
882 	bss_desc->bss_mode = NL80211_IFTYPE_ADHOC;
883 	adhoc_start->beacon_period = cpu_to_le16(priv->beacon_period);
884 	bss_desc->beacon_period = priv->beacon_period;
885 
886 	/* Set Physical param set */
887 /* Parameter IE Id */
888 #define DS_PARA_IE_ID   3
889 /* Parameter IE length */
890 #define DS_PARA_IE_LEN  1
891 
892 	adhoc_start->phy_param_set.ds_param_set.element_id = DS_PARA_IE_ID;
893 	adhoc_start->phy_param_set.ds_param_set.len = DS_PARA_IE_LEN;
894 
895 	if (!mwifiex_get_cfp(priv, adapter->adhoc_start_band,
896 			     (u16) priv->adhoc_channel, 0)) {
897 		struct mwifiex_chan_freq_power *cfp;
898 		cfp = mwifiex_get_cfp(priv, adapter->adhoc_start_band,
899 				      FIRST_VALID_CHANNEL, 0);
900 		if (cfp)
901 			priv->adhoc_channel = (u8) cfp->channel;
902 	}
903 
904 	if (!priv->adhoc_channel) {
905 		mwifiex_dbg(adapter, ERROR,
906 			    "ADHOC_S_CMD: adhoc_channel cannot be 0\n");
907 		return -1;
908 	}
909 
910 	mwifiex_dbg(adapter, INFO,
911 		    "info: ADHOC_S_CMD: creating ADHOC on channel %d\n",
912 		    priv->adhoc_channel);
913 
914 	priv->curr_bss_params.bss_descriptor.channel = priv->adhoc_channel;
915 	priv->curr_bss_params.band = adapter->adhoc_start_band;
916 
917 	bss_desc->channel = priv->adhoc_channel;
918 	adhoc_start->phy_param_set.ds_param_set.current_chan =
919 		priv->adhoc_channel;
920 
921 	memcpy(&bss_desc->phy_param_set, &adhoc_start->phy_param_set,
922 	       sizeof(union ieee_types_phy_param_set));
923 
924 	/* Set IBSS param set */
925 /* IBSS parameter IE Id */
926 #define IBSS_PARA_IE_ID   6
927 /* IBSS parameter IE length */
928 #define IBSS_PARA_IE_LEN  2
929 
930 	adhoc_start->ss_param_set.ibss_param_set.element_id = IBSS_PARA_IE_ID;
931 	adhoc_start->ss_param_set.ibss_param_set.len = IBSS_PARA_IE_LEN;
932 	adhoc_start->ss_param_set.ibss_param_set.atim_window
933 					= cpu_to_le16(priv->atim_window);
934 	memcpy(&bss_desc->ss_param_set, &adhoc_start->ss_param_set,
935 	       sizeof(union ieee_types_ss_param_set));
936 
937 	/* Set Capability info */
938 	bss_desc->cap_info_bitmap |= WLAN_CAPABILITY_IBSS;
939 	tmp_cap = WLAN_CAPABILITY_IBSS;
940 
941 	/* Set up privacy in bss_desc */
942 	if (priv->sec_info.encryption_mode) {
943 		/* Ad-Hoc capability privacy on */
944 		mwifiex_dbg(adapter, INFO,
945 			    "info: ADHOC_S_CMD: wep_status set privacy to WEP\n");
946 		bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_8021X_WEP;
947 		tmp_cap |= WLAN_CAPABILITY_PRIVACY;
948 	} else {
949 		mwifiex_dbg(adapter, INFO,
950 			    "info: ADHOC_S_CMD: wep_status NOT set,\t"
951 			    "setting privacy to ACCEPT ALL\n");
952 		bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_ACCEPT_ALL;
953 	}
954 
955 	memset(adhoc_start->data_rate, 0, sizeof(adhoc_start->data_rate));
