xref: /linux/drivers/net/wireless/nxp/nxpwifi/scan.c (revision 91ec2035134982b98fab0609a9fd8480e8217dc1)

// SPDX-License-Identifier: GPL-2.0-only
/*
 * nxpwifi: scan ioctl and command handling
 *
 * Copyright 2011-2024 NXP
 */

#include "cfg.h"
#include "util.h"
#include "fw.h"
#include "main.h"
#include "cmdevt.h"
#include "11n.h"
#include "11ac.h"
#include "11ax.h"
#include "cfg80211.h"

/* The maximum number of channels the firmware can scan per command */
#define NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN   14

#define NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD        4

/* Memory needed to store a max sized Channel List TLV for a firmware scan */
#define CHAN_TLV_MAX_SIZE  (sizeof(struct nxpwifi_ie_types_header)        \
			    + (NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN     \
			    * sizeof(struct nxpwifi_chan_scan_param_set)))

/* Memory needed to store supported rate */
#define RATE_TLV_MAX_SIZE   (sizeof(struct nxpwifi_ie_types_rates_param_set) \
			     + HOSTCMD_SUPPORTED_RATES)

/* Memory needed to store a max number/size WildCard SSID TLV for a firmware scan */
#define WILDCARD_SSID_TLV_MAX_SIZE  \
	(NXPWIFI_MAX_SSID_LIST_LENGTH *					\
		(sizeof(struct nxpwifi_ie_types_wildcard_ssid_params)	\
			+ IEEE80211_MAX_SSID_LEN))

/* Maximum memory needed for a nxpwifi_scan_cmd_config with all TLVs at max */
#define MAX_SCAN_CFG_ALLOC (sizeof(struct nxpwifi_scan_cmd_config)        \
				+ sizeof(struct nxpwifi_ie_types_num_probes)   \
				+ sizeof(struct nxpwifi_ie_types_htcap)       \
				+ sizeof(struct nxpwifi_ie_types_vhtcap)      \
				+ sizeof(struct nxpwifi_ie_types_he_cap)      \
				+ CHAN_TLV_MAX_SIZE                 \
				+ RATE_TLV_MAX_SIZE                 \
				+ WILDCARD_SSID_TLV_MAX_SIZE)

union nxpwifi_scan_cmd_config_tlv {
	/* Scan configuration (variable length) */
	struct nxpwifi_scan_cmd_config config;
	/* Max allocated block */
	u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC];
};

#define NXPWIFI_WPA_CIPHER_SUITE_TKIP		SUITE(WLAN_OUI_MICROSOFT, 2)
#define NXPWIFI_WPA_CIPHER_SUITE_CCMP		SUITE(WLAN_OUI_MICROSOFT, 4)

static void
_dbg_security_flags(int log_level, const char *func, const char *desc,
		    struct nxpwifi_private *priv,
		    struct nxpwifi_bssdescriptor *bss_desc)
{
	_nxpwifi_dbg(priv->adapter, log_level,
		     "info: %s: %s:\twpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s\tEncMode=%#x privacy=%#x\n",
		     func, desc,
		     bss_desc->bcn_wpa_ie ?
		     bss_desc->bcn_wpa_ie->vend_hdr.element_id : 0,
		     bss_desc->bcn_rsn_ie ?
		     bss_desc->bcn_rsn_ie->id : 0,
		     priv->sec_info.wep_enabled ? "e" : "d",
		     priv->sec_info.wpa_enabled ? "e" : "d",
		     priv->sec_info.wpa2_enabled ? "e" : "d",
		     priv->sec_info.encryption_mode,
		     bss_desc->privacy);
}

#define dbg_security_flags(mask, desc, priv, bss_desc) \
	_dbg_security_flags(NXPWIFI_DBG_##mask, __func__, desc, priv, bss_desc)

/* Parse a WPA/RSN element and check whether its PTK list contains the OUI */
static u8
nxpwifi_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
{
	u8 count;

	count = iebody->ptk_cnt[0];

	/*
	 * PTK may contain multiple OUIs; iterate through the list and compare
	 * each one
	 */
	while (count) {
		if (!memcmp(iebody->ptk_body, oui, sizeof(iebody->ptk_body)))
			return NXPWIFI_OUI_PRESENT;

		--count;
		if (count)
			iebody = (struct ie_body *)((u8 *)iebody +
						sizeof(iebody->ptk_body));
	}

	pr_debug("info: %s: OUI is not found in PTK\n", __func__);
	return NXPWIFI_OUI_NOT_PRESENT;
}

/* Check whether the RSN IE is present and if its PTK list contains the OUI */
static u8
nxpwifi_is_rsn_oui_present(struct nxpwifi_bssdescriptor *bss_desc,
			   u32 cipher)
{
	struct ie_body *iebody;
	u8 ret = NXPWIFI_OUI_NOT_PRESENT;
	__be32 oui = cpu_to_be32(cipher);

	if (bss_desc->bcn_rsn_ie) {
		iebody = (struct ie_body *)
			 (((u8 *)bss_desc->bcn_rsn_ie->data) +
			  RSN_GTK_OUI_OFFSET);
		ret = nxpwifi_search_oui_in_ie(iebody, (u8 *)&oui);
		if (ret)
			return ret;
	}
	return ret;
}

/* Check if the WPA IE exists and whether its PTK list contains the OUI */
static u8
nxpwifi_is_wpa_oui_present(struct nxpwifi_bssdescriptor *bss_desc, u32 cipher)
{
	struct ie_body *iebody;
	u8 ret = NXPWIFI_OUI_NOT_PRESENT;
	__be32 oui = cpu_to_be32(cipher);

	if (bss_desc->bcn_wpa_ie) {
		iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
					    WPA_GTK_OUI_OFFSET);
		ret = nxpwifi_search_oui_in_ie(iebody, (u8 *)&oui);
		if (ret)
			return ret;
	}
	return ret;
}

/* Check whether both driver and BSS operate with no security */
static bool
nxpwifi_is_bss_no_sec(struct nxpwifi_private *priv,
		      struct nxpwifi_bssdescriptor *bss_desc)
{
	if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
	    !priv->sec_info.wpa2_enabled &&
	    !bss_desc->bcn_rsn_ie &&
	    !bss_desc->bcn_wpa_ie &&
	    !priv->sec_info.encryption_mode && !bss_desc->privacy) {
		return true;
	}
	return false;
}

/* Check whether static WEP is enabled and the BSS privacy setting matches */
static bool
nxpwifi_is_bss_static_wep(struct nxpwifi_private *priv,
			  struct nxpwifi_bssdescriptor *bss_desc)
{
	if (priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
	    !priv->sec_info.wpa2_enabled && bss_desc->privacy) {
		return true;
	}
	return false;
}

/* Check whether WPA is enabled and the BSS contains a WPA IE */
static bool
nxpwifi_is_bss_wpa(struct nxpwifi_private *priv,
		   struct nxpwifi_bssdescriptor *bss_desc)
{
	if (!priv->sec_info.wep_enabled && priv->sec_info.wpa_enabled &&
	    !priv->sec_info.wpa2_enabled &&
	    bss_desc->bcn_wpa_ie) {
		dbg_security_flags(INFO, "WPA", priv, bss_desc);
		return true;
	}
	return false;
}

/* Check whether WPA2 is enabled and the BSS includes an RSN IE */
static bool
nxpwifi_is_bss_wpa2(struct nxpwifi_private *priv,
		    struct nxpwifi_bssdescriptor *bss_desc)
{
	if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
	    priv->sec_info.wpa2_enabled &&
	    bss_desc->bcn_rsn_ie) {
		/*
		 * Some APs (e.g., WRT54G) may omit the privacy bit even when
		 * using WPA2
		 */
		dbg_security_flags(ERROR, "WPA2", priv, bss_desc);
		return true;
	}
	return false;
}

/* Check dynamic WEP: enabled in driver, privacy set, and no WPA/RSN IE present */
static bool
nxpwifi_is_bss_dynamic_wep(struct nxpwifi_private *priv,
			   struct nxpwifi_bssdescriptor *bss_desc)
{
	if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
	    !priv->sec_info.wpa2_enabled &&
	    !bss_desc->bcn_wpa_ie &&
	    !bss_desc->bcn_rsn_ie &&
	    priv->sec_info.encryption_mode && bss_desc->privacy) {
		dbg_security_flags(INFO, "dynamic", priv, bss_desc);
		return true;
	}
	return false;
}

/*
 * Check whether a scanned network is compatible with the driver's security
 * configuration. The decision considers WEP, WPA, WPA2, privacy settings,
 * and whether HT must be disabled when required (e.g., no AES).
 *
 * General rules:
 * - Open networks: always compatible.
 * - WPA-only: compatible; HT disabled if AES is not supported.
 * - WPA2-only: compatible; HT disabled if AES is not supported.
 * - Static WEP: compatible; HT disabled.
 * - Dynamic WEP: compatible when privacy is enabled.
 *
 * Note: Compatibility is not enforced during roaming except for security mode.
 */
static int
nxpwifi_is_network_compatible(struct nxpwifi_private *priv,
			      struct nxpwifi_bssdescriptor *bss_desc, u32 mode)
{
	struct nxpwifi_adapter *adapter = priv->adapter;

	bss_desc->disable_11n = false;

	/* Skip compatibility checks while roaming */
	if (priv->media_connected &&
	    priv->bss_mode == NL80211_IFTYPE_STATION &&
	    bss_desc->bss_mode == NL80211_IFTYPE_STATION)
		return 0;

	if (priv->wps.session_enable) {
		nxpwifi_dbg(adapter, IOCTL,
			    "info: return success directly in WPS period\n");
		return 0;
	}

	if (bss_desc->chan_sw_ie_present) {
		nxpwifi_dbg(adapter, INFO,
			    "Don't connect to AP with WLAN_EID_CHANNEL_SWITCH\n");
		return -EPERM;
	}

	if (bss_desc->bss_mode == mode) {
		if (nxpwifi_is_bss_no_sec(priv, bss_desc)) {
			return 0;
		} else if (nxpwifi_is_bss_static_wep(priv, bss_desc)) {
			nxpwifi_dbg(adapter, INFO,
				    "info: Disable 11n in WEP mode.\n");
			bss_desc->disable_11n = true;
			return 0;
		} else if (nxpwifi_is_bss_wpa(priv, bss_desc)) {
			if (((priv->config_bands & BAND_GN ||
			      priv->config_bands & BAND_AN) &&
			     bss_desc->bcn_ht_cap) &&
			    !nxpwifi_is_wpa_oui_present(bss_desc,
							 NXPWIFI_WPA_CIPHER_SUITE_CCMP)) {
				if (nxpwifi_is_wpa_oui_present
						(bss_desc, NXPWIFI_WPA_CIPHER_SUITE_TKIP)) {
					nxpwifi_dbg(adapter, INFO,
						    "info: Disable 11n if AES\t"
						    "is not supported by AP\n");
					bss_desc->disable_11n = true;
				} else {
					return -EINVAL;
				}
			}
			return 0;
		} else if (nxpwifi_is_bss_wpa2(priv, bss_desc)) {
			if (((priv->config_bands & BAND_GN ||
			      priv->config_bands & BAND_AN) &&
			     bss_desc->bcn_ht_cap) &&
			    !nxpwifi_is_rsn_oui_present(bss_desc,
							WLAN_CIPHER_SUITE_CCMP)) {
				if (nxpwifi_is_rsn_oui_present
						(bss_desc, WLAN_CIPHER_SUITE_TKIP)) {
					nxpwifi_dbg(adapter, INFO,
						    "info: Disable 11n if AES\t"
						    "is not supported by AP\n");
					bss_desc->disable_11n = true;
				} else if (nxpwifi_is_rsn_oui_present
						(bss_desc, WLAN_CIPHER_SUITE_GCMP_256) ||
						nxpwifi_is_rsn_oui_present
						(bss_desc, WLAN_CIPHER_SUITE_CCMP_256)) {
					return 0;
				} else {
					return -EINVAL;
				}
			}
			return 0;
		} else if (nxpwifi_is_bss_dynamic_wep(priv, bss_desc)) {
			return 0;
		}

