drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2010 Broadcom Corporation
   4  */
   5
   6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/vmalloc.h>
  12 #include <net/cfg80211.h>
  13 #include <net/netlink.h>
  14 #include <uapi/linux/if_arp.h>
  15
  16 #include <brcmu_utils.h>
  17 #include <defs.h>
  18 #include <brcmu_wifi.h>
  19 #include <brcm_hw_ids.h>
  20 #include "core.h"
  21 #include "debug.h"
  22 #include "tracepoint.h"
  23 #include "fwil_types.h"
  24 #include "p2p.h"
  25 #include "btcoex.h"
  26 #include "pno.h"
  27 #include "fwsignal.h"
  28 #include "cfg80211.h"
  29 #include "feature.h"
  30 #include "fwil.h"
  31 #include "proto.h"
  32 #include "vendor.h"
  33 #include "bus.h"
  34 #include "common.h"
  35
  36 #define BRCMF_SCAN_IE_LEN_MAX           2048
  37
  38 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  39 #define WPA_OUI_TYPE                    1
  40 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  41 #define WME_OUI_TYPE                    2
  42 #define WPS_OUI_TYPE                    4
  43
  44 #define VS_IE_FIXED_HDR_LEN             6
  45 #define WPA_IE_VERSION_LEN              2
  46 #define WPA_IE_MIN_OUI_LEN              4
  47 #define WPA_IE_SUITE_COUNT_LEN          2
  48
  49 #define WPA_CIPHER_NONE                 0       /* None */
  50 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  51 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  52 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  53 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  54
  55 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  56 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  57 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  58 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  59 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  60 #define RSN_AKM_SAE                     8       /* SAE */
  61 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  62 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  63 #define RSN_CAP_MFPR_MASK               BIT(6)
  64 #define RSN_CAP_MFPC_MASK               BIT(7)
  65 #define RSN_PMKID_COUNT_LEN             2
  66
  67 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  68                                                  * string :"add", "del" (+ NUL)
  69                                                  */
  70 #define VNDR_IE_COUNT_OFFSET            4
  71 #define VNDR_IE_PKTFLAG_OFFSET          8
  72 #define VNDR_IE_VSIE_OFFSET             12
  73 #define VNDR_IE_HDR_SIZE                12
  74 #define VNDR_IE_PARSE_LIMIT             5
  75
  76 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  77 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  78
  79 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  80 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  81 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  82
  83 #define BRCMF_SCAN_CHANNEL_TIME         40
  84 #define BRCMF_SCAN_UNASSOC_TIME         40
  85 #define BRCMF_SCAN_PASSIVE_TIME         120
  86
  87 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  88
  89 #define BRCMF_PS_MAX_TIMEOUT_MS         2000
  90
  91 /* Dump obss definitions */
  92 #define ACS_MSRMNT_DELAY                80
  93 #define CHAN_NOISE_DUMMY                (-80)
  94 #define OBSS_TOKEN_IDX                  15
  95 #define IBSS_TOKEN_IDX                  15
  96 #define TX_TOKEN_IDX                    14
  97 #define CTG_TOKEN_IDX                   13
  98 #define PKT_TOKEN_IDX                   15
  99 #define IDLE_TOKEN_IDX                  12
 100
 101 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 102         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 103
 104 #define BRCMF_MAX_CHANSPEC_LIST \
 105         (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
 106
 107 struct brcmf_dump_survey {
 108         u32 obss;
 109         u32 ibss;
 110         u32 no_ctg;
 111         u32 no_pckt;
 112         u32 tx;
 113         u32 idle;
 114 };
 115
 116 struct cca_stats_n_flags {
 117         u32 msrmnt_time; /* Time for Measurement (msec) */
 118         u32 msrmnt_done; /* flag set when measurement complete */
 119         char buf[1];
 120 };
 121
 122 struct cca_msrmnt_query {
 123         u32 msrmnt_query;
 124         u32 time_req;
 125 };
 126
 127 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 128 {
 129         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 130                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 131                           vif->sme_state);
 132                 return false;
 133         }
 134         return true;
 135 }
 136
 137 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 138 #define RATETAB_ENT(_rateid, _flags) \
 139         {                                                               \
 140                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 141                 .hw_value       = (_rateid),                            \
 142                 .flags          = (_flags),                             \
 143         }
 144
 145 static struct ieee80211_rate __wl_rates[] = {
 146         RATETAB_ENT(BRCM_RATE_1M, 0),
 147         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 148         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(BRCM_RATE_6M, 0),
 151         RATETAB_ENT(BRCM_RATE_9M, 0),
 152         RATETAB_ENT(BRCM_RATE_12M, 0),
 153         RATETAB_ENT(BRCM_RATE_18M, 0),
 154         RATETAB_ENT(BRCM_RATE_24M, 0),
 155         RATETAB_ENT(BRCM_RATE_36M, 0),
 156         RATETAB_ENT(BRCM_RATE_48M, 0),
 157         RATETAB_ENT(BRCM_RATE_54M, 0),
 158 };
 159
 160 #define wl_g_rates              (__wl_rates + 0)
 161 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 162 #define wl_a_rates              (__wl_rates + 4)
 163 #define wl_a_rates_size         (wl_g_rates_size - 4)
 164
 165 #define CHAN2G(_channel, _freq) {                               \
 166         .band                   = NL80211_BAND_2GHZ,            \
 167         .center_freq            = (_freq),                      \
 168         .hw_value               = (_channel),                   \
 169         .max_antenna_gain       = 0,                            \
 170         .max_power              = 30,                           \
 171 }
 172
 173 #define CHAN5G(_channel) {                                      \
 174         .band                   = NL80211_BAND_5GHZ,            \
 175         .center_freq            = 5000 + (5 * (_channel)),      \
 176         .hw_value               = (_channel),                   \
 177         .max_antenna_gain       = 0,                            \
 178         .max_power              = 30,                           \
 179 }
 180
 181 static struct ieee80211_channel __wl_2ghz_channels[] = {
 182         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 183         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 184         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 185         CHAN2G(13, 2472), CHAN2G(14, 2484)
 186 };
 187
 188 static struct ieee80211_channel __wl_5ghz_channels[] = {
 189         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 190         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 191         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 192         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 193         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 194         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 195 };
 196
 197 /* Band templates duplicated per wiphy. The channel info
 198  * above is added to the band during setup.
 199  */
 200 static const struct ieee80211_supported_band __wl_band_2ghz = {
 201         .band = NL80211_BAND_2GHZ,
 202         .bitrates = wl_g_rates,
 203         .n_bitrates = wl_g_rates_size,
 204 };
 205
 206 static const struct ieee80211_supported_band __wl_band_5ghz = {
 207         .band = NL80211_BAND_5GHZ,
 208         .bitrates = wl_a_rates,
 209         .n_bitrates = wl_a_rates_size,
 210 };
 211
 212 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 213  * By default world regulatory domain defined in reg.c puts the flags
 214  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 215  * With respect to these flags, wpa_supplicant doesn't * start p2p
 216  * operations on 5GHz channels. All the changes in world regulatory
 217  * domain are to be done here.
 218  */
 219 static const struct ieee80211_regdomain brcmf_regdom = {
 220         .n_reg_rules = 4,
 221         .alpha2 =  "99",
 222         .reg_rules = {
 223                 /* IEEE 802.11b/g, channels 1..11 */
 224                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 225                 /* If any */
 226                 /* IEEE 802.11 channel 14 - Only JP enables
 227                  * this and for 802.11b only
 228                  */
 229                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 230                 /* IEEE 802.11a, channel 36..64 */
 231                 REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
 232                 /* IEEE 802.11a, channel 100..165 */
 233                 REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
 234 };
 235
 236 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 237  * are supported. A pointer to this array and the number of entries is passed
 238  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 239  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 240  * device does not support MFP then the number of suites will be decreased by 1
 241  */
 242 static const u32 brcmf_cipher_suites[] = {
 243         WLAN_CIPHER_SUITE_WEP40,
 244         WLAN_CIPHER_SUITE_WEP104,
 245         WLAN_CIPHER_SUITE_TKIP,
 246         WLAN_CIPHER_SUITE_CCMP,
 247         /* Keep as last entry: */
 248         WLAN_CIPHER_SUITE_AES_CMAC
 249 };
 250
 251 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 252 struct brcmf_vs_tlv {
 253         u8 id;
 254         u8 len;
 255         u8 oui[3];
 256         u8 oui_type;
 257 };
 258
 259 struct parsed_vndr_ie_info {
 260         u8 *ie_ptr;
 261         u32 ie_len;     /* total length including id & length field */
 262         struct brcmf_vs_tlv vndrie;
 263 };
 264
 265 struct parsed_vndr_ies {
 266         u32 count;
 267         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 268 };
 269
 270 #define WL_INTERFACE_CREATE_VER_1               1
 271 #define WL_INTERFACE_CREATE_VER_2               2
 272 #define WL_INTERFACE_CREATE_VER_3               3
 273 #define WL_INTERFACE_CREATE_VER_MAX             WL_INTERFACE_CREATE_VER_3
 274
 275 #define WL_INTERFACE_MAC_DONT_USE       0x0
 276 #define WL_INTERFACE_MAC_USE            0x2
 277
 278 #define WL_INTERFACE_CREATE_STA         0x0
 279 #define WL_INTERFACE_CREATE_AP          0x1
 280
 281 struct wl_interface_create_v1 {
 282         u16     ver;                    /* structure version */
 283         u32     flags;                  /* flags for operation */
 284         u8      mac_addr[ETH_ALEN];     /* MAC address */
 285         u32     wlc_index;              /* optional for wlc index */
 286 };
 287
 288 struct wl_interface_create_v2 {
 289         u16     ver;                    /* structure version */
 290         u8      pad1[2];
 291         u32     flags;                  /* flags for operation */
 292         u8      mac_addr[ETH_ALEN];     /* MAC address */
 293         u8      iftype;                 /* type of interface created */
 294         u8      pad2;
 295         u32     wlc_index;              /* optional for wlc index */
 296 };
 297
 298 struct wl_interface_create_v3 {
 299         u16 ver;                        /* structure version */
 300         u16 len;                        /* length of structure + data */
 301         u16 fixed_len;                  /* length of structure */
 302         u8 iftype;                      /* type of interface created */
 303         u8 wlc_index;                   /* optional for wlc index */
 304         u32 flags;                      /* flags for operation */
 305         u8 mac_addr[ETH_ALEN];          /* MAC address */
 306         u8 bssid[ETH_ALEN];             /* optional for BSSID */
 307         u8 if_index;                    /* interface index request */
 308         u8 pad[3];
 309         u8 data[];                      /* Optional for specific data */
 310 };
 311
 312 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 313 {
 314         switch (band) {
 315         case NL80211_BAND_2GHZ:
 316                 return WLC_BAND_2G;
 317         case NL80211_BAND_5GHZ:
 318                 return WLC_BAND_5G;
 319         default:
 320                 WARN_ON(1);
 321                 break;
 322         }
 323         return 0;
 324 }
 325
 326 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 327                                struct cfg80211_chan_def *ch)
 328 {
 329         struct brcmu_chan ch_inf;
 330         s32 primary_offset;
 331
 332         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 333                   ch->chan->center_freq, ch->center_freq1, ch->width);
 334         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 335         primary_offset = ch->chan->center_freq - ch->center_freq1;
 336         switch (ch->width) {
 337         case NL80211_CHAN_WIDTH_20:
 338         case NL80211_CHAN_WIDTH_20_NOHT:
 339                 ch_inf.bw = BRCMU_CHAN_BW_20;
 340                 WARN_ON(primary_offset != 0);
 341                 break;
 342         case NL80211_CHAN_WIDTH_40:
 343                 ch_inf.bw = BRCMU_CHAN_BW_40;
 344                 if (primary_offset > 0)
 345                         ch_inf.sb = BRCMU_CHAN_SB_U;
 346                 else
 347                         ch_inf.sb = BRCMU_CHAN_SB_L;
 348                 break;
 349         case NL80211_CHAN_WIDTH_80:
 350                 ch_inf.bw = BRCMU_CHAN_BW_80;
 351                 if (primary_offset == -30)
 352                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 353                 else if (primary_offset == -10)
 354                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 355                 else if (primary_offset == 10)
 356                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 357                 else
 358                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 359                 break;
 360         case NL80211_CHAN_WIDTH_160:
 361                 ch_inf.bw = BRCMU_CHAN_BW_160;
 362                 if (primary_offset == -70)
 363                         ch_inf.sb = BRCMU_CHAN_SB_LLL;
 364                 else if (primary_offset == -50)
 365                         ch_inf.sb = BRCMU_CHAN_SB_LLU;
 366                 else if (primary_offset == -30)
 367                         ch_inf.sb = BRCMU_CHAN_SB_LUL;
 368                 else if (primary_offset == -10)
 369                         ch_inf.sb = BRCMU_CHAN_SB_LUU;
 370                 else if (primary_offset == 10)
 371                         ch_inf.sb = BRCMU_CHAN_SB_ULL;
 372                 else if (primary_offset == 30)
 373                         ch_inf.sb = BRCMU_CHAN_SB_ULU;
 374                 else if (primary_offset == 50)
 375                         ch_inf.sb = BRCMU_CHAN_SB_UUL;
 376                 else
 377                         ch_inf.sb = BRCMU_CHAN_SB_UUU;
 378                 break;
 379         case NL80211_CHAN_WIDTH_80P80:
 380         case NL80211_CHAN_WIDTH_5:
 381         case NL80211_CHAN_WIDTH_10:
 382         default:
 383                 WARN_ON_ONCE(1);
 384         }
 385         switch (ch->chan->band) {
 386         case NL80211_BAND_2GHZ:
 387                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 388                 break;
 389         case NL80211_BAND_5GHZ:
 390                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 391                 break;
 392         case NL80211_BAND_60GHZ:
 393         default:
 394                 WARN_ON_ONCE(1);
 395         }
 396         d11inf->encchspec(&ch_inf);
 397
 398         brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
 399         return ch_inf.chspec;
 400 }
 401
 402 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 403                         struct ieee80211_channel *ch)
 404 {
 405         struct brcmu_chan ch_inf;
 406
 407         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 408         ch_inf.bw = BRCMU_CHAN_BW_20;
 409         d11inf->encchspec(&ch_inf);
 410
 411         return ch_inf.chspec;
 412 }
 413
 414 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 415  * triples, returning a pointer to the substring whose first element
 416  * matches tag
 417  */
 418 static const struct brcmf_tlv *
 419 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 420 {
 421         const struct brcmf_tlv *elt = buf;
 422         int totlen = buflen;
 423
 424         /* find tagged parameter */
 425         while (totlen >= TLV_HDR_LEN) {
 426                 int len = elt->len;
 427
 428                 /* validate remaining totlen */
 429                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 430                         return elt;
 431
 432                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 433                 totlen -= (len + TLV_HDR_LEN);
 434         }
 435
 436         return NULL;
 437 }
 438
 439 /* Is any of the tlvs the expected entry? If
 440  * not update the tlvs buffer pointer/length.
 441  */
 442 static bool
 443 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 444                  const u8 *oui, u32 oui_len, u8 type)
 445 {
 446         /* If the contents match the OUI and the type */
 447         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 448             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 449             type == ie[TLV_BODY_OFF + oui_len]) {
 450                 return true;
 451         }
 452
 453         if (tlvs == NULL)
 454                 return false;
 455         /* point to the next ie */
 456         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 457         /* calculate the length of the rest of the buffer */
 458         *tlvs_len -= (int)(ie - *tlvs);
 459         /* update the pointer to the start of the buffer */
 460         *tlvs = ie;
 461
 462         return false;
 463 }
 464
 465 static struct brcmf_vs_tlv *
 466 brcmf_find_wpaie(const u8 *parse, u32 len)
 467 {
 468         const struct brcmf_tlv *ie;
 469
 470         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 471                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 472                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 473                         return (struct brcmf_vs_tlv *)ie;
 474         }
 475         return NULL;
 476 }
 477
 478 static struct brcmf_vs_tlv *
 479 brcmf_find_wpsie(const u8 *parse, u32 len)
 480 {
 481         const struct brcmf_tlv *ie;
 482
 483         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 484                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 485                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 486                         return (struct brcmf_vs_tlv *)ie;
 487         }
 488         return NULL;
 489 }
 490
 491 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 492                                      struct brcmf_cfg80211_vif *vif,
 493                                      enum nl80211_iftype new_type)
 494 {
 495         struct brcmf_cfg80211_vif *pos;
 496         bool check_combos = false;
 497         int ret = 0;
 498         struct iface_combination_params params = {
 499                 .num_different_channels = 1,
 500         };
 501
 502         list_for_each_entry(pos, &cfg->vif_list, list)
 503                 if (pos == vif) {
 504                         params.iftype_num[new_type]++;
 505                 } else {
 506                         /* concurrent interfaces so need check combinations */
 507                         check_combos = true;
 508                         params.iftype_num[pos->wdev.iftype]++;
 509                 }
 510
 511         if (check_combos)
 512                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 513
 514         return ret;
 515 }
 516
 517 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 518                                   enum nl80211_iftype new_type)
 519 {
 520         struct brcmf_cfg80211_vif *pos;
 521         struct iface_combination_params params = {
 522                 .num_different_channels = 1,
 523         };
 524
 525         list_for_each_entry(pos, &cfg->vif_list, list)
 526                 params.iftype_num[pos->wdev.iftype]++;
 527
 528         params.iftype_num[new_type]++;
 529         return cfg80211_check_combinations(cfg->wiphy, &params);
 530 }
 531
 532 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 533                                  struct brcmf_wsec_key_le *key_le)
 534 {
 535         key_le->index = cpu_to_le32(key->index);
 536         key_le->len = cpu_to_le32(key->len);
 537         key_le->algo = cpu_to_le32(key->algo);
 538         key_le->flags = cpu_to_le32(key->flags);
 539         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 540         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 541         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 542         memcpy(key_le->data, key->data, sizeof(key->data));
 543         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 544 }
 545
 546 static int
 547 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 548 {
 549         struct brcmf_pub *drvr = ifp->drvr;
 550         int err;
 551         struct brcmf_wsec_key_le key_le;
 552
 553         convert_key_from_CPU(key, &key_le);
 554
 555         brcmf_netdev_wait_pend8021x(ifp);
 556
 557         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 558                                         sizeof(key_le));
 559
 560         if (err)
 561                 bphy_err(drvr, "wsec_key error (%d)\n", err);
 562         return err;
 563 }
 564
 565 static void
 566 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 567 {
 568         struct brcmf_cfg80211_vif *vif;
 569         struct brcmf_if *ifp;
 570
 571         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 572         ifp = vif->ifp;
 573
 574         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 575             (wdev->iftype == NL80211_IFTYPE_AP) ||
 576             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 577                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 578                                                 ADDR_DIRECT);
 579         else
 580                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 581                                                 ADDR_INDIRECT);
 582 }
 583
 584 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 585 {
 586         int bsscfgidx;
 587
 588         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 589                 /* bsscfgidx 1 is reserved for legacy P2P */
 590                 if (bsscfgidx == 1)
 591                         continue;
 592                 if (!drvr->iflist[bsscfgidx])
 593                         return bsscfgidx;
 594         }
 595
 596         return -ENOMEM;
 597 }
 598
 599 static void brcmf_set_vif_sta_macaddr(struct brcmf_if *ifp, u8 *mac_addr)
 600 {
 601         u8 mac_idx = ifp->drvr->sta_mac_idx;
 602
 603         /* set difference MAC address with locally administered bit */
 604         memcpy(mac_addr, ifp->mac_addr, ETH_ALEN);
 605         mac_addr[0] |= 0x02;
 606         mac_addr[3] ^= mac_idx ? 0xC0 : 0xA0;
 607         mac_idx++;
 608         mac_idx = mac_idx % 2;
 609         ifp->drvr->sta_mac_idx = mac_idx;
 610 }
 611
 612 static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
 613 {
 614         struct wl_interface_create_v1 iface_v1;
 615         struct wl_interface_create_v2 iface_v2;
 616         struct wl_interface_create_v3 iface_v3;
 617         u32 iface_create_ver;
 618         int err;
 619
 620         /* interface_create version 1 */
 621         memset(&iface_v1, 0, sizeof(iface_v1));
 622         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 623         iface_v1.flags = WL_INTERFACE_CREATE_STA |
 624                          WL_INTERFACE_MAC_USE;
 625         if (!is_zero_ether_addr(macaddr))
 626                 memcpy(iface_v1.mac_addr, macaddr, ETH_ALEN);
 627         else
 628                 brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 629
 630         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 631                                        &iface_v1,
 632                                        sizeof(iface_v1));
 633         if (err) {
 634                 brcmf_info("failed to create interface(v1), err=%d\n",
 635                            err);
 636         } else {
 637                 brcmf_dbg(INFO, "interface created(v1)\n");
 638                 return 0;
 639         }
 640
 641         /* interface_create version 2 */
 642         memset(&iface_v2, 0, sizeof(iface_v2));
 643         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 644         iface_v2.flags = WL_INTERFACE_MAC_USE;
 645         iface_v2.iftype = WL_INTERFACE_CREATE_STA;
 646         if (!is_zero_ether_addr(macaddr))
 647                 memcpy(iface_v2.mac_addr, macaddr, ETH_ALEN);
 648         else
 649                 brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 650
 651         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 652                                        &iface_v2,
 653                                        sizeof(iface_v2));
 654         if (err) {
 655                 brcmf_info("failed to create interface(v2), err=%d\n",
 656                            err);
 657         } else {
 658                 brcmf_dbg(INFO, "interface created(v2)\n");
 659                 return 0;
 660         }
 661
 662         /* interface_create version 3+ */
 663         /* get supported version from firmware side */
 664         iface_create_ver = 0;
 665         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 666                                        &iface_create_ver);
 667         if (err) {
 668                 brcmf_err("fail to get supported version, err=%d\n", err);
 669                 return -EOPNOTSUPP;
 670         }
 671
 672         switch (iface_create_ver) {
 673         case WL_INTERFACE_CREATE_VER_3:
 674                 memset(&iface_v3, 0, sizeof(iface_v3));
 675                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 676                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 677                 iface_v3.iftype = WL_INTERFACE_CREATE_STA;
 678                 if (!is_zero_ether_addr(macaddr))
 679                         memcpy(iface_v3.mac_addr, macaddr, ETH_ALEN);
 680                 else
 681                         brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 682
 683                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 684                                                &iface_v3,
 685                                                sizeof(iface_v3));
 686
 687                 if (!err)
 688                         brcmf_dbg(INFO, "interface created(v3)\n");
 689                 break;
 690         default:
 691                 brcmf_err("not support interface create(v%d)\n",
 692                           iface_create_ver);
 693                 err = -EOPNOTSUPP;
 694                 break;
 695         }
 696
 697         if (err) {
 698                 brcmf_info("station interface creation failed (%d)\n",
 699                            err);
 700                 return -EIO;
 701         }
 702
 703         return 0;
 704 }
 705
 706 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 707 {
 708         struct wl_interface_create_v1 iface_v1;
 709         struct wl_interface_create_v2 iface_v2;
 710         struct wl_interface_create_v3 iface_v3;
 711         u32 iface_create_ver;
 712         struct brcmf_pub *drvr = ifp->drvr;
 713         struct brcmf_mbss_ssid_le mbss_ssid_le;
 714         int bsscfgidx;
 715         int err;
 716
 717         /* interface_create version 1 */
 718         memset(&iface_v1, 0, sizeof(iface_v1));
 719         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 720         iface_v1.flags = WL_INTERFACE_CREATE_AP |
 721                          WL_INTERFACE_MAC_USE;
 722
 723         brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 724
 725         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 726                                        &iface_v1,
 727                                        sizeof(iface_v1));
 728         if (err) {
 729                 brcmf_info("failed to create interface(v1), err=%d\n",
 730                            err);
 731         } else {
 732                 brcmf_dbg(INFO, "interface created(v1)\n");
 733                 return 0;
 734         }
 735
 736         /* interface_create version 2 */
 737         memset(&iface_v2, 0, sizeof(iface_v2));
 738         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 739         iface_v2.flags = WL_INTERFACE_MAC_USE;
 740         iface_v2.iftype = WL_INTERFACE_CREATE_AP;
 741
 742         brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 743
 744         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 745                                        &iface_v2,
 746                                        sizeof(iface_v2));
 747         if (err) {
 748                 brcmf_info("failed to create interface(v2), err=%d\n",
 749                            err);
 750         } else {
 751                 brcmf_dbg(INFO, "interface created(v2)\n");
 752                 return 0;
 753         }
 754
 755         /* interface_create version 3+ */
 756         /* get supported version from firmware side */
 757         iface_create_ver = 0;
 758         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 759                                        &iface_create_ver);
 760         if (err) {
 761                 brcmf_err("fail to get supported version, err=%d\n", err);
 762                 return -EOPNOTSUPP;
 763         }
 764
 765         switch (iface_create_ver) {
 766         case WL_INTERFACE_CREATE_VER_3:
 767                 memset(&iface_v3, 0, sizeof(iface_v3));
 768                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 769                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 770                 iface_v3.iftype = WL_INTERFACE_CREATE_AP;
 771                 brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 772
 773                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 774                                                &iface_v3,
 775                                                sizeof(iface_v3));
 776
 777                 if (!err)
 778                         brcmf_dbg(INFO, "interface created(v3)\n");
 779                 break;
 780         default:
 781                 brcmf_err("not support interface create(v%d)\n",
 782                           iface_create_ver);
 783                 err = -EOPNOTSUPP;
 784                 break;
 785         }
 786
 787         if (err) {
 788                 brcmf_info("Does not support interface_create (%d)\n",
 789                            err);
 790                 memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 791                 bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 792                 if (bsscfgidx < 0)
 793                         return bsscfgidx;
 794
 795                 mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 796                 mbss_ssid_le.SSID_len = cpu_to_le32(5);
 797                 sprintf(mbss_ssid_le.SSID, "ssid%d", bsscfgidx);
 798
 799                 err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 800                                                 sizeof(mbss_ssid_le));
 801
 802                 if (err < 0)
 803                         bphy_err(drvr, "setting ssid failed %d\n", err);
 804         }
 805
 806         return err;
 807 }
 808
 809 /**
 810  * brcmf_apsta_add_vif() - create a new AP or STA virtual interface
 811  *
 812  * @wiphy: wiphy device of new interface.