956 	mwifiex_get_active_data_rates(priv, adhoc_start->data_rate);
957 	if ((adapter->adhoc_start_band & BAND_G) &&
958 	    (priv->curr_pkt_filter & HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON)) {
959 		if (mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
960 				     HostCmd_ACT_GEN_SET, 0,
961 				     &priv->curr_pkt_filter, false)) {
962 			mwifiex_dbg(adapter, ERROR,
963 				    "ADHOC_S_CMD: G Protection config failed\n");
964 			return -1;
965 		}
966 	}
967 	/* Find the last non zero */
968 	for (i = 0; i < sizeof(adhoc_start->data_rate); i++)
969 		if (!adhoc_start->data_rate[i])
970 			break;
971 
972 	priv->curr_bss_params.num_of_rates = i;
973 
974 	/* Copy the ad-hoc creating rates into Current BSS rate structure */
975 	memcpy(&priv->curr_bss_params.data_rates,
976 	       &adhoc_start->data_rate, priv->curr_bss_params.num_of_rates);
977 
978 	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: rates=%4ph\n",
979 		    adhoc_start->data_rate);
980 
981 	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: AD-HOC Start command is ready\n");
982 
983 	if (IS_SUPPORT_MULTI_BANDS(adapter)) {
984 		/* Append a channel TLV */
985 		chan_tlv = (struct mwifiex_ie_types_chan_list_param_set *) pos;
986 		chan_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
987 		chan_tlv->header.len =
988 			cpu_to_le16(sizeof(struct mwifiex_chan_scan_param_set));
989 
990 		memset(chan_tlv->chan_scan_param, 0x00,
991 		       sizeof(struct mwifiex_chan_scan_param_set));
992 		chan_tlv->chan_scan_param[0].chan_number =
993 			(u8) priv->curr_bss_params.bss_descriptor.channel;
994 
995 		mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: TLV Chan = %d\n",
996 			    chan_tlv->chan_scan_param[0].chan_number);
997 
998 		chan_tlv->chan_scan_param[0].radio_type
999 		       = mwifiex_band_to_radio_type(priv->curr_bss_params.band);
1000 		if (adapter->adhoc_start_band & BAND_GN ||
1001 		    adapter->adhoc_start_band & BAND_AN) {
1002 			if (adapter->sec_chan_offset ==
1003 					    IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
1004 				chan_tlv->chan_scan_param[0].radio_type |=
1005 					(IEEE80211_HT_PARAM_CHA_SEC_ABOVE << 4);
1006 			else if (adapter->sec_chan_offset ==
1007 					    IEEE80211_HT_PARAM_CHA_SEC_BELOW)
1008 				chan_tlv->chan_scan_param[0].radio_type |=
1009 					(IEEE80211_HT_PARAM_CHA_SEC_BELOW << 4);
1010 		}
1011 		mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: TLV Band = %d\n",
1012 			    chan_tlv->chan_scan_param[0].radio_type);
1013 		pos += sizeof(chan_tlv->header) +
1014 			sizeof(struct mwifiex_chan_scan_param_set);
1015 		cmd_append_size +=
1016 			sizeof(chan_tlv->header) +
1017 			sizeof(struct mwifiex_chan_scan_param_set);
1018 	}
1019 
1020 	/* Append vendor specific IE TLV */
1021 	cmd_append_size += mwifiex_cmd_append_vsie_tlv(priv,