		/* Security mismatch */
		dbg_security_flags(ERROR, "failed", priv, bss_desc);
		return -EINVAL;
	}

	return -EINVAL;
}

/*
 * Build the channel list for scanning based on region and band settings.
 * Used when a scan request does not specify its own channel list.
 */
static int
nxpwifi_scan_create_channel_list(struct nxpwifi_private *priv,
				 const struct nxpwifi_user_scan_cfg
				 *user_scan_in,
				 struct nxpwifi_chan_scan_param_set
				 *scan_chan_list,
				 u8 filtered_scan)
{
	enum nl80211_band band;
	struct ieee80211_supported_band *sband;
	struct ieee80211_channel *ch;
	struct nxpwifi_adapter *adapter = priv->adapter;
	int chan_idx = 0, i;
	u16 scan_time = 0;

	if (user_scan_in)
		scan_time = (u16)user_scan_in->chan_list[0].scan_time;

	for (band = 0; (band < NUM_NL80211_BANDS) ; band++) {
		if (!priv->wdev.wiphy->bands[band])
			continue;

		sband = priv->wdev.wiphy->bands[band];

		for (i = 0; (i < sband->n_channels) ; i++) {
			ch = &sband->channels[i];
			if (ch->flags & IEEE80211_CHAN_DISABLED)
				continue;
			scan_chan_list[chan_idx].band_cfg = band;

			if (scan_time)
				scan_chan_list[chan_idx].max_scan_time =
					cpu_to_le16(scan_time);
			else if ((ch->flags & IEEE80211_CHAN_NO_IR) ||
				 (ch->flags & IEEE80211_CHAN_RADAR))
				scan_chan_list[chan_idx].max_scan_time =
					cpu_to_le16(adapter->passive_scan_time);
			else
				scan_chan_list[chan_idx].max_scan_time =
					cpu_to_le16(adapter->active_scan_time);

			if (ch->flags & IEEE80211_CHAN_NO_IR)
				scan_chan_list[chan_idx].chan_scan_mode_bmap |=
					(NXPWIFI_PASSIVE_SCAN | NXPWIFI_HIDDEN_SSID_REPORT);
			else
				scan_chan_list[chan_idx].chan_scan_mode_bmap &=
					~NXPWIFI_PASSIVE_SCAN;

			scan_chan_list[chan_idx].chan_number = (u32)ch->hw_value;
			scan_chan_list[chan_idx].chan_scan_mode_bmap |=
				NXPWIFI_DISABLE_CHAN_FILT;

			if (filtered_scan &&
			    !((ch->flags & IEEE80211_CHAN_NO_IR) ||
			      (ch->flags & IEEE80211_CHAN_RADAR)))
				scan_chan_list[chan_idx].max_scan_time =
				cpu_to_le16(adapter->specific_scan_time);

			chan_idx++;
		}
	}
	return chan_idx;
}

/*
 * Build the channel-list TLV for bgscan based on region and band settings.
 */
static int
nxpwifi_bgscan_create_channel_list(struct nxpwifi_private *priv,
				   const struct nxpwifi_bg_scan_cfg
				   *bgscan_cfg_in,
				   struct nxpwifi_chan_scan_param_set
				   *scan_chan_list)
{
	enum nl80211_band band;
	struct ieee80211_supported_band *sband;
	struct ieee80211_channel *ch;
	struct nxpwifi_adapter *adapter = priv->adapter;
	int chan_idx = 0, i;
	u16 scan_time = 0, specific_scan_time = adapter->specific_scan_time;

	if (bgscan_cfg_in)
		scan_time = (u16)bgscan_cfg_in->chan_list[0].scan_time;

	for (band = 0; (band < NUM_NL80211_BANDS); band++) {
		if (!priv->wdev.wiphy->bands[band])
			continue;

		sband = priv->wdev.wiphy->bands[band];

		for (i = 0; (i < sband->n_channels) ; i++) {
			ch = &sband->channels[i];
			if (ch->flags & IEEE80211_CHAN_DISABLED)
				continue;
			scan_chan_list[chan_idx].band_cfg = band;

			if (scan_time)
				scan_chan_list[chan_idx].max_scan_time =
					cpu_to_le16(scan_time);
			else if (ch->flags & IEEE80211_CHAN_NO_IR)
				scan_chan_list[chan_idx].max_scan_time =
					cpu_to_le16(adapter->passive_scan_time);
			else
				scan_chan_list[chan_idx].max_scan_time =
					cpu_to_le16(specific_scan_time);

			if (ch->flags & IEEE80211_CHAN_NO_IR)
				scan_chan_list[chan_idx].chan_scan_mode_bmap |=
					NXPWIFI_PASSIVE_SCAN;
			else
				scan_chan_list[chan_idx].chan_scan_mode_bmap &=
					~NXPWIFI_PASSIVE_SCAN;

			scan_chan_list[chan_idx].chan_number = (u32)ch->hw_value;
			chan_idx++;
		}
	}
	return chan_idx;
}

/* Append the rate TLV to the scan configuration command */
static int
nxpwifi_append_rate_tlv(struct nxpwifi_private *priv,
			struct nxpwifi_scan_cmd_config *scan_cfg_out,
			u8 radio)
{
	struct nxpwifi_ie_types_rates_param_set *rates_tlv;
	u8 rates[NXPWIFI_SUPPORTED_RATES], *tlv_pos;
	u32 rates_size;

	memset(rates, 0, sizeof(rates));

	tlv_pos = (u8 *)scan_cfg_out->tlv_buf + scan_cfg_out->tlv_buf_len;

	if (priv->scan_request)
		rates_size = nxpwifi_get_rates_from_cfg80211(priv, rates,
							     radio);
	else
		rates_size = nxpwifi_get_supported_rates(priv, rates);

	nxpwifi_dbg(priv->adapter, CMD,
		    "info: SCAN_CMD: Rates size = %d\n",
		rates_size);
	rates_tlv = (struct nxpwifi_ie_types_rates_param_set *)tlv_pos;
	rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
	rates_tlv->header.len = cpu_to_le16((u16)rates_size);
	memcpy(rates_tlv->rates, rates, rates_size);
	scan_cfg_out->tlv_buf_len += sizeof(rates_tlv->header) + rates_size;

	return rates_size;
}

/*
 * Build and send multiple scan commands by chunking channel TLVs per scan
 * limit.
 */
static int
nxpwifi_scan_channel_list(struct nxpwifi_private *priv,
			  u32 max_chan_per_scan, u8 filtered_scan,
			  struct nxpwifi_scan_cmd_config *scan_cfg_out,
			  struct nxpwifi_ie_types_chan_list_param_set *tlv_o,
			  struct nxpwifi_chan_scan_param_set *scan_chan_list)
{
	struct nxpwifi_adapter *adapter = priv->adapter;
	int ret = 0;
	struct nxpwifi_chan_scan_param_set *tmp_chan_list;
	u32 tlv_idx, rates_size, cmd_no;
	u32 total_scan_time;
	u32 done_early;
	u8 radio_type;

	if (!scan_cfg_out || !tlv_o || !scan_chan_list) {
		nxpwifi_dbg(priv->adapter, ERROR,
			    "info: Scan: Null detect: %p, %p, %p\n",
			    scan_cfg_out, tlv_o, scan_chan_list);
		return -EINVAL;
	}

	/* Check csa channel expiry before preparing scan list */
	nxpwifi_11h_get_csa_closed_channel(priv);

	tlv_o->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);

	tmp_chan_list = scan_chan_list;

	/*
	 * Iterate through the channel list and send a firmware scan command for
	 * each group of max_chan_per_scan channels, or individually for
	 * channels 1, 6, and 11 when configured.
	 */
	while (tmp_chan_list->chan_number) {
		tlv_idx = 0;
		total_scan_time = 0;
		radio_type = 0;
		tlv_o->header.len = 0;
		done_early = false;

		/*
		 * Build the channel TLV for the scan command. Continue adding
		 * channel TLVs until one of the following conditions is met:
		 * - tlv_idx reaches the maximum allowed per scan command
		 * - the next channel is 0 (end of the desired channel list)
		 * - done_early is set (used for per-channel scanning of 1, 6,
		 * and 11)
		 */
		while (tlv_idx < max_chan_per_scan &&
		       tmp_chan_list->chan_number && !done_early) {
			if (tmp_chan_list->chan_number == priv->csa_chan) {
				tmp_chan_list++;
				continue;
			}

			radio_type = tmp_chan_list->band_cfg;
			nxpwifi_dbg(priv->adapter, INFO,
				    "info: Scan: Chan(%3d), Band(%d),\t"
				    "Mode(%d, %d), Dur(%d)\n",
				    tmp_chan_list->chan_number,
				    tmp_chan_list->band_cfg,
				    tmp_chan_list->chan_scan_mode_bmap
				    & NXPWIFI_PASSIVE_SCAN,
				    (tmp_chan_list->chan_scan_mode_bmap
				    & NXPWIFI_DISABLE_CHAN_FILT) >> 1,
				    le16_to_cpu(tmp_chan_list->max_scan_time));

			/* Copy the current channel TLV into the command being prepared */
			memcpy(&tlv_o->chan_scan_param[tlv_idx], tmp_chan_list,
			       sizeof(*tlv_o->chan_scan_param));

			/*
			 * Increment the TLV header length by the size
			 * appended
			 */
			le16_unaligned_add_cpu(&tlv_o->header.len,
					       sizeof(*tlv_o->chan_scan_param));

			/*
			 * The tlv buffer length is set to the number of bytes
			 * of the between the channel tlv pointer and the start
			 * of the tlv buffer.  This compensates for any TLVs
			 * that were appended before the channel list.
			 */
			scan_cfg_out->tlv_buf_len =
				(u32)((u8 *)tlv_o - scan_cfg_out->tlv_buf);

			scan_cfg_out->tlv_buf_len +=
				(sizeof(tlv_o->header)
				 + le16_to_cpu(tlv_o->header.len));

			/* Advance the index for the channel TLV being constructed. */
			tlv_idx++;

			/* Count the total scan time per command */
			total_scan_time +=
				le16_to_cpu(tmp_chan_list->max_scan_time);

			done_early = false;

			/*
			 * Stop the loop if the current channel is one of 1, 6,
			 * or 11 and no SSID or BSSID filter is applied.
			 */
			if (!filtered_scan &&
			    (tmp_chan_list->chan_number == 1 ||
			     tmp_chan_list->chan_number == 6 ||
			     tmp_chan_list->chan_number == 11))
				done_early = true;

			/* Advance the tmp pointer to the next channel to be scanned. */
			tmp_chan_list++;

			/*
			 * Stop the loop if the next channel is one of 1, 6,
			 * or 11. This causes that channel to be scanned alone
			 * in the next iteration.
			 */
			if (!filtered_scan &&
			    (tmp_chan_list->chan_number == 1 ||
			     tmp_chan_list->chan_number == 6 ||
			     tmp_chan_list->chan_number == 11))
				done_early = true;
		}

		/* Ensure the total scan time does not exceed the scan-command timeout. */
		if (total_scan_time > NXPWIFI_MAX_TOTAL_SCAN_TIME) {
			nxpwifi_dbg(priv->adapter, ERROR,
				    "total scan time %dms\t"
				    "is over limit (%dms), scan skipped\n",
				    total_scan_time,
				    NXPWIFI_MAX_TOTAL_SCAN_TIME);
			ret = -EINVAL;
			break;
		}

		rates_size = nxpwifi_append_rate_tlv(priv, scan_cfg_out,
						     radio_type);

		if (priv->adapter->ext_scan)
			cmd_no = HOST_CMD_802_11_SCAN_EXT;
		else
			cmd_no = HOST_CMD_802_11_SCAN;

		ret = nxpwifi_send_cmd(priv, cmd_no, HOST_ACT_GEN_SET,
				       0, scan_cfg_out, false);

		/*
		 * The rate element is updated for each scan command, but the
		 * same starting pointer is reused, so the previous rate element
		 * in scan_cfg_out->buf is overwritten.
		 */
		scan_cfg_out->tlv_buf_len -=
		    sizeof(struct nxpwifi_ie_types_header) + rates_size;

		if (ret) {
			nxpwifi_cancel_pending_scan_cmd(adapter);
			break;
		}
	}

	return ret;
}

/*
 * Build final scan config from user params, disabling missing filters and using
 * defaults.
 */
static void
nxpwifi_config_scan(struct nxpwifi_private *priv,
		    const struct nxpwifi_user_scan_cfg *user_scan_in,
		    struct nxpwifi_scan_cmd_config *scan_cfg_out,
		    struct nxpwifi_ie_types_chan_list_param_set **chan_list_out,
		    struct nxpwifi_chan_scan_param_set *scan_chan_list,
		    u8 *max_chan_per_scan, u8 *filtered_scan,
		    u8 *scan_current_only)
{
	struct nxpwifi_adapter *adapter = priv->adapter;
	struct nxpwifi_ie_types_num_probes *num_probes_tlv;
	struct nxpwifi_ie_types_scan_chan_gap *chan_gap_tlv;
	struct nxpwifi_ie_types_random_mac *random_mac_tlv;
	struct nxpwifi_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
	struct nxpwifi_ie_types_bssid_list *bssid_tlv;
	struct nxpwifi_ie_types_extcap *ext_cap;
	u8 *ext_capab = NULL;
	u8 *tlv_pos;
	u32 num_probes;
	u32 ssid_len;
	u32 chan_idx;
	u32 scan_time;
	u32 scan_type;
	u16 scan_dur;
	u8 channel;
	u8 radio_type;
	int i, vsid;
	u8 ssid_filter;
	struct nxpwifi_ie_types_htcap *ht_cap;
	struct nxpwifi_ie_types_bss_mode *bss_mode;
	struct nxpwifi_ie_types_vhtcap *vht_cap;
	struct nxpwifi_ie_types_he_cap *he_cap;