 813  * @name: name of the new interface.
 814  * @params: contains mac address for AP or STA device.
 815  * @type: interface type.
 816  */
 817 static
 818 struct wireless_dev *brcmf_apsta_add_vif(struct wiphy *wiphy, const char *name,
 819                                          struct vif_params *params,
 820                                          enum nl80211_iftype type)
 821 {
 822         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 823         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 824         struct brcmf_pub *drvr = cfg->pub;
 825         struct brcmf_cfg80211_vif *vif;
 826         int err;
 827
 828         if (type != NL80211_IFTYPE_STATION && type != NL80211_IFTYPE_AP)
 829                 return ERR_PTR(-EINVAL);
 830
 831         if (brcmf_cfg80211_vif_event_armed(cfg))
 832                 return ERR_PTR(-EBUSY);
 833
 834         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 835
 836         vif = brcmf_alloc_vif(cfg, type);
 837         if (IS_ERR(vif))
 838                 return (struct wireless_dev *)vif;
 839
 840         brcmf_cfg80211_arm_vif_event(cfg, vif);
 841
 842         if (type == NL80211_IFTYPE_STATION)
 843                 err = brcmf_cfg80211_request_sta_if(ifp, params->macaddr);
 844         else
 845                 err = brcmf_cfg80211_request_ap_if(ifp);
 846         if (err) {
 847                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 848                 goto fail;
 849         }
 850
 851         /* wait for firmware event */
 852         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 853                                             BRCMF_VIF_EVENT_TIMEOUT);
 854         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 855         if (!err) {
 856                 bphy_err(drvr, "timeout occurred\n");
 857                 err = -EIO;
 858                 goto fail;
 859         }
 860
 861         /* interface created in firmware */
 862         ifp = vif->ifp;
 863         if (!ifp) {
 864                 bphy_err(drvr, "no if pointer provided\n");
 865                 err = -ENOENT;
 866                 goto fail;
 867         }
 868
 869         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 870         err = brcmf_net_attach(ifp, true);
 871         if (err) {
 872                 bphy_err(drvr, "Registering netdevice failed\n");
 873                 free_netdev(ifp->ndev);
 874                 goto fail;
 875         }
 876
 877         return &ifp->vif->wdev;
 878
 879 fail:
 880         brcmf_free_vif(vif);
 881         return ERR_PTR(err);
 882 }
 883
 884 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 885 {
 886         enum nl80211_iftype iftype;
 887
 888         iftype = vif->wdev.iftype;
 889         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 890 }
 891
 892 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 893 {
 894         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 895 }
 896
 897 /**
 898  * brcmf_mon_add_vif() - create monitor mode virtual interface
 899  *
 900  * @wiphy: wiphy device of new interface.
 901  * @name: name of the new interface.
 902  */
 903 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
 904                                               const char *name)
 905 {
 906         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 907         struct brcmf_cfg80211_vif *vif;
 908         struct net_device *ndev;
 909         struct brcmf_if *ifp;
 910         int err;
 911
 912         if (cfg->pub->mon_if) {
 913                 err = -EEXIST;
 914                 goto err_out;
 915         }
 916
 917         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
 918         if (IS_ERR(vif)) {
 919                 err = PTR_ERR(vif);
 920                 goto err_out;
 921         }
 922
 923         ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
 924         if (!ndev) {
 925                 err = -ENOMEM;
 926                 goto err_free_vif;
 927         }
 928         ndev->type = ARPHRD_IEEE80211_RADIOTAP;
 929         ndev->ieee80211_ptr = &vif->wdev;
 930         ndev->needs_free_netdev = true;
 931         ndev->priv_destructor = brcmf_cfg80211_free_netdev;
 932         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
 933
 934         ifp = netdev_priv(ndev);
 935         ifp->vif = vif;
 936         ifp->ndev = ndev;
 937         ifp->drvr = cfg->pub;
 938
 939         vif->ifp = ifp;
 940         vif->wdev.netdev = ndev;
 941
 942         err = brcmf_net_mon_attach(ifp);
 943         if (err) {
 944                 brcmf_err("Failed to attach %s device\n", ndev->name);
 945                 free_netdev(ndev);
 946                 goto err_free_vif;
 947         }
 948
 949         cfg->pub->mon_if = ifp;
 950
 951         return &vif->wdev;
 952
 953 err_free_vif:
 954         brcmf_free_vif(vif);
 955 err_out:
 956         return ERR_PTR(err);
 957 }
 958
 959 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 960 {
 961         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 962         struct net_device *ndev = wdev->netdev;
 963
 964         ndev->netdev_ops->ndo_stop(ndev);
 965
 966         brcmf_net_detach(ndev, true);
 967
 968         cfg->pub->mon_if = NULL;
 969
 970         return 0;
 971 }
 972
 973 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 974                                                      const char *name,
 975                                                      unsigned char name_assign_type,
 976                                                      enum nl80211_iftype type,
 977                                                      struct vif_params *params)
 978 {
 979         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 980         struct brcmf_pub *drvr = cfg->pub;
 981         struct wireless_dev *wdev;
 982         int err;
 983
 984         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 985         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 986         if (err) {
 987                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 988                 return ERR_PTR(err);
 989         }
 990         switch (type) {
 991         case NL80211_IFTYPE_ADHOC:
 992         case NL80211_IFTYPE_AP_VLAN:
 993         case NL80211_IFTYPE_WDS:
 994         case NL80211_IFTYPE_MESH_POINT:
 995                 return ERR_PTR(-EOPNOTSUPP);
 996         case NL80211_IFTYPE_MONITOR:
 997                 return brcmf_mon_add_vif(wiphy, name);
 998         case NL80211_IFTYPE_STATION:
 999         case NL80211_IFTYPE_AP:
1000                 wdev = brcmf_apsta_add_vif(wiphy, name, params, type);
1001                 break;
1002         case NL80211_IFTYPE_P2P_CLIENT:
1003         case NL80211_IFTYPE_P2P_GO:
1004         case NL80211_IFTYPE_P2P_DEVICE:
1005                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
1006                 break;
1007         case NL80211_IFTYPE_UNSPECIFIED:
1008         default:
1009                 return ERR_PTR(-EINVAL);
1010         }
1011
1012         if (IS_ERR(wdev))
1013                 bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
1014                          type, (int)PTR_ERR(wdev));
1015         else
1016                 brcmf_cfg80211_update_proto_addr_mode(wdev);
1017
1018         return wdev;
1019 }
1020
1021 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
1022 {
1023         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
1024                 brcmf_set_mpc(ifp, mpc);
1025 }
1026
1027 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
1028 {
1029         struct brcmf_pub *drvr = ifp->drvr;
1030         s32 err = 0;
1031
1032         if (check_vif_up(ifp->vif)) {
1033                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
1034                 if (err) {
1035                         bphy_err(drvr, "fail to set mpc\n");
1036                         return;
1037                 }
1038                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
1039         }
1040 }
1041
1042 static void brcmf_scan_params_v2_to_v1(struct brcmf_scan_params_v2_le *params_v2_le,
1043                                        struct brcmf_scan_params_le *params_le)
1044 {
1045         size_t params_size;
1046         u32 ch;
1047         int n_channels, n_ssids;
1048
1049         memcpy(&params_le->ssid_le, &params_v2_le->ssid_le,
1050                sizeof(params_le->ssid_le));
1051         memcpy(&params_le->bssid, &params_v2_le->bssid,
1052                sizeof(params_le->bssid));
1053
1054         params_le->bss_type = params_v2_le->bss_type;
1055         params_le->scan_type = le32_to_cpu(params_v2_le->scan_type);
1056         params_le->nprobes = params_v2_le->nprobes;
1057         params_le->active_time = params_v2_le->active_time;
1058         params_le->passive_time = params_v2_le->passive_time;
1059         params_le->home_time = params_v2_le->home_time;
1060         params_le->channel_num = params_v2_le->channel_num;
1061
1062         ch = le32_to_cpu(params_v2_le->channel_num);
1063         n_channels = ch & BRCMF_SCAN_PARAMS_COUNT_MASK;
1064         n_ssids = ch >> BRCMF_SCAN_PARAMS_NSSID_SHIFT;
1065
1066         params_size = sizeof(u16) * n_channels;
1067         if (n_ssids > 0) {
1068                 params_size = roundup(params_size, sizeof(u32));
1069                 params_size += sizeof(struct brcmf_ssid_le) * n_ssids;
1070         }
1071
1072         memcpy(&params_le->channel_list[0],
1073                &params_v2_le->channel_list[0], params_size);
1074 }
1075
1076 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1077                              struct brcmf_scan_params_v2_le *params_le,
1078                              struct cfg80211_scan_request *request)
1079 {
1080         u32 n_ssids;
1081         u32 n_channels;
1082         s32 i;
1083         s32 offset;
1084         u16 chanspec;
1085         char *ptr;
1086         int length;
1087         struct brcmf_ssid_le ssid_le;
1088
1089         eth_broadcast_addr(params_le->bssid);
1090
1091         length = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1092
1093         params_le->version = cpu_to_le16(BRCMF_SCAN_PARAMS_VERSION_V2);
1094         params_le->bss_type = DOT11_BSSTYPE_ANY;
1095         params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_ACTIVE);
1096         params_le->channel_num = 0;
1097         params_le->nprobes = cpu_to_le32(-1);
1098         params_le->active_time = cpu_to_le32(-1);
1099         params_le->passive_time = cpu_to_le32(-1);
1100         params_le->home_time = cpu_to_le32(-1);
1101         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1102
1103         /* Scan abort */
1104         if (!request) {
1105                 length += sizeof(u16);
1106                 params_le->channel_num = cpu_to_le32(1);
1107                 params_le->channel_list[0] = cpu_to_le16(-1);
1108                 params_le->length = cpu_to_le16(length);
1109                 return;
1110         }
1111
1112         n_ssids = request->n_ssids;
1113         n_channels = request->n_channels;
1114
1115         /* Copy channel array if applicable */
1116         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1117                   n_channels);
1118         if (n_channels > 0) {
1119                 length += roundup(sizeof(u16) * n_channels, sizeof(u32));
1120                 for (i = 0; i < n_channels; i++) {
1121                         chanspec = channel_to_chanspec(&cfg->d11inf,
1122                                                        request->channels[i]);
1123                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1124                                   request->channels[i]->hw_value, chanspec);
1125                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1126                 }
1127         } else {
1128                 brcmf_dbg(SCAN, "Scanning all channels\n");
1129         }
1130
1131         /* Copy ssid array if applicable */
1132         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1133         if (n_ssids > 0) {
1134                 offset = offsetof(struct brcmf_scan_params_v2_le, channel_list) +
1135                                 n_channels * sizeof(u16);
1136                 offset = roundup(offset, sizeof(u32));
1137                 length += sizeof(ssid_le) * n_ssids,
1138                 ptr = (char *)params_le + offset;
1139                 for (i = 0; i < n_ssids; i++) {
1140                         memset(&ssid_le, 0, sizeof(ssid_le));
1141                         ssid_le.SSID_len =
1142                                         cpu_to_le32(request->ssids[i].ssid_len);
1143                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1144                                request->ssids[i].ssid_len);
1145                         if (!ssid_le.SSID_len)
1146                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1147                         else
1148                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1149                                           i, ssid_le.SSID, ssid_le.SSID_len);
1150                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1151                         ptr += sizeof(ssid_le);
1152                 }
1153         } else {
1154                 brcmf_dbg(SCAN, "Performing passive scan\n");
1155                 params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_PASSIVE);
1156         }
1157         params_le->length = cpu_to_le16(length);
1158         /* Adding mask to channel numbers */
1159         params_le->channel_num =
1160                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1161                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1162 }
1163
1164 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
1165                                 struct brcmf_if *ifp, bool aborted,
1166                                 bool fw_abort)
1167 {
1168         struct brcmf_pub *drvr = cfg->pub;
1169         struct brcmf_scan_params_v2_le params_v2_le;
1170         struct cfg80211_scan_request *scan_request;
1171         u64 reqid;
1172         u32 bucket;
1173         s32 err = 0;
1174
1175         brcmf_dbg(SCAN, "Enter\n");
1176
1177         /* clear scan request, because the FW abort can cause a second call */
1178         /* to this functon and might cause a double cfg80211_scan_done      */
1179         scan_request = cfg->scan_request;
1180         cfg->scan_request = NULL;
1181
1182         if (timer_pending(&cfg->escan_timeout))
1183                 del_timer_sync(&cfg->escan_timeout);
1184
1185         if (fw_abort) {
1186                 /* Do a scan abort to stop the driver's scan engine */
1187                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
1188
1189                 brcmf_escan_prep(cfg, &params_v2_le, NULL);
1190
1191                 /* E-Scan (or anyother type) can be aborted by SCAN */
1192                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1193                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1194                                                      &params_v2_le,
1195                                                      sizeof(params_v2_le));
1196                 } else {
1197                         struct brcmf_scan_params_le params_le;
1198
1199                         brcmf_scan_params_v2_to_v1(&params_v2_le, &params_le);
1200                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1201                                                      &params_le,
1202                                                      sizeof(params_le));
1203                 }
1204
1205                 if (err)
1206                         bphy_err(drvr, "Scan abort failed\n");
1207         }
1208
1209         brcmf_scan_config_mpc(ifp, 1);
1210
1211         /*
1212          * e-scan can be initiated internally
1213          * which takes precedence.
1214          */
1215         if (cfg->int_escan_map) {
1216                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
1217                           cfg->int_escan_map);
1218                 while (cfg->int_escan_map) {
1219                         bucket = __ffs(cfg->int_escan_map);
1220                         cfg->int_escan_map &= ~BIT(bucket);
1221                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
1222                                                                bucket);
1223                         if (!aborted) {
1224                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
1225                                           reqid);
1226                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
1227                                                             reqid);
1228                         }
1229                 }
1230         } else if (scan_request) {
1231                 struct cfg80211_scan_info info = {
1232                         .aborted = aborted,
1233                 };
1234
1235                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
1236                           aborted ? "Aborted" : "Done");
1237                 cfg80211_scan_done(scan_request, &info);
1238         }
1239         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
1240                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
1241
1242         return err;
1243 }
1244
1245 static int brcmf_cfg80211_del_apsta_iface(struct wiphy *wiphy,
1246                                           struct wireless_dev *wdev)
1247 {
1248         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1249         struct net_device *ndev = wdev->netdev;
1250         struct brcmf_if *ifp = netdev_priv(ndev);
1251         struct brcmf_pub *drvr = cfg->pub;
1252         int ret;
1253         int err;
1254
1255         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
1256
1257         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
1258         if (err) {
1259                 bphy_err(drvr, "interface_remove failed %d\n", err);
1260                 goto err_unarm;
1261         }
1262
1263         /* wait for firmware event */
1264         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
1265                                             BRCMF_VIF_EVENT_TIMEOUT);
1266         if (!ret) {
1267                 bphy_err(drvr, "timeout occurred\n");
1268                 err = -EIO;
1269                 goto err_unarm;
1270         }
1271
1272         brcmf_remove_interface(ifp, true);
1273
1274 err_unarm:
1275         brcmf_cfg80211_arm_vif_event(cfg, NULL);
1276         return err;
1277 }
1278
1279 static
1280 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
1281 {
1282         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1283         struct net_device *ndev = wdev->netdev;
1284
1285         if (ndev && ndev == cfg_to_ndev(cfg))
1286                 return -ENOTSUPP;
1287
1288         /* vif event pending in firmware */
1289         if (brcmf_cfg80211_vif_event_armed(cfg))
1290                 return -EBUSY;
1291
1292         if (ndev) {
1293                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
1294                     cfg->escan_info.ifp == netdev_priv(ndev))
1295                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
1296                                                     true, true);
1297
1298                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
1299         }
1300
1301         switch (wdev->iftype) {
1302         case NL80211_IFTYPE_ADHOC:
1303         case NL80211_IFTYPE_AP_VLAN:
1304         case NL80211_IFTYPE_WDS:
1305         case NL80211_IFTYPE_MESH_POINT:
1306                 return -EOPNOTSUPP;
1307         case NL80211_IFTYPE_MONITOR:
1308                 return brcmf_mon_del_vif(wiphy, wdev);
1309         case NL80211_IFTYPE_STATION:
1310         case NL80211_IFTYPE_AP:
1311                 return brcmf_cfg80211_del_apsta_iface(wiphy, wdev);
1312         case NL80211_IFTYPE_P2P_CLIENT:
1313         case NL80211_IFTYPE_P2P_GO:
1314         case NL80211_IFTYPE_P2P_DEVICE:
1315                 return brcmf_p2p_del_vif(wiphy, wdev);
1316         case NL80211_IFTYPE_UNSPECIFIED:
1317         default:
1318                 return -EINVAL;
1319         }
1320         return -EOPNOTSUPP;
1321 }
1322
1323 static s32
1324 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
1325                          enum nl80211_iftype type,
1326                          struct vif_params *params)
1327 {
1328         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1329         struct brcmf_if *ifp = netdev_priv(ndev);
1330         struct brcmf_cfg80211_vif *vif = ifp->vif;
1331         struct brcmf_pub *drvr = cfg->pub;
1332         s32 infra = 0;
1333         s32 ap = 0;
1334         s32 err = 0;
1335
1336         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
1337                   type);
1338
1339         /* WAR: There are a number of p2p interface related problems which
1340          * need to be handled initially (before doing the validate).
1341          * wpa_supplicant tends to do iface changes on p2p device/client/go
1342          * which are not always possible/allowed. However we need to return
1343          * OK otherwise the wpa_supplicant wont start. The situation differs
1344          * on configuration and setup (p2pon=1 module param). The first check
1345          * is to see if the request is a change to station for p2p iface.
1346          */
1347         if ((type == NL80211_IFTYPE_STATION) &&
1348             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
1349              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
1350              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
1351                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
1352                 /* Now depending on whether module param p2pon=1 was used the
1353                  * response needs to be either 0 or EOPNOTSUPP. The reason is
1354                  * that if p2pon=1 is used, but a newer supplicant is used then
1355                  * we should return an error, as this combination wont work.
1356                  * In other situations 0 is returned and supplicant will start
1357                  * normally. It will give a trace in cfg80211, but it is the
1358                  * only way to get it working. Unfortunately this will result
1359                  * in situation where we wont support new supplicant in
1360                  * combination with module param p2pon=1, but that is the way
1361                  * it is. If the user tries this then unloading of driver might
1362                  * fail/lock.