1022 				MWIFIEX_VSIE_MASK_ADHOC, &pos);
1023 
1024 	if (priv->sec_info.wpa_enabled) {
1025 		rsn_ie_len = mwifiex_append_rsn_ie_wpa_wpa2(priv, &pos);
1026 		if (rsn_ie_len == -1)
1027 			return -1;
1028 		cmd_append_size += rsn_ie_len;
1029 	}
1030 
1031 	if (adapter->adhoc_11n_enabled) {
1032 		/* Fill HT CAPABILITY */
1033 		ht_cap = (struct mwifiex_ie_types_htcap *) pos;
1034 		memset(ht_cap, 0, sizeof(struct mwifiex_ie_types_htcap));
1035 		ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
1036 		ht_cap->header.len =
1037 		       cpu_to_le16(sizeof(struct ieee80211_ht_cap));
1038 		radio_type = mwifiex_band_to_radio_type(
1039 					priv->adapter->config_bands);
1040 		mwifiex_fill_cap_info(priv, radio_type, &ht_cap->ht_cap);
1041 
1042 		if (adapter->sec_chan_offset ==
1043 					IEEE80211_HT_PARAM_CHA_SEC_NONE) {
1044 			u16 tmp_ht_cap;
1045 
1046 			tmp_ht_cap = le16_to_cpu(ht_cap->ht_cap.cap_info);
1047 			tmp_ht_cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
1048 			tmp_ht_cap &= ~IEEE80211_HT_CAP_SGI_40;
1049 			ht_cap->ht_cap.cap_info = cpu_to_le16(tmp_ht_cap);
1050 		}
1051 
1052 		pos += sizeof(struct mwifiex_ie_types_htcap);
1053 		cmd_append_size += sizeof(struct mwifiex_ie_types_htcap);
1054 
1055 		/* Fill HT INFORMATION */
1056 		ht_info = (struct mwifiex_ie_types_htinfo *) pos;
1057 		memset(ht_info, 0, sizeof(struct mwifiex_ie_types_htinfo));
1058 		ht_info->header.type = cpu_to_le16(WLAN_EID_HT_OPERATION);
1059 		ht_info->header.len =
1060 			cpu_to_le16(sizeof(struct ieee80211_ht_operation));
1061 
1062 		ht_info->ht_oper.primary_chan =
1063 			(u8) priv->curr_bss_params.bss_descriptor.channel;
1064 		if (adapter->sec_chan_offset) {
1065 			ht_info->ht_oper.ht_param = adapter->sec_chan_offset;
1066 			ht_info->ht_oper.ht_param |=
1067 					IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
1068 		}
1069 		ht_info->ht_oper.operation_mode =
1070 		     cpu_to_le16(IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
1071 		ht_info->ht_oper.basic_set[0] = 0xff;
1072 		pos += sizeof(struct mwifiex_ie_types_htinfo);
1073 		cmd_append_size +=
1074 				sizeof(struct mwifiex_ie_types_htinfo);
1075 	}
1076 
1077 	cmd->size =
1078 		cpu_to_le16((u16)(sizeof(struct host_cmd_ds_802_11_ad_hoc_start)
1079 				  + S_DS_GEN + cmd_append_size));
1080 
1081 	if (adapter->adhoc_start_band == BAND_B)
1082 		tmp_cap &= ~WLAN_CAPABILITY_SHORT_SLOT_TIME;
1083 	else
1084 		tmp_cap |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1085 
1086 	adhoc_start->cap_info_bitmap = cpu_to_le16(tmp_cap);
1087 
1088 	return 0;
1089 }
1090 
1091 /*
1092  * This function prepares command for ad-hoc join.
1093  *
1094  * Most of the parameters are set up by copying from the target BSS descriptor
1095  * from the scan response.
