1 files changed, 50 insertions, 12 deletions

diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 3e82f1627209..317f086ced0a 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -10,6 +10,7 @@
 #include <linux/wait.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/wait.h>
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
 #include <asm/unaligned.h>
@@ -526,20 +527,31 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
 
         pos = scanresp->bssdesc_and_tlvbuffer;
 
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_RSP", scanresp->bssdesc_and_tlvbuffer,
+                        scanresp->bssdescriptsize);
+
         tsfdesc = pos + bsssize;
         tsfsize = 4 + 8 * scanresp->nr_sets;
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TSF", (u8 *) tsfdesc, tsfsize);
 
         /* Validity check: we expect a Marvell-Local TLV */
         i = get_unaligned_le16(tsfdesc);
         tsfdesc += 2;
-        if (i != TLV_TYPE_TSFTIMESTAMP)
+        if (i != TLV_TYPE_TSFTIMESTAMP) {
+                lbs_deb_scan("scan response: invalid TSF Timestamp %d\n", i);
                 goto done;
+        }
+
         /* Validity check: the TLV holds TSF values with 8 bytes each, so
          * the size in the TLV must match the nr_sets value */
         i = get_unaligned_le16(tsfdesc);
         tsfdesc += 2;
-        if (i / 8 != scanresp->nr_sets)
+        if (i / 8 != scanresp->nr_sets) {
+                lbs_deb_scan("scan response: invalid number of TSF timestamp "
+                             "sets (expected %d got %d)\n", scanresp->nr_sets,
+                             i / 8);
                 goto done;
+        }
 
         for (i = 0; i < scanresp->nr_sets; i++) {
                 const u8 *bssid;
@@ -581,8 +593,11 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         id = *pos++;
                         elen = *pos++;
                         left -= 2;
-                        if (elen > left || elen == 0)
+                        if (elen > left || elen == 0) {
+                                lbs_deb_scan("scan response: invalid IE fmt\n");
                                 goto done;
+                        }
+
                         if (id == WLAN_EID_DS_PARAMS)
                                 chan_no = *pos;
                         if (id == WLAN_EID_SSID) {
@@ -613,7 +628,9 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                                         capa, intvl, ie, ielen,
                                         LBS_SCAN_RSSI_TO_MBM(rssi),
                                         GFP_KERNEL);
-                }
+                } else
+                        lbs_deb_scan("scan response: missing BSS channel IE\n");
+
                 tsfdesc += 8;
         }
         ret = 0;
@@ -1103,7 +1120,7 @@ static int lbs_associate(struct lbs_private *priv,
         lbs_deb_hex(LBS_DEB_ASSOC, "Common Rates", tmp, pos - tmp);
 
         /* add auth type TLV */
-        if (priv->fwrelease >= 0x09000000)
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) >= 9)
                 pos += lbs_add_auth_type_tlv(pos, sme->auth_type);
 
         /* add WPA/WPA2 TLV */
@@ -1114,6 +1131,9 @@ static int lbs_associate(struct lbs_private *priv,
                 (u16)(pos - (u8 *) &cmd->iebuf);
         cmd->hdr.size = cpu_to_le16(len);
 
+        lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_CMD", (u8 *) cmd,
+                        le16_to_cpu(cmd->hdr.size));
+
         /* store for later use */
         memcpy(priv->assoc_bss, bss->bssid, ETH_ALEN);
 
@@ -1121,14 +1141,28 @@ static int lbs_associate(struct lbs_private *priv,
         if (ret)
                 goto done;
 
-
         /* generate connect message to cfg80211 */
 
         resp = (void *) cmd; /* recast for easier field access */
         status = le16_to_cpu(resp->statuscode);
 
-        /* Convert statis code of old firmware */
-        if (priv->fwrelease < 0x09000000)
+        /* Older FW versions map the IEEE 802.11 Status Code in the association
+         * response to the following values returned in resp->statuscode:
+         *
+         *    IEEE Status Code                Marvell Status Code
+         *    0                       ->      0x0000 ASSOC_RESULT_SUCCESS
+         *    13                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    14                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    15                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    16                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    others                  ->      0x0003 ASSOC_RESULT_REFUSED
+         *
+         * Other response codes:
+         *    0x0001 -> ASSOC_RESULT_INVALID_PARAMETERS (unused)
+         *    0x0002 -> ASSOC_RESULT_TIMEOUT (internal timer expired waiting for
+         *                                    association response from the AP)
+         */
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
                 switch (status) {
                 case 0:
                         break;
@@ -1150,11 +1184,16 @@ static int lbs_associate(struct lbs_private *priv,
                         break;
                 default:
                         lbs_deb_assoc("association failure %d\n", status);
-                        status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+                        /* v5 OLPC firmware does return the AP status code if
+                         * it's not one of the values above.  Let that through.
+                         */
+                        break;
+                }
         }
 
-        lbs_deb_assoc("status %d, capability 0x%04x\n", status,
-                      le16_to_cpu(resp->capability));
+        lbs_deb_assoc("status %d, statuscode 0x%04x, capability 0x%04x, "
+                      "aid 0x%04x\n", status, le16_to_cpu(resp->statuscode),
+                      le16_to_cpu(resp->capability), le16_to_cpu(resp->aid));
 
         resp_ie_len = le16_to_cpu(resp->hdr.size)
                 - sizeof(resp->hdr)
@@ -1174,7 +1213,6 @@ static int lbs_associate(struct lbs_private *priv,
                         netif_tx_wake_all_queues(priv->dev);
         }
 
-
 done:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;