1363                  */
1364                 if (cfg->p2p.p2pdev_dynamically)
1365                         return -EOPNOTSUPP;
1366                 else
1367                         return 0;
1368         }
1369         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
1370         if (err) {
1371                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
1372                 return err;
1373         }
1374         switch (type) {
1375         case NL80211_IFTYPE_MONITOR:
1376         case NL80211_IFTYPE_WDS:
1377                 bphy_err(drvr, "type (%d) : currently we do not support this type\n",
1378                          type);
1379                 return -EOPNOTSUPP;
1380         case NL80211_IFTYPE_ADHOC:
1381                 infra = 0;
1382                 break;
1383         case NL80211_IFTYPE_STATION:
1384                 infra = 1;
1385                 break;
1386         case NL80211_IFTYPE_AP:
1387         case NL80211_IFTYPE_P2P_GO:
1388                 ap = 1;
1389                 break;
1390         default:
1391                 err = -EINVAL;
1392                 goto done;
1393         }
1394
1395         if (ap) {
1396                 if (type == NL80211_IFTYPE_P2P_GO) {
1397                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
1398                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1399                 }
1400                 if (!err) {
1401                         brcmf_dbg(INFO, "IF Type = AP\n");
1402                 }
1403         } else {
1404                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1405                 if (err) {
1406                         bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1407                         err = -EAGAIN;
1408                         goto done;
1409                 }
1410                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1411                           "Adhoc" : "Infra");
1412         }
1413         ndev->ieee80211_ptr->iftype = type;
1414
1415         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1416
1417 done:
1418         brcmf_dbg(TRACE, "Exit\n");
1419
1420         return err;
1421 }
1422
1423 static s32
1424 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1425                 struct cfg80211_scan_request *request)
1426 {
1427         struct brcmf_pub *drvr = cfg->pub;
1428         s32 params_size = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE +
1429                           offsetof(struct brcmf_escan_params_le, params_v2_le);
1430         struct brcmf_escan_params_le *params;
1431         s32 err = 0;
1432
1433         brcmf_dbg(SCAN, "E-SCAN START\n");
1434
1435         if (request != NULL) {
1436                 /* Allocate space for populating ssids in struct */
1437                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1438
1439                 /* Allocate space for populating ssids in struct */
1440                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1441         }
1442
1443         params = kzalloc(params_size, GFP_KERNEL);
1444         if (!params) {
1445                 err = -ENOMEM;
1446                 goto exit;
1447         }
1448         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1449         brcmf_escan_prep(cfg, &params->params_v2_le, request);
1450
1451         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
1452
1453         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1454                 struct brcmf_escan_params_le *params_v1;
1455
1456                 params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1457                 params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
1458                 params_v1 = kzalloc(params_size, GFP_KERNEL);
1459                 if (!params_v1) {
1460                         err = -ENOMEM;
1461                         goto exit_params;
1462                 }
1463                 params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1464                 brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
1465                 kfree(params);
1466                 params = params_v1;
1467         }
1468
1469         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1470         params->sync_id = cpu_to_le16(0x1234);
1471
1472         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1473         if (err) {
1474                 if (err == -EBUSY)
1475                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1476                 else
1477                         bphy_err(drvr, "error (%d)\n", err);
1478         }
1479
1480 exit_params:
1481         kfree(params);
1482 exit:
1483         return err;
1484 }
1485
1486 static s32
1487 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1488 {
1489         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1490         s32 err;
1491         struct brcmf_scan_results *results;
1492         struct escan_info *escan = &cfg->escan_info;
1493
1494         brcmf_dbg(SCAN, "Enter\n");
1495         escan->ifp = ifp;
1496         escan->wiphy = cfg->wiphy;
1497         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1498
1499         brcmf_scan_config_mpc(ifp, 0);
1500         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1501         results->version = 0;
1502         results->count = 0;
1503         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1504
1505         err = escan->run(cfg, ifp, request);
1506         if (err)
1507                 brcmf_scan_config_mpc(ifp, 1);
1508         return err;
1509 }
1510
1511 static s32
1512 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1513 {
1514         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1515         struct brcmf_pub *drvr = cfg->pub;
1516         struct brcmf_cfg80211_vif *vif;
1517         s32 err = 0;
1518
1519         brcmf_dbg(TRACE, "Enter\n");
1520         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1521         if (!check_vif_up(vif))
1522                 return -EIO;
1523
1524         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1525                 bphy_err(drvr, "Scanning already: status (%lu)\n",
1526                          cfg->scan_status);
1527                 return -EAGAIN;
1528         }
1529         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1530                 bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1531                          cfg->scan_status);
1532                 return -EAGAIN;
1533         }
1534         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1535                 bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1536                          cfg->scan_status);
1537                 return -EAGAIN;
1538         }
1539         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1540                 bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1541                 return -EAGAIN;
1542         }
1543
1544         /* If scan req comes for p2p0, send it over primary I/F */
1545         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1546                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1547
1548         brcmf_dbg(SCAN, "START ESCAN\n");
1549
1550         cfg->scan_request = request;
1551         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1552
1553         cfg->escan_info.run = brcmf_run_escan;
1554         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1555         if (err)
1556                 goto scan_out;
1557
1558         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1559                                     request->ie, request->ie_len);
1560         if (err)
1561                 goto scan_out;
1562
1563         err = brcmf_do_escan(vif->ifp, request);
1564         if (err)
1565                 goto scan_out;
1566
1567         /* Arm scan timeout timer */
1568         mod_timer(&cfg->escan_timeout,
1569                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1570
1571         return 0;
1572
1573 scan_out:
1574         bphy_err(drvr, "scan error (%d)\n", err);
1575         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1576         cfg->scan_request = NULL;
1577         return err;
1578 }
1579
1580 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1581 {
1582         struct brcmf_if *ifp = netdev_priv(ndev);
1583         struct brcmf_pub *drvr = ifp->drvr;
1584         s32 err = 0;
1585
1586         err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1587         if (err)
1588                 bphy_err(drvr, "Error (%d)\n", err);
1589
1590         return err;
1591 }
1592
1593 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1594 {
1595         struct brcmf_if *ifp = netdev_priv(ndev);
1596         struct brcmf_pub *drvr = ifp->drvr;
1597         s32 err = 0;
1598
1599         err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1600                                       frag_threshold);
1601         if (err)
1602                 bphy_err(drvr, "Error (%d)\n", err);
1603
1604         return err;
1605 }
1606
1607 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1608 {
1609         struct brcmf_if *ifp = netdev_priv(ndev);
1610         struct brcmf_pub *drvr = ifp->drvr;
1611         s32 err = 0;
1612         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1613
1614         err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1615         if (err) {
1616                 bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1617                 return err;
1618         }
1619         return err;
1620 }
1621
1622 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1623 {
1624         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1625         struct net_device *ndev = cfg_to_ndev(cfg);
1626         struct brcmf_if *ifp = netdev_priv(ndev);
1627         s32 err = 0;
1628
1629         brcmf_dbg(TRACE, "Enter\n");
1630         if (!check_vif_up(ifp->vif))
1631                 return -EIO;
1632
1633         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1634             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1635                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1636                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1637                 if (!err)
1638                         goto done;
1639         }
1640         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1641             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1642                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1643                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1644                 if (!err)
1645                         goto done;
1646         }
1647         if (changed & WIPHY_PARAM_RETRY_LONG
1648             && (cfg->conf->retry_long != wiphy->retry_long)) {
1649                 cfg->conf->retry_long = wiphy->retry_long;
1650                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1651                 if (!err)
1652                         goto done;
1653         }
1654         if (changed & WIPHY_PARAM_RETRY_SHORT
1655             && (cfg->conf->retry_short != wiphy->retry_short)) {
1656                 cfg->conf->retry_short = wiphy->retry_short;
1657                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1658                 if (!err)
1659                         goto done;
1660         }
1661
1662 done:
1663         brcmf_dbg(TRACE, "Exit\n");
1664         return err;
1665 }
1666
1667 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1668 {
1669         memset(prof, 0, sizeof(*prof));
1670 }
1671
1672 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1673 {
1674         u16 reason;
1675
1676         switch (e->event_code) {
1677         case BRCMF_E_DEAUTH:
1678         case BRCMF_E_DEAUTH_IND:
1679         case BRCMF_E_DISASSOC_IND:
1680                 reason = e->reason;
1681                 break;
1682         case BRCMF_E_LINK:
1683         default:
1684                 reason = 0;
1685                 break;
1686         }
1687         return reason;
1688 }
1689
1690 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1691 {
1692         struct brcmf_pub *drvr = ifp->drvr;
1693         struct brcmf_wsec_pmk_le pmk;
1694         int err;
1695
1696         memset(&pmk, 0, sizeof(pmk));
1697
1698         /* pass pmk directly */
1699         pmk.key_len = cpu_to_le16(pmk_len);
1700         pmk.flags = cpu_to_le16(0);
1701         memcpy(pmk.key, pmk_data, pmk_len);
1702
1703         /* store psk in firmware */
1704         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1705                                      &pmk, sizeof(pmk));
1706         if (err < 0)
1707                 bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1708                          pmk_len);
1709
1710         return err;
1711 }
1712
1713 static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
1714                                   u16 pwd_len)
1715 {
1716         struct brcmf_pub *drvr = ifp->drvr;
1717         struct brcmf_wsec_sae_pwd_le sae_pwd;
1718         int err;
1719
1720         if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
1721                 bphy_err(drvr, "sae_password must be less than %d\n",
1722                          BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
1723                 return -EINVAL;
1724         }
1725
1726         sae_pwd.key_len = cpu_to_le16(pwd_len);
1727         memcpy(sae_pwd.key, pwd_data, pwd_len);
1728
1729         err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
1730                                        sizeof(sae_pwd));
1731         if (err < 0)
1732                 bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
1733                          pwd_len);
1734
1735         return err;
1736 }
1737
1738 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1739                             bool locally_generated)
1740 {
1741         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1742         struct brcmf_pub *drvr = cfg->pub;
1743         bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1744         s32 err = 0;
1745
1746         brcmf_dbg(TRACE, "Enter\n");
1747
1748         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1749                 if (bus_up) {
1750                         brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1751                         err = brcmf_fil_cmd_data_set(vif->ifp,
1752                                                      BRCMF_C_DISASSOC, NULL, 0);
1753                         if (err)
1754                                 bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1755                                          err);
1756                 }
1757
1758                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1759                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1760                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1761                                               locally_generated, GFP_KERNEL);
1762         }
1763         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1764         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
1765         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
1766         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1767         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1768         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1769                 if (bus_up)
1770                         brcmf_set_pmk(vif->ifp, NULL, 0);
1771                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1772         }
1773         brcmf_dbg(TRACE, "Exit\n");
1774 }
1775
1776 static s32
1777 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1778                       struct cfg80211_ibss_params *params)
1779 {
1780         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1781         struct brcmf_if *ifp = netdev_priv(ndev);
1782         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1783         struct brcmf_pub *drvr = cfg->pub;
1784         struct brcmf_join_params join_params;
1785         size_t join_params_size = 0;
1786         s32 err = 0;
1787         s32 wsec = 0;
1788         s32 bcnprd;
1789         u16 chanspec;
1790         u32 ssid_len;
1791
1792         brcmf_dbg(TRACE, "Enter\n");
1793         if (!check_vif_up(ifp->vif))
1794                 return -EIO;
1795
1796         if (params->ssid)
1797                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1798         else {
1799                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1800                 return -EOPNOTSUPP;
1801         }
1802
1803         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1804
1805         if (params->bssid)
1806                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1807         else
1808                 brcmf_dbg(CONN, "No BSSID specified\n");
1809
1810         if (params->chandef.chan)
1811                 brcmf_dbg(CONN, "channel: %d\n",
1812                           params->chandef.chan->center_freq);
1813         else
1814                 brcmf_dbg(CONN, "no channel specified\n");
1815
1816         if (params->channel_fixed)
1817                 brcmf_dbg(CONN, "fixed channel required\n");
1818         else
1819                 brcmf_dbg(CONN, "no fixed channel required\n");
1820
1821         if (params->ie && params->ie_len)
1822                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1823         else
1824                 brcmf_dbg(CONN, "no ie specified\n");
1825
1826         if (params->beacon_interval)
1827                 brcmf_dbg(CONN, "beacon interval: %d\n",
1828                           params->beacon_interval);
1829         else
1830                 brcmf_dbg(CONN, "no beacon interval specified\n");
1831
1832         if (params->basic_rates)
1833                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1834         else
1835                 brcmf_dbg(CONN, "no basic rates specified\n");
1836
1837         if (params->privacy)
1838                 brcmf_dbg(CONN, "privacy required\n");
1839         else
1840                 brcmf_dbg(CONN, "no privacy required\n");
1841
1842         /* Configure Privacy for starter */
1843         if (params->privacy)
1844                 wsec |= WEP_ENABLED;
1845
1846         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1847         if (err) {
1848                 bphy_err(drvr, "wsec failed (%d)\n", err);
1849                 goto done;
1850         }
1851
1852         /* Configure Beacon Interval for starter */
1853         if (params->beacon_interval)
1854                 bcnprd = params->beacon_interval;
1855         else
1856                 bcnprd = 100;
1857
1858         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1859         if (err) {
1860                 bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1861                 goto done;
1862         }
1863
1864         /* Configure required join parameter */
1865         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1866
1867         /* SSID */
1868         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1869         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1870         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1871         join_params_size = sizeof(join_params.ssid_le);
1872
1873         /* BSSID */
1874         if (params->bssid) {
1875                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1876                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1877                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1878         } else {
1879                 eth_broadcast_addr(join_params.params_le.bssid);
1880                 eth_zero_addr(profile->bssid);
1881         }
1882
1883         /* Channel */
1884         if (params->chandef.chan) {
1885                 u32 target_channel;
1886
1887                 cfg->channel =
1888                         ieee80211_frequency_to_channel(
1889                                 params->chandef.chan->center_freq);
1890                 if (params->channel_fixed) {
1891                         /* adding chanspec */
1892                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1893                                                        &params->chandef);
1894                         join_params.params_le.chanspec_list[0] =
1895                                 cpu_to_le16(chanspec);
1896                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1897                         join_params_size += sizeof(join_params.params_le);
1898                 }
1899
1900                 /* set channel for starter */
1901                 target_channel = cfg->channel;
1902                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1903                                             target_channel);
1904                 if (err) {
1905                         bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1906                         goto done;
1907                 }
1908         } else
1909                 cfg->channel = 0;
1910
1911         cfg->ibss_starter = false;
1912
1913
1914         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1915                                      &join_params, join_params_size);
1916         if (err) {
1917                 bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1918                 goto done;
1919         }
1920
1921 done:
1922         if (err)
1923                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1924         brcmf_dbg(TRACE, "Exit\n");
1925         return err;
1926 }
1927
1928 static s32
1929 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1930 {
1931         struct brcmf_if *ifp = netdev_priv(ndev);
1932
1933         brcmf_dbg(TRACE, "Enter\n");
1934         if (!check_vif_up(ifp->vif)) {
1935                 /* When driver is being unloaded, it can end up here. If an
1936                  * error is returned then later on a debug trace in the wireless
1937                  * core module will be printed. To avoid this 0 is returned.
1938                  */
1939                 return 0;
1940         }
1941
1942         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1943         brcmf_net_setcarrier(ifp, false);
1944
1945         brcmf_dbg(TRACE, "Exit\n");
1946
1947         return 0;
1948 }
1949
1950 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1951                                  struct cfg80211_connect_params *sme)
1952 {
1953         struct brcmf_if *ifp = netdev_priv(ndev);
1954         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1955         struct brcmf_pub *drvr = ifp->drvr;
1956         struct brcmf_cfg80211_security *sec;
1957         s32 val = 0;
1958         s32 err = 0;
1959
1960         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1961                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1962         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1963                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1964         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
1965                 val = WPA3_AUTH_SAE_PSK;
1966         else
1967                 val = WPA_AUTH_DISABLED;
1968         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1969         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1970         if (err) {
1971                 bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1972                 return err;
1973         }
1974         sec = &profile->sec;
1975         sec->wpa_versions = sme->crypto.wpa_versions;
1976         return err;
1977 }
1978
1979 static s32 brcmf_set_auth_type(struct net_device *ndev,
1980                                struct cfg80211_connect_params *sme)
1981 {
1982         struct brcmf_if *ifp = netdev_priv(ndev);
1983         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1984         struct brcmf_pub *drvr = ifp->drvr;
1985         struct brcmf_cfg80211_security *sec;
1986         s32 val = 0;
1987         s32 err = 0;
1988
1989         switch (sme->auth_type) {
1990         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1991                 val = 0;
1992                 brcmf_dbg(CONN, "open system\n");
1993                 break;
1994         case NL80211_AUTHTYPE_SHARED_KEY:
1995                 val = 1;
1996                 brcmf_dbg(CONN, "shared key\n");
1997                 break;
1998         case NL80211_AUTHTYPE_SAE:
1999                 val = 3;
2000                 brcmf_dbg(CONN, "SAE authentication\n");
2001                 break;
2002         default:
2003                 val = 2;
2004                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
2005                 break;
2006         }
2007
2008         err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2009         if (err) {
2010                 bphy_err(drvr, "set auth failed (%d)\n", err);
2011                 return err;
2012         }
2013         sec = &profile->sec;
2014         sec->auth_type = sme->auth_type;
2015         return err;
2016 }
2017
2018 static s32
2019 brcmf_set_wsec_mode(struct net_device *ndev,
2020                     struct cfg80211_connect_params *sme)
2021 {
2022         struct brcmf_if *ifp = netdev_priv(ndev);
2023         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2024         struct brcmf_pub *drvr = ifp->drvr;
2025         struct brcmf_cfg80211_security *sec;
2026         s32 pval = 0;
2027         s32 gval = 0;
2028         s32 wsec;
2029         s32 err = 0;
2030
2031         if (sme->crypto.n_ciphers_pairwise) {
2032                 switch (sme->crypto.ciphers_pairwise[0]) {
2033                 case WLAN_CIPHER_SUITE_WEP40:
2034                 case WLAN_CIPHER_SUITE_WEP104:
2035                         pval = WEP_ENABLED;
2036                         break;
2037                 case WLAN_CIPHER_SUITE_TKIP:
2038                         pval = TKIP_ENABLED;
2039                         break;
2040                 case WLAN_CIPHER_SUITE_CCMP:
2041                         pval = AES_ENABLED;
2042                         break;
2043                 case WLAN_CIPHER_SUITE_AES_CMAC:
2044                         pval = AES_ENABLED;
2045                         break;
2046                 default:
2047                         bphy_err(drvr, "invalid cipher pairwise (%d)\n",
2048                                  sme->crypto.ciphers_pairwise[0]);
2049                         return -EINVAL;
2050                 }
2051         }
2052         if (sme->crypto.cipher_group) {
2053                 switch (sme->crypto.cipher_group) {
2054                 case WLAN_CIPHER_SUITE_WEP40:
2055                 case WLAN_CIPHER_SUITE_WEP104:
2056                         gval = WEP_ENABLED;
2057                         break;
2058                 case WLAN_CIPHER_SUITE_TKIP:
2059                         gval = TKIP_ENABLED;
2060                         break;
2061                 case WLAN_CIPHER_SUITE_CCMP:
2062                         gval = AES_ENABLED;
2063                         break;
2064                 case WLAN_CIPHER_SUITE_AES_CMAC:
2065                         gval = AES_ENABLED;
2066                         break;
2067                 default:
2068                         bphy_err(drvr, "invalid cipher group (%d)\n",
2069                                  sme->crypto.cipher_group);
2070                         return -EINVAL;
2071                 }
2072         }
2073
2074         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
2075         /* In case of privacy, but no security and WPS then simulate */
2076         /* setting AES. WPS-2.0 allows no security                   */
2077         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
2078             sme->privacy)
2079                 pval = AES_ENABLED;
2080
2081         wsec = pval | gval;
2082         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2083         if (err) {
2084                 bphy_err(drvr, "error (%d)\n", err);
2085                 return err;
2086         }
2087
2088         sec = &profile->sec;
2089         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
2090         sec->cipher_group = sme->crypto.cipher_group;
2091
2092         return err;
2093 }
2094
2095 static s32
2096 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
2097 {
2098         struct brcmf_if *ifp = netdev_priv(ndev);
2099         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2100         struct brcmf_pub *drvr = ifp->drvr;
2101         s32 val;
2102         s32 err;
2103         const struct brcmf_tlv *rsn_ie;
2104         const u8 *ie;
2105         u32 ie_len;
2106         u32 offset;
2107         u16 rsn_cap;
2108         u32 mfp;
2109         u16 count;
2110
2111         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2112         profile->is_ft = false;
2113
2114         if (!sme->crypto.n_akm_suites)
2115                 return 0;
2116
2117         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
2118         if (err) {
2119                 bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
2120                 return err;
2121         }
2122         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
2123                 switch (sme->crypto.akm_suites[0]) {
2124                 case WLAN_AKM_SUITE_8021X:
2125                         val = WPA_AUTH_UNSPECIFIED;
2126                         if (sme->want_1x)
2127                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2128                         break;
2129                 case WLAN_AKM_SUITE_PSK:
2130                         val = WPA_AUTH_PSK;
2131                         break;
2132                 default:
2133                         bphy_err(drvr, "invalid akm suite (%d)\n",
2134                                  sme->crypto.akm_suites[0]);
2135                         return -EINVAL;
2136                 }
2137         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
2138                 switch (sme->crypto.akm_suites[0]) {
2139                 case WLAN_AKM_SUITE_8021X:
2140                         val = WPA2_AUTH_UNSPECIFIED;
2141                         if (sme->want_1x)
2142                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2143                         break;
2144                 case WLAN_AKM_SUITE_8021X_SHA256:
2145                         val = WPA2_AUTH_1X_SHA256;
2146                         if (sme->want_1x)
2147                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2148                         break;
2149                 case WLAN_AKM_SUITE_PSK_SHA256:
2150                         val = WPA2_AUTH_PSK_SHA256;
2151                         break;
2152                 case WLAN_AKM_SUITE_PSK:
2153                         val = WPA2_AUTH_PSK;
2154                         break;
2155                 case WLAN_AKM_SUITE_FT_8021X:
2156                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
2157                         profile->is_ft = true;
2158                         if (sme->want_1x)
2159                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2160                         break;
2161                 case WLAN_AKM_SUITE_FT_PSK:
2162                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
2163                         profile->is_ft = true;
2164                         break;
2165                 default:
2166                         bphy_err(drvr, "invalid akm suite (%d)\n",
2167                                  sme->crypto.akm_suites[0]);
2168                         return -EINVAL;
2169                 }
2170         } else if (val & WPA3_AUTH_SAE_PSK) {
2171                 switch (sme->crypto.akm_suites[0]) {
2172                 case WLAN_AKM_SUITE_SAE:
2173                         val = WPA3_AUTH_SAE_PSK;
2174                         if (sme->crypto.sae_pwd) {
2175                                 brcmf_dbg(INFO, "using SAE offload\n");
2176                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2177                         }
2178                         break;
2179                 case WLAN_AKM_SUITE_FT_OVER_SAE:
2180                         val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
2181                         profile->is_ft = true;
2182                         if (sme->crypto.sae_pwd) {
2183                                 brcmf_dbg(INFO, "using SAE offload\n");
2184                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2185                         }
2186                         break;
2187                 default:
2188                         bphy_err(drvr, "invalid akm suite (%d)\n",
2189                                  sme->crypto.akm_suites[0]);
2190                         return -EINVAL;
2191                 }
2192         }
2193
2194         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
2195                 brcmf_dbg(INFO, "using 1X offload\n");
2196
2197         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2198                 goto skip_mfp_config;
2199         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
2200          * IE will not be verified, just a quick search for MFP config
2201          */
2202         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
2203                                   WLAN_EID_RSN);
2204         if (!rsn_ie)
2205                 goto skip_mfp_config;
2206         ie = (const u8 *)rsn_ie;
2207         ie_len = rsn_ie->len + TLV_HDR_LEN;
2208         /* Skip unicast suite */
2209         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
2210         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2211                 goto skip_mfp_config;
2212         /* Skip multicast suite */
2213         count = ie[offset] + (ie[offset + 1] << 8);
2214         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2215         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2216                 goto skip_mfp_config;
2217         /* Skip auth key management suite(s) */
2218         count = ie[offset] + (ie[offset + 1] << 8);
2219         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2220         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
2221                 goto skip_mfp_config;