1096  *
1097  * In addition, the following TLVs are added -
1098  *      - Channel TLV
1099  *      - Vendor specific IE
1100  *      - WPA/WPA2 IE
1101  *      - 11n IE
1102  *
1103  * Preparation also includes -
1104  *      - Setting command ID and proper size
1105  *      - Ensuring correct endian-ness
1106  */
1107 int
1108 mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
1109 			       struct host_cmd_ds_command *cmd,
1110 			       struct mwifiex_bssdescriptor *bss_desc)
1111 {
1112 	int rsn_ie_len = 0;
1113 	struct host_cmd_ds_802_11_ad_hoc_join *adhoc_join =
1114 		&cmd->params.adhoc_join;
1115 	struct mwifiex_ie_types_chan_list_param_set *chan_tlv;
1116 	u32 cmd_append_size = 0;
1117 	u16 tmp_cap;
1118 	u32 i, rates_size = 0;
1119 	u16 curr_pkt_filter;
1120 	u8 *pos =
1121 		(u8 *) adhoc_join +
1122 		sizeof(struct host_cmd_ds_802_11_ad_hoc_join);
1123 
1124 /* Use G protection */
1125 #define USE_G_PROTECTION        0x02
1126 	if (bss_desc->erp_flags & USE_G_PROTECTION) {
1127 		curr_pkt_filter =
1128 			priv->
1129 			curr_pkt_filter | HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON;
1130 
1131 		if (mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
1132 				     HostCmd_ACT_GEN_SET, 0,
1133 				     &curr_pkt_filter, false)) {
1134 			mwifiex_dbg(priv->adapter, ERROR,
1135 				    "ADHOC_J_CMD: G Protection config failed\n");
1136 			return -1;
1137 		}
1138 	}
1139 
1140 	priv->attempted_bss_desc = bss_desc;
1141 
1142 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_AD_HOC_JOIN);
1143 
1144 	adhoc_join->bss_descriptor.bss_mode = HostCmd_BSS_MODE_IBSS;
1145 
1146 	adhoc_join->bss_descriptor.beacon_period
1147 		= cpu_to_le16(bss_desc->beacon_period);
1148 
1149 	memcpy(&adhoc_join->bss_descriptor.bssid,
1150 	       &bss_desc->mac_address, ETH_ALEN);
1151 
1152 	memcpy(&adhoc_join->bss_descriptor.ssid,
1153 	       &bss_desc->ssid.ssid, bss_desc->ssid.ssid_len);
1154 
1155 	memcpy(&adhoc_join->bss_descriptor.phy_param_set,
1156 	       &bss_desc->phy_param_set,
1157 	       sizeof(union ieee_types_phy_param_set));
1158 
1159 	memcpy(&adhoc_join->bss_descriptor.ss_param_set,
1160 	       &bss_desc->ss_param_set, sizeof(union ieee_types_ss_param_set));
1161 
1162 	tmp_cap = bss_desc->cap_info_bitmap;
1163 
1164 	tmp_cap &= CAPINFO_MASK;
1165 
1166 	mwifiex_dbg(priv->adapter, INFO,
1167 		    "info: ADHOC_J_CMD: tmp_cap=%4X CAPINFO_MASK=%4lX\n",
1168 		    tmp_cap, CAPINFO_MASK);
1169 
1170 	/* Information on BSSID descriptor passed to FW */
1171 	mwifiex_dbg(priv->adapter, INFO,
1172 		    "info: ADHOC_J_CMD: BSSID=%pM, SSID='%s'\n",
1173 		    adhoc_join->bss_descriptor.bssid,
1174 		    adhoc_join->bss_descriptor.ssid);
1175 
1176 	for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
1177 		    bss_desc->supported_rates[i]; i++)
1178 		;
1179 	rates_size = i;
1180 
1181 	/* Copy Data Rates from the Rates recorded in scan response */