	/*
	 * tlv_buf_len is recalculated for each scan command. TLVs added in this
	 * routine are preserved because the send routine appends channel TLVs
	 * at chan_list_out. The difference between chan_list_out and the start
	 * of the TLV buffer determines the size of the TLVs added here.
	 */
	scan_cfg_out->tlv_buf_len = 0;

	/*
	 * Running TLV pointer. It is assigned to chan_list_out at the end of
	 * the function so later routines know where channel TLVs can be
	 * appended in the command buffer.
	 */
	tlv_pos = scan_cfg_out->tlv_buf;

	/*
	 * Initialize the scan as un-filtered; the flag is later set to TRUE
	 * below if a SSID or BSSID filter is sent in the command
	 */
	*filtered_scan = false;

	/*
	 * Initialize the scan as not being only on the current channel.  If
	 * the channel list is customized, only contains one channel, and is
	 * the active channel, this is set true and data flow is not halted.
	 */
	*scan_current_only = false;

	if (user_scan_in) {
		u8 tmpaddr[ETH_ALEN];

		/*
		 * Default the ssid_filter flag to TRUE, set false under
		 * certain wildcard conditions and qualified by the existence
		 * of an SSID list before marking the scan as filtered
		 */
		ssid_filter = true;

		/*
		 * Set the BSS type scan filter, use Adapter setting if
		 * unset
		 */
		scan_cfg_out->bss_mode =
			(u8)(user_scan_in->bss_mode ?: adapter->scan_mode);

		/*
		 * Set the number of probes to send, use Adapter setting
		 * if unset
		 */
		num_probes = user_scan_in->num_probes ?: adapter->scan_probes;

		/*
		 * Set the BSSID filter to the incoming configuration,
		 * if non-zero.  If not set, it will remain disabled
		 * (all zeros).
		 */
		memcpy(scan_cfg_out->specific_bssid,
		       user_scan_in->specific_bssid,
		       sizeof(scan_cfg_out->specific_bssid));

		memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);

		if (adapter->ext_scan &&
		    !is_zero_ether_addr(tmpaddr)) {
			bssid_tlv =
				(struct nxpwifi_ie_types_bssid_list *)tlv_pos;
			bssid_tlv->header.type = cpu_to_le16(TLV_TYPE_BSSID);
			bssid_tlv->header.len = cpu_to_le16(ETH_ALEN);
			memcpy(bssid_tlv->bssid, user_scan_in->specific_bssid,
			       ETH_ALEN);
			tlv_pos += sizeof(struct nxpwifi_ie_types_bssid_list);
		}

		for (i = 0; i < user_scan_in->num_ssids; i++) {
			ssid_len = user_scan_in->ssid_list[i].ssid_len;

			wildcard_ssid_tlv =
				(struct nxpwifi_ie_types_wildcard_ssid_params *)
				tlv_pos;
			wildcard_ssid_tlv->header.type =
				cpu_to_le16(TLV_TYPE_WILDCARDSSID);
			wildcard_ssid_tlv->header.len =
				cpu_to_le16((u16)(ssid_len + sizeof(u8)));

			/*
			 * max_ssid_length = 0 tells firmware to perform
			 * specific scan for the SSID filled, whereas
			 * max_ssid_length = IEEE80211_MAX_SSID_LEN is for
			 * wildcard scan.
			 */
			if (ssid_len)
				wildcard_ssid_tlv->max_ssid_length = 0;
			else
				wildcard_ssid_tlv->max_ssid_length =
							IEEE80211_MAX_SSID_LEN;

			if (!memcmp(user_scan_in->ssid_list[i].ssid,
				    "DIRECT-", 7))
				wildcard_ssid_tlv->max_ssid_length = 0xfe;

			memcpy(wildcard_ssid_tlv->ssid,
			       user_scan_in->ssid_list[i].ssid, ssid_len);

			tlv_pos += (sizeof(wildcard_ssid_tlv->header)
				+ le16_to_cpu(wildcard_ssid_tlv->header.len));

			nxpwifi_dbg(adapter, INFO,
				    "info: scan: ssid[%d]: %s, %d\n",
				    i, wildcard_ssid_tlv->ssid,
				    wildcard_ssid_tlv->max_ssid_length);

			/*
			 * Empty wildcard ssid with a maxlen will match many or
			 * potentially all SSIDs (maxlen == 32), therefore do
			 * not treat the scan as
			 * filtered.
			 */
			if (!ssid_len && wildcard_ssid_tlv->max_ssid_length)
				ssid_filter = false;
		}

		/*
		 * The default number of channels sent in the command is low to
		 *  ensure the response buffer from the firmware does not
		 *  truncate scan results.  That is not an issue with an SSID
		 *  or BSSID filter applied to the scan results in the firmware.
		 */
		memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
		if ((i && ssid_filter) ||
		    !is_zero_ether_addr(tmpaddr))
			*filtered_scan = true;

		if (user_scan_in->scan_chan_gap) {
			nxpwifi_dbg(adapter, INFO,
				    "info: scan: channel gap = %d\n",
				    user_scan_in->scan_chan_gap);
			*max_chan_per_scan =
					NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN;

			chan_gap_tlv = (void *)tlv_pos;
			chan_gap_tlv->header.type =
					 cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
			chan_gap_tlv->header.len =
				    cpu_to_le16(sizeof(chan_gap_tlv->chan_gap));
			chan_gap_tlv->chan_gap =
				     cpu_to_le16((user_scan_in->scan_chan_gap));
			tlv_pos +=
				  sizeof(struct nxpwifi_ie_types_scan_chan_gap);
		}

		if (!is_zero_ether_addr(user_scan_in->random_mac)) {
			random_mac_tlv = (void *)tlv_pos;
			random_mac_tlv->header.type =
					 cpu_to_le16(TLV_TYPE_RANDOM_MAC);
			random_mac_tlv->header.len =
				    cpu_to_le16(sizeof(random_mac_tlv->mac));
			ether_addr_copy(random_mac_tlv->mac,
					user_scan_in->random_mac);
			tlv_pos +=
				  sizeof(struct nxpwifi_ie_types_random_mac);
		}
	} else {
		scan_cfg_out->bss_mode = (u8)adapter->scan_mode;
		num_probes = adapter->scan_probes;
	}

	/*
	 * If a specific BSSID or SSID is used, the number of channels in the
	 *  scan command will be increased to the absolute maximum.
	 */
	if (*filtered_scan) {
		*max_chan_per_scan = NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN;
	} else {
		if (!priv->media_connected)
			*max_chan_per_scan = NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD;
		else
			*max_chan_per_scan =
					NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD / 2;
	}

	if (adapter->ext_scan) {
		bss_mode = (struct nxpwifi_ie_types_bss_mode *)tlv_pos;
		bss_mode->header.type = cpu_to_le16(TLV_TYPE_BSS_MODE);
		bss_mode->header.len = cpu_to_le16(sizeof(bss_mode->bss_mode));
		bss_mode->bss_mode = scan_cfg_out->bss_mode;
		tlv_pos += sizeof(bss_mode->header) +
			   le16_to_cpu(bss_mode->header.len);
	}

	/*
	 * If the input config or adapter has the number of Probes set,
	 * add tlv
	 */
	if (num_probes) {
		nxpwifi_dbg(adapter, INFO,
			    "info: scan: num_probes = %d\n",
			    num_probes);

		num_probes_tlv = (struct nxpwifi_ie_types_num_probes *)tlv_pos;
		num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
		num_probes_tlv->header.len =
			cpu_to_le16(sizeof(num_probes_tlv->num_probes));
		num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);

		tlv_pos += sizeof(num_probes_tlv->header) +
			le16_to_cpu(num_probes_tlv->header.len);
	}

	if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
	    (priv->config_bands & BAND_GN ||
	     priv->config_bands & BAND_AN)) {
		ht_cap = (struct nxpwifi_ie_types_htcap *)tlv_pos;
		memset(ht_cap, 0, sizeof(struct nxpwifi_ie_types_htcap));
		ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
		ht_cap->header.len =
			cpu_to_le16(sizeof(struct ieee80211_ht_cap));
		radio_type =
			nxpwifi_band_to_radio_type(priv->config_bands);
		nxpwifi_fill_cap_info(priv, radio_type, &ht_cap->ht_cap);
		tlv_pos += sizeof(struct nxpwifi_ie_types_htcap);
	}

	if (ISSUPP_11ACENABLED(adapter->fw_cap_info) &&
	    (priv->config_bands & BAND_AAC)) {
		vht_cap = (struct nxpwifi_ie_types_vhtcap *)tlv_pos;
		memset(vht_cap, 0, sizeof(struct nxpwifi_ie_types_vhtcap));
		vht_cap->header.type = cpu_to_le16(WLAN_EID_VHT_CAPABILITY);
		vht_cap->header.len = cpu_to_le16(sizeof(struct ieee80211_vht_cap));
		nxpwifi_fill_vht_cap_tlv(priv, &vht_cap->vht_cap, priv->config_bands);
		tlv_pos += sizeof(*vht_cap);
	}

	if (ISSUPP_11AXENABLED(adapter->fw_cap_ext) &&
	    (priv->config_bands & BAND_GAX ||
	     priv->config_bands & BAND_AAX)) {
		he_cap = (struct nxpwifi_ie_types_he_cap *)tlv_pos;
		memset(he_cap, 0, sizeof(struct nxpwifi_ie_types_he_cap));
		tlv_pos += nxpwifi_fill_he_cap_tlv(priv, he_cap, priv->config_bands);
	}

	if (nxpwifi_is_sta_11ax_twt_req_supported(priv)) {
		for (vsid = 0; vsid < NXPWIFI_MAX_VSIE_NUM; vsid++) {
			if (priv->vs_ie[vsid].mask & NXPWIFI_VSIE_MASK_SCAN) {
				ext_capab = (u8 *)cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
								   priv->vs_ie[vsid].ie,
								   sizeof(priv->vs_ie[vsid].ie));
				break;
			}
		}

		if (ext_capab) {
			ext_capab += 2;
		} else {
			ext_cap = (struct nxpwifi_ie_types_extcap *)tlv_pos;
			memset(ext_cap, 0, sizeof(struct nxpwifi_ie_types_extcap) +
			       NXPWIFI_EXT_CAPAB_IE_LEN);
			ext_cap->header.type = cpu_to_le16(WLAN_EID_EXT_CAPABILITY);
			ext_cap->header.len = cpu_to_le16(NXPWIFI_EXT_CAPAB_IE_LEN);
			ext_capab = ext_cap->ext_capab;
			tlv_pos += sizeof(struct nxpwifi_ie_types_extcap) +
				le16_to_cpu(ext_cap->header.len);
		}

		ext_capab[9] |= WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT;
	}

	/* Append vendor specific element TLV */
	nxpwifi_cmd_append_vsie_tlv(priv, NXPWIFI_VSIE_MASK_SCAN, &tlv_pos);