2222         /* Ready to read capabilities */
2223         mfp = BRCMF_MFP_NONE;
2224         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
2225         if (rsn_cap & RSN_CAP_MFPR_MASK)
2226                 mfp = BRCMF_MFP_REQUIRED;
2227         else if (rsn_cap & RSN_CAP_MFPC_MASK)
2228                 mfp = BRCMF_MFP_CAPABLE;
2229         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
2230
2231 skip_mfp_config:
2232         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
2233         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
2234         if (err) {
2235                 bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
2236                 return err;
2237         }
2238
2239         return err;
2240 }
2241
2242 static s32
2243 brcmf_set_sharedkey(struct net_device *ndev,
2244                     struct cfg80211_connect_params *sme)
2245 {
2246         struct brcmf_if *ifp = netdev_priv(ndev);
2247         struct brcmf_pub *drvr = ifp->drvr;
2248         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2249         struct brcmf_cfg80211_security *sec;
2250         struct brcmf_wsec_key key;
2251         s32 val;
2252         s32 err = 0;
2253
2254         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
2255
2256         if (sme->key_len == 0)
2257                 return 0;
2258
2259         sec = &profile->sec;
2260         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
2261                   sec->wpa_versions, sec->cipher_pairwise);
2262
2263         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
2264                                  NL80211_WPA_VERSION_3))
2265                 return 0;
2266
2267         if (!(sec->cipher_pairwise &
2268             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
2269                 return 0;
2270
2271         memset(&key, 0, sizeof(key));
2272         key.len = (u32) sme->key_len;
2273         key.index = (u32) sme->key_idx;
2274         if (key.len > sizeof(key.data)) {
2275                 bphy_err(drvr, "Too long key length (%u)\n", key.len);
2276                 return -EINVAL;
2277         }
2278         memcpy(key.data, sme->key, key.len);
2279         key.flags = BRCMF_PRIMARY_KEY;
2280         switch (sec->cipher_pairwise) {
2281         case WLAN_CIPHER_SUITE_WEP40:
2282                 key.algo = CRYPTO_ALGO_WEP1;
2283                 break;
2284         case WLAN_CIPHER_SUITE_WEP104:
2285                 key.algo = CRYPTO_ALGO_WEP128;
2286                 break;
2287         default:
2288                 bphy_err(drvr, "Invalid algorithm (%d)\n",
2289                          sme->crypto.ciphers_pairwise[0]);
2290                 return -EINVAL;
2291         }
2292         /* Set the new key/index */
2293         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
2294                   key.len, key.index, key.algo);
2295         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
2296         err = send_key_to_dongle(ifp, &key);
2297         if (err)
2298                 return err;
2299
2300         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
2301                 brcmf_dbg(CONN, "set auth_type to shared key\n");
2302                 val = WL_AUTH_SHARED_KEY;       /* shared key */
2303                 err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2304                 if (err)
2305                         bphy_err(drvr, "set auth failed (%d)\n", err);
2306         }
2307         return err;
2308 }
2309
2310 static
2311 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
2312                                            enum nl80211_auth_type type)
2313 {
2314         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
2315             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
2316                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
2317                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2318         }
2319         return type;
2320 }
2321
2322 static void brcmf_set_join_pref(struct brcmf_if *ifp,
2323                                 struct cfg80211_bss_selection *bss_select)
2324 {
2325         struct brcmf_pub *drvr = ifp->drvr;
2326         struct brcmf_join_pref_params join_pref_params[2];
2327         enum nl80211_band band;
2328         int err, i = 0;
2329
2330         join_pref_params[i].len = 2;
2331         join_pref_params[i].rssi_gain = 0;
2332
2333         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
2334                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
2335
2336         switch (bss_select->behaviour) {
2337         case __NL80211_BSS_SELECT_ATTR_INVALID:
2338                 brcmf_c_set_joinpref_default(ifp);
2339                 return;
2340         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
2341                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
2342                 band = bss_select->param.band_pref;
2343                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2344                 i++;
2345                 break;
2346         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2347                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2348                 band = bss_select->param.adjust.band;
2349                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2350                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2351                 i++;
2352                 break;
2353         case NL80211_BSS_SELECT_ATTR_RSSI:
2354         default:
2355                 break;
2356         }
2357         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2358         join_pref_params[i].len = 2;
2359         join_pref_params[i].rssi_gain = 0;
2360         join_pref_params[i].band = 0;
2361         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2362                                        sizeof(join_pref_params));
2363         if (err)
2364                 bphy_err(drvr, "Set join_pref error (%d)\n", err);
2365 }
2366
2367 static s32
2368 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2369                        struct cfg80211_connect_params *sme)
2370 {
2371         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2372         struct brcmf_if *ifp = netdev_priv(ndev);
2373         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2374         struct ieee80211_channel *chan = sme->channel;
2375         struct brcmf_pub *drvr = ifp->drvr;
2376         struct brcmf_join_params join_params;
2377         size_t join_params_size;
2378         const struct brcmf_tlv *rsn_ie;
2379         const struct brcmf_vs_tlv *wpa_ie;
2380         const void *ie;
2381         u32 ie_len;
2382         struct brcmf_ext_join_params_le *ext_join_params;
2383         u16 chanspec;
2384         s32 err = 0;
2385         u32 ssid_len;
2386
2387         brcmf_dbg(TRACE, "Enter\n");
2388         if (!check_vif_up(ifp->vif))
2389                 return -EIO;
2390
2391         if (!sme->ssid) {
2392                 bphy_err(drvr, "Invalid ssid\n");
2393                 return -EOPNOTSUPP;
2394         }
2395
2396         if (sme->channel_hint)
2397                 chan = sme->channel_hint;
2398
2399         if (sme->bssid_hint)
2400                 sme->bssid = sme->bssid_hint;
2401
2402         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2403                 /* A normal (non P2P) connection request setup. */
2404                 ie = NULL;
2405                 ie_len = 0;
2406                 /* find the WPA_IE */
2407                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2408                 if (wpa_ie) {
2409                         ie = wpa_ie;
2410                         ie_len = wpa_ie->len + TLV_HDR_LEN;
2411                 } else {
2412                         /* find the RSN_IE */
2413                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2414                                                   sme->ie_len,
2415                                                   WLAN_EID_RSN);
2416                         if (rsn_ie) {
2417                                 ie = rsn_ie;
2418                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
2419                         }
2420                 }
2421                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2422         }
2423
2424         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2425                                     sme->ie, sme->ie_len);
2426         if (err)
2427                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2428         else
2429                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2430
2431         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2432
2433         if (chan) {
2434                 cfg->channel =
2435                         ieee80211_frequency_to_channel(chan->center_freq);
2436                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2437                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2438                           cfg->channel, chan->center_freq, chanspec);
2439         } else {
2440                 cfg->channel = 0;
2441                 chanspec = 0;
2442         }
2443
2444         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2445
2446         err = brcmf_set_wpa_version(ndev, sme);
2447         if (err) {
2448                 bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2449                 goto done;
2450         }
2451
2452         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2453         err = brcmf_set_auth_type(ndev, sme);
2454         if (err) {
2455                 bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2456                 goto done;
2457         }
2458
2459         err = brcmf_set_wsec_mode(ndev, sme);
2460         if (err) {
2461                 bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2462                 goto done;
2463         }
2464
2465         err = brcmf_set_key_mgmt(ndev, sme);
2466         if (err) {
2467                 bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2468                 goto done;
2469         }
2470
2471         err = brcmf_set_sharedkey(ndev, sme);
2472         if (err) {
2473                 bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2474                 goto done;
2475         }
2476
2477         if (sme->crypto.psk &&
2478             profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2479                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2480                         err = -EINVAL;
2481                         goto done;
2482                 }
2483                 brcmf_dbg(INFO, "using PSK offload\n");
2484                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2485         }
2486
2487         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2488                 /* enable firmware supplicant for this interface */
2489                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2490                 if (err < 0) {
2491                         bphy_err(drvr, "failed to enable fw supplicant\n");
2492                         goto done;
2493                 }
2494         }
2495
2496         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2497                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2498                                     BRCMF_WSEC_MAX_PSK_LEN);
2499         else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2500                 /* clean up user-space RSNE */
2501                 err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
2502                 if (err) {
2503                         bphy_err(drvr, "failed to clean up user-space RSNE\n");
2504                         goto done;
2505                 }
2506                 err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
2507                                              sme->crypto.sae_pwd_len);
2508                 if (!err && sme->crypto.psk)
2509                         err = brcmf_set_pmk(ifp, sme->crypto.psk,
2510                                             BRCMF_WSEC_MAX_PSK_LEN);
2511         }
2512         if (err)
2513                 goto done;
2514
2515         /* Join with specific BSSID and cached SSID
2516          * If SSID is zero join based on BSSID only
2517          */
2518         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2519                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2520         if (cfg->channel)
2521                 join_params_size += sizeof(u16);
2522         ext_join_params = kzalloc(sizeof(*ext_join_params), GFP_KERNEL);
2523         if (ext_join_params == NULL) {
2524                 err = -ENOMEM;
2525                 goto done;
2526         }
2527         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2528         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2529         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2530         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2531                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2532                           ext_join_params->ssid_le.SSID, ssid_len);
2533
2534         /* Set up join scan parameters */
2535         ext_join_params->scan_le.scan_type = -1;
2536         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2537
2538         if (sme->bssid)
2539                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2540         else
2541                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2542
2543         if (cfg->channel) {
2544                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2545
2546                 ext_join_params->assoc_le.chanspec_list[0] =
2547                         cpu_to_le16(chanspec);
2548                 /* Increase dwell time to receive probe response or detect
2549                  * beacon from target AP at a noisy air only during connect
2550                  * command.
2551                  */
2552                 ext_join_params->scan_le.active_time =
2553                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2554                 ext_join_params->scan_le.passive_time =
2555                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2556                 /* To sync with presence period of VSDB GO send probe request
2557                  * more frequently. Probe request will be stopped when it gets
2558                  * probe response from target AP/GO.
2559                  */
2560                 ext_join_params->scan_le.nprobes =
2561                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2562                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2563         } else {
2564                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2565                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2566                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2567         }
2568
2569         brcmf_set_join_pref(ifp, &sme->bss_select);
2570
2571         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2572                                          join_params_size);
2573         kfree(ext_join_params);
2574         if (!err)
2575                 /* This is it. join command worked, we are done */
2576                 goto done;
2577
2578         /* join command failed, fallback to set ssid */
2579         memset(&join_params, 0, sizeof(join_params));
2580         join_params_size = sizeof(join_params.ssid_le);
2581
2582         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2583         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2584
2585         if (sme->bssid)
2586                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2587         else
2588                 eth_broadcast_addr(join_params.params_le.bssid);
2589
2590         if (cfg->channel) {
2591                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2592                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2593                 join_params_size += sizeof(join_params.params_le);
2594         }
2595         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2596                                      &join_params, join_params_size);
2597         if (err)
2598                 bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2599
2600 done:
2601         if (err)
2602                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2603         brcmf_dbg(TRACE, "Exit\n");
2604         return err;
2605 }
2606
2607 static s32
2608 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2609                        u16 reason_code)
2610 {
2611         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2612         struct brcmf_if *ifp = netdev_priv(ndev);
2613         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2614         struct brcmf_pub *drvr = cfg->pub;
2615         struct brcmf_scb_val_le scbval;
2616         s32 err = 0;
2617
2618         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2619         if (!check_vif_up(ifp->vif))
2620                 return -EIO;
2621
2622         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2623         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2624         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &ifp->vif->sme_state);
2625         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &ifp->vif->sme_state);
2626         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2627
2628         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2629         scbval.val = cpu_to_le32(reason_code);
2630         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2631                                      &scbval, sizeof(scbval));
2632         if (err)
2633                 bphy_err(drvr, "error (%d)\n", err);
2634
2635         brcmf_dbg(TRACE, "Exit\n");
2636         return err;
2637 }
2638
2639 static s32
2640 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2641                             enum nl80211_tx_power_setting type, s32 mbm)
2642 {
2643         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2644         struct net_device *ndev = cfg_to_ndev(cfg);
2645         struct brcmf_if *ifp = netdev_priv(ndev);
2646         struct brcmf_pub *drvr = cfg->pub;
2647         s32 err;
2648         s32 disable;
2649         u32 qdbm = 127;
2650
2651         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2652         if (!check_vif_up(ifp->vif))
2653                 return -EIO;
2654
2655         switch (type) {
2656         case NL80211_TX_POWER_AUTOMATIC:
2657                 break;
2658         case NL80211_TX_POWER_LIMITED:
2659         case NL80211_TX_POWER_FIXED:
2660                 if (mbm < 0) {
2661                         bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2662                         err = -EINVAL;
2663                         goto done;
2664                 }
2665                 qdbm =  MBM_TO_DBM(4 * mbm);
2666                 if (qdbm > 127)
2667                         qdbm = 127;
2668                 qdbm |= WL_TXPWR_OVERRIDE;
2669                 break;
2670         default:
2671                 bphy_err(drvr, "Unsupported type %d\n", type);
2672                 err = -EINVAL;
2673                 goto done;
2674         }
2675         /* Make sure radio is off or on as far as software is concerned */
2676         disable = WL_RADIO_SW_DISABLE << 16;
2677         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2678         if (err)
2679                 bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2680
2681         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2682         if (err)
2683                 bphy_err(drvr, "qtxpower error (%d)\n", err);
2684
2685 done:
2686         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2687         return err;
2688 }
2689
2690 static s32
2691 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2692                             s32 *dbm)
2693 {
2694         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2695         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2696         struct brcmf_pub *drvr = cfg->pub;
2697         s32 qdbm = 0;
2698         s32 err;
2699
2700         brcmf_dbg(TRACE, "Enter\n");
2701         if (!check_vif_up(vif))
2702                 return -EIO;
2703
2704         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2705         if (err) {
2706                 bphy_err(drvr, "error (%d)\n", err);
2707                 goto done;
2708         }
2709         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2710
2711 done:
2712         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2713         return err;
2714 }
2715
2716 static s32
2717 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2718                                   int link_id, u8 key_idx, bool unicast,
2719                                   bool multicast)
2720 {
2721         struct brcmf_if *ifp = netdev_priv(ndev);
2722         struct brcmf_pub *drvr = ifp->drvr;
2723         u32 index;
2724         u32 wsec;
2725         s32 err = 0;
2726
2727         brcmf_dbg(TRACE, "Enter\n");
2728         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2729         if (!check_vif_up(ifp->vif))
2730                 return -EIO;
2731
2732         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2733         if (err) {
2734                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2735                 goto done;
2736         }
2737
2738         if (wsec & WEP_ENABLED) {
2739                 /* Just select a new current key */
2740                 index = key_idx;
2741                 err = brcmf_fil_cmd_int_set(ifp,
2742                                             BRCMF_C_SET_KEY_PRIMARY, index);
2743                 if (err)
2744                         bphy_err(drvr, "error (%d)\n", err);
2745         }
2746 done:
2747         brcmf_dbg(TRACE, "Exit\n");
2748         return err;
2749 }
2750
2751 static s32
2752 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2753                        int link_id, u8 key_idx, bool pairwise,
2754                        const u8 *mac_addr)
2755 {
2756         struct brcmf_if *ifp = netdev_priv(ndev);
2757         struct brcmf_wsec_key *key;
2758         s32 err;
2759
2760         brcmf_dbg(TRACE, "Enter\n");
2761         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2762
2763         if (!check_vif_up(ifp->vif))
2764                 return -EIO;
2765
2766         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2767                 /* we ignore this key index in this case */
2768                 return -EINVAL;
2769         }
2770
2771         key = &ifp->vif->profile.key[key_idx];
2772
2773         if (key->algo == CRYPTO_ALGO_OFF) {
2774                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2775                 return -EINVAL;
2776         }
2777
2778         memset(key, 0, sizeof(*key));
2779         key->index = (u32)key_idx;
2780         key->flags = BRCMF_PRIMARY_KEY;
2781
2782         /* Clear the key/index */
2783         err = send_key_to_dongle(ifp, key);
2784
2785         brcmf_dbg(TRACE, "Exit\n");
2786         return err;
2787 }
2788
2789 static s32
2790 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2791                        int link_id, u8 key_idx, bool pairwise,
2792                        const u8 *mac_addr, struct key_params *params)
2793 {
2794         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2795         struct brcmf_if *ifp = netdev_priv(ndev);
2796         struct brcmf_pub *drvr = cfg->pub;
2797         struct brcmf_wsec_key *key;
2798         s32 val;
2799         s32 wsec;
2800         s32 err;
2801         u8 keybuf[8];
2802         bool ext_key;
2803
2804         brcmf_dbg(TRACE, "Enter\n");
2805         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2806         if (!check_vif_up(ifp->vif))
2807                 return -EIO;
2808
2809         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2810                 /* we ignore this key index in this case */
2811                 bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2812                 return -EINVAL;
2813         }
2814
2815         if (params->key_len == 0)
2816                 return brcmf_cfg80211_del_key(wiphy, ndev, -1, key_idx,
2817                                               pairwise, mac_addr);
2818
2819         if (params->key_len > sizeof(key->data)) {
2820                 bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2821                 return -EINVAL;
2822         }
2823
2824         ext_key = false;
2825         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2826             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2827                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2828                 ext_key = true;
2829         }
2830
2831         key = &ifp->vif->profile.key[key_idx];
2832         memset(key, 0, sizeof(*key));
2833         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2834                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2835         key->len = params->key_len;
2836         key->index = key_idx;
2837         memcpy(key->data, params->key, key->len);
2838         if (!ext_key)
2839                 key->flags = BRCMF_PRIMARY_KEY;
2840
2841         if (params->seq && params->seq_len == 6) {
2842                 /* rx iv */
2843                 u8 *ivptr;
2844
2845                 ivptr = (u8 *)params->seq;
2846                 key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2847                         (ivptr[3] << 8) | ivptr[2];
2848                 key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2849                 key->iv_initialized = true;
2850         }
2851
2852         switch (params->cipher) {
2853         case WLAN_CIPHER_SUITE_WEP40:
2854                 key->algo = CRYPTO_ALGO_WEP1;
2855                 val = WEP_ENABLED;
2856                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2857                 break;
2858         case WLAN_CIPHER_SUITE_WEP104:
2859                 key->algo = CRYPTO_ALGO_WEP128;
2860                 val = WEP_ENABLED;
2861                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2862                 break;
2863         case WLAN_CIPHER_SUITE_TKIP:
2864                 if (!brcmf_is_apmode(ifp->vif)) {
2865                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2866                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2867                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2868                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2869                 }
2870                 key->algo = CRYPTO_ALGO_TKIP;
2871                 val = TKIP_ENABLED;
2872                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2873                 break;
2874         case WLAN_CIPHER_SUITE_AES_CMAC:
2875                 key->algo = CRYPTO_ALGO_AES_CCM;
2876                 val = AES_ENABLED;
2877                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2878                 break;
2879         case WLAN_CIPHER_SUITE_CCMP:
2880                 key->algo = CRYPTO_ALGO_AES_CCM;
2881                 val = AES_ENABLED;
2882                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2883                 break;
2884         default:
2885                 bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2886                 err = -EINVAL;
2887                 goto done;
2888         }
2889
2890         err = send_key_to_dongle(ifp, key);
2891         if (ext_key || err)
2892                 goto done;
2893
2894         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2895         if (err) {
2896                 bphy_err(drvr, "get wsec error (%d)\n", err);
2897                 goto done;
2898         }
2899         wsec |= val;
2900         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2901         if (err) {
2902                 bphy_err(drvr, "set wsec error (%d)\n", err);
2903                 goto done;
2904         }
2905
2906 done:
2907         brcmf_dbg(TRACE, "Exit\n");
2908         return err;
2909 }
2910
2911 static s32
2912 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2913                        int link_id, u8 key_idx, bool pairwise,
2914                        const u8 *mac_addr, void *cookie,
2915                        void (*callback)(void *cookie,
2916                                         struct key_params *params))
2917 {
2918         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2919         struct key_params params;
2920         struct brcmf_if *ifp = netdev_priv(ndev);
2921         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2922         struct brcmf_pub *drvr = cfg->pub;
2923         struct brcmf_cfg80211_security *sec;
2924         s32 wsec;
2925         s32 err = 0;
2926
2927         brcmf_dbg(TRACE, "Enter\n");
2928         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2929         if (!check_vif_up(ifp->vif))
2930                 return -EIO;
2931
2932         memset(&params, 0, sizeof(params));
2933
2934         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2935         if (err) {
2936                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2937                 /* Ignore this error, may happen during DISASSOC */
2938                 err = -EAGAIN;
2939                 goto done;
2940         }
2941         if (wsec & WEP_ENABLED) {
2942                 sec = &profile->sec;
2943                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2944                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2945                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2946                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2947                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2948                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2949                 }
2950         } else if (wsec & TKIP_ENABLED) {
2951                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2952                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2953         } else if (wsec & AES_ENABLED) {
2954                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2955                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2956         } else  {
2957                 bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2958                 err = -EINVAL;
2959                 goto done;
2960         }
2961         callback(cookie, &params);
2962
2963 done:
2964         brcmf_dbg(TRACE, "Exit\n");
2965         return err;
2966 }
2967
2968 static s32
2969 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2970                                        struct net_device *ndev, int link_id,
2971                                        u8 key_idx)
2972 {
2973         struct brcmf_if *ifp = netdev_priv(ndev);
2974
2975         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2976
2977         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2978                 return 0;
2979
2980         brcmf_dbg(INFO, "Not supported\n");
2981
2982         return -EOPNOTSUPP;
2983 }
2984
2985 static void
2986 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2987 {
2988         struct brcmf_pub *drvr = ifp->drvr;
2989         s32 err;
2990         u8 key_idx;
2991         struct brcmf_wsec_key *key;
2992         s32 wsec;
2993
2994         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2995                 key = &ifp->vif->profile.key[key_idx];
2996                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2997                     (key->algo == CRYPTO_ALGO_WEP128))
2998                         break;
2999         }
3000         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
3001                 return;
3002
3003         err = send_key_to_dongle(ifp, key);
3004         if (err) {
3005                 bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
3006                 return;
3007         }
3008         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
3009         if (err) {
3010                 bphy_err(drvr, "get wsec error (%d)\n", err);
3011                 return;
3012         }
3013         wsec |= WEP_ENABLED;
3014         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3015         if (err)
3016                 bphy_err(drvr, "set wsec error (%d)\n", err);
3017 }
3018
3019 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
3020 {
3021         struct nl80211_sta_flag_update *sfu;
3022
3023         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
3024         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
3025         sfu = &si->sta_flags;
3026         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
3027                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3028                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
3029                     BIT(NL80211_STA_FLAG_AUTHORIZED);
3030         if (fw_sta_flags & BRCMF_STA_WME)
3031                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
3032         if (fw_sta_flags & BRCMF_STA_AUTHE)
3033                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3034         if (fw_sta_flags & BRCMF_STA_ASSOC)
3035                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3036         if (fw_sta_flags & BRCMF_STA_AUTHO)
3037                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3038 }
3039
3040 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
3041 {
3042         struct brcmf_pub *drvr = ifp->drvr;
3043         struct {
3044                 __le32 len;
3045                 struct brcmf_bss_info_le bss_le;
3046         } *buf;
3047         u16 capability;
3048         int err;
3049
3050         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3051         if (!buf)
3052                 return;
3053
3054         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
3055         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
3056                                      WL_BSS_INFO_MAX);
3057         if (err) {
3058                 bphy_err(drvr, "Failed to get bss info (%d)\n", err);