1182 	memset(adhoc_join->bss_descriptor.data_rates, 0,
1183 	       sizeof(adhoc_join->bss_descriptor.data_rates));
1184 	memcpy(adhoc_join->bss_descriptor.data_rates,
1185 	       bss_desc->supported_rates, rates_size);
1186 
1187 	/* Copy the adhoc join rates into Current BSS state structure */
1188 	priv->curr_bss_params.num_of_rates = rates_size;
1189 	memcpy(&priv->curr_bss_params.data_rates, bss_desc->supported_rates,
1190 	       rates_size);
1191 
1192 	/* Copy the channel information */
1193 	priv->curr_bss_params.bss_descriptor.channel = bss_desc->channel;
1194 	priv->curr_bss_params.band = (u8) bss_desc->bss_band;
1195 
1196 	if (priv->sec_info.wep_enabled || priv->sec_info.wpa_enabled)
1197 		tmp_cap |= WLAN_CAPABILITY_PRIVACY;
1198 
1199 	if (IS_SUPPORT_MULTI_BANDS(priv->adapter)) {
1200 		/* Append a channel TLV */
1201 		chan_tlv = (struct mwifiex_ie_types_chan_list_param_set *) pos;
1202 		chan_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
1203 		chan_tlv->header.len =
1204 			cpu_to_le16(sizeof(struct mwifiex_chan_scan_param_set));
1205 
1206 		memset(chan_tlv->chan_scan_param, 0x00,
1207 		       sizeof(struct mwifiex_chan_scan_param_set));
1208 		chan_tlv->chan_scan_param[0].chan_number =
1209 			(bss_desc->phy_param_set.ds_param_set.current_chan);
1210 		mwifiex_dbg(priv->adapter, INFO, "info: ADHOC_J_CMD: TLV Chan=%d\n",
1211 			    chan_tlv->chan_scan_param[0].chan_number);
1212 
1213 		chan_tlv->chan_scan_param[0].radio_type =
1214 			mwifiex_band_to_radio_type((u8) bss_desc->bss_band);
1215 
1216 		mwifiex_dbg(priv->adapter, INFO, "info: ADHOC_J_CMD: TLV Band=%d\n",
1217 			    chan_tlv->chan_scan_param[0].radio_type);
1218 		pos += sizeof(chan_tlv->header) +
1219 				sizeof(struct mwifiex_chan_scan_param_set);
1220 		cmd_append_size += sizeof(chan_tlv->header) +
1221 				sizeof(struct mwifiex_chan_scan_param_set);
1222 	}
1223 
1224 	if (priv->sec_info.wpa_enabled)
1225 		rsn_ie_len = mwifiex_append_rsn_ie_wpa_wpa2(priv, &pos);
1226 	if (rsn_ie_len == -1)
1227 		return -1;
1228 	cmd_append_size += rsn_ie_len;
1229 
1230 	if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info))
1231 		cmd_append_size += mwifiex_cmd_append_11n_tlv(priv,
1232 			bss_desc, &pos);
1233 
1234 	/* Append vendor specific IE TLV */
1235 	cmd_append_size += mwifiex_cmd_append_vsie_tlv(priv,
1236 			MWIFIEX_VSIE_MASK_ADHOC, &pos);
1237 
1238 	cmd->size = cpu_to_le16
1239 		((u16) (sizeof(struct host_cmd_ds_802_11_ad_hoc_join)
1240 			+ S_DS_GEN + cmd_append_size));
1241 
1242 	adhoc_join->bss_descriptor.cap_info_bitmap = cpu_to_le16(tmp_cap);
1243 
1244 	return 0;
1245 }
1246 
1247 /*
1248  * This function handles the command response of ad-hoc start and
1249  * ad-hoc join.
1250  *
1251  * The function generates a device-connected event to notify
1252  * the applications, in case of successful ad-hoc start/join, and
1253  * saves the beacon buffer.