	/*
	 * Set the channel TLV output pointer to the end of the newly added TLVs
	 * (SSID, num_probes). Channel TLVs for each scan will be appended after
	 * these, preserving previously added TLVs.
	 */
	*chan_list_out =
		(struct nxpwifi_ie_types_chan_list_param_set *)tlv_pos;

	if (user_scan_in && user_scan_in->chan_list[0].chan_number) {
		nxpwifi_dbg(adapter, INFO,
			    "info: Scan: Using supplied channel list\n");

		for (chan_idx = 0;
		     chan_idx < NXPWIFI_USER_SCAN_CHAN_MAX &&
		     user_scan_in->chan_list[chan_idx].chan_number;
		     chan_idx++) {
			channel = user_scan_in->chan_list[chan_idx].chan_number;
			scan_chan_list[chan_idx].chan_number = channel;

			radio_type =
				user_scan_in->chan_list[chan_idx].radio_type;
			scan_chan_list[chan_idx].band_cfg = radio_type;

			scan_type = user_scan_in->chan_list[chan_idx].scan_type;

			if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
				scan_chan_list[chan_idx].chan_scan_mode_bmap |=
					(NXPWIFI_PASSIVE_SCAN |
					 NXPWIFI_HIDDEN_SSID_REPORT);
			else
				scan_chan_list[chan_idx].chan_scan_mode_bmap &=
					~NXPWIFI_PASSIVE_SCAN;

			scan_chan_list[chan_idx].chan_scan_mode_bmap |=
				NXPWIFI_DISABLE_CHAN_FILT;

			scan_time = user_scan_in->chan_list[chan_idx].scan_time;

			if (scan_time) {
				scan_dur = (u16)scan_time;
			} else {
				if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
					scan_dur = adapter->passive_scan_time;
				else if (*filtered_scan)
					scan_dur = adapter->specific_scan_time;
				else
					scan_dur = adapter->active_scan_time;
			}

			scan_chan_list[chan_idx].min_scan_time =
				cpu_to_le16(scan_dur);
			scan_chan_list[chan_idx].max_scan_time =
				cpu_to_le16(scan_dur);
		}

		/* Check if we are only scanning the current channel */
		if (chan_idx == 1 &&
		    user_scan_in->chan_list[0].chan_number ==
		    priv->curr_bss_params.bss_descriptor.channel) {
			*scan_current_only = true;
			nxpwifi_dbg(adapter, INFO,
				    "info: Scan: Scanning current channel only\n");
		}
	} else {
		nxpwifi_dbg(adapter, INFO,
			    "info: Scan: Creating full region channel list\n");
		nxpwifi_scan_create_channel_list(priv, user_scan_in,
						 scan_chan_list,
						 *filtered_scan);
	}
}

/* Parse the beacon buffer and update the BSS descriptor fields. */
int nxpwifi_update_bss_desc_with_ie(struct nxpwifi_adapter *adapter,
				    struct nxpwifi_bssdescriptor *bss_entry)
{
	u8 element_id;
	u16 elem_size = sizeof(struct element);
	struct ieee_types_fh_param_set *fh_param_set;
	struct ieee_types_ds_param_set *ds_param_set;
	struct ieee_types_cf_param_set *cf_param_set;
	u8 *current_ptr;
	u8 *rate;
	u8 element_len;
	u16 total_ie_len;
	u8 bytes_to_copy;
	u8 rate_size;
	u8 found_data_rate_ie;
	u32 bytes_left;
	struct ieee_types_vendor_specific *vendor_ie;
	const u8 wpa_oui[4] = { 0x00, 0x50, 0xf2, 0x01 };
	const u8 wmm_oui[4] = { 0x00, 0x50, 0xf2, 0x02 };
	struct element *elem;

	found_data_rate_ie = false;
	rate_size = 0;
	current_ptr = bss_entry->beacon_buf;
	bytes_left = bss_entry->beacon_buf_size;

	/* Process variable element */
	while (bytes_left >= 2) {
		element_id = *current_ptr;
		element_len = *(current_ptr + 1);
		total_ie_len = element_len + elem_size;

		if (bytes_left < total_ie_len) {
			nxpwifi_dbg(adapter, ERROR,
				    "err: InterpretIE: in processing\t"
				    "element, bytes left < element length\n");
			return -EINVAL;
		}
		switch (element_id) {
		case WLAN_EID_SSID:
			if (element_len > IEEE80211_MAX_SSID_LEN)
				return -EINVAL;
			bss_entry->ssid.ssid_len = element_len;
			memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
			       element_len);
			nxpwifi_dbg(adapter, INFO,
				    "info: InterpretIE: ssid: %-32s\n",
				    bss_entry->ssid.ssid);
			break;

		case WLAN_EID_SUPP_RATES:
			if (element_len > NXPWIFI_SUPPORTED_RATES)
				return -EINVAL;
			memcpy(bss_entry->data_rates, current_ptr + 2,
			       element_len);
			memcpy(bss_entry->supported_rates, current_ptr + 2,
			       element_len);
			rate_size = element_len;
			found_data_rate_ie = true;
			break;

		case WLAN_EID_FH_PARAMS:
			if (total_ie_len < sizeof(*fh_param_set))
				return -EINVAL;
			fh_param_set =
				(struct ieee_types_fh_param_set *)current_ptr;
			memcpy(&bss_entry->phy_param_set.fh_param_set,
			       fh_param_set,
			       sizeof(struct ieee_types_fh_param_set));
			break;

		case WLAN_EID_DS_PARAMS:
			if (total_ie_len < sizeof(*ds_param_set))
				return -EINVAL;
			ds_param_set =
				(struct ieee_types_ds_param_set *)current_ptr;

			bss_entry->channel = ds_param_set->current_chan;

			memcpy(&bss_entry->phy_param_set.ds_param_set,
			       ds_param_set,
			       sizeof(struct ieee_types_ds_param_set));
			break;

		case WLAN_EID_CF_PARAMS:
			if (total_ie_len < sizeof(*cf_param_set))
				return -EINVAL;
			cf_param_set =
				(struct ieee_types_cf_param_set *)current_ptr;
			memcpy(&bss_entry->cf_param_set,
			       cf_param_set,
			       sizeof(struct ieee_types_cf_param_set));
			break;

		case WLAN_EID_ERP_INFO:
			if (!element_len)
				return -EINVAL;
			bss_entry->erp_flags = *(current_ptr + 2);
			break;

		case WLAN_EID_PWR_CONSTRAINT:
			if (!element_len)
				return -EINVAL;
			bss_entry->local_constraint = *(current_ptr + 2);
			bss_entry->sensed_11h = true;
			break;

		case WLAN_EID_CHANNEL_SWITCH:
			bss_entry->chan_sw_ie_present = true;
			fallthrough;
		case WLAN_EID_PWR_CAPABILITY:
		case WLAN_EID_TPC_REPORT:
		case WLAN_EID_QUIET:
			bss_entry->sensed_11h = true;
			break;

		case WLAN_EID_EXT_SUPP_RATES:
			/*
			 * Only process extended supported rate
			 * if data rate is already found.
			 * Data rate element should come before
			 * extended supported rate element
			 */
			if (found_data_rate_ie) {
				if ((element_len + rate_size) >
				    NXPWIFI_SUPPORTED_RATES)
					bytes_to_copy =
						(NXPWIFI_SUPPORTED_RATES -
						 rate_size);
				else
					bytes_to_copy = element_len;

				rate = (u8 *)bss_entry->data_rates;
				rate += rate_size;
				memcpy(rate, current_ptr + 2, bytes_to_copy);

				rate = (u8 *)bss_entry->supported_rates;
				rate += rate_size;
				memcpy(rate, current_ptr + 2, bytes_to_copy);
			}
			break;

		case WLAN_EID_VENDOR_SPECIFIC:
			vendor_ie = (struct ieee_types_vendor_specific *)
				current_ptr;

			/* 802.11 requires at least 3-byte OUI. */
			if (element_len < sizeof(vendor_ie->vend_hdr.oui))
				return -EINVAL;

			/* Not long enough for a match? Skip it. */
			if (element_len < sizeof(wpa_oui))
				break;

			if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
				    sizeof(wpa_oui))) {
				bss_entry->bcn_wpa_ie =
					(struct ieee_types_vendor_specific *)
					current_ptr;
				bss_entry->wpa_offset =
					(u16)(current_ptr -
					      bss_entry->beacon_buf);
			} else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
					   sizeof(wmm_oui))) {
				if (total_ie_len ==
				    sizeof(struct ieee80211_wmm_param_ie) ||
				    total_ie_len ==
				    sizeof(struct ieee_types_wmm_info))
					/*
					 * Only accept and copy the WMM element if
					 * it matches the size expected for the
					 * WMM Info element or the WMM Parameter element.
					 */
					memcpy((u8 *)&bss_entry->wmm_ie,
					       current_ptr, total_ie_len);
			}
			break;
		case WLAN_EID_RSN:
			bss_entry->bcn_rsn_ie =
				(struct element *)current_ptr;
			bss_entry->rsn_offset =
				(u16)(current_ptr - bss_entry->beacon_buf);
			break;
		case WLAN_EID_RSNX:
			bss_entry->bcn_rsnx_ie =
				(struct element *)current_ptr;
			bss_entry->rsnx_offset =
				(u16)(current_ptr - bss_entry->beacon_buf);
			break;
		case WLAN_EID_HT_CAPABILITY:
			bss_entry->bcn_ht_cap =
				(struct ieee80211_ht_cap *)(current_ptr +
							    elem_size);
			bss_entry->ht_cap_offset =
				(u16)(current_ptr + elem_size -
				      bss_entry->beacon_buf);
			break;
		case WLAN_EID_HT_OPERATION:
			bss_entry->bcn_ht_oper =
				(struct ieee80211_ht_operation *)(current_ptr +
								  elem_size);
			bss_entry->ht_info_offset =
				(u16)(current_ptr + elem_size -
				      bss_entry->beacon_buf);
			break;
		case WLAN_EID_VHT_CAPABILITY:
			bss_entry->disable_11ac = false;
			bss_entry->bcn_vht_cap = (void *)(current_ptr +
							  elem_size);
			bss_entry->vht_cap_offset =
				(u16)((u8 *)bss_entry->bcn_vht_cap -
				      bss_entry->beacon_buf);
			break;
		case WLAN_EID_VHT_OPERATION:
			bss_entry->bcn_vht_oper =
				(void *)(current_ptr + elem_size);
			bss_entry->vht_info_offset =
				(u16)((u8 *)bss_entry->bcn_vht_oper -
				      bss_entry->beacon_buf);
			break;
		case WLAN_EID_BSS_COEX_2040:
			bss_entry->bcn_bss_co_2040 = current_ptr;
			bss_entry->bss_co_2040_offset =
				(u16)(current_ptr - bss_entry->beacon_buf);
			break;
		case WLAN_EID_EXT_CAPABILITY:
			bss_entry->bcn_ext_cap = current_ptr;
			bss_entry->ext_cap_offset =
				(u16)(current_ptr - bss_entry->beacon_buf);
			break;
		case WLAN_EID_OPMODE_NOTIF:
			bss_entry->oper_mode = (void *)current_ptr;
			bss_entry->oper_mode_offset =
				(u16)(current_ptr - bss_entry->beacon_buf);
			break;
		case WLAN_EID_EXTENSION:
			if (!element_len)
				return -EINVAL;

			elem = (struct element *)current_ptr;

			switch (elem->data[0]) {
			case WLAN_EID_EXT_HE_CAPABILITY:
				bss_entry->disable_11ax = false;
				bss_entry->bcn_he_cap =
					(void *)(current_ptr + elem_size + 1);
				bss_entry->he_cap_offset =
					(u16)((u8 *)bss_entry->bcn_he_cap -
					      bss_entry->beacon_buf);
				break;
			case WLAN_EID_EXT_HE_OPERATION:
				bss_entry->bcn_he_oper =
					(void *)(current_ptr + elem_size + 1);
				bss_entry->he_info_offset =
					(u16)((u8 *)bss_entry->bcn_he_oper -
					      bss_entry->beacon_buf);
				break;
			default:
				break;
			}
			break;
		default:
			break;
		}

		current_ptr += total_ie_len;
		bytes_left -= total_ie_len;

	}	/* while (bytes_left > 2) */
	return 0;
}

/* Convert the radio-type scan parameter to the join command's band config. */
static u8
nxpwifi_radio_type_to_band(u8 radio_type)
{
	switch (radio_type) {
	case HOST_SCAN_RADIO_TYPE_A:
		return BAND_A;
	case HOST_SCAN_RADIO_TYPE_BG:
	default:
		return BAND_G;
	}
}