3059                 goto out_kfree;
3060         }
3061         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
3062         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
3063         si->bss_param.dtim_period = buf->bss_le.dtim_period;
3064         capability = le16_to_cpu(buf->bss_le.capability);
3065         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
3066                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
3067         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3068                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
3069         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
3070                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
3071
3072 out_kfree:
3073         kfree(buf);
3074 }
3075
3076 static s32
3077 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
3078                                 struct station_info *sinfo)
3079 {
3080         struct brcmf_pub *drvr = ifp->drvr;
3081         struct brcmf_scb_val_le scbval;
3082         struct brcmf_pktcnt_le pktcnt;
3083         s32 err;
3084         u32 rate;
3085         u32 rssi;
3086
3087         /* Get the current tx rate */
3088         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
3089         if (err < 0) {
3090                 bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
3091                 return err;
3092         }
3093         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3094         sinfo->txrate.legacy = rate * 5;
3095
3096         memset(&scbval, 0, sizeof(scbval));
3097         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
3098                                      sizeof(scbval));
3099         if (err) {
3100                 bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
3101                 return err;
3102         }
3103         rssi = le32_to_cpu(scbval.val);
3104         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3105         sinfo->signal = rssi;
3106
3107         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
3108                                      sizeof(pktcnt));
3109         if (err) {
3110                 bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
3111                 return err;
3112         }
3113         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
3114                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
3115                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
3116                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3117         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
3118         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
3119         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
3120         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
3121
3122         return 0;
3123 }
3124
3125 static s32
3126 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
3127                            const u8 *mac, struct station_info *sinfo)
3128 {
3129         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3130         struct brcmf_if *ifp = netdev_priv(ndev);
3131         struct brcmf_pub *drvr = cfg->pub;
3132         struct brcmf_scb_val_le scb_val;
3133         s32 err = 0;
3134         struct brcmf_sta_info_le sta_info_le;
3135         u32 sta_flags;
3136         u32 is_tdls_peer;
3137         s32 total_rssi_avg = 0;
3138         s32 total_rssi = 0;
3139         s32 count_rssi = 0;
3140         int rssi;
3141         u32 i;
3142
3143         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
3144         if (!check_vif_up(ifp->vif))
3145                 return -EIO;
3146
3147         if (brcmf_is_ibssmode(ifp->vif))
3148                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
3149
3150         memset(&sta_info_le, 0, sizeof(sta_info_le));
3151         memcpy(&sta_info_le, mac, ETH_ALEN);
3152         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
3153                                        &sta_info_le,
3154                                        sizeof(sta_info_le));
3155         is_tdls_peer = !err;
3156         if (err) {
3157                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
3158                                                &sta_info_le,
3159                                                sizeof(sta_info_le));
3160                 if (err < 0) {
3161                         bphy_err(drvr, "GET STA INFO failed, %d\n", err);
3162                         goto done;
3163                 }
3164         }
3165         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
3166         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
3167         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
3168         sta_flags = le32_to_cpu(sta_info_le.flags);
3169         brcmf_convert_sta_flags(sta_flags, sinfo);
3170         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3171         if (is_tdls_peer)
3172                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3173         else
3174                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3175         if (sta_flags & BRCMF_STA_ASSOC) {
3176                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
3177                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
3178                 brcmf_fill_bss_param(ifp, sinfo);
3179         }
3180         if (sta_flags & BRCMF_STA_SCBSTATS) {
3181                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3182                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
3183                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
3184                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
3185                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
3186                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
3187                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
3188                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
3189                 if (sinfo->tx_packets) {
3190                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3191                         sinfo->txrate.legacy =
3192                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
3193                 }
3194                 if (sinfo->rx_packets) {
3195                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
3196                         sinfo->rxrate.legacy =
3197                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
3198                 }
3199                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
3200                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
3201                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
3202                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
3203                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
3204                 }
3205                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
3206                         if (sta_info_le.rssi[i] == 0 ||
3207                             sta_info_le.rx_lastpkt_rssi[i] == 0)
3208                                 continue;
3209                         sinfo->chains |= BIT(count_rssi);
3210                         sinfo->chain_signal[count_rssi] =
3211                                 sta_info_le.rx_lastpkt_rssi[i];
3212                         sinfo->chain_signal_avg[count_rssi] =
3213                                 sta_info_le.rssi[i];
3214                         total_rssi += sta_info_le.rx_lastpkt_rssi[i];
3215                         total_rssi_avg += sta_info_le.rssi[i];
3216                         count_rssi++;
3217                 }
3218                 if (count_rssi) {
3219                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3220                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
3221                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
3222                         sinfo->filled |=
3223                                 BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
3224                         sinfo->signal = total_rssi / count_rssi;
3225                         sinfo->signal_avg = total_rssi_avg / count_rssi;
3226                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
3227                         &ifp->vif->sme_state)) {
3228                         memset(&scb_val, 0, sizeof(scb_val));
3229                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
3230                                                      &scb_val, sizeof(scb_val));
3231                         if (err) {
3232                                 bphy_err(drvr, "Could not get rssi (%d)\n",
3233                                          err);
3234                                 goto done;
3235                         } else {
3236                                 rssi = le32_to_cpu(scb_val.val);
3237                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3238                                 sinfo->signal = rssi;
3239                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
3240                         }
3241                 }
3242         }
3243 done:
3244         brcmf_dbg(TRACE, "Exit\n");
3245         return err;
3246 }
3247
3248 static int
3249 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
3250                             int idx, u8 *mac, struct station_info *sinfo)
3251 {
3252         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3253         struct brcmf_if *ifp = netdev_priv(ndev);
3254         struct brcmf_pub *drvr = cfg->pub;
3255         s32 err;
3256
3257         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
3258
3259         if (idx == 0) {
3260                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
3261                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
3262                                              &cfg->assoclist,
3263                                              sizeof(cfg->assoclist));
3264                 if (err) {
3265                         /* GET_ASSOCLIST unsupported by firmware of older chips */
3266                         if (err == -EBADE)
3267                                 bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
3268                         else
3269                                 bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
3270                                          err);
3271
3272                         cfg->assoclist.count = 0;
3273                         return -EOPNOTSUPP;
3274                 }
3275         }
3276         if (idx < le32_to_cpu(cfg->assoclist.count)) {
3277                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
3278                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
3279         }
3280         return -ENOENT;
3281 }
3282
3283 static s32
3284 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
3285                            bool enabled, s32 timeout)
3286 {
3287         s32 pm;
3288         s32 err = 0;
3289         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3290         struct brcmf_if *ifp = netdev_priv(ndev);
3291         struct brcmf_pub *drvr = cfg->pub;
3292
3293         brcmf_dbg(TRACE, "Enter\n");
3294
3295         /*
3296          * Powersave enable/disable request is coming from the
3297          * cfg80211 even before the interface is up. In that
3298          * scenario, driver will be storing the power save
3299          * preference in cfg struct to apply this to
3300          * FW later while initializing the dongle
3301          */
3302         cfg->pwr_save = enabled;
3303         if (!check_vif_up(ifp->vif)) {
3304
3305                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
3306                 goto done;
3307         }
3308
3309         pm = enabled ? PM_FAST : PM_OFF;
3310         /* Do not enable the power save after assoc if it is a p2p interface */
3311         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
3312                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
3313                 pm = PM_OFF;
3314         }
3315         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
3316
3317         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
3318         if (err) {
3319                 if (err == -ENODEV)
3320                         bphy_err(drvr, "net_device is not ready yet\n");
3321                 else
3322                         bphy_err(drvr, "error (%d)\n", err);
3323         }
3324
3325         err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
3326                                 min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
3327         if (err)
3328                 bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
3329
3330 done:
3331         brcmf_dbg(TRACE, "Exit\n");
3332         return err;
3333 }
3334
3335 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
3336                                    struct brcmf_bss_info_le *bi)
3337 {
3338         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3339         struct brcmf_pub *drvr = cfg->pub;
3340         struct cfg80211_bss *bss;
3341         enum nl80211_band band;
3342         struct brcmu_chan ch;
3343         u16 channel;
3344         u32 freq;
3345         u16 notify_capability;
3346         u16 notify_interval;
3347         u8 *notify_ie;
3348         size_t notify_ielen;
3349         struct cfg80211_inform_bss bss_data = {};
3350
3351         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
3352                 bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
3353                 return -EINVAL;
3354         }
3355
3356         if (!bi->ctl_ch) {
3357                 ch.chspec = le16_to_cpu(bi->chanspec);
3358                 cfg->d11inf.decchspec(&ch);
3359                 bi->ctl_ch = ch.control_ch_num;
3360         }
3361         channel = bi->ctl_ch;
3362
3363         if (channel <= CH_MAX_2G_CHANNEL)
3364                 band = NL80211_BAND_2GHZ;
3365         else
3366                 band = NL80211_BAND_5GHZ;
3367
3368         freq = ieee80211_channel_to_frequency(channel, band);
3369         bss_data.chan = ieee80211_get_channel(wiphy, freq);
3370         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3371         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3372
3373         notify_capability = le16_to_cpu(bi->capability);
3374         notify_interval = le16_to_cpu(bi->beacon_period);
3375         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3376         notify_ielen = le32_to_cpu(bi->ie_length);
3377         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3378
3379         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3380         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3381         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3382         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3383         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3384
3385         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3386                                        CFG80211_BSS_FTYPE_UNKNOWN,
3387                                        (const u8 *)bi->BSSID,
3388                                        0, notify_capability,
3389                                        notify_interval, notify_ie,
3390                                        notify_ielen, GFP_KERNEL);
3391
3392         if (!bss)
3393                 return -ENOMEM;
3394
3395         cfg80211_put_bss(wiphy, bss);
3396
3397         return 0;
3398 }
3399
3400 static struct brcmf_bss_info_le *
3401 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3402 {
3403         if (bss == NULL)
3404                 return list->bss_info_le;
3405         return (struct brcmf_bss_info_le *)((unsigned long)bss +
3406                                             le32_to_cpu(bss->length));
3407 }
3408
3409 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3410 {
3411         struct brcmf_pub *drvr = cfg->pub;
3412         struct brcmf_scan_results *bss_list;
3413         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
3414         s32 err = 0;
3415         int i;
3416
3417         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3418         if (bss_list->count != 0 &&
3419             bss_list->version != BRCMF_BSS_INFO_VERSION) {
3420                 bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3421                          bss_list->version);
3422                 return -EOPNOTSUPP;
3423         }
3424         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3425         for (i = 0; i < bss_list->count; i++) {
3426                 bi = next_bss_le(bss_list, bi);
3427                 err = brcmf_inform_single_bss(cfg, bi);
3428                 if (err)
3429                         break;
3430         }
3431         return err;
3432 }
3433
3434 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3435                              struct net_device *ndev, const u8 *bssid)
3436 {
3437         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3438         struct brcmf_pub *drvr = cfg->pub;
3439         struct ieee80211_channel *notify_channel;
3440         struct brcmf_bss_info_le *bi = NULL;
3441         struct ieee80211_supported_band *band;
3442         struct cfg80211_bss *bss;
3443         struct brcmu_chan ch;
3444         u8 *buf = NULL;
3445         s32 err = 0;
3446         u32 freq;
3447         u16 notify_capability;
3448         u16 notify_interval;
3449         u8 *notify_ie;
3450         size_t notify_ielen;
3451         s32 notify_signal;
3452
3453         brcmf_dbg(TRACE, "Enter\n");
3454
3455         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3456         if (buf == NULL) {
3457                 err = -ENOMEM;
3458                 goto CleanUp;
3459         }
3460
3461         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3462
3463         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3464                                      buf, WL_BSS_INFO_MAX);
3465         if (err) {
3466                 bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3467                 goto CleanUp;
3468         }
3469
3470         bi = (struct brcmf_bss_info_le *)(buf + 4);
3471
3472         ch.chspec = le16_to_cpu(bi->chanspec);
3473         cfg->d11inf.decchspec(&ch);
3474
3475         if (ch.band == BRCMU_CHAN_BAND_2G)
3476                 band = wiphy->bands[NL80211_BAND_2GHZ];
3477         else
3478                 band = wiphy->bands[NL80211_BAND_5GHZ];
3479
3480         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3481         cfg->channel = freq;
3482         notify_channel = ieee80211_get_channel(wiphy, freq);
3483
3484         notify_capability = le16_to_cpu(bi->capability);
3485         notify_interval = le16_to_cpu(bi->beacon_period);
3486         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3487         notify_ielen = le32_to_cpu(bi->ie_length);
3488         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3489
3490         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3491         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3492         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3493         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3494
3495         bss = cfg80211_inform_bss(wiphy, notify_channel,
3496                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3497                                   notify_capability, notify_interval,
3498                                   notify_ie, notify_ielen, notify_signal,
3499                                   GFP_KERNEL);
3500
3501         if (!bss) {
3502                 err = -ENOMEM;
3503                 goto CleanUp;
3504         }
3505
3506         cfg80211_put_bss(wiphy, bss);
3507
3508 CleanUp:
3509
3510         kfree(buf);
3511
3512         brcmf_dbg(TRACE, "Exit\n");
3513
3514         return err;
3515 }
3516
3517 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3518                                  struct brcmf_if *ifp)
3519 {
3520         struct brcmf_pub *drvr = cfg->pub;
3521         struct brcmf_bss_info_le *bi = NULL;
3522         s32 err = 0;
3523
3524         brcmf_dbg(TRACE, "Enter\n");
3525         if (brcmf_is_ibssmode(ifp->vif))
3526                 return err;
3527
3528         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3529         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3530                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3531         if (err) {
3532                 bphy_err(drvr, "Could not get bss info %d\n", err);
3533                 goto update_bss_info_out;
3534         }
3535         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3536         err = brcmf_inform_single_bss(cfg, bi);
3537
3538 update_bss_info_out:
3539         brcmf_dbg(TRACE, "Exit");
3540         return err;
3541 }
3542
3543 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3544 {
3545         struct escan_info *escan = &cfg->escan_info;
3546
3547         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3548         if (cfg->int_escan_map || cfg->scan_request) {
3549                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3550                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3551         }
3552         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3553         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3554 }
3555
3556 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3557 {
3558         struct brcmf_cfg80211_info *cfg =
3559                         container_of(work, struct brcmf_cfg80211_info,
3560                                      escan_timeout_work);
3561
3562         brcmf_inform_bss(cfg);
3563         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3564 }
3565
3566 static void brcmf_escan_timeout(struct timer_list *t)
3567 {
3568         struct brcmf_cfg80211_info *cfg =
3569                         from_timer(cfg, t, escan_timeout);
3570         struct brcmf_pub *drvr = cfg->pub;
3571
3572         if (cfg->int_escan_map || cfg->scan_request) {
3573                 bphy_err(drvr, "timer expired\n");
3574                 schedule_work(&cfg->escan_timeout_work);
3575         }
3576 }
3577
3578 static s32
3579 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3580                               struct brcmf_bss_info_le *bss,
3581                               struct brcmf_bss_info_le *bss_info_le)
3582 {
3583         struct brcmu_chan ch_bss, ch_bss_info_le;
3584
3585         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3586         cfg->d11inf.decchspec(&ch_bss);
3587         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3588         cfg->d11inf.decchspec(&ch_bss_info_le);
3589
3590         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3591                 ch_bss.band == ch_bss_info_le.band &&
3592                 bss_info_le->SSID_len == bss->SSID_len &&
3593                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3594                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3595                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3596                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3597                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3598
3599                         /* preserve max RSSI if the measurements are
3600                         * both on-channel or both off-channel
3601                         */
3602                         if (bss_info_rssi > bss_rssi)
3603                                 bss->RSSI = bss_info_le->RSSI;
3604                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3605                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3606                         /* preserve the on-channel rssi measurement
3607                         * if the new measurement is off channel
3608                         */
3609                         bss->RSSI = bss_info_le->RSSI;
3610                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3611                 }
3612                 return 1;
3613         }
3614         return 0;
3615 }
3616
3617 static s32
3618 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3619                              const struct brcmf_event_msg *e, void *data)
3620 {
3621         struct brcmf_pub *drvr = ifp->drvr;
3622         struct brcmf_cfg80211_info *cfg = drvr->config;
3623         s32 status;
3624         struct brcmf_escan_result_le *escan_result_le;
3625         u32 escan_buflen;
3626         struct brcmf_bss_info_le *bss_info_le;
3627         struct brcmf_bss_info_le *bss = NULL;
3628         u32 bi_length;
3629         struct brcmf_scan_results *list;
3630         u32 i;
3631         bool aborted;
3632
3633         status = e->status;
3634
3635         if (status == BRCMF_E_STATUS_ABORT)
3636                 goto exit;
3637
3638         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3639                 bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3640                          ifp->bsscfgidx);
3641                 return -EPERM;
3642         }
3643
3644         if (status == BRCMF_E_STATUS_PARTIAL) {
3645                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3646                 if (e->datalen < sizeof(*escan_result_le)) {
3647                         bphy_err(drvr, "invalid event data length\n");
3648                         goto exit;
3649                 }
3650                 escan_result_le = (struct brcmf_escan_result_le *) data;
3651                 if (!escan_result_le) {
3652                         bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3653                         goto exit;
3654                 }
3655                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3656                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3657                     escan_buflen > e->datalen ||
3658                     escan_buflen < sizeof(*escan_result_le)) {
3659                         bphy_err(drvr, "Invalid escan buffer length: %d\n",
3660                                  escan_buflen);
3661                         goto exit;
3662                 }
3663                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3664                         bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3665                                  escan_result_le->bss_count);
3666                         goto exit;
3667                 }
3668                 bss_info_le = &escan_result_le->bss_info_le;
3669
3670                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3671                         goto exit;
3672
3673                 if (!cfg->int_escan_map && !cfg->scan_request) {
3674                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3675                         goto exit;
3676                 }
3677
3678                 bi_length = le32_to_cpu(bss_info_le->length);
3679                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3680                         bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3681                                  bi_length);
3682                         goto exit;
3683                 }
3684
3685                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3686                                         BIT(NL80211_IFTYPE_ADHOC))) {
3687                         if (le16_to_cpu(bss_info_le->capability) &
3688                                                 WLAN_CAPABILITY_IBSS) {
3689                                 bphy_err(drvr, "Ignoring IBSS result\n");
3690                                 goto exit;
3691                         }
3692                 }
3693
3694                 list = (struct brcmf_scan_results *)
3695                                 cfg->escan_info.escan_buf;
3696                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3697                         bphy_err(drvr, "Buffer is too small: ignoring\n");
3698                         goto exit;
3699                 }
3700
3701                 for (i = 0; i < list->count; i++) {
3702                         bss = bss ? (struct brcmf_bss_info_le *)
3703                                 ((unsigned char *)bss +
3704                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3705                         if (brcmf_compare_update_same_bss(cfg, bss,
3706                                                           bss_info_le))
3707                                 goto exit;
3708                 }
3709                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3710                        bi_length);
3711                 list->version = le32_to_cpu(bss_info_le->version);
3712                 list->buflen += bi_length;
3713                 list->count++;
3714         } else {
3715                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3716                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3717                         goto exit;
3718                 if (cfg->int_escan_map || cfg->scan_request) {
3719                         brcmf_inform_bss(cfg);
3720                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3721                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3722                 } else
3723                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3724                                   status);
3725         }
3726 exit:
3727         return 0;
3728 }
3729
3730 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3731 {
3732         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3733                             brcmf_cfg80211_escan_handler);
3734         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3735         /* Init scan_timeout timer */
3736         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3737         INIT_WORK(&cfg->escan_timeout_work,
3738                   brcmf_cfg80211_escan_timeout_worker);
3739 }
3740
3741 static struct cfg80211_scan_request *
3742 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3743         struct cfg80211_scan_request *req;
3744         size_t req_size;
3745
3746         req_size = sizeof(*req) +
3747                    n_netinfo * sizeof(req->channels[0]) +
3748                    n_netinfo * sizeof(*req->ssids);
3749
3750         req = kzalloc(req_size, GFP_KERNEL);
3751         if (req) {
3752                 req->wiphy = wiphy;
3753                 req->ssids = (void *)(&req->channels[0]) +
3754                              n_netinfo * sizeof(req->channels[0]);
3755         }
3756         return req;
3757 }
3758
3759 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3760                                          u8 *ssid, u8 ssid_len, u8 channel)
3761 {
3762         struct ieee80211_channel *chan;
3763         enum nl80211_band band;
3764         int freq, i;
3765
3766         if (channel <= CH_MAX_2G_CHANNEL)
3767                 band = NL80211_BAND_2GHZ;
3768         else
3769                 band = NL80211_BAND_5GHZ;
3770
3771         freq = ieee80211_channel_to_frequency(channel, band);
3772         if (!freq)
3773                 return -EINVAL;
3774
3775         chan = ieee80211_get_channel(req->wiphy, freq);
3776         if (!chan)
3777                 return -EINVAL;
3778
3779         for (i = 0; i < req->n_channels; i++) {
3780                 if (req->channels[i] == chan)
3781                         break;
3782         }
3783         if (i == req->n_channels)
3784                 req->channels[req->n_channels++] = chan;
3785
3786         for (i = 0; i < req->n_ssids; i++) {
3787                 if (req->ssids[i].ssid_len == ssid_len &&
3788                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3789                         break;
3790         }
3791         if (i == req->n_ssids) {
3792                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3793                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3794         }
3795         return 0;
3796 }
3797
3798 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3799                                       struct cfg80211_scan_request *request)
3800 {
3801         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3802         int err;
3803
3804         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3805                 if (cfg->int_escan_map)
3806                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3807                                   cfg->int_escan_map);
3808                 /* Abort any on-going scan */
3809                 brcmf_abort_scanning(cfg);
3810         }
3811
3812         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3813         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3814         cfg->escan_info.run = brcmf_run_escan;
3815         err = brcmf_do_escan(ifp, request);
3816         if (err) {
3817                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3818                 return err;
3819         }
3820         cfg->int_escan_map = fwmap;
3821         return 0;
3822 }
3823
3824 static struct brcmf_pno_net_info_le *
3825 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3826 {
3827         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3828         struct brcmf_pno_net_info_le *netinfo;
3829
3830         switch (pfn_v1->version) {
3831         default:
3832                 WARN_ON(1);
3833                 fallthrough;
3834         case cpu_to_le32(1):
3835                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3836                 break;
3837         case cpu_to_le32(2):
3838                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3839                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3840                 break;
3841         }
3842
3843         return netinfo;
3844 }
3845
3846 /* PFN result doesn't have all the info which are required by the supplicant
3847  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3848  * via wl_inform_single_bss in the required format. Escan does require the
3849  * scan request in the form of cfg80211_scan_request. For timebeing, create
3850  * cfg80211_scan_request one out of the received PNO event.