1254  */
1255 int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv,
1256 			      struct host_cmd_ds_command *resp)
1257 {
1258 	int ret = 0;
1259 	struct mwifiex_adapter *adapter = priv->adapter;
1260 	struct host_cmd_ds_802_11_ad_hoc_start_result *start_result =
1261 				&resp->params.start_result;
1262 	struct host_cmd_ds_802_11_ad_hoc_join_result *join_result =
1263 				&resp->params.join_result;
1264 	struct mwifiex_bssdescriptor *bss_desc;
1265 	u16 cmd = le16_to_cpu(resp->command);
1266 	u8 result;
1267 
1268 	if (!priv->attempted_bss_desc) {
1269 		mwifiex_dbg(priv->adapter, ERROR,
1270 			    "ADHOC_RESP: failed, association terminated by host\n");
1271 		goto done;
1272 	}
1273 
1274 	if (cmd == HostCmd_CMD_802_11_AD_HOC_START)
1275 		result = start_result->result;
1276 	else
1277 		result = join_result->result;
1278 
1279 	bss_desc = priv->attempted_bss_desc;
1280 
1281 	/* Join result code 0 --> SUCCESS */
1282 	if (result) {
1283 		mwifiex_dbg(priv->adapter, ERROR, "ADHOC_RESP: failed\n");
1284 		if (priv->media_connected)
1285 			mwifiex_reset_connect_state(priv, result, true);
1286 
1287 		memset(&priv->curr_bss_params.bss_descriptor,
1288 		       0x00, sizeof(struct mwifiex_bssdescriptor));
1289 
1290 		ret = -1;
1291 		goto done;
1292 	}
1293 
1294 	/* Send a Media Connected event, according to the Spec */
1295 	priv->media_connected = true;
1296 
1297 	if (le16_to_cpu(resp->command) == HostCmd_CMD_802_11_AD_HOC_START) {
1298 		mwifiex_dbg(priv->adapter, INFO, "info: ADHOC_S_RESP %s\n",
1299 			    bss_desc->ssid.ssid);
1300 
1301 		/* Update the created network descriptor with the new BSSID */
1302 		memcpy(bss_desc->mac_address,
1303 		       start_result->bssid, ETH_ALEN);
1304 
1305 		priv->adhoc_state = ADHOC_STARTED;
1306 	} else {
1307 		/*
1308 		 * Now the join cmd should be successful.
1309 		 * If BSSID has changed use SSID to compare instead of BSSID
1310 		 */
1311 		mwifiex_dbg(priv->adapter, INFO,
1312 			    "info: ADHOC_J_RESP %s\n",
1313 			    bss_desc->ssid.ssid);
1314 
1315 		/*
1316 		 * Make a copy of current BSSID descriptor, only needed for
1317 		 * join since the current descriptor is already being used
1318 		 * for adhoc start
1319 		 */
1320 		memcpy(&priv->curr_bss_params.bss_descriptor,
1321 		       bss_desc, sizeof(struct mwifiex_bssdescriptor));
1322 
1323 		priv->adhoc_state = ADHOC_JOINED;
1324 	}
1325 
1326 	mwifiex_dbg(priv->adapter, INFO, "info: ADHOC_RESP: channel = %d\n",
1327 		    priv->adhoc_channel);
1328 	mwifiex_dbg(priv->adapter, INFO, "info: ADHOC_RESP: BSSID = %pM\n",
1329 		    priv->curr_bss_params.bss_descriptor.mac_address);
1330 
1331 	if (!netif_carrier_ok(priv->netdev))
1332 		netif_carrier_on(priv->netdev);
1333 	mwifiex_wake_up_net_dev_queue(priv->netdev, adapter);
1334 
1335 	mwifiex_save_curr_bcn(priv);
1336 
1337 done:
1338 	/* Need to indicate IOCTL complete */
1339 	if (adapter->curr_cmd->wait_q_enabled) {
1340 		if (ret)
1341 			adapter->cmd_wait_q.status = -1;
1342 		else
1343 			adapter->cmd_wait_q.status = 0;
1344 
1345 	}
1346 
1347 	return ret;
1348 }
1349 
1350 /*
1351  * This function associates to a specific BSS discovered in a scan.
1352  *
1353  * It clears any past association response stored for application
1354  * retrieval and calls the command preparation routine to send the
1355  * command to firmware.
1356  */
1357 int mwifiex_associate(struct mwifiex_private *priv,
1358 		      struct mwifiex_bssdescriptor *bss_desc)
1359 {
1360 	/* Return error if the adapter is not STA role or table entry
1361 	 * is not marked as infra.