/* Internal helper to start a scan using the given configuration. */
int nxpwifi_scan_networks(struct nxpwifi_private *priv,
			  const struct nxpwifi_user_scan_cfg *user_scan_in)
{
	int ret;
	struct nxpwifi_adapter *adapter = priv->adapter;
	struct cmd_ctrl_node *cmd_node;
	union nxpwifi_scan_cmd_config_tlv *scan_cfg_out;
	struct nxpwifi_ie_types_chan_list_param_set *chan_list_out;
	struct nxpwifi_chan_scan_param_set *scan_chan_list;
	u8 filtered_scan;
	u8 scan_current_chan_only;
	u8 max_chan_per_scan;

	if (adapter->scan_processing) {
		nxpwifi_dbg(adapter, WARN,
			    "cmd: Scan already in process...\n");
		return -EBUSY;
	}

	if (priv->scan_block) {
		nxpwifi_dbg(adapter, WARN,
			    "cmd: Scan is blocked during association...\n");
		return -EBUSY;
	}

	if (test_bit(NXPWIFI_SURPRISE_REMOVED, &adapter->work_flags) ||
	    test_bit(NXPWIFI_IS_CMD_TIMEDOUT, &adapter->work_flags)) {
		nxpwifi_dbg(adapter, ERROR,
			    "Ignore scan. Card removed or firmware in bad state\n");
		return -EPERM;
	}

	spin_lock_bh(&adapter->nxpwifi_cmd_lock);
	adapter->scan_processing = true;
	spin_unlock_bh(&adapter->nxpwifi_cmd_lock);

	scan_cfg_out = kzalloc_obj(union nxpwifi_scan_cmd_config_tlv,
				   GFP_KERNEL);
	if (!scan_cfg_out) {
		ret = -ENOMEM;
		goto done;
	}

	scan_chan_list = kzalloc_objs(struct nxpwifi_chan_scan_param_set,
				      NXPWIFI_USER_SCAN_CHAN_MAX, GFP_KERNEL);
	if (!scan_chan_list) {
		kfree(scan_cfg_out);
		ret = -ENOMEM;
		goto done;
	}

	nxpwifi_config_scan(priv, user_scan_in, &scan_cfg_out->config,
			    &chan_list_out, scan_chan_list, &max_chan_per_scan,
			    &filtered_scan, &scan_current_chan_only);

	ret = nxpwifi_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
					&scan_cfg_out->config, chan_list_out,
					scan_chan_list);

	/* Get scan command from scan_pending_q and put to cmd_pending_q */
	if (!ret) {
		spin_lock_bh(&adapter->scan_pending_q_lock);
		if (!list_empty(&adapter->scan_pending_q)) {
			cmd_node = list_first_entry(&adapter->scan_pending_q,
						    struct cmd_ctrl_node, list);
			list_del(&cmd_node->list);
			spin_unlock_bh(&adapter->scan_pending_q_lock);
			nxpwifi_insert_cmd_to_pending_q(adapter, cmd_node);
			nxpwifi_queue_work(adapter, &adapter->main_work);

			/* Perform internal scan synchronously */
			if (!priv->scan_request) {
				nxpwifi_dbg(adapter, INFO,
					    "wait internal scan\n");
				nxpwifi_wait_queue_complete(adapter, cmd_node);
			}
		} else {
			spin_unlock_bh(&adapter->scan_pending_q_lock);
		}
	}

	kfree(scan_cfg_out);
	kfree(scan_chan_list);
done:
	if (ret) {
		spin_lock_bh(&adapter->nxpwifi_cmd_lock);
		adapter->scan_processing = false;
		spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
	}
	return ret;
}

/*
 * Build the firmware scan command from the given configuration, including
 * fixed fields and TLVs, and set the command ID, size, and endianness.
 */
int nxpwifi_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
			    struct nxpwifi_scan_cmd_config *scan_cfg)
{
	struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;

	/* Set fixed field variables in scan command */
	scan_cmd->bss_mode = scan_cfg->bss_mode;
	memcpy(scan_cmd->bssid, scan_cfg->specific_bssid,
	       sizeof(scan_cmd->bssid));
	memcpy(scan_cmd->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);

	cmd->command = cpu_to_le16(HOST_CMD_802_11_SCAN);

	/* Size is equal to the sizeof(fixed portions) + the TLV len + header */
	cmd->size = cpu_to_le16((u16)(sizeof(scan_cmd->bss_mode)
					  + sizeof(scan_cmd->bssid)
					  + scan_cfg->tlv_buf_len + S_DS_GEN));

	return 0;
}

/* Check compatibility of the requested network with current driver settings. */
int nxpwifi_check_network_compatibility(struct nxpwifi_private *priv,
					struct nxpwifi_bssdescriptor *bss_desc)
{
	int ret = 0;

	if (!bss_desc)
		return -EINVAL;

	if ((nxpwifi_get_cfp(priv, (u8)bss_desc->bss_band,
			     (u16)bss_desc->channel, 0))) {
		switch (priv->bss_mode) {
		case NL80211_IFTYPE_STATION:
			ret = nxpwifi_is_network_compatible(priv, bss_desc,
							    priv->bss_mode);
			if (ret)
				nxpwifi_dbg(priv->adapter, ERROR,
					    "Incompatible network settings\n");
			break;
		default:
			ret = 0;
		}
	}

	return ret;
}

/* Check if the SSID length is zero or all bytes are zero. */
static bool nxpwifi_is_hidden_ssid(struct cfg80211_ssid *ssid)
{
	int idx;

	for (idx = 0; idx < ssid->ssid_len; idx++) {
		if (ssid->ssid[idx])
			return false;
	}

	return true;
}

/* Find hidden SSIDs on passive channels and save those channels for active scan. */
static int nxpwifi_save_hidden_ssid_channels(struct nxpwifi_private *priv,
					     struct cfg80211_bss *bss)
{
	struct nxpwifi_bssdescriptor *bss_desc;
	int ret;
	int chid;

	/* Allocate and fill new bss descriptor */
	bss_desc = kzalloc_obj(*bss_desc, GFP_KERNEL);
	if (!bss_desc)
		return -ENOMEM;

	ret = nxpwifi_fill_new_bss_desc(priv, bss, bss_desc);
	if (ret)
		goto done;

	if (nxpwifi_is_hidden_ssid(&bss_desc->ssid)) {
		nxpwifi_dbg(priv->adapter, INFO, "found hidden SSID\n");
		for (chid = 0 ; chid < NXPWIFI_USER_SCAN_CHAN_MAX; chid++) {
			if (priv->hidden_chan[chid].chan_number ==
			    bss->channel->hw_value)
				break;

			if (!priv->hidden_chan[chid].chan_number) {
				priv->hidden_chan[chid].chan_number =
					bss->channel->hw_value;
				priv->hidden_chan[chid].radio_type =
					bss->channel->band;
				priv->hidden_chan[chid].scan_type =
					NXPWIFI_SCAN_TYPE_ACTIVE;
				break;
			}
		}
	}

done:
	/* Free beacon_ie allocated by nxpwifi_fill_new_bss_desc(). */
	kfree(bss_desc->beacon_buf);
	kfree(bss_desc);
	return ret;
}

static int nxpwifi_update_curr_bss_params(struct nxpwifi_private *priv,
					  struct cfg80211_bss *bss)
{
	struct nxpwifi_bssdescriptor *bss_desc;
	int ret;

	/* Allocate and fill new bss descriptor */
	bss_desc = kzalloc_obj(*bss_desc, GFP_KERNEL);
	if (!bss_desc)
		return -ENOMEM;

	ret = nxpwifi_fill_new_bss_desc(priv, bss, bss_desc);
	if (ret)
		goto done;

	ret = nxpwifi_check_network_compatibility(priv, bss_desc);
	if (ret)
		goto done;

	spin_lock_bh(&priv->curr_bcn_buf_lock);
	/* Make a copy of current BSSID descriptor */
	memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
	       sizeof(priv->curr_bss_params.bss_descriptor));

	/* beacon_ie will be copied to its own buffer in nxpwifi_save_curr_bcn(). */
	nxpwifi_save_curr_bcn(priv);
	spin_unlock_bh(&priv->curr_bcn_buf_lock);

done:
	/* Free beacon_ie allocated by nxpwifi_fill_new_bss_desc(). */
	kfree(bss_desc->beacon_buf);
	kfree(bss_desc);
	return ret;
}

static int
nxpwifi_parse_single_response_buf(struct nxpwifi_private *priv, u8 **bss_info,
				  u32 *bytes_left, u64 fw_tsf, const u8 *radio_type,
				  bool ext_scan, s32 rssi_val)
{
	struct nxpwifi_adapter *adapter = priv->adapter;
	struct nxpwifi_chan_freq_power *cfp;
	struct cfg80211_bss *bss;
	u8 bssid[ETH_ALEN];
	s32 rssi;
	const u8 *ie_buf;
	size_t ie_len;
	u16 channel = 0;
	u16 beacon_size = 0;
	u32 curr_bcn_bytes;
	u32 freq;
	u16 beacon_period;
	u16 cap_info_bitmap;
	u8 *current_ptr;
	u64 timestamp;
	struct nxpwifi_fixed_bcn_param *bcn_param;
	struct nxpwifi_bss_priv *bss_priv;

	if (*bytes_left >= sizeof(beacon_size)) {
		/* Extract & convert beacon size from command buffer */
		beacon_size = get_unaligned_le16((*bss_info));
		*bytes_left -= sizeof(beacon_size);
		*bss_info += sizeof(beacon_size);
	}

	if (!beacon_size || beacon_size > *bytes_left) {
		*bss_info += *bytes_left;
		*bytes_left = 0;
		return -EINVAL;
	}

	/*
	 * Initialize the current working beacon pointer for this BSS
	 * iteration
	 */
	current_ptr = *bss_info;

	/* Advance the return beacon pointer past the current beacon */
	*bss_info += beacon_size;
	*bytes_left -= beacon_size;

	curr_bcn_bytes = beacon_size;

	/*
	 * First 5 fields are bssid, RSSI(for legacy scan only),
	 * time stamp, beacon interval, and capability information
	 */
	if (curr_bcn_bytes < ETH_ALEN + sizeof(u8) +
	    sizeof(struct nxpwifi_fixed_bcn_param)) {
		nxpwifi_dbg(adapter, ERROR,
			    "InterpretIE: not enough bytes left\n");
		return -EINVAL;
	}

	memcpy(bssid, current_ptr, ETH_ALEN);
	current_ptr += ETH_ALEN;
	curr_bcn_bytes -= ETH_ALEN;

	if (!ext_scan) {
		rssi = (s32)*current_ptr;
		rssi = (-rssi) * 100;		/* Convert dBm to mBm */
		current_ptr += sizeof(u8);
		curr_bcn_bytes -= sizeof(u8);
		nxpwifi_dbg(adapter, INFO,
			    "info: InterpretIE: RSSI=%d\n", rssi);
	} else {
		rssi = rssi_val;
	}

	bcn_param = (struct nxpwifi_fixed_bcn_param *)current_ptr;
	current_ptr += sizeof(*bcn_param);
	curr_bcn_bytes -= sizeof(*bcn_param);

	timestamp = le64_to_cpu(bcn_param->timestamp);
	beacon_period = le16_to_cpu(bcn_param->beacon_period);

	cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
	nxpwifi_dbg(adapter, INFO,
		    "info: InterpretIE: capabilities=0x%X\n",
		    cap_info_bitmap);

	/* Rest of the current buffer are element's */
	ie_buf = current_ptr;
	ie_len = curr_bcn_bytes;
	nxpwifi_dbg(adapter, INFO,
		    "info: InterpretIE: IELength for this AP = %d\n",
		    curr_bcn_bytes);

	while (curr_bcn_bytes >= sizeof(struct element)) {
		u8 element_id, element_len;

		element_id = *current_ptr;
		element_len = *(current_ptr + 1);
		if (curr_bcn_bytes < element_len +
				sizeof(struct element)) {
			nxpwifi_dbg(adapter, ERROR,
				    "%s: bytes left < element length\n", __func__);
			return -EFAULT;
		}
		if (element_id == WLAN_EID_DS_PARAMS) {
			channel = *(current_ptr +
				    sizeof(struct element));
			break;
		}

		current_ptr += element_len + sizeof(struct element);
		curr_bcn_bytes -= element_len +
					sizeof(struct element);
	}

	if (channel) {
		struct ieee80211_channel *chan;
		struct nxpwifi_bssdescriptor *bss_desc;
		u8 band;