3851  */
3852 static s32
3853 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3854                                 const struct brcmf_event_msg *e, void *data)
3855 {
3856         struct brcmf_pub *drvr = ifp->drvr;
3857         struct brcmf_cfg80211_info *cfg = drvr->config;
3858         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3859         struct cfg80211_scan_request *request = NULL;
3860         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3861         int i, err = 0;
3862         struct brcmf_pno_scanresults_le *pfn_result;
3863         u32 bucket_map;
3864         u32 result_count;
3865         u32 status;
3866         u32 datalen;
3867
3868         brcmf_dbg(SCAN, "Enter\n");
3869
3870         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3871                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3872                 return 0;
3873         }
3874
3875         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3876                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3877                 return 0;
3878         }
3879
3880         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3881         result_count = le32_to_cpu(pfn_result->count);
3882         status = le32_to_cpu(pfn_result->status);
3883
3884         /* PFN event is limited to fit 512 bytes so we may get
3885          * multiple NET_FOUND events. For now place a warning here.
3886          */
3887         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3888         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3889         if (!result_count) {
3890                 bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3891                 goto out_err;
3892         }
3893
3894         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3895         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3896         if (datalen < result_count * sizeof(*netinfo)) {
3897                 bphy_err(drvr, "insufficient event data\n");
3898                 goto out_err;
3899         }
3900
3901         request = brcmf_alloc_internal_escan_request(wiphy,
3902                                                      result_count);
3903         if (!request) {
3904                 err = -ENOMEM;
3905                 goto out_err;
3906         }
3907
3908         bucket_map = 0;
3909         for (i = 0; i < result_count; i++) {
3910                 netinfo = &netinfo_start[i];
3911
3912                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3913                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3914                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3915                           netinfo->SSID, netinfo->channel);
3916                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3917                 err = brcmf_internal_escan_add_info(request,
3918                                                     netinfo->SSID,
3919                                                     netinfo->SSID_len,
3920                                                     netinfo->channel);
3921                 if (err)
3922                         goto out_err;
3923         }
3924
3925         if (!bucket_map)
3926                 goto free_req;
3927
3928         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3929         if (!err)
3930                 goto free_req;
3931
3932 out_err:
3933         cfg80211_sched_scan_stopped(wiphy, 0);
3934 free_req:
3935         kfree(request);
3936         return err;
3937 }
3938
3939 static int
3940 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3941                                 struct net_device *ndev,
3942                                 struct cfg80211_sched_scan_request *req)
3943 {
3944         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3945         struct brcmf_if *ifp = netdev_priv(ndev);
3946         struct brcmf_pub *drvr = cfg->pub;
3947
3948         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3949                   req->n_match_sets, req->n_ssids);
3950
3951         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3952                 bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3953                          cfg->scan_status);
3954                 return -EAGAIN;
3955         }
3956
3957         if (req->n_match_sets <= 0) {
3958                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3959                           req->n_match_sets);
3960                 return -EINVAL;
3961         }
3962
3963         return brcmf_pno_start_sched_scan(ifp, req);
3964 }
3965
3966 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3967                                           struct net_device *ndev, u64 reqid)
3968 {
3969         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3970         struct brcmf_if *ifp = netdev_priv(ndev);
3971
3972         brcmf_dbg(SCAN, "enter\n");
3973         brcmf_pno_stop_sched_scan(ifp, reqid);
3974         if (cfg->int_escan_map)
3975                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3976         return 0;
3977 }
3978
3979 static __always_inline void brcmf_delay(u32 ms)
3980 {
3981         if (ms < 1000 / HZ) {
3982                 cond_resched();
3983                 mdelay(ms);
3984         } else {
3985                 msleep(ms);
3986         }
3987 }
3988
3989 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3990                                      u8 *pattern, u32 patternsize, u8 *mask,
3991                                      u32 packet_offset)
3992 {
3993         struct brcmf_fil_wowl_pattern_le *filter;
3994         u32 masksize;
3995         u32 patternoffset;
3996         u8 *buf;
3997         u32 bufsize;
3998         s32 ret;
3999
4000         masksize = (patternsize + 7) / 8;
4001         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
4002
4003         bufsize = sizeof(*filter) + patternsize + masksize;
4004         buf = kzalloc(bufsize, GFP_KERNEL);
4005         if (!buf)
4006                 return -ENOMEM;
4007         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
4008
4009         memcpy(filter->cmd, cmd, 4);
4010         filter->masksize = cpu_to_le32(masksize);
4011         filter->offset = cpu_to_le32(packet_offset);
4012         filter->patternoffset = cpu_to_le32(patternoffset);
4013         filter->patternsize = cpu_to_le32(patternsize);
4014         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
4015
4016         if ((mask) && (masksize))
4017                 memcpy(buf + sizeof(*filter), mask, masksize);
4018         if ((pattern) && (patternsize))
4019                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
4020
4021         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
4022
4023         kfree(buf);
4024         return ret;
4025 }
4026
4027 static s32
4028 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
4029                       void *data)
4030 {
4031         struct brcmf_pub *drvr = ifp->drvr;
4032         struct brcmf_cfg80211_info *cfg = drvr->config;
4033         struct brcmf_pno_scanresults_le *pfn_result;
4034         struct brcmf_pno_net_info_le *netinfo;
4035
4036         brcmf_dbg(SCAN, "Enter\n");
4037
4038         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
4039                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
4040                 return 0;
4041         }
4042
4043         pfn_result = (struct brcmf_pno_scanresults_le *)data;
4044
4045         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
4046                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
4047                 return 0;
4048         }
4049
4050         if (le32_to_cpu(pfn_result->count) < 1) {
4051                 bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
4052                          le32_to_cpu(pfn_result->count));
4053                 return -EINVAL;
4054         }
4055
4056         netinfo = brcmf_get_netinfo_array(pfn_result);
4057         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
4058                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
4059         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
4060         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
4061         cfg->wowl.nd->n_channels = 1;
4062         cfg->wowl.nd->channels[0] =
4063                 ieee80211_channel_to_frequency(netinfo->channel,
4064                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
4065                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
4066         cfg->wowl.nd_info->n_matches = 1;
4067         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
4068
4069         /* Inform (the resume task) that the net detect information was recvd */
4070         cfg->wowl.nd_data_completed = true;
4071         wake_up(&cfg->wowl.nd_data_wait);
4072
4073         return 0;
4074 }
4075
4076 #ifdef CONFIG_PM
4077
4078 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4079 {
4080         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4081         struct brcmf_pub *drvr = cfg->pub;
4082         struct brcmf_wowl_wakeind_le wake_ind_le;
4083         struct cfg80211_wowlan_wakeup wakeup_data;
4084         struct cfg80211_wowlan_wakeup *wakeup;
4085         u32 wakeind;
4086         s32 err;
4087         int timeout;
4088
4089         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
4090                                        sizeof(wake_ind_le));
4091         if (err) {
4092                 bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
4093                 return;
4094         }
4095
4096         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
4097         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
4098                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
4099                        BRCMF_WOWL_PFN_FOUND)) {
4100                 wakeup = &wakeup_data;
4101                 memset(&wakeup_data, 0, sizeof(wakeup_data));
4102                 wakeup_data.pattern_idx = -1;
4103
4104                 if (wakeind & BRCMF_WOWL_MAGIC) {
4105                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
4106                         wakeup_data.magic_pkt = true;
4107                 }
4108                 if (wakeind & BRCMF_WOWL_DIS) {
4109                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
4110                         wakeup_data.disconnect = true;
4111                 }
4112                 if (wakeind & BRCMF_WOWL_BCN) {
4113                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
4114                         wakeup_data.disconnect = true;
4115                 }
4116                 if (wakeind & BRCMF_WOWL_RETR) {
4117                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
4118                         wakeup_data.disconnect = true;
4119                 }
4120                 if (wakeind & BRCMF_WOWL_NET) {
4121                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
4122                         /* For now always map to pattern 0, no API to get
4123                          * correct information available at the moment.
4124                          */
4125                         wakeup_data.pattern_idx = 0;
4126                 }
4127                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
4128                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
4129                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
4130                                 cfg->wowl.nd_data_completed,
4131                                 BRCMF_ND_INFO_TIMEOUT);
4132                         if (!timeout)
4133                                 bphy_err(drvr, "No result for wowl net detect\n");
4134                         else
4135                                 wakeup_data.net_detect = cfg->wowl.nd_info;
4136                 }
4137                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
4138                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
4139                         wakeup_data.gtk_rekey_failure = true;
4140                 }
4141         } else {
4142                 wakeup = NULL;
4143         }
4144         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
4145 }
4146
4147 #else
4148
4149 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4150 {
4151 }
4152
4153 #endif /* CONFIG_PM */
4154
4155 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
4156 {
4157         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4158         struct net_device *ndev = cfg_to_ndev(cfg);
4159         struct brcmf_if *ifp = netdev_priv(ndev);
4160
4161         brcmf_dbg(TRACE, "Enter\n");
4162
4163         if (cfg->wowl.active) {
4164                 brcmf_report_wowl_wakeind(wiphy, ifp);
4165                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
4166                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
4167                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4168                         brcmf_configure_arp_nd_offload(ifp, true);
4169                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
4170                                       cfg->wowl.pre_pmmode);
4171                 cfg->wowl.active = false;
4172                 if (cfg->wowl.nd_enabled) {
4173                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
4174                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4175                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4176                                             brcmf_notify_sched_scan_results);
4177                         cfg->wowl.nd_enabled = false;
4178                 }
4179         }
4180         return 0;
4181 }
4182
4183 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
4184                                  struct brcmf_if *ifp,
4185                                  struct cfg80211_wowlan *wowl)
4186 {
4187         u32 wowl_config;
4188         struct brcmf_wowl_wakeind_le wowl_wakeind;
4189         u32 i;
4190
4191         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
4192
4193         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4194                 brcmf_configure_arp_nd_offload(ifp, false);
4195         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
4196         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
4197
4198         wowl_config = 0;
4199         if (wowl->disconnect)
4200                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
4201         if (wowl->magic_pkt)
4202                 wowl_config |= BRCMF_WOWL_MAGIC;
4203         if ((wowl->patterns) && (wowl->n_patterns)) {
4204                 wowl_config |= BRCMF_WOWL_NET;
4205                 for (i = 0; i < wowl->n_patterns; i++) {
4206                         brcmf_config_wowl_pattern(ifp, "add",
4207                                 (u8 *)wowl->patterns[i].pattern,
4208                                 wowl->patterns[i].pattern_len,
4209                                 (u8 *)wowl->patterns[i].mask,
4210                                 wowl->patterns[i].pkt_offset);
4211                 }
4212         }
4213         if (wowl->nd_config) {
4214                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
4215                                                 wowl->nd_config);
4216                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
4217
4218                 cfg->wowl.nd_data_completed = false;
4219                 cfg->wowl.nd_enabled = true;
4220                 /* Now reroute the event for PFN to the wowl function. */
4221                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4222                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4223                                     brcmf_wowl_nd_results);
4224         }
4225         if (wowl->gtk_rekey_failure)
4226                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
4227         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4228                 wowl_config |= BRCMF_WOWL_UNASSOC;
4229
4230         memcpy(&wowl_wakeind, "clear", 6);
4231         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
4232                                  sizeof(wowl_wakeind));
4233         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
4234         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
4235         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
4236         cfg->wowl.active = true;
4237 }
4238
4239 static int brcmf_keepalive_start(struct brcmf_if *ifp, unsigned int interval)
4240 {
4241         struct brcmf_mkeep_alive_pkt_le kalive = {0};
4242         int ret = 0;
4243
4244         /* Configure Null function/data keepalive */
4245         kalive.version = cpu_to_le16(1);
4246         kalive.period_msec = cpu_to_le32(interval * MSEC_PER_SEC);
4247         kalive.len_bytes = cpu_to_le16(0);
4248         kalive.keep_alive_id = 0;
4249
4250         ret = brcmf_fil_iovar_data_set(ifp, "mkeep_alive", &kalive, sizeof(kalive));
4251         if (ret)
4252                 brcmf_err("keep-alive packet config failed, ret=%d\n", ret);
4253
4254         return ret;
4255 }
4256
4257 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
4258                                   struct cfg80211_wowlan *wowl)
4259 {
4260         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4261         struct net_device *ndev = cfg_to_ndev(cfg);
4262         struct brcmf_if *ifp = netdev_priv(ndev);
4263         struct brcmf_cfg80211_vif *vif;
4264
4265         brcmf_dbg(TRACE, "Enter\n");
4266
4267         /* if the primary net_device is not READY there is nothing
4268          * we can do but pray resume goes smoothly.
4269          */
4270         if (!check_vif_up(ifp->vif))
4271                 goto exit;
4272
4273         /* Stop scheduled scan */
4274         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
4275                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
4276
4277         /* end any scanning */
4278         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
4279                 brcmf_abort_scanning(cfg);
4280
4281         if (wowl == NULL) {
4282                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
4283                 list_for_each_entry(vif, &cfg->vif_list, list) {
4284                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
4285                                 continue;
4286                         /* While going to suspend if associated with AP
4287                          * disassociate from AP to save power while system is
4288                          * in suspended state
4289                          */
4290                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
4291                         /* Make sure WPA_Supplicant receives all the event
4292                          * generated due to DISASSOC call to the fw to keep
4293                          * the state fw and WPA_Supplicant state consistent
4294                          */
4295                         brcmf_delay(500);
4296                 }
4297                 /* Configure MPC */
4298                 brcmf_set_mpc(ifp, 1);
4299
4300         } else {
4301                 /* Configure WOWL paramaters */
4302                 brcmf_configure_wowl(cfg, ifp, wowl);
4303
4304                 /* Prevent disassociation due to inactivity with keep-alive */
4305                 brcmf_keepalive_start(ifp, 30);
4306         }
4307
4308 exit:
4309         brcmf_dbg(TRACE, "Exit\n");
4310         /* clear any scanning activity */
4311         cfg->scan_status = 0;
4312         return 0;
4313 }
4314
4315 static s32
4316 brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
4317                   bool alive)
4318 {
4319         struct brcmf_pmk_op_v3_le *pmk_op;
4320         int length = offsetof(struct brcmf_pmk_op_v3_le, pmk);
4321         int ret;
4322
4323         pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
4324         pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
4325
4326         if (!pmksa) {
4327                 /* Flush operation, operate on entire list */
4328                 pmk_op->count = cpu_to_le16(0);
4329         } else {
4330                 /* Single PMK operation */
4331                 pmk_op->count = cpu_to_le16(1);
4332                 length += sizeof(struct brcmf_pmksa_v3);
4333                 memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
4334                 memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4335                 pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
4336                 pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
4337         }
4338
4339         pmk_op->length = cpu_to_le16(length);
4340
4341         ret = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_op, sizeof(*pmk_op));
4342         kfree(pmk_op);
4343         return ret;
4344 }
4345
4346 static __used s32
4347 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
4348 {
4349         struct brcmf_pmk_list_le *pmk_list;
4350         int i;
4351         u32 npmk;
4352
4353         pmk_list = &cfg->pmk_list;
4354         npmk = le32_to_cpu(pmk_list->npmk);
4355
4356         brcmf_dbg(CONN, "No of elements %d\n", npmk);
4357         for (i = 0; i < npmk; i++)
4358                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
4359
4360         return brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
4361                         sizeof(*pmk_list));
4362 }
4363
4364 static s32
4365 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4366                          struct cfg80211_pmksa *pmksa)
4367 {
4368         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4369         struct brcmf_if *ifp = netdev_priv(ndev);
4370         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4371         struct brcmf_pub *drvr = cfg->pub;
4372         s32 err;
4373         u32 npmk, i;
4374
4375         brcmf_dbg(TRACE, "Enter\n");
4376         if (!check_vif_up(ifp->vif))
4377                 return -EIO;
4378
4379         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmksa->bssid);
4380         brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmksa->pmkid);
4381
4382         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4383                 return brcmf_pmksa_v3_op(ifp, pmksa, true);
4384
4385         /* TODO: implement PMKID_V2 */
4386
4387         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4388         for (i = 0; i < npmk; i++)
4389                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4390                         break;
4391         if (i < BRCMF_MAXPMKID) {
4392                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4393                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4394                 if (i == npmk) {
4395                         npmk++;
4396                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
4397                 }
4398         } else {
4399                 bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4400                 return -EINVAL;
4401         }
4402
4403         err = brcmf_update_pmklist(cfg, ifp);
4404
4405         brcmf_dbg(TRACE, "Exit\n");
4406         return err;
4407 }
4408
4409 static s32
4410 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4411                          struct cfg80211_pmksa *pmksa)
4412 {
4413         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4414         struct brcmf_if *ifp = netdev_priv(ndev);
4415         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4416         struct brcmf_pub *drvr = cfg->pub;
4417         s32 err;
4418         u32 npmk, i;
4419
4420         brcmf_dbg(TRACE, "Enter\n");
4421         if (!check_vif_up(ifp->vif))
4422                 return -EIO;
4423
4424         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4425
4426         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4427                 return brcmf_pmksa_v3_op(ifp, pmksa, false);
4428
4429         /* TODO: implement PMKID_V2 */
4430
4431         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4432         for (i = 0; i < npmk; i++)
4433                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4434                         break;
4435
4436         if ((npmk > 0) && (i < npmk)) {
4437                 for (; i < (npmk - 1); i++) {
4438                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4439                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4440                                WLAN_PMKID_LEN);
4441                 }
4442                 memset(&pmk[i], 0, sizeof(*pmk));
4443                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4444         } else {
4445                 bphy_err(drvr, "Cache entry not found\n");
4446                 return -EINVAL;
4447         }
4448
4449         err = brcmf_update_pmklist(cfg, ifp);
4450
4451         brcmf_dbg(TRACE, "Exit\n");
4452         return err;
4453
4454 }
4455
4456 static s32
4457 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4458 {
4459         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4460         struct brcmf_if *ifp = netdev_priv(ndev);
4461         s32 err;
4462
4463         brcmf_dbg(TRACE, "Enter\n");
4464         if (!check_vif_up(ifp->vif))
4465                 return -EIO;
4466
4467         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4468                 return brcmf_pmksa_v3_op(ifp, NULL, false);
4469
4470         /* TODO: implement PMKID_V2 */
4471
4472         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4473         err = brcmf_update_pmklist(cfg, ifp);
4474
4475         brcmf_dbg(TRACE, "Exit\n");
4476         return err;
4477
4478 }
4479
4480 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4481 {
4482         struct brcmf_pub *drvr = ifp->drvr;
4483         s32 err;
4484         s32 wpa_val;
4485
4486         /* set auth */
4487         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4488         if (err < 0) {
4489                 bphy_err(drvr, "auth error %d\n", err);
4490                 return err;
4491         }
4492         /* set wsec */
4493         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4494         if (err < 0) {
4495                 bphy_err(drvr, "wsec error %d\n", err);
4496                 return err;
4497         }
4498         /* set upper-layer auth */
4499         if (brcmf_is_ibssmode(ifp->vif))
4500                 wpa_val = WPA_AUTH_NONE;
4501         else
4502                 wpa_val = WPA_AUTH_DISABLED;
4503         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4504         if (err < 0) {
4505                 bphy_err(drvr, "wpa_auth error %d\n", err);
4506                 return err;
4507         }
4508
4509         return 0;
4510 }
4511
4512 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4513 {
4514         if (is_rsn_ie)
4515                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4516
4517         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4518 }
4519
4520 static s32
4521 brcmf_configure_wpaie(struct brcmf_if *ifp,
4522                       const struct brcmf_vs_tlv *wpa_ie,
4523                       bool is_rsn_ie)
4524 {
4525         struct brcmf_pub *drvr = ifp->drvr;
4526         u32 auth = 0; /* d11 open authentication */
4527         u16 count;
4528         s32 err = 0;
4529         s32 len;
4530         u32 i;
4531         u32 wsec;
4532         u32 pval = 0;
4533         u32 gval = 0;
4534         u32 wpa_auth = 0;
4535         u32 offset;
4536         u8 *data;
4537         u16 rsn_cap;
4538         u32 wme_bss_disable;
4539         u32 mfp;
4540
4541         brcmf_dbg(TRACE, "Enter\n");
4542         if (wpa_ie == NULL)
4543                 goto exit;
4544
4545         len = wpa_ie->len + TLV_HDR_LEN;
4546         data = (u8 *)wpa_ie;
4547         offset = TLV_HDR_LEN;
4548         if (!is_rsn_ie)
4549                 offset += VS_IE_FIXED_HDR_LEN;
4550         else
4551                 offset += WPA_IE_VERSION_LEN;
4552
4553         /* check for multicast cipher suite */
4554         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4555                 err = -EINVAL;
4556                 bphy_err(drvr, "no multicast cipher suite\n");
4557                 goto exit;
4558         }
4559
4560         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4561                 err = -EINVAL;
4562                 bphy_err(drvr, "ivalid OUI\n");
4563                 goto exit;
4564         }
4565         offset += TLV_OUI_LEN;
4566
4567         /* pick up multicast cipher */
4568         switch (data[offset]) {
4569         case WPA_CIPHER_NONE:
4570                 gval = 0;
4571                 break;
4572         case WPA_CIPHER_WEP_40:
4573         case WPA_CIPHER_WEP_104:
4574                 gval = WEP_ENABLED;
4575                 break;
4576         case WPA_CIPHER_TKIP:
4577                 gval = TKIP_ENABLED;
4578                 break;
4579         case WPA_CIPHER_AES_CCM:
4580                 gval = AES_ENABLED;
4581                 break;
4582         default:
4583                 err = -EINVAL;
4584                 bphy_err(drvr, "Invalid multi cast cipher info\n");
4585                 goto exit;
4586         }
4587
4588         offset++;
4589         /* walk thru unicast cipher list and pick up what we recognize */
4590         count = data[offset] + (data[offset + 1] << 8);
4591         offset += WPA_IE_SUITE_COUNT_LEN;
4592         /* Check for unicast suite(s) */
4593         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4594                 err = -EINVAL;
4595                 bphy_err(drvr, "no unicast cipher suite\n");
4596                 goto exit;
4597         }
4598         for (i = 0; i < count; i++) {
4599                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4600                         err = -EINVAL;
4601                         bphy_err(drvr, "ivalid OUI\n");
4602                         goto exit;
4603                 }
4604                 offset += TLV_OUI_LEN;
4605                 switch (data[offset]) {
4606                 case WPA_CIPHER_NONE:
4607                         break;
4608                 case WPA_CIPHER_WEP_40:
4609                 case WPA_CIPHER_WEP_104:
4610                         pval |= WEP_ENABLED;
4611                         break;
4612                 case WPA_CIPHER_TKIP:
4613                         pval |= TKIP_ENABLED;
4614                         break;
4615                 case WPA_CIPHER_AES_CCM:
4616                         pval |= AES_ENABLED;
4617                         break;
4618                 default:
4619                         bphy_err(drvr, "Invalid unicast security info\n");
4620                 }
4621                 offset++;
4622         }
4623         /* walk thru auth management suite list and pick up what we recognize */
4624         count = data[offset] + (data[offset + 1] << 8);
4625         offset += WPA_IE_SUITE_COUNT_LEN;
4626         /* Check for auth key management suite(s) */
4627         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4628                 err = -EINVAL;
4629                 bphy_err(drvr, "no auth key mgmt suite\n");
4630                 goto exit;
4631         }
4632         for (i = 0; i < count; i++) {
4633                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4634                         err = -EINVAL;
4635                         bphy_err(drvr, "ivalid OUI\n");
4636                         goto exit;
4637                 }
4638                 offset += TLV_OUI_LEN;
4639                 switch (data[offset]) {
4640                 case RSN_AKM_NONE:
4641                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4642                         wpa_auth |= WPA_AUTH_NONE;
4643                         break;
4644                 case RSN_AKM_UNSPECIFIED:
4645                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4646                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4647                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4648                         break;
4649                 case RSN_AKM_PSK:
4650                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4651                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4652                                     (wpa_auth |= WPA_AUTH_PSK);
4653                         break;
4654                 case RSN_AKM_SHA256_PSK:
4655                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4656                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4657                         break;
4658                 case RSN_AKM_SHA256_1X:
4659                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4660                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4661                         break;
4662                 case RSN_AKM_SAE:
4663                         brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4664                         wpa_auth |= WPA3_AUTH_SAE_PSK;
4665                         break;
4666                 default:
4667                         bphy_err(drvr, "Invalid key mgmt info\n");
4668                 }
4669                 offset++;
4670         }
4671
4672         mfp = BRCMF_MFP_NONE;
4673         if (is_rsn_ie) {
4674                 wme_bss_disable = 1;
4675                 if ((offset + RSN_CAP_LEN) <= len) {
4676                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4677                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4678                                 wme_bss_disable = 0;
4679                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4680                                 brcmf_dbg(TRACE, "MFP Required\n");
4681                                 mfp = BRCMF_MFP_REQUIRED;
4682                                 /* Firmware only supports mfp required in
4683                                  * combination with WPA2_AUTH_PSK_SHA256,
4684                                  * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4685                                  */
4686                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4687                                                   WPA2_AUTH_1X_SHA256 |
4688                                                   WPA3_AUTH_SAE_PSK))) {
4689                                         err = -EINVAL;
4690                                         goto exit;
4691                                 }
4692                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4693                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4694                                  * is to be included in the rsn ie.