1362 	 */
1363 	if ((GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) ||
1364 	    (bss_desc->bss_mode != NL80211_IFTYPE_STATION))
1365 		return -1;
1366 
1367 	if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
1368 	    !bss_desc->disable_11n && !bss_desc->disable_11ac &&
1369 	    priv->adapter->config_bands & BAND_AAC)
1370 		mwifiex_set_11ac_ba_params(priv);
1371 	else
1372 		mwifiex_set_ba_params(priv);
1373 
1374 	/* Clear any past association response stored for application
1375 	   retrieval */
1376 	priv->assoc_rsp_size = 0;
1377 
1378 	return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_ASSOCIATE,
1379 				HostCmd_ACT_GEN_SET, 0, bss_desc, true);
1380 }
1381 
1382 /*
1383  * This function starts an ad-hoc network.
1384  *
1385  * It calls the command preparation routine to send the command to firmware.
1386  */
1387 int
1388 mwifiex_adhoc_start(struct mwifiex_private *priv,
1389 		    struct cfg80211_ssid *adhoc_ssid)
1390 {
1391 	mwifiex_dbg(priv->adapter, INFO, "info: Adhoc Channel = %d\n",
1392 		    priv->adhoc_channel);
1393 	mwifiex_dbg(priv->adapter, INFO, "info: curr_bss_params.channel = %d\n",
1394 		    priv->curr_bss_params.bss_descriptor.channel);
1395 	mwifiex_dbg(priv->adapter, INFO, "info: curr_bss_params.band = %d\n",
1396 		    priv->curr_bss_params.band);
1397 
1398 	if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
1399 	    priv->adapter->config_bands & BAND_AAC)
1400 		mwifiex_set_11ac_ba_params(priv);
1401 	else
1402 		mwifiex_set_ba_params(priv);
1403 
1404 	return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_AD_HOC_START,
1405 				HostCmd_ACT_GEN_SET, 0, adhoc_ssid, true);
1406 }
1407 
1408 /*
1409  * This function joins an ad-hoc network found in a previous scan.
1410  *
1411  * It calls the command preparation routine to send the command to firmware,
1412  * if already not connected to the requested SSID.
1413  */
1414 int mwifiex_adhoc_join(struct mwifiex_private *priv,
1415 		       struct mwifiex_bssdescriptor *bss_desc)
1416 {
1417 	mwifiex_dbg(priv->adapter, INFO,
1418 		    "info: adhoc join: curr_bss ssid =%s\n",
1419 		    priv->curr_bss_params.bss_descriptor.ssid.ssid);
1420 	mwifiex_dbg(priv->adapter, INFO,
1421 		    "info: adhoc join: curr_bss ssid_len =%u\n",
1422 		    priv->curr_bss_params.bss_descriptor.ssid.ssid_len);
1423 	mwifiex_dbg(priv->adapter, INFO, "info: adhoc join: ssid =%s\n",
1424 		    bss_desc->ssid.ssid);
1425 	mwifiex_dbg(priv->adapter, INFO, "info: adhoc join: ssid_len =%u\n",
1426 		    bss_desc->ssid.ssid_len);
1427 
1428 	/* Check if the requested SSID is already joined */
1429 	if (priv->curr_bss_params.bss_descriptor.ssid.ssid_len &&
1430 	    !mwifiex_ssid_cmp(&bss_desc->ssid,
1431 			      &priv->curr_bss_params.bss_descriptor.ssid) &&
1432 	    (priv->curr_bss_params.bss_descriptor.bss_mode ==
1433 							NL80211_IFTYPE_ADHOC)) {
1434 		mwifiex_dbg(priv->adapter, INFO,
1435 			    "info: ADHOC_J_CMD: new ad-hoc SSID\t"
1436 			    "is the same as current; not attempting to re-join\n");
1437 		return -1;
1438 	}
1439 
1440 	if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info) &&
1441 	    !bss_desc->disable_11n && !bss_desc->disable_11ac &&
1442 	    priv->adapter->config_bands & BAND_AAC)
1443 		mwifiex_set_11ac_ba_params(priv);
1444 	else
1445 		mwifiex_set_ba_params(priv);
1446 
1447 	mwifiex_dbg(priv->adapter, INFO,
1448 		    "info: curr_bss_params.channel = %d\n",
1449 		    priv->curr_bss_params.bss_descriptor.channel);
1450 	mwifiex_dbg(priv->adapter, INFO,
1451 		    "info: curr_bss_params.band = %c\n",
1452 		    priv->curr_bss_params.band);
1453 
1454 	return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_AD_HOC_JOIN,
1455 				HostCmd_ACT_GEN_SET, 0, bss_desc, true);
1456 }
1457 
1458 /*
1459  * This function deauthenticates/disconnects from infra network by sending
1460  * deauthentication request.