		/* Skip entry if on csa closed channel */
		if (channel == priv->csa_chan) {
			nxpwifi_dbg(adapter, WARN,
				    "Dropping entry on csa closed channel\n");
			return 0;
		}

		band = BAND_G;
		if (radio_type)
			band = nxpwifi_radio_type_to_band(*radio_type &
							  (BIT(0) | BIT(1)));

		cfp = nxpwifi_get_cfp(priv, band, channel, 0);

		freq = cfp ? cfp->freq : 0;

		chan = ieee80211_get_channel(priv->wdev.wiphy, freq);

		if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
			bss = cfg80211_inform_bss(priv->wdev.wiphy, chan,
						  CFG80211_BSS_FTYPE_UNKNOWN,
						  bssid, timestamp,
						  cap_info_bitmap,
						  beacon_period,
						  ie_buf, ie_len, rssi,
						  GFP_ATOMIC);
			if (bss) {
				bss_priv = (struct nxpwifi_bss_priv *)bss->priv;
				bss_priv->band = band;
				bss_priv->fw_tsf = fw_tsf;
				bss_desc =
					&priv->curr_bss_params.bss_descriptor;
				if (priv->media_connected &&
				    !memcmp(bssid, bss_desc->mac_address,
					    ETH_ALEN))
					nxpwifi_update_curr_bss_params(priv,
								       bss);

				if ((chan->flags & IEEE80211_CHAN_RADAR) ||
				    (chan->flags & IEEE80211_CHAN_NO_IR)) {
					nxpwifi_dbg(adapter, INFO,
						    "radar or passive channel %d\n",
						    channel);
					nxpwifi_save_hidden_ssid_channels(priv,
									  bss);
				}

				cfg80211_put_bss(priv->wdev.wiphy, bss);
			}
		}
	} else {
		nxpwifi_dbg(adapter, WARN, "missing BSS channel element\n");
	}

	return 0;
}

static void nxpwifi_complete_scan(struct nxpwifi_private *priv)
{
	struct nxpwifi_adapter *adapter = priv->adapter;

	adapter->survey_idx = 0;
	if (adapter->curr_cmd->wait_q_enabled) {
		adapter->cmd_wait_q.status = 0;
		if (!priv->scan_request) {
			nxpwifi_dbg(adapter, INFO,
				    "complete internal scan\n");
			nxpwifi_complete_cmd(adapter, adapter->curr_cmd);
		}
	}
}

/* Find hidden SSIDs on passive channels and run active scans on them. */
static int
nxpwifi_active_scan_req_for_passive_chan(struct nxpwifi_private *priv)
{
	int ret;
	struct nxpwifi_adapter *adapter = priv->adapter;
	u8 id = 0;
	struct nxpwifi_user_scan_cfg  *user_scan_cfg;

	if (adapter->active_scan_triggered || !priv->scan_request ||
	    priv->scan_aborting) {
		adapter->active_scan_triggered = false;
		return 0;
	}

	if (!priv->hidden_chan[0].chan_number) {
		nxpwifi_dbg(adapter, INFO, "No BSS with hidden SSID found on DFS channels\n");
		return 0;
	}
	user_scan_cfg = kzalloc_obj(*user_scan_cfg, GFP_KERNEL);

	if (!user_scan_cfg)
		return -ENOMEM;

	for (id = 0; id < NXPWIFI_USER_SCAN_CHAN_MAX; id++) {
		if (!priv->hidden_chan[id].chan_number)
			break;
		memcpy(&user_scan_cfg->chan_list[id],
		       &priv->hidden_chan[id],
		       sizeof(struct nxpwifi_user_scan_chan));
	}

	adapter->active_scan_triggered = true;
	if (priv->scan_request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
		ether_addr_copy(user_scan_cfg->random_mac,
				priv->scan_request->mac_addr);
	user_scan_cfg->num_ssids = priv->scan_request->n_ssids;
	user_scan_cfg->ssid_list = priv->scan_request->ssids;

	ret = nxpwifi_scan_networks(priv, user_scan_cfg);
	kfree(user_scan_cfg);

	memset(&priv->hidden_chan, 0, sizeof(priv->hidden_chan));

	if (ret)
		nxpwifi_dbg(adapter, ERROR, "scan failed: %d\n", ret);

	return ret;
}

static void nxpwifi_check_next_scan_command(struct nxpwifi_private *priv)
{
	struct nxpwifi_adapter *adapter = priv->adapter;
	struct cmd_ctrl_node *cmd_node;

	spin_lock_bh(&adapter->scan_pending_q_lock);
	if (list_empty(&adapter->scan_pending_q)) {
		spin_unlock_bh(&adapter->scan_pending_q_lock);

		spin_lock_bh(&adapter->nxpwifi_cmd_lock);
		adapter->scan_processing = false;
		spin_unlock_bh(&adapter->nxpwifi_cmd_lock);

		nxpwifi_active_scan_req_for_passive_chan(priv);

		if (!adapter->ext_scan)
			nxpwifi_complete_scan(priv);

		if (priv->scan_request) {
			struct cfg80211_scan_info info = {
				.aborted = false,
			};

			nxpwifi_dbg(adapter, INFO,
				    "info: notifying scan done\n");
			cfg80211_scan_done(priv->scan_request, &info);
			priv->scan_request = NULL;
			priv->scan_aborting = false;
		} else {
			priv->scan_aborting = false;
			nxpwifi_dbg(adapter, INFO,
				    "info: scan already aborted\n");
		}
	} else if ((priv->scan_aborting && !priv->scan_request) ||
		   priv->scan_block) {
		spin_unlock_bh(&adapter->scan_pending_q_lock);

		nxpwifi_cancel_pending_scan_cmd(adapter);

		spin_lock_bh(&adapter->nxpwifi_cmd_lock);
		adapter->scan_processing = false;
		spin_unlock_bh(&adapter->nxpwifi_cmd_lock);

		if (!adapter->active_scan_triggered) {
			if (priv->scan_request) {
				struct cfg80211_scan_info info = {
					.aborted = true,
				};

				nxpwifi_dbg(adapter, INFO,
					    "info: aborting scan\n");
				cfg80211_scan_done(priv->scan_request, &info);
				priv->scan_request = NULL;
				priv->scan_aborting = false;
			} else {
				priv->scan_aborting = false;
				nxpwifi_dbg(adapter, INFO,
					    "info: scan already aborted\n");
			}
		}
	} else {
		/* Move a scan command from scan_pending_q to cmd_pending_q. */
		cmd_node = list_first_entry(&adapter->scan_pending_q,
					    struct cmd_ctrl_node, list);
		list_del(&cmd_node->list);
		spin_unlock_bh(&adapter->scan_pending_q_lock);
		nxpwifi_insert_cmd_to_pending_q(adapter, cmd_node);
	}
}

void nxpwifi_cancel_scan(struct nxpwifi_adapter *adapter)
{
	struct nxpwifi_private *priv;
	int i;

	nxpwifi_cancel_pending_scan_cmd(adapter);

	if (adapter->scan_processing) {
		spin_lock_bh(&adapter->nxpwifi_cmd_lock);
		adapter->scan_processing = false;
		spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
		for (i = 0; i < adapter->priv_num; i++) {
			priv = adapter->priv[i];
			if (priv->scan_request) {
				struct cfg80211_scan_info info = {
					.aborted = true,
				};

				nxpwifi_dbg(adapter, INFO,
					    "info: aborting scan\n");
				cfg80211_scan_done(priv->scan_request, &info);
				priv->scan_request = NULL;
				priv->scan_aborting = false;
			}
		}
	}
}

/*
 * Handle the scan command response.
 *
 * The scan response buffer has the following layout:
 *
 *   -------------------------------------------------------------
 *   | Header (4 * t_u16): standard command response header       |
 *   -------------------------------------------------------------
 *   | BufSize (t_u16): size of the BSS description data         |
 *   -------------------------------------------------------------
 *   | NumOfSet (t_u8): number of returned BSS descriptions      |
 *   -------------------------------------------------------------
 *   | BSS description data (variable, size = BufSize)           |
 *   -------------------------------------------------------------
 *   | TLV data (variable, size = cmd_size - fixed fields)       |
 *   -------------------------------------------------------------
 */
int nxpwifi_ret_802_11_scan(struct nxpwifi_private *priv,
			    struct host_cmd_ds_command *resp)
{
	int ret = 0;
	struct nxpwifi_adapter *adapter = priv->adapter;
	struct host_cmd_ds_802_11_scan_rsp *scan_rsp;
	u8 *tlv_data;
	const struct nxpwifi_ie_types_tsf_timestamp *tsf_tlv;
	u8 *bss_info;
	u32 scan_resp_size;
	u32 bytes_left;
	u32 idx;
	u32 tlv_buf_size;
	const struct nxpwifi_ie_types_chan_band_list_param_set *chan_band_tlv;
	const struct chan_band_param_set *chan_band;
	u8 is_bgscan_resp;
	__le64 fw_tsf = 0;
	const u8 *radio_type;
	struct cfg80211_wowlan_nd_match *pmatch;
	struct cfg80211_sched_scan_request *nd_config = NULL;

	is_bgscan_resp = (le16_to_cpu(resp->command)
			  == HOST_CMD_802_11_BG_SCAN_QUERY);
	if (is_bgscan_resp)
		scan_rsp = &resp->params.bg_scan_query_resp.scan_resp;
	else
		scan_rsp = &resp->params.scan_resp;

	if (scan_rsp->number_of_sets > NXPWIFI_MAX_AP) {
		nxpwifi_dbg(adapter, ERROR,
			    "SCAN_RESP: too many AP returned (%d)\n",
			    scan_rsp->number_of_sets);
		ret = -EINVAL;
		goto check_next_scan;
	}

	/* Check csa channel expiry before parsing scan response */
	nxpwifi_11h_get_csa_closed_channel(priv);

	bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
	nxpwifi_dbg(adapter, INFO,
		    "info: SCAN_RESP: bss_descript_size %d\n",
		    bytes_left);

	scan_resp_size = le16_to_cpu(resp->size);

	nxpwifi_dbg(adapter, INFO,
		    "info: SCAN_RESP: returned %d APs before parsing\n",
		    scan_rsp->number_of_sets);

	bss_info = scan_rsp->bss_desc_and_tlv_buffer;

	/*
	 * TLV buffer size = scan_resp_size minus the fixed fields, BSS
	 * description data, and the command response header (S_DS_GEN).
	 */
	tlv_buf_size = scan_resp_size - (bytes_left
					 + sizeof(scan_rsp->bss_descript_size)
					 + sizeof(scan_rsp->number_of_sets)
					 + S_DS_GEN);

	tlv_data = (scan_rsp->bss_desc_and_tlv_buffer +
					  bytes_left);

	/* Find timestamp TLV */
	{
		const struct nxpwifi_tlv *t;

		t = nxpwifi_find_tlv(TLV_TYPE_TSFTIMESTAMP, tlv_data, tlv_buf_size);
		tsf_tlv = (const struct nxpwifi_ie_types_tsf_timestamp *)t;
	}

	/* Find channel-band list TLV */
	{
		const struct nxpwifi_tlv *t;

		t = nxpwifi_find_tlv(TLV_TYPE_CHANNELBANDLIST, tlv_data,
				     tlv_buf_size);
		chan_band_tlv =
		    (const struct nxpwifi_ie_types_chan_band_list_param_set *)t;
	}

#ifdef CONFIG_PM
	if (priv->wdev.wiphy->wowlan_config)
		nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
#endif

	if (nd_config) {
		adapter->nd_info =
			kzalloc_flex(*adapter->nd_info, matches,
				     scan_rsp->number_of_sets, GFP_ATOMIC);

		if (adapter->nd_info)
			adapter->nd_info->n_matches = scan_rsp->number_of_sets;
	}

	for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
		/*
		 * If a TSF TLV is present, save its TSF value in fw_tsf. This
		 * is the firmware TSF at the time the beacon or probe response
		 * was received.
		 */
		if (tsf_tlv)
			memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
			       sizeof(fw_tsf));

		if (chan_band_tlv) {
			chan_band = &chan_band_tlv->chan_band_param[idx];
			radio_type = &chan_band->radio_type;
		} else {
			radio_type = NULL;
		}

		if (chan_band_tlv && adapter->nd_info) {
			adapter->nd_info->matches[idx] =
				kzalloc(sizeof(*pmatch) + sizeof(u32),
					GFP_ATOMIC);

			pmatch = adapter->nd_info->matches[idx];

			if (pmatch) {
				pmatch->n_channels = 1;
				pmatch->channels[0] = chan_band->chan_number;
			}
		}

		ret = nxpwifi_parse_single_response_buf(priv, &bss_info,
							&bytes_left,
							le64_to_cpu(fw_tsf),
							radio_type, false, 0);
		if (ret)
			goto check_next_scan;
	}

check_next_scan:
	nxpwifi_check_next_scan_command(priv);
	return ret;
}

/*
 * Prepare the extended scan command using the provided scan configuration
 * and build the structure to be sent to firmware.
 */
int nxpwifi_cmd_802_11_scan_ext(struct nxpwifi_private *priv,
				struct host_cmd_ds_command *cmd,
				void *data_buf)
{
	struct host_cmd_ds_802_11_scan_ext *ext_scan = &cmd->params.ext_scan;
	struct nxpwifi_scan_cmd_config *scan_cfg = data_buf;

	memcpy(ext_scan->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);

	cmd->command = cpu_to_le16(HOST_CMD_802_11_SCAN_EXT);