4695                                  */
4696                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4697                                         wpa_auth |= WPA2_AUTH_PSK;
4698                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4699                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4700                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4701                                 brcmf_dbg(TRACE, "MFP Capable\n");
4702                                 mfp = BRCMF_MFP_CAPABLE;
4703                         }
4704                 }
4705                 offset += RSN_CAP_LEN;
4706                 /* set wme_bss_disable to sync RSN Capabilities */
4707                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4708                                                wme_bss_disable);
4709                 if (err < 0) {
4710                         bphy_err(drvr, "wme_bss_disable error %d\n", err);
4711                         goto exit;
4712                 }
4713
4714                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4715                 offset += RSN_PMKID_COUNT_LEN;
4716
4717                 /* See if there is BIP wpa suite left for MFP */
4718                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4719                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4720                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4721                                                         &data[offset],
4722                                                         WPA_IE_MIN_OUI_LEN);
4723                         if (err < 0) {
4724                                 bphy_err(drvr, "bip error %d\n", err);
4725                                 goto exit;
4726                         }
4727                 }
4728         }
4729         /* FOR WPS , set SES_OW_ENABLED */
4730         wsec = (pval | gval | SES_OW_ENABLED);
4731
4732         /* set auth */
4733         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4734         if (err < 0) {
4735                 bphy_err(drvr, "auth error %d\n", err);
4736                 goto exit;
4737         }
4738         /* set wsec */
4739         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4740         if (err < 0) {
4741                 bphy_err(drvr, "wsec error %d\n", err);
4742                 goto exit;
4743         }
4744         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4745          * will overwrite the values set by MFP
4746          */
4747         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4748                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4749                 if (err < 0) {
4750                         bphy_err(drvr, "mfp error %d\n", err);
4751                         goto exit;
4752                 }
4753         }
4754         /* set upper-layer auth */
4755         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4756         if (err < 0) {
4757                 bphy_err(drvr, "wpa_auth error %d\n", err);
4758                 goto exit;
4759         }
4760
4761 exit:
4762         return err;
4763 }
4764
4765 static s32
4766 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4767                      struct parsed_vndr_ies *vndr_ies)
4768 {
4769         struct brcmf_vs_tlv *vndrie;
4770         struct brcmf_tlv *ie;
4771         struct parsed_vndr_ie_info *parsed_info;
4772         s32 remaining_len;
4773
4774         remaining_len = (s32)vndr_ie_len;
4775         memset(vndr_ies, 0, sizeof(*vndr_ies));
4776
4777         ie = (struct brcmf_tlv *)vndr_ie_buf;
4778         while (ie) {
4779                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4780                         goto next;
4781                 vndrie = (struct brcmf_vs_tlv *)ie;
4782                 /* len should be bigger than OUI length + one */
4783                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4784                         brcmf_err("invalid vndr ie. length is too small %d\n",
4785                                   vndrie->len);
4786                         goto next;
4787                 }
4788                 /* if wpa or wme ie, do not add ie */
4789                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4790                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4791                     (vndrie->oui_type == WME_OUI_TYPE))) {
4792                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4793                         goto next;
4794                 }
4795
4796                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4797
4798                 /* save vndr ie information */
4799                 parsed_info->ie_ptr = (char *)vndrie;
4800                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4801                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4802
4803                 vndr_ies->count++;
4804
4805                 brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4806                           parsed_info->vndrie.oui,
4807                           parsed_info->vndrie.oui_type);
4808
4809                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4810                         break;
4811 next:
4812                 remaining_len -= (ie->len + TLV_HDR_LEN);
4813                 if (remaining_len <= TLV_HDR_LEN)
4814                         ie = NULL;
4815                 else
4816                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4817                                 TLV_HDR_LEN);
4818         }
4819         return 0;
4820 }
4821
4822 static u32
4823 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4824 {
4825         strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4826
4827         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4828
4829         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4830
4831         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4832
4833         return ie_len + VNDR_IE_HDR_SIZE;
4834 }
4835
4836 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4837                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4838 {
4839         struct brcmf_pub *drvr;
4840         struct brcmf_if *ifp;
4841         struct vif_saved_ie *saved_ie;
4842         s32 err = 0;
4843         u8  *iovar_ie_buf;
4844         u8  *curr_ie_buf;
4845         u8  *mgmt_ie_buf = NULL;
4846         int mgmt_ie_buf_len;
4847         u32 *mgmt_ie_len;
4848         u32 del_add_ie_buf_len = 0;
4849         u32 total_ie_buf_len = 0;
4850         u32 parsed_ie_buf_len = 0;
4851         struct parsed_vndr_ies old_vndr_ies;
4852         struct parsed_vndr_ies new_vndr_ies;
4853         struct parsed_vndr_ie_info *vndrie_info;
4854         s32 i;
4855         u8 *ptr;
4856         int remained_buf_len;
4857
4858         if (!vif)
4859                 return -ENODEV;
4860         ifp = vif->ifp;
4861         drvr = ifp->drvr;
4862         saved_ie = &vif->saved_ie;
4863
4864         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4865                   pktflag);
4866         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4867         if (!iovar_ie_buf)
4868                 return -ENOMEM;
4869         curr_ie_buf = iovar_ie_buf;
4870         switch (pktflag) {
4871         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4872                 mgmt_ie_buf = saved_ie->probe_req_ie;
4873                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4874                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4875                 break;
4876         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4877                 mgmt_ie_buf = saved_ie->probe_res_ie;
4878                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4879                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4880                 break;
4881         case BRCMF_VNDR_IE_BEACON_FLAG:
4882                 mgmt_ie_buf = saved_ie->beacon_ie;
4883                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4884                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4885                 break;
4886         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4887                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4888                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4889                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4890                 break;
4891         case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4892                 mgmt_ie_buf = saved_ie->assoc_res_ie;
4893                 mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4894                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4895                 break;
4896         default:
4897                 err = -EPERM;
4898                 bphy_err(drvr, "not suitable type\n");
4899                 goto exit;
4900         }
4901
4902         if (vndr_ie_len > mgmt_ie_buf_len) {
4903                 err = -ENOMEM;
4904                 bphy_err(drvr, "extra IE size too big\n");
4905                 goto exit;
4906         }
4907
4908         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4909         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4910                 ptr = curr_ie_buf;
4911                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4912                 for (i = 0; i < new_vndr_ies.count; i++) {
4913                         vndrie_info = &new_vndr_ies.ie_info[i];
4914                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4915                                vndrie_info->ie_len);
4916                         parsed_ie_buf_len += vndrie_info->ie_len;
4917                 }
4918         }
4919
4920         if (mgmt_ie_buf && *mgmt_ie_len) {
4921                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4922                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4923                             parsed_ie_buf_len) == 0)) {
4924                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4925                         goto exit;
4926                 }
4927
4928                 /* parse old vndr_ie */
4929                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4930
4931                 /* make a command to delete old ie */
4932                 for (i = 0; i < old_vndr_ies.count; i++) {
4933                         vndrie_info = &old_vndr_ies.ie_info[i];
4934
4935                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4936                                   vndrie_info->vndrie.id,
4937                                   vndrie_info->vndrie.len,
4938                                   vndrie_info->vndrie.oui);
4939
4940                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4941                                                            vndrie_info->ie_ptr,
4942                                                            vndrie_info->ie_len,
4943                                                            "del");
4944                         curr_ie_buf += del_add_ie_buf_len;
4945                         total_ie_buf_len += del_add_ie_buf_len;
4946                 }
4947         }
4948
4949         *mgmt_ie_len = 0;
4950         /* Add if there is any extra IE */
4951         if (mgmt_ie_buf && parsed_ie_buf_len) {
4952                 ptr = mgmt_ie_buf;
4953
4954                 remained_buf_len = mgmt_ie_buf_len;
4955
4956                 /* make a command to add new ie */
4957                 for (i = 0; i < new_vndr_ies.count; i++) {
4958                         vndrie_info = &new_vndr_ies.ie_info[i];
4959
4960                         /* verify remained buf size before copy data */
4961                         if (remained_buf_len < (vndrie_info->vndrie.len +
4962                                                         VNDR_IE_VSIE_OFFSET)) {
4963                                 bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4964                                          remained_buf_len);
4965                                 break;
4966                         }
4967                         remained_buf_len -= (vndrie_info->ie_len +
4968                                              VNDR_IE_VSIE_OFFSET);
4969
4970                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4971                                   vndrie_info->vndrie.id,
4972                                   vndrie_info->vndrie.len,
4973                                   vndrie_info->vndrie.oui);
4974
4975                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4976                                                            vndrie_info->ie_ptr,
4977                                                            vndrie_info->ie_len,
4978                                                            "add");
4979
4980                         /* save the parsed IE in wl struct */
4981                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4982                                vndrie_info->ie_len);
4983                         *mgmt_ie_len += vndrie_info->ie_len;
4984
4985                         curr_ie_buf += del_add_ie_buf_len;
4986                         total_ie_buf_len += del_add_ie_buf_len;
4987                 }
4988         }
4989         if (total_ie_buf_len) {
4990                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4991                                                  total_ie_buf_len);
4992                 if (err)
4993                         bphy_err(drvr, "vndr ie set error : %d\n", err);
4994         }
4995
4996 exit:
4997         kfree(iovar_ie_buf);
4998         return err;
4999 }
5000
5001 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
5002 {
5003         static const s32 pktflags[] = {
5004                 BRCMF_VNDR_IE_PRBREQ_FLAG,
5005                 BRCMF_VNDR_IE_PRBRSP_FLAG,
5006                 BRCMF_VNDR_IE_BEACON_FLAG
5007         };
5008         int i;
5009
5010         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
5011                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
5012
5013         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
5014         return 0;
5015 }
5016
5017 static s32
5018 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
5019                         struct cfg80211_beacon_data *beacon)
5020 {
5021         struct brcmf_pub *drvr = vif->ifp->drvr;
5022         s32 err;
5023
5024         /* Set Beacon IEs to FW */
5025         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
5026                                     beacon->tail, beacon->tail_len);
5027         if (err) {
5028                 bphy_err(drvr, "Set Beacon IE Failed\n");
5029                 return err;
5030         }
5031         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
5032
5033         /* Set Probe Response IEs to FW */
5034         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
5035                                     beacon->proberesp_ies,
5036                                     beacon->proberesp_ies_len);
5037         if (err)
5038                 bphy_err(drvr, "Set Probe Resp IE Failed\n");
5039         else
5040                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
5041
5042         /* Set Assoc Response IEs to FW */
5043         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
5044                                     beacon->assocresp_ies,
5045                                     beacon->assocresp_ies_len);
5046         if (err)
5047                 brcmf_err("Set Assoc Resp IE Failed\n");
5048         else
5049                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
5050
5051         return err;
5052 }
5053
5054 static s32
5055 brcmf_parse_configure_security(struct brcmf_if *ifp,
5056                                struct cfg80211_ap_settings *settings,
5057                                enum nl80211_iftype dev_role)
5058 {
5059         const struct brcmf_tlv *rsn_ie;
5060         const struct brcmf_vs_tlv *wpa_ie;
5061         s32 err = 0;
5062
5063         /* find the RSN_IE */
5064         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5065                                   settings->beacon.tail_len, WLAN_EID_RSN);
5066
5067         /* find the WPA_IE */
5068         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
5069                                   settings->beacon.tail_len);
5070
5071         if (wpa_ie || rsn_ie) {
5072                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
5073                 if (wpa_ie) {
5074                         /* WPA IE */
5075                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
5076                         if (err < 0)
5077                                 return err;
5078                 } else {
5079                         struct brcmf_vs_tlv *tmp_ie;
5080
5081                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
5082
5083                         /* RSN IE */
5084                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
5085                         if (err < 0)
5086                                 return err;
5087                 }
5088         } else {
5089                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
5090                 brcmf_configure_opensecurity(ifp);
5091         }
5092
5093         return err;
5094 }
5095
5096 static s32
5097 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
5098                         struct cfg80211_ap_settings *settings)
5099 {
5100         s32 ie_offset;
5101         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5102         struct brcmf_if *ifp = netdev_priv(ndev);
5103         struct brcmf_pub *drvr = cfg->pub;
5104         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5105         struct cfg80211_crypto_settings *crypto = &settings->crypto;
5106         const struct brcmf_tlv *ssid_ie;
5107         const struct brcmf_tlv *country_ie;
5108         struct brcmf_ssid_le ssid_le;
5109         s32 err = -EPERM;
5110         struct brcmf_join_params join_params;
5111         enum nl80211_iftype dev_role;
5112         struct brcmf_fil_bss_enable_le bss_enable;
5113         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
5114         bool mbss;
5115         int is_11d;
5116         bool supports_11d;
5117
5118         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
5119                   settings->chandef.chan->hw_value,
5120                   settings->chandef.center_freq1, settings->chandef.width,
5121                   settings->beacon_interval, settings->dtim_period);
5122         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
5123                   settings->ssid, settings->ssid_len, settings->auth_type,
5124                   settings->inactivity_timeout);
5125         dev_role = ifp->vif->wdev.iftype;
5126         mbss = ifp->vif->mbss;
5127
5128         /* store current 11d setting */
5129         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
5130                                   &ifp->vif->is_11d)) {
5131                 is_11d = supports_11d = false;
5132         } else {
5133                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5134                                               settings->beacon.tail_len,
5135                                               WLAN_EID_COUNTRY);
5136                 is_11d = country_ie ? 1 : 0;
5137                 supports_11d = true;
5138         }
5139
5140         memset(&ssid_le, 0, sizeof(ssid_le));
5141         if (settings->ssid == NULL || settings->ssid_len == 0) {
5142                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
5143                 ssid_ie = brcmf_parse_tlvs(
5144                                 (u8 *)&settings->beacon.head[ie_offset],
5145                                 settings->beacon.head_len - ie_offset,
5146                                 WLAN_EID_SSID);
5147                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
5148                         return -EINVAL;
5149
5150                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
5151                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
5152                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
5153         } else {
5154                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
5155                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
5156         }
5157
5158         if (!mbss) {
5159                 brcmf_set_mpc(ifp, 0);
5160                 brcmf_configure_arp_nd_offload(ifp, false);
5161         }
5162
5163         /* Parameters shared by all radio interfaces */
5164         if (!mbss) {
5165                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
5166                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5167                                                     is_11d);
5168                         if (err < 0) {
5169                                 bphy_err(drvr, "Regulatory Set Error, %d\n",
5170                                          err);
5171                                 goto exit;
5172                         }
5173                 }
5174                 if (settings->beacon_interval) {
5175                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
5176                                                     settings->beacon_interval);
5177                         if (err < 0) {
5178                                 bphy_err(drvr, "Beacon Interval Set Error, %d\n",
5179                                          err);
5180                                 goto exit;
5181                         }
5182                 }
5183                 if (settings->dtim_period) {
5184                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
5185                                                     settings->dtim_period);
5186                         if (err < 0) {
5187                                 bphy_err(drvr, "DTIM Interval Set Error, %d\n",
5188                                          err);
5189                                 goto exit;
5190                         }
5191                 }
5192
5193                 if ((dev_role == NL80211_IFTYPE_AP) &&
5194                     ((ifp->ifidx == 0) ||
5195                      (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
5196                       !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
5197                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5198                         if (err < 0) {
5199                                 bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
5200                                          err);
5201                                 goto exit;
5202                         }
5203                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
5204                 }
5205
5206                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
5207                 if (err < 0) {
5208                         bphy_err(drvr, "SET INFRA error %d\n", err);
5209                         goto exit;
5210                 }
5211         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
5212                 /* Multiple-BSS should use same 11d configuration */
5213                 err = -EINVAL;
5214                 goto exit;
5215         }
5216
5217         /* Interface specific setup */
5218         if (dev_role == NL80211_IFTYPE_AP) {
5219                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
5220                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
5221
5222                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
5223                 if (err < 0) {
5224                         bphy_err(drvr, "setting AP mode failed %d\n",
5225                                  err);
5226                         goto exit;
5227                 }
5228                 if (!mbss) {
5229                         /* Firmware 10.x requires setting channel after enabling
5230                          * AP and before bringing interface up.
5231                          */
5232                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5233                         if (err < 0) {
5234                                 bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5235                                          chanspec, err);
5236                                 goto exit;
5237                         }
5238                 }
5239                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5240                 if (err < 0) {
5241                         bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
5242                         goto exit;
5243                 }
5244
5245                 if (crypto->psk) {
5246                         brcmf_dbg(INFO, "using PSK offload\n");
5247                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
5248                         err = brcmf_set_pmk(ifp, crypto->psk,
5249                                             BRCMF_WSEC_MAX_PSK_LEN);
5250                         if (err < 0)
5251                                 goto exit;
5252                 }
5253                 if (crypto->sae_pwd) {
5254                         brcmf_dbg(INFO, "using SAE offload\n");
5255                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
5256                         err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
5257                                                      crypto->sae_pwd_len);
5258                         if (err < 0)
5259                                 goto exit;
5260                 }
5261                 if (profile->use_fwauth == 0)
5262                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5263
5264                 err = brcmf_parse_configure_security(ifp, settings,
5265                                                      NL80211_IFTYPE_AP);
5266                 if (err < 0) {
5267                         bphy_err(drvr, "brcmf_parse_configure_security error\n");
5268                         goto exit;
5269                 }
5270
5271                 /* On DOWN the firmware removes the WEP keys, reconfigure
5272                  * them if they were set.
5273                  */
5274                 brcmf_cfg80211_reconfigure_wep(ifp);
5275
5276                 memset(&join_params, 0, sizeof(join_params));
5277                 /* join parameters starts with ssid */
5278                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
5279                 /* create softap */
5280                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5281                                              &join_params, sizeof(join_params));
5282                 if (err < 0) {
5283                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5284                         goto exit;
5285                 }
5286
5287                 err = brcmf_fil_iovar_int_set(ifp, "closednet",
5288                                               settings->hidden_ssid);
5289                 if (err) {
5290                         bphy_err(drvr, "%s closednet error (%d)\n",
5291                                  settings->hidden_ssid ?