1461  */
1462 static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv, u8 *mac)
1463 {
1464 	u8 mac_address[ETH_ALEN];
1465 	int ret;
1466 
1467 	if (!mac || is_zero_ether_addr(mac))
1468 		memcpy(mac_address,
1469 		       priv->curr_bss_params.bss_descriptor.mac_address,
1470 		       ETH_ALEN);
1471 	else
1472 		memcpy(mac_address, mac, ETH_ALEN);
1473 
1474 	ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_DEAUTHENTICATE,
1475 			       HostCmd_ACT_GEN_SET, 0, mac_address, true);
1476 
1477 	return ret;
1478 }
1479 
1480 /*
1481  * This function deauthenticates/disconnects from a BSS.
1482  *
1483  * In case of infra made, it sends deauthentication request, and
1484  * in case of ad-hoc mode, a stop network request is sent to the firmware.
1485  * In AP mode, a command to stop bss is sent to firmware.
1486  */
1487 int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
1488 {
1489 	int ret = 0;
1490 
1491 	if (!priv->media_connected)
1492 		return 0;
1493 
1494 	switch (priv->bss_mode) {
1495 	case NL80211_IFTYPE_STATION:
1496 	case NL80211_IFTYPE_P2P_CLIENT:
1497 		ret = mwifiex_deauthenticate_infra(priv, mac);
1498 		if (ret)
1499 			cfg80211_disconnected(priv->netdev, 0, NULL, 0,
1500 					      true, GFP_KERNEL);
1501 		break;
1502 	case NL80211_IFTYPE_ADHOC:
1503 		return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_AD_HOC_STOP,
1504 					HostCmd_ACT_GEN_SET, 0, NULL, true);
1505 	case NL80211_IFTYPE_AP:
1506 		return mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
1507 					HostCmd_ACT_GEN_SET, 0, NULL, true);
1508 	default:
1509 		break;
1510 	}
1511 
1512 	return ret;
1513 }
1514 
1515 /* This function deauthenticates/disconnects from all BSS. */
1516 void mwifiex_deauthenticate_all(struct mwifiex_adapter *adapter)
1517 {
1518 	struct mwifiex_private *priv;
1519 	int i;
1520 
1521 	for (i = 0; i < adapter->priv_num; i++) {
1522 		priv = adapter->priv[i];
1523 		if (priv)
1524 			mwifiex_deauthenticate(priv, NULL);
1525 	}
1526 }
1527 EXPORT_SYMBOL_GPL(mwifiex_deauthenticate_all);
1528 
1529 /*
1530  * This function converts band to radio type used in channel TLV.
1531  */
1532 u8
1533 mwifiex_band_to_radio_type(u8 band)
1534 {
1535 	switch (band) {
1536 	case BAND_A:
1537 	case BAND_AN:
1538 	case BAND_A | BAND_AN:
1539 	case BAND_A | BAND_AN | BAND_AAC:
1540 		return HostCmd_SCAN_RADIO_TYPE_A;
1541 	case BAND_B:
1542 	case BAND_G:
1543 	case BAND_B | BAND_G:
1544 	default:
1545 		return HostCmd_SCAN_RADIO_TYPE_BG;
1546 	}
1547 }
1548