	/* Size is equal to the sizeof(fixed portions) + the TLV len + header */
	cmd->size = cpu_to_le16((u16)(sizeof(ext_scan->reserved)
				      + scan_cfg->tlv_buf_len + S_DS_GEN));

	return 0;
}

/* Prepare the background scan config command to send to firmware. */
int nxpwifi_cmd_802_11_bg_scan_config(struct nxpwifi_private *priv,
				      struct host_cmd_ds_command *cmd,
				      void *data_buf)
{
	struct host_cmd_ds_802_11_bg_scan_config *bgscan_config =
					&cmd->params.bg_scan_config;
	struct nxpwifi_bg_scan_cfg *bgscan_cfg_in = data_buf;
	u8 *tlv_pos = bgscan_config->tlv;
	u8 num_probes;
	u32 ssid_len, chan_idx, scan_time, scan_type, scan_dur, chan_num;
	int i;
	struct nxpwifi_ie_types_num_probes *num_probes_tlv;
	struct nxpwifi_ie_types_repeat_count *repeat_count_tlv;
	struct nxpwifi_ie_types_min_rssi_threshold *rssi_threshold_tlv;
	struct nxpwifi_ie_types_bgscan_start_later *start_later_tlv;
	struct nxpwifi_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
	struct nxpwifi_ie_types_chan_list_param_set *tlv_l;
	struct nxpwifi_chan_scan_param_set *temp_chan;

	cmd->command = cpu_to_le16(HOST_CMD_802_11_BG_SCAN_CONFIG);
	cmd->size = cpu_to_le16(sizeof(*bgscan_config) + S_DS_GEN);

	bgscan_config->action = cpu_to_le16(bgscan_cfg_in->action);
	bgscan_config->enable = bgscan_cfg_in->enable;
	bgscan_config->bss_type = bgscan_cfg_in->bss_type;
	bgscan_config->scan_interval =
		cpu_to_le32(bgscan_cfg_in->scan_interval);
	bgscan_config->report_condition =
		cpu_to_le32(bgscan_cfg_in->report_condition);

	/*  stop sched scan  */
	if (!bgscan_config->enable)
		return 0;

	bgscan_config->chan_per_scan = bgscan_cfg_in->chan_per_scan;

	num_probes = (bgscan_cfg_in->num_probes ?
		bgscan_cfg_in->num_probes : priv->adapter->scan_probes);

	if (num_probes) {
		num_probes_tlv = (struct nxpwifi_ie_types_num_probes *)tlv_pos;
		num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
		num_probes_tlv->header.len =
			cpu_to_le16(sizeof(num_probes_tlv->num_probes));
		num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);

		tlv_pos += sizeof(num_probes_tlv->header) +
			le16_to_cpu(num_probes_tlv->header.len);
	}

	if (bgscan_cfg_in->repeat_count) {
		repeat_count_tlv =
			(struct nxpwifi_ie_types_repeat_count *)tlv_pos;
		repeat_count_tlv->header.type =
			cpu_to_le16(TLV_TYPE_REPEAT_COUNT);
		repeat_count_tlv->header.len =
			cpu_to_le16(sizeof(repeat_count_tlv->repeat_count));
		repeat_count_tlv->repeat_count =
			cpu_to_le16(bgscan_cfg_in->repeat_count);

		tlv_pos += sizeof(repeat_count_tlv->header) +
			le16_to_cpu(repeat_count_tlv->header.len);
	}

	if (bgscan_cfg_in->rssi_threshold) {
		rssi_threshold_tlv =
			(struct nxpwifi_ie_types_min_rssi_threshold *)tlv_pos;
		rssi_threshold_tlv->header.type =
			cpu_to_le16(TLV_TYPE_RSSI_LOW);
		rssi_threshold_tlv->header.len =
			cpu_to_le16(sizeof(rssi_threshold_tlv->rssi_threshold));
		rssi_threshold_tlv->rssi_threshold =
			cpu_to_le16(bgscan_cfg_in->rssi_threshold);

		tlv_pos += sizeof(rssi_threshold_tlv->header) +
			le16_to_cpu(rssi_threshold_tlv->header.len);
	}

	for (i = 0; i < bgscan_cfg_in->num_ssids; i++) {
		ssid_len = bgscan_cfg_in->ssid_list[i].ssid.ssid_len;

		wildcard_ssid_tlv =
			(struct nxpwifi_ie_types_wildcard_ssid_params *)tlv_pos;
		wildcard_ssid_tlv->header.type =
				cpu_to_le16(TLV_TYPE_WILDCARDSSID);
		wildcard_ssid_tlv->header.len =
			cpu_to_le16((u16)(ssid_len + sizeof(u8)));

		/*
		 * max_ssid_length = 0 tells firmware to scan only for the given
		 * SSID. max_ssid_length = IEEE80211_MAX_SSID_LEN triggers a
		 * wildcard scan.
		 */
		if (ssid_len)
			wildcard_ssid_tlv->max_ssid_length = 0;
		else
			wildcard_ssid_tlv->max_ssid_length =
						IEEE80211_MAX_SSID_LEN;

		memcpy(wildcard_ssid_tlv->ssid,
		       bgscan_cfg_in->ssid_list[i].ssid.ssid, ssid_len);

		tlv_pos += (sizeof(wildcard_ssid_tlv->header) +
			le16_to_cpu(wildcard_ssid_tlv->header.len));
	}

	tlv_l = (struct nxpwifi_ie_types_chan_list_param_set *)tlv_pos;

	if (bgscan_cfg_in->chan_list[0].chan_number) {
		nxpwifi_dbg(priv->adapter, INFO, "info: bgscan: Using supplied channel list\n");

		tlv_l->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);

		for (chan_idx = 0;
		     chan_idx < NXPWIFI_BG_SCAN_CHAN_MAX &&
		     bgscan_cfg_in->chan_list[chan_idx].chan_number;
		     chan_idx++) {
			temp_chan = &tlv_l->chan_scan_param[chan_idx];

			/* Increment the TLV header length by size appended */
			le16_unaligned_add_cpu(&tlv_l->header.len,
					       sizeof(*tlv_l->chan_scan_param));

			temp_chan->chan_number =
				bgscan_cfg_in->chan_list[chan_idx].chan_number;
			temp_chan->band_cfg =
				bgscan_cfg_in->chan_list[chan_idx].radio_type;

			scan_type =
				bgscan_cfg_in->chan_list[chan_idx].scan_type;

			if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
				temp_chan->chan_scan_mode_bmap |=
					NXPWIFI_PASSIVE_SCAN;
			else
				temp_chan->chan_scan_mode_bmap &=
					~NXPWIFI_PASSIVE_SCAN;

			scan_time = bgscan_cfg_in->chan_list[chan_idx].scan_time;

			if (scan_time) {
				scan_dur = (u16)scan_time;
			} else {
				scan_dur = (scan_type ==
					    NXPWIFI_SCAN_TYPE_PASSIVE) ?
					    priv->adapter->passive_scan_time :
					    priv->adapter->specific_scan_time;
			}

			temp_chan->min_scan_time = cpu_to_le16(scan_dur);
			temp_chan->max_scan_time = cpu_to_le16(scan_dur);
		}
	} else {
		nxpwifi_dbg(priv->adapter, INFO,
			    "info: bgscan: Creating full region channel list\n");
		chan_num =
			nxpwifi_bgscan_create_channel_list
			(priv, bgscan_cfg_in,
			 tlv_l->chan_scan_param);
		le16_unaligned_add_cpu(&tlv_l->header.len,
				       chan_num *
				       sizeof(*tlv_l->chan_scan_param));
	}

	tlv_pos += (sizeof(tlv_l->header)
			+ le16_to_cpu(tlv_l->header.len));

	if (bgscan_cfg_in->start_later) {
		start_later_tlv =
			(struct nxpwifi_ie_types_bgscan_start_later *)tlv_pos;
		start_later_tlv->header.type =
			cpu_to_le16(TLV_TYPE_BGSCAN_START_LATER);
		start_later_tlv->header.len =
			cpu_to_le16(sizeof(start_later_tlv->start_later));
		start_later_tlv->start_later =
			cpu_to_le16(bgscan_cfg_in->start_later);

		tlv_pos += sizeof(start_later_tlv->header) +
			le16_to_cpu(start_later_tlv->header.len);
	}

	/* Append vendor specific element TLV */
	nxpwifi_cmd_append_vsie_tlv(priv, NXPWIFI_VSIE_MASK_BGSCAN, &tlv_pos);

	le16_unaligned_add_cpu(&cmd->size, tlv_pos - bgscan_config->tlv);

	return 0;
}

int nxpwifi_stop_bg_scan(struct nxpwifi_private *priv)
{
	struct nxpwifi_bg_scan_cfg *bgscan_cfg;
	int ret;

	if (!priv->sched_scanning) {
		nxpwifi_dbg(priv->adapter, MSG, "bgscan already stopped!\n");
		return 0;
	}

	bgscan_cfg = kzalloc_obj(*bgscan_cfg, GFP_KERNEL);
	if (!bgscan_cfg)
		return -ENOMEM;

	bgscan_cfg->bss_type = NXPWIFI_BSS_MODE_INFRA;
	bgscan_cfg->action = NXPWIFI_BGSCAN_ACT_SET;
	bgscan_cfg->enable = false;

	ret = nxpwifi_send_cmd(priv, HOST_CMD_802_11_BG_SCAN_CONFIG,
			       HOST_ACT_GEN_SET, 0, bgscan_cfg, true);
	if (!ret)
		priv->sched_scanning = false;

	kfree(bgscan_cfg);
	return ret;
}

static void
nxpwifi_update_chan_statistics(struct nxpwifi_private *priv,
			       struct nxpwifi_ietypes_chanstats *tlv_stat)
{
	struct nxpwifi_adapter *adapter = priv->adapter;
	u8 i, num_chan;
	struct nxpwifi_fw_chan_stats *fw_chan_stats;
	struct nxpwifi_chan_stats chan_stats;

	fw_chan_stats = (void *)((u8 *)tlv_stat +
			      sizeof(struct nxpwifi_ie_types_header));
	num_chan = le16_to_cpu(tlv_stat->header.len) /
					      sizeof(struct nxpwifi_chan_stats);

	for (i = 0 ; i < num_chan; i++) {
		if (adapter->survey_idx >= adapter->num_in_chan_stats) {
			nxpwifi_dbg(adapter, WARN,
				    "FW reported too many channel results (max %d)\n",
				    adapter->num_in_chan_stats);
			return;
		}
		chan_stats.chan_num = fw_chan_stats->chan_num;
		chan_stats.bandcfg = fw_chan_stats->bandcfg;
		chan_stats.flags = fw_chan_stats->flags;
		chan_stats.noise = fw_chan_stats->noise;
		chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
		chan_stats.cca_scan_dur =
				       le16_to_cpu(fw_chan_stats->cca_scan_dur);
		chan_stats.cca_busy_dur =
				       le16_to_cpu(fw_chan_stats->cca_busy_dur);
		nxpwifi_dbg(adapter, INFO,
			    "chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
			    chan_stats.chan_num,
			    chan_stats.noise,
			    chan_stats.total_bss,
			    chan_stats.cca_scan_dur,
			    chan_stats.cca_busy_dur);
		memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
		       sizeof(struct nxpwifi_chan_stats));
		fw_chan_stats++;
	}
}