5292                                  "enabled" : "disabled",
5293                                  err);
5294                         goto exit;
5295                 }
5296
5297                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
5298         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
5299                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5300                 if (err < 0) {
5301                         bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5302                                  chanspec, err);
5303                         goto exit;
5304                 }
5305
5306                 err = brcmf_parse_configure_security(ifp, settings,
5307                                                      NL80211_IFTYPE_P2P_GO);
5308                 if (err < 0) {
5309                         brcmf_err("brcmf_parse_configure_security error\n");
5310                         goto exit;
5311                 }
5312
5313                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
5314                                                 sizeof(ssid_le));
5315                 if (err < 0) {
5316                         bphy_err(drvr, "setting ssid failed %d\n", err);
5317                         goto exit;
5318                 }
5319                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5320                 bss_enable.enable = cpu_to_le32(1);
5321                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5322                                                sizeof(bss_enable));
5323                 if (err < 0) {
5324                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5325                         goto exit;
5326                 }
5327
5328                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
5329         } else {
5330                 WARN_ON(1);
5331         }
5332
5333         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
5334         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5335         brcmf_net_setcarrier(ifp, true);
5336
5337 exit:
5338         if ((err) && (!mbss)) {
5339                 brcmf_set_mpc(ifp, 1);
5340                 brcmf_configure_arp_nd_offload(ifp, true);
5341         }
5342         return err;
5343 }
5344
5345 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
5346                                   unsigned int link_id)
5347 {
5348         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5349         struct brcmf_if *ifp = netdev_priv(ndev);
5350         struct brcmf_pub *drvr = cfg->pub;
5351         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5352         s32 err;
5353         struct brcmf_fil_bss_enable_le bss_enable;
5354         struct brcmf_join_params join_params;
5355
5356         brcmf_dbg(TRACE, "Enter\n");
5357
5358         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
5359                 /* Due to most likely deauths outstanding we sleep */
5360                 /* first to make sure they get processed by fw. */
5361                 msleep(400);
5362
5363                 if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
5364                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
5365                                 brcmf_set_pmk(ifp, NULL, 0);
5366                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
5367                                 brcmf_set_sae_password(ifp, NULL, 0);
5368                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5369                 }
5370
5371                 if (ifp->vif->mbss) {
5372                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5373                         return err;
5374                 }
5375
5376                 /* First BSS doesn't get a full reset */
5377                 if (ifp->bsscfgidx == 0)
5378                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
5379
5380                 memset(&join_params, 0, sizeof(join_params));
5381                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5382                                              &join_params, sizeof(join_params));
5383                 if (err < 0)
5384                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5385                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5386                 if (err < 0)
5387                         bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
5388                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
5389                 if (err < 0)
5390                         bphy_err(drvr, "setting AP mode failed %d\n", err);
5391                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
5392                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
5393                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5394                                       ifp->vif->is_11d);
5395                 /* Bring device back up so it can be used again */
5396                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5397                 if (err < 0)
5398                         bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
5399
5400                 brcmf_vif_clear_mgmt_ies(ifp->vif);
5401         } else {
5402                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5403                 bss_enable.enable = cpu_to_le32(0);
5404                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5405                                                sizeof(bss_enable));
5406                 if (err < 0)
5407                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5408         }
5409         brcmf_set_mpc(ifp, 1);
5410         brcmf_configure_arp_nd_offload(ifp, true);
5411         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5412         brcmf_net_setcarrier(ifp, false);
5413
5414         return err;
5415 }
5416
5417 static s32
5418 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5419                              struct cfg80211_beacon_data *info)
5420 {
5421         struct brcmf_if *ifp = netdev_priv(ndev);
5422
5423         brcmf_dbg(TRACE, "Enter\n");
5424
5425         return brcmf_config_ap_mgmt_ie(ifp->vif, info);
5426 }
5427
5428 static int
5429 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5430                            struct station_del_parameters *params)
5431 {
5432         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5433         struct brcmf_pub *drvr = cfg->pub;
5434         struct brcmf_scb_val_le scbval;
5435         struct brcmf_if *ifp = netdev_priv(ndev);
5436         s32 err;
5437
5438         if (!params->mac)
5439                 return -EFAULT;
5440
5441         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5442
5443         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5444                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5445         if (!check_vif_up(ifp->vif))
5446                 return -EIO;
5447
5448         memcpy(&scbval.ea, params->mac, ETH_ALEN);
5449         scbval.val = cpu_to_le32(params->reason_code);
5450         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5451                                      &scbval, sizeof(scbval));
5452         if (err)
5453                 bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5454                          err);
5455
5456         brcmf_dbg(TRACE, "Exit\n");
5457         return err;
5458 }
5459
5460 static int
5461 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5462                               const u8 *mac, struct station_parameters *params)
5463 {
5464         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5465         struct brcmf_pub *drvr = cfg->pub;
5466         struct brcmf_if *ifp = netdev_priv(ndev);
5467         s32 err;
5468
5469         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5470                   params->sta_flags_mask, params->sta_flags_set);
5471
5472         /* Ignore all 00 MAC */
5473         if (is_zero_ether_addr(mac))
5474                 return 0;
5475
5476         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5477                 return 0;
5478
5479         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5480                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5481                                              (void *)mac, ETH_ALEN);
5482         else
5483                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5484                                              (void *)mac, ETH_ALEN);
5485         if (err < 0)
5486                 bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5487
5488         return err;
5489 }
5490
5491 static void
5492 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5493                                                struct wireless_dev *wdev,
5494                                                struct mgmt_frame_regs *upd)
5495 {
5496         struct brcmf_cfg80211_vif *vif;
5497
5498         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5499
5500         vif->mgmt_rx_reg = upd->interface_stypes;
5501 }
5502
5503
5504 static int
5505 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5506                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5507 {
5508         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5509         struct ieee80211_channel *chan = params->chan;
5510         struct brcmf_pub *drvr = cfg->pub;
5511         const u8 *buf = params->buf;
5512         size_t len = params->len;
5513         const struct ieee80211_mgmt *mgmt;
5514         struct brcmf_cfg80211_vif *vif;
5515         s32 err = 0;
5516         s32 ie_offset;
5517         s32 ie_len;
5518         struct brcmf_fil_action_frame_le *action_frame;
5519         struct brcmf_fil_af_params_le *af_params;
5520         bool ack;
5521         s32 chan_nr;
5522         u32 freq;
5523
5524         brcmf_dbg(TRACE, "Enter\n");
5525
5526         *cookie = 0;
5527
5528         mgmt = (const struct ieee80211_mgmt *)buf;
5529
5530         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5531                 bphy_err(drvr, "Driver only allows MGMT packet type\n");
5532                 return -EPERM;
5533         }
5534
5535         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5536
5537         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5538                 /* Right now the only reason to get a probe response */
5539                 /* is for p2p listen response or for p2p GO from     */
5540                 /* wpa_supplicant. Unfortunately the probe is send   */
5541                 /* on primary ndev, while dongle wants it on the p2p */
5542                 /* vif. Since this is only reason for a probe        */
5543                 /* response to be sent, the vif is taken from cfg.   */
5544                 /* If ever desired to send proberesp for non p2p     */
5545                 /* response then data should be checked for          */
5546                 /* "DIRECT-". Note in future supplicant will take    */
5547                 /* dedicated p2p wdev to do this and then this 'hack'*/
5548                 /* is not needed anymore.                            */
5549                 ie_offset =  DOT11_MGMT_HDR_LEN +
5550                              DOT11_BCN_PRB_FIXED_LEN;
5551                 ie_len = len - ie_offset;
5552                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5553                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5554                 err = brcmf_vif_set_mgmt_ie(vif,
5555                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
5556                                             &buf[ie_offset],
5557                                             ie_len);
5558                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5559                                         GFP_KERNEL);
5560         } else if (ieee80211_is_action(mgmt->frame_control)) {
5561                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5562                         bphy_err(drvr, "invalid action frame length\n");
5563                         err = -EINVAL;
5564                         goto exit;
5565                 }
5566                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5567                 if (af_params == NULL) {
5568                         bphy_err(drvr, "unable to allocate frame\n");
5569                         err = -ENOMEM;
5570                         goto exit;
5571                 }
5572                 action_frame = &af_params->action_frame;
5573                 /* Add the packet Id */
5574                 action_frame->packet_id = cpu_to_le32(*cookie);
5575                 /* Add BSSID */
5576                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5577                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5578                 /* Add the length exepted for 802.11 header  */
5579                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5580                 /* Add the channel. Use the one specified as parameter if any or
5581                  * the current one (got from the firmware) otherwise
5582                  */
5583                 if (chan)
5584                         freq = chan->center_freq;
5585                 else
5586                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5587                                               &freq);
5588                 chan_nr = ieee80211_frequency_to_channel(freq);
5589                 af_params->channel = cpu_to_le32(chan_nr);
5590                 af_params->dwell_time = cpu_to_le32(params->wait);
5591                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5592                        le16_to_cpu(action_frame->len));
5593
5594                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5595                           *cookie, le16_to_cpu(action_frame->len), freq);
5596
5597                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5598                                                   af_params);
5599
5600                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5601                                         GFP_KERNEL);
5602                 kfree(af_params);
5603         } else {
5604                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5605                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5606         }
5607
5608 exit:
5609         return err;
5610 }
5611
5612 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5613                                                     struct net_device *ndev,
5614                                                     s32 rssi_low, s32 rssi_high)
5615 {
5616         struct brcmf_cfg80211_vif *vif;
5617         struct brcmf_if *ifp;
5618         int err = 0;
5619
5620         brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5621
5622         ifp = netdev_priv(ndev);
5623         vif = ifp->vif;
5624
5625         if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5626                 /* The firmware will send an event when the RSSI is less than or
5627                  * equal to a configured level and the previous RSSI event was
5628                  * less than or equal to a different level. Set a third level
5629                  * so that we also detect the transition from rssi <= rssi_high
5630                  * to rssi > rssi_high.
5631                  */
5632                 struct brcmf_rssi_event_le config = {
5633                         .rate_limit_msec = cpu_to_le32(0),
5634                         .rssi_level_num = 3,
5635                         .rssi_levels = {
5636                                 clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5637                                 clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5638                                 S8_MAX,
5639                         },
5640                 };
5641
5642                 err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5643                                                sizeof(config));
5644                 if (err) {
5645                         err = -EINVAL;
5646                 } else {
5647                         vif->cqm_rssi_low = rssi_low;
5648                         vif->cqm_rssi_high = rssi_high;
5649                 }
5650         }
5651
5652         return err;
5653 }
5654
5655 static int
5656 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5657                                         struct wireless_dev *wdev,
5658                                         u64 cookie)
5659 {
5660         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5661         struct brcmf_pub *drvr = cfg->pub;
5662         struct brcmf_cfg80211_vif *vif;
5663         int err = 0;
5664
5665         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5666
5667         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5668         if (vif == NULL) {
5669                 bphy_err(drvr, "No p2p device available for probe response\n");
5670                 err = -ENODEV;
5671                 goto exit;
5672         }
5673         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5674 exit:
5675         return err;
5676 }
5677
5678 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5679                                       struct wireless_dev *wdev,
5680                                       unsigned int link_id,
5681                                       struct cfg80211_chan_def *chandef)
5682 {
5683         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5684         struct net_device *ndev = wdev->netdev;
5685         struct brcmf_pub *drvr = cfg->pub;
5686         struct brcmu_chan ch;
5687         enum nl80211_band band = 0;
5688         enum nl80211_chan_width width = 0;
5689         u32 chanspec;
5690         int freq, err;
5691
5692         if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5693                 return -ENODEV;
5694
5695         err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5696         if (err) {
5697                 bphy_err(drvr, "chanspec failed (%d)\n", err);
5698                 return err;
5699         }
5700
5701         ch.chspec = chanspec;
5702         cfg->d11inf.decchspec(&ch);
5703
5704         switch (ch.band) {
5705         case BRCMU_CHAN_BAND_2G:
5706                 band = NL80211_BAND_2GHZ;
5707                 break;
5708         case BRCMU_CHAN_BAND_5G:
5709                 band = NL80211_BAND_5GHZ;
5710                 break;
5711         }
5712
5713         switch (ch.bw) {
5714         case BRCMU_CHAN_BW_80:
5715                 width = NL80211_CHAN_WIDTH_80;
5716                 break;
5717         case BRCMU_CHAN_BW_40:
5718                 width = NL80211_CHAN_WIDTH_40;
5719                 break;
5720         case BRCMU_CHAN_BW_20:
5721                 width = NL80211_CHAN_WIDTH_20;
5722                 break;
5723         case BRCMU_CHAN_BW_80P80:
5724                 width = NL80211_CHAN_WIDTH_80P80;
5725                 break;
5726         case BRCMU_CHAN_BW_160:
5727                 width = NL80211_CHAN_WIDTH_160;
5728                 break;
5729         }
5730
5731         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5732         chandef->chan = ieee80211_get_channel(wiphy, freq);
5733         chandef->width = width;
5734         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5735         chandef->center_freq2 = 0;
5736
5737         return 0;
5738 }
5739
5740 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5741                                            struct wireless_dev *wdev,
5742                                            enum nl80211_crit_proto_id proto,
5743                                            u16 duration)
5744 {
5745         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5746         struct brcmf_cfg80211_vif *vif;
5747
5748         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5749
5750         /* only DHCP support for now */
5751         if (proto != NL80211_CRIT_PROTO_DHCP)
5752                 return -EINVAL;
5753
5754         /* suppress and abort scanning */
5755         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5756         brcmf_abort_scanning(cfg);
5757
5758         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5759 }
5760
5761 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5762                                            struct wireless_dev *wdev)
5763 {
5764         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5765         struct brcmf_cfg80211_vif *vif;
5766
5767         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5768
5769         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5770         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5771 }
5772
5773 static s32
5774 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5775                              const struct brcmf_event_msg *e, void *data)
5776 {
5777         switch (e->reason) {
5778         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5779                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5780                 break;
5781         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5782                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5783                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5784                 break;
5785         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5786                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5787                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5788                 break;
5789         }
5790
5791         return 0;
5792 }
5793
5794 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5795 {
5796         int ret;
5797
5798         switch (oper) {
5799         case NL80211_TDLS_DISCOVERY_REQ:
5800                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5801                 break;
5802         case NL80211_TDLS_SETUP:
5803                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5804                 break;
5805         case NL80211_TDLS_TEARDOWN:
5806                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5807                 break;
5808         default:
5809                 brcmf_err("unsupported operation: %d\n", oper);
5810                 ret = -EOPNOTSUPP;
5811         }
5812         return ret;
5813 }
5814
5815 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5816                                     struct net_device *ndev, const u8 *peer,
5817                                     enum nl80211_tdls_operation oper)
5818 {
5819         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5820         struct brcmf_pub *drvr = cfg->pub;
5821         struct brcmf_if *ifp;
5822         struct brcmf_tdls_iovar_le info;
5823         int ret = 0;
5824
5825         ret = brcmf_convert_nl80211_tdls_oper(oper);
5826         if (ret < 0)
5827                 return ret;
5828
5829         ifp = netdev_priv(ndev);
5830         memset(&info, 0, sizeof(info));
5831         info.mode = (u8)ret;
5832         if (peer)
5833                 memcpy(info.ea, peer, ETH_ALEN);
5834
5835         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5836                                        &info, sizeof(info));
5837         if (ret < 0)
5838                 bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5839
5840         return ret;
5841 }
5842
5843 static int
5844 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5845                                   struct net_device *ndev,
5846                                   struct cfg80211_connect_params *sme,
5847                                   u32 changed)
5848 {
5849         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5850         struct brcmf_pub *drvr = cfg->pub;
5851         struct brcmf_if *ifp;
5852         int err;
5853
5854         if (!(changed & UPDATE_ASSOC_IES))
5855                 return 0;
5856
5857         ifp = netdev_priv(ndev);
5858         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5859                                     sme->ie, sme->ie_len);
5860         if (err)
5861                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5862         else
5863                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5864
5865         return err;
5866 }
5867
5868 #ifdef CONFIG_PM
5869 static int
5870 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5871                               struct cfg80211_gtk_rekey_data *gtk)
5872 {
5873         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5874         struct brcmf_pub *drvr = cfg->pub;
5875         struct brcmf_if *ifp = netdev_priv(ndev);
5876         struct brcmf_gtk_keyinfo_le gtk_le;
5877         int ret;
5878
5879         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5880
5881         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5882         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5883         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5884                sizeof(gtk_le.replay_counter));
5885
5886         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5887                                        sizeof(gtk_le));
5888         if (ret < 0)
5889                 bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5890
5891         return ret;
5892 }
5893 #endif
5894
5895 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5896                                   const struct cfg80211_pmk_conf *conf)
5897 {
5898         struct brcmf_if *ifp;
5899
5900         brcmf_dbg(TRACE, "enter\n");
5901
5902         /* expect using firmware supplicant for 1X */
5903         ifp = netdev_priv(dev);
5904         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5905                 return -EINVAL;
5906
5907         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5908                 return -ERANGE;
5909
5910         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5911 }
5912
5913 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5914                                   const u8 *aa)
5915 {
5916         struct brcmf_if *ifp;
5917
5918         brcmf_dbg(TRACE, "enter\n");
5919         ifp = netdev_priv(dev);
5920         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5921                 return -EINVAL;
5922
5923         return brcmf_set_pmk(ifp, NULL, 0);
5924 }
5925
5926 static struct cfg80211_ops brcmf_cfg80211_ops = {
5927         .add_virtual_intf = brcmf_cfg80211_add_iface,
5928         .del_virtual_intf = brcmf_cfg80211_del_iface,
5929         .change_virtual_intf = brcmf_cfg80211_change_iface,
5930         .scan = brcmf_cfg80211_scan,
5931         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5932         .join_ibss = brcmf_cfg80211_join_ibss,
5933         .leave_ibss = brcmf_cfg80211_leave_ibss,
5934         .get_station = brcmf_cfg80211_get_station,
5935         .dump_station = brcmf_cfg80211_dump_station,
5936         .set_tx_power = brcmf_cfg80211_set_tx_power,
5937         .get_tx_power = brcmf_cfg80211_get_tx_power,
5938         .add_key = brcmf_cfg80211_add_key,
5939         .del_key = brcmf_cfg80211_del_key,
5940         .get_key = brcmf_cfg80211_get_key,
5941         .set_default_key = brcmf_cfg80211_config_default_key,
5942         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5943         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5944         .connect = brcmf_cfg80211_connect,
5945         .disconnect = brcmf_cfg80211_disconnect,
5946         .suspend = brcmf_cfg80211_suspend,
5947         .resume = brcmf_cfg80211_resume,
5948         .set_pmksa = brcmf_cfg80211_set_pmksa,
5949         .del_pmksa = brcmf_cfg80211_del_pmksa,
5950         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5951         .start_ap = brcmf_cfg80211_start_ap,
5952         .stop_ap = brcmf_cfg80211_stop_ap,
5953         .change_beacon = brcmf_cfg80211_change_beacon,
5954         .del_station = brcmf_cfg80211_del_station,
5955         .change_station = brcmf_cfg80211_change_station,
5956         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5957         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5958         .update_mgmt_frame_registrations =
5959                 brcmf_cfg80211_update_mgmt_frame_registrations,
5960         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5961         .set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
5962         .remain_on_channel = brcmf_p2p_remain_on_channel,
5963         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5964         .get_channel = brcmf_cfg80211_get_channel,
5965         .start_p2p_device = brcmf_p2p_start_device,
5966         .stop_p2p_device = brcmf_p2p_stop_device,
5967         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5968         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5969         .tdls_oper = brcmf_cfg80211_tdls_oper,
5970         .update_connect_params = brcmf_cfg80211_update_conn_params,
5971         .set_pmk = brcmf_cfg80211_set_pmk,
5972         .del_pmk = brcmf_cfg80211_del_pmk,
5973 };
5974
5975 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
5976 {
5977         struct cfg80211_ops *ops;
5978
5979         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5980                        GFP_KERNEL);
5981
5982         if (ops && settings->roamoff)
5983                 ops->update_connect_params = NULL;
5984
5985         return ops;
5986 }
5987
5988 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5989                                            enum nl80211_iftype type)
5990 {
5991         struct brcmf_cfg80211_vif *vif_walk;
5992         struct brcmf_cfg80211_vif *vif;
5993         bool mbss;
5994         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
5995
5996         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5997                   sizeof(*vif));
5998         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5999         if (!vif)
6000                 return ERR_PTR(-ENOMEM);
6001
6002         vif->wdev.wiphy = cfg->wiphy;
6003         vif->wdev.iftype = type;
6004
6005         brcmf_init_prof(&vif->profile);
6006
6007         if (type == NL80211_IFTYPE_AP &&
6008             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
6009                 mbss = false;
6010                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
6011                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
6012                                 mbss = true;
6013                                 break;
6014                         }
6015                 }
6016                 vif->mbss = mbss;
6017         }
6018
6019         list_add_tail(&vif->list, &cfg->vif_list);
6020         return vif;
6021 }
6022
6023 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
6024 {
6025         list_del(&vif->list);
6026         kfree(vif);
6027 }
6028
6029 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
6030 {
6031         struct brcmf_cfg80211_vif *vif;
6032         struct brcmf_if *ifp;
6033
6034         ifp = netdev_priv(ndev);
6035         vif = ifp->vif;
6036
6037         if (vif)
6038                 brcmf_free_vif(vif);
6039 }
6040
6041 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
6042                             const struct brcmf_event_msg *e)
6043 {
6044         u32 event = e->event_code;
6045         u32 status = e->status;
6046
6047         if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
6048              vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
6049             event == BRCMF_E_PSK_SUP &&
6050             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
6051                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6052         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
6053                 brcmf_dbg(CONN, "Processing set ssid\n");
6054                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
6055                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
6056                     vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
6057                         return true;
6058
6059                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6060         }
6061
6062         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
6063             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
6064                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6065                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6066                 return true;
6067         }
6068         return false;
6069 }
6070
6071 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
6072                             const struct brcmf_event_msg *e)
6073 {
6074         u32 event = e->event_code;
6075         u16 flags = e->flags;
6076
6077         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
6078             (event == BRCMF_E_DISASSOC_IND) ||
6079             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
6080                 brcmf_dbg(CONN, "Processing link down\n");
6081                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6082                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6083                 return true;
6084         }
6085         return false;
6086 }
6087
6088 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
6089                                const struct brcmf_event_msg *e)
6090 {
6091         u32 event = e->event_code;
6092         u32 status = e->status;
6093
6094         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
6095                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
6096                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
6097                 return true;
6098         }
6099
6100         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
6101                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
6102                 return true;
6103         }
6104
6105         if (event == BRCMF_E_PSK_SUP &&
6106             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
6107                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
6108                           status);
6109                 return true;
6110         }
6111
6112         return false;
6113 }
6114
6115 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
6116 {
6117         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6118
6119         kfree(conn_info->req_ie);
6120         conn_info->req_ie = NULL;
6121         conn_info->req_ie_len = 0;
6122         kfree(conn_info->resp_ie);
6123         conn_info->resp_ie = NULL;
6124         conn_info->resp_ie_len = 0;
6125 }
6126
6127 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
6128 {
6129         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6130
6131         if (!cfg)
6132                 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
6133                        (prio ^ 2) : prio;
6134
6135         /* For those AC(s) with ACM flag set to 1, convert its 4-level priority
6136          * to an 8-level precedence which is the same as BE's
6137          */
6138         if (prio > PRIO_8021D_EE &&
6139             cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
6140                 return cfg->ac_priority[prio] * 2;
6141
6142         /* Conversion of 4-level priority to 8-level precedence */
6143         if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
6144             prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
6145                 return cfg->ac_priority[prio] * 2;
6146         else
6147                 return cfg->ac_priority[prio] * 2 + 1;
6148 }
6149
6150 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
6151 {
6152         /* Prio here refers to the 802.1d priority in range of 0 to 7.
6153          * ACI here refers to the WLAN AC Index in range of 0 to 3.
6154          * This function will return ACI corresponding to input prio.
6155          */
6156         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6157
6158         if (cfg)
6159                 return cfg->ac_priority[prio];
6160
6161         return prio;
6162 }
6163
6164 static void brcmf_init_wmm_prio(u8 *priority)
6165 {
6166         /* Initialize AC priority array to default
6167          * 802.1d priority as per following table:
6168          * 802.1d prio 0,3 maps to BE
6169          * 802.1d prio 1,2 maps to BK
6170          * 802.1d prio 4,5 maps to VI
6171          * 802.1d prio 6,7 maps to VO
6172          */
6173         priority[0] = BRCMF_FWS_FIFO_AC_BE;
6174         priority[3] = BRCMF_FWS_FIFO_AC_BE;
6175         priority[1] = BRCMF_FWS_FIFO_AC_BK;
6176         priority[2] = BRCMF_FWS_FIFO_AC_BK;
6177         priority[4] = BRCMF_FWS_