/* Handle the extended scan command response. */
int nxpwifi_ret_802_11_scan_ext(struct nxpwifi_private *priv,
				struct host_cmd_ds_command *resp)
{
	struct nxpwifi_adapter *adapter = priv->adapter;
	struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
	struct nxpwifi_ie_types_header *tlv;
	struct nxpwifi_ietypes_chanstats *tlv_stat;
	u16 buf_left, type, len;

	struct host_cmd_ds_command *cmd_ptr;
	struct cmd_ctrl_node *cmd_node;
	bool complete_scan = false;

	nxpwifi_dbg(adapter, INFO, "info: EXT scan returns successfully\n");

	ext_scan_resp = &resp->params.ext_scan;

	tlv = (void *)ext_scan_resp->tlv_buffer;
	buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN);

	while (buf_left >= sizeof(struct nxpwifi_ie_types_header)) {
		type = le16_to_cpu(tlv->type);
		len = le16_to_cpu(tlv->len);

		if (buf_left < (sizeof(struct nxpwifi_ie_types_header) + len)) {
			nxpwifi_dbg(adapter, ERROR,
				    "error processing scan response TLVs");
			break;
		}

		switch (type) {
		case TLV_TYPE_CHANNEL_STATS:
			tlv_stat = (void *)tlv;
			nxpwifi_update_chan_statistics(priv, tlv_stat);
			break;
		default:
			break;
		}

		buf_left -= len + sizeof(struct nxpwifi_ie_types_header);
		tlv = (void *)((u8 *)tlv + len +
			       sizeof(struct nxpwifi_ie_types_header));
	}

	spin_lock_bh(&adapter->cmd_pending_q_lock);
	spin_lock_bh(&adapter->scan_pending_q_lock);
	if (list_empty(&adapter->scan_pending_q)) {
		complete_scan = true;
		list_for_each_entry(cmd_node, &adapter->cmd_pending_q, list) {
			cmd_ptr = (void *)cmd_node->cmd_skb->data;
			if (le16_to_cpu(cmd_ptr->command) ==
			    HOST_CMD_802_11_SCAN_EXT) {
				nxpwifi_dbg(adapter, INFO,
					    "Scan pending in command pending list");
				complete_scan = false;
				break;
			}
		}
	}
	spin_unlock_bh(&adapter->scan_pending_q_lock);
	spin_unlock_bh(&adapter->cmd_pending_q_lock);

	if (complete_scan)
		nxpwifi_complete_scan(priv);

	return 0;
}

/*
 * Handle the extended scan report event: parse the results and notify
 * cfg80211.
 */
int nxpwifi_handle_event_ext_scan_report(struct nxpwifi_private *priv,
					 void *buf)
{
	int ret = 0;
	struct nxpwifi_adapter *adapter = priv->adapter;
	u8 *bss_info;
	u32 bytes_left, bytes_left_for_tlv, idx;
	u16 type, len;
	struct nxpwifi_ie_types_data *tlv;
	struct nxpwifi_ie_types_scan_rsp *scan_rsp_tlv;
	struct nxpwifi_ie_types_scan_inf *scan_info_tlv;
	u8 *radio_type;
	u64 fw_tsf = 0;
	s32 rssi = 0;
	struct nxpwifi_event_scan_result *event_scan = buf;
	u8 num_of_set = event_scan->num_of_set;
	u8 *scan_resp = buf + sizeof(struct nxpwifi_event_scan_result);
	u16 scan_resp_size = le16_to_cpu(event_scan->buf_size);

	if (num_of_set > NXPWIFI_MAX_AP) {
		nxpwifi_dbg(adapter, ERROR,
			    "EXT_SCAN: Invalid number of AP returned (%d)!!\n",
			    num_of_set);
		ret = -EINVAL;
		goto check_next_scan;
	}

	bytes_left = scan_resp_size;
	nxpwifi_dbg(adapter, INFO,
		    "EXT_SCAN: size %d, returned %d APs...",
		    scan_resp_size, num_of_set);
	nxpwifi_dbg_dump(adapter, CMD_D, "EXT_SCAN buffer:", buf,
			 scan_resp_size +
			 sizeof(struct nxpwifi_event_scan_result));

	tlv = (struct nxpwifi_ie_types_data *)scan_resp;

	for (idx = 0; idx < num_of_set && bytes_left; idx++) {
		type = le16_to_cpu(tlv->header.type);
		len = le16_to_cpu(tlv->header.len);
		if (bytes_left < sizeof(struct nxpwifi_ie_types_header) + len) {
			nxpwifi_dbg(adapter, ERROR,
				    "EXT_SCAN: Error bytes left < TLV length\n");
			break;
		}
		scan_rsp_tlv = NULL;
		scan_info_tlv = NULL;
		bytes_left_for_tlv = bytes_left;

		/*
		 * BSS response TLV with beacon or probe response buffer
		 * at the initial position of each descriptor
		 */
		if (type != TLV_TYPE_BSS_SCAN_RSP)
			break;

		bss_info = (u8 *)tlv;
		scan_rsp_tlv = (struct nxpwifi_ie_types_scan_rsp *)tlv;
		tlv = (struct nxpwifi_ie_types_data *)(tlv->data + len);
		bytes_left_for_tlv -=
			(len + sizeof(struct nxpwifi_ie_types_header));

		while (bytes_left_for_tlv >=
		       sizeof(struct nxpwifi_ie_types_header) &&
		       le16_to_cpu(tlv->header.type) != TLV_TYPE_BSS_SCAN_RSP) {
			type = le16_to_cpu(tlv->header.type);
			len = le16_to_cpu(tlv->header.len);
			if (bytes_left_for_tlv <
			    sizeof(struct nxpwifi_ie_types_header) + len) {
				nxpwifi_dbg(adapter, ERROR,
					    "EXT_SCAN: Error in processing TLV,\t"
					    "bytes left < TLV length\n");
				scan_rsp_tlv = NULL;
				bytes_left_for_tlv = 0;
				continue;
			}
			switch (type) {
			case TLV_TYPE_BSS_SCAN_INFO:
				scan_info_tlv =
					(struct nxpwifi_ie_types_scan_inf *)tlv;
				if (len !=
				 sizeof(struct nxpwifi_ie_types_scan_inf) -
				 sizeof(struct nxpwifi_ie_types_header)) {
					bytes_left_for_tlv = 0;
					continue;
				}
				break;
			default:
				break;
			}
			tlv = (struct nxpwifi_ie_types_data *)(tlv->data + len);
			bytes_left -=
				(len + sizeof(struct nxpwifi_ie_types_header));
			bytes_left_for_tlv -=
				(len + sizeof(struct nxpwifi_ie_types_header));
		}

		if (!scan_rsp_tlv)
			break;

		/*
		 * Advance pointer to the beacon buffer length and
		 * update the bytes count so that the function
		 * wlan_interpret_bss_desc_with_ie() can handle the
		 * scan buffer withut any change
		 */
		bss_info += sizeof(u16);
		bytes_left -= sizeof(u16);

		if (scan_info_tlv) {
			rssi = (s32)(s16)(le16_to_cpu(scan_info_tlv->rssi));
			rssi *= 100;           /* Convert dBm to mBm */
			nxpwifi_dbg(adapter, INFO,
				    "info: InterpretIE: RSSI=%d\n", rssi);
			fw_tsf = le64_to_cpu(scan_info_tlv->tsf);
			radio_type = &scan_info_tlv->radio_type;
		} else {
			radio_type = NULL;
		}
		ret = nxpwifi_parse_single_response_buf(priv, &bss_info,
							&bytes_left, fw_tsf,
							radio_type, true, rssi);
		if (ret)
			goto check_next_scan;
	}

check_next_scan:
	if (!event_scan->more_event)
		nxpwifi_check_next_scan_command(priv);

	return ret;
}

/*
 * Prepare the background scan query command. Sets the command ID, size,
 * flush parameter, and fixes endianness.
 */
int nxpwifi_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
{
	struct host_cmd_ds_802_11_bg_scan_query *bg_query =
		&cmd->params.bg_scan_query;

	cmd->command = cpu_to_le16(HOST_CMD_802_11_BG_SCAN_QUERY);
	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_bg_scan_query)
				+ S_DS_GEN);

	bg_query->flush = 1;

	return 0;
}

/* Insert a scan command node into the scan_pending_q. */
void
nxpwifi_queue_scan_cmd(struct nxpwifi_private *priv,
		       struct cmd_ctrl_node *cmd_node)
{
	struct nxpwifi_adapter *adapter = priv->adapter;

	cmd_node->wait_q_enabled = true;
	cmd_node->condition = &adapter->scan_wait_q_woken;
	spin_lock_bh(&adapter->scan_pending_q_lock);
	list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
	spin_unlock_bh(&adapter->scan_pending_q_lock);
}

/* Append a vendor-specific element TLV to the buffer. */
int
nxpwifi_cmd_append_vsie_tlv(struct nxpwifi_private *priv,
			    u16 vsie_mask, u8 **buffer)
{
	int id, ret_len = 0;
	struct nxpwifi_ie_types_vendor_param_set *vs_param_set;

	if (!buffer)
		return 0;
	if (!(*buffer))
		return 0;

	/*
	 * Traverse through the saved vendor specific element array and append
	 * the selected(scan/assoc) element as TLV to the command
	 */
	for (id = 0; id < NXPWIFI_MAX_VSIE_NUM; id++) {
		if (priv->vs_ie[id].mask & vsie_mask) {
			vs_param_set =
				(struct nxpwifi_ie_types_vendor_param_set *)
				*buffer;
			vs_param_set->header.type =
				cpu_to_le16(TLV_TYPE_PASSTHROUGH);
			vs_param_set->header.len =
				cpu_to_le16((((u16)priv->vs_ie[id].ie[1])
				& 0x00FF) + 2);
			if (le16_to_cpu(vs_param_set->header.len) >
				NXPWIFI_MAX_VSIE_LEN) {
				nxpwifi_dbg(priv->adapter, ERROR,
					    "Invalid param length!\n");
				break;
			}

			memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
			       le16_to_cpu(vs_param_set->header.len));
			*buffer += le16_to_cpu(vs_param_set->header.len) +
				   sizeof(struct nxpwifi_ie_types_header);
			ret_len += le16_to_cpu(vs_param_set->header.len) +
				   sizeof(struct nxpwifi_ie_types_header);
		}
	}
	return ret_len;
}

/*
 * Save the beacon buffer of the current BSS descriptor.
 *
 * The buffer is preserved so it can be restored when the current SSID's
 * beacon is missing, such as when:
 *  - the SSID was not found in the latest scan, or
 *  - the SSID was the last entry in the scan table and was overwritten.
 */
void
nxpwifi_save_curr_bcn(struct nxpwifi_private *priv)
{
	struct nxpwifi_bssdescriptor *curr_bss =
		&priv->curr_bss_params.bss_descriptor;

	if (!curr_bss->beacon_buf_size)
		return;

	/* allocate beacon buffer at 1st time; or if it's size has changed */
	if (!priv->curr_bcn_buf ||
	    priv->curr_bcn_size != curr_bss->beacon_buf_size) {
		priv->curr_bcn_size = curr_bss->beacon_buf_size;

		kfree(priv->curr_bcn_buf);
		priv->curr_bcn_buf = kmalloc(curr_bss->beacon_buf_size,
					     GFP_ATOMIC);
		if (!priv->curr_bcn_buf)
			return;
	}

	memcpy(priv->curr_bcn_buf, curr_bss->beacon_buf,
	       curr_bss->beacon_buf_size);
	nxpwifi_dbg(priv->adapter, INFO,
		    "info: current beacon saved %d\n",
		    priv->curr_bcn_size);

	curr_bss->beacon_buf = priv->curr_bcn_buf;

	/* adjust the pointers in the current BSS descriptor */
	if (curr_bss->bcn_wpa_ie)
		curr_bss->bcn_wpa_ie =
			(struct ieee_types_vendor_specific *)
			(curr_bss->beacon_buf +
			 curr_bss->wpa_offset);

	if (curr_bss->bcn_rsn_ie)
		curr_bss->bcn_rsn_ie =
			(struct element *)(curr_bss->beacon_buf +
					   curr_bss->rsn_offset);

	if (curr_bss->bcn_ht_cap)
		curr_bss->bcn_ht_cap = (struct ieee80211_ht_cap *)
			(curr_bss->beacon_buf +
			 curr_bss->ht_cap_offset);

	if (curr_bss->bcn_ht_oper)
		curr_bss->bcn_ht_oper = (struct ieee80211_ht_operation *)
			(curr_bss->beacon_buf +
			 curr_bss->ht_info_offset);

	if (curr_bss->bcn_vht_cap)
		curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
						 curr_bss->vht_cap_offset);

	if (curr_bss->bcn_vht_oper)
		curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
						  curr_bss->vht_info_offset);

	if (curr_bss->bcn_he_cap)
		curr_bss->bcn_he_cap = (void *)(curr_bss->beacon_buf +
						curr_bss->he_cap_offset);

	if (curr_bss->bcn_he_oper)
		curr_bss->bcn_he_oper = (void *)(curr_bss->beacon_buf +
						 curr_bss->he_info_offset);

	if (curr_bss->bcn_bss_co_2040)
		curr_bss->bcn_bss_co_2040 =
			(curr_bss->beacon_buf + curr_bss->bss_co_2040_offset);

	if (curr_bss->bcn_ext_cap)
		curr_bss->bcn_ext_cap = curr_bss->beacon_buf +
			curr_bss->ext_cap_offset;

	if (curr_bss->oper_mode)
		curr_bss->oper_mode = (void *)(curr_bss->beacon_buf +
					       curr_bss->oper_mode_offset);
}

/* Free the beacon buffer in the current BSS descriptor. */
void
nxpwifi_free_curr_bcn(struct nxpwifi_private *priv)
{
	kfree(priv->curr_bcn_buf);
	priv->curr_bcn_buf = NULL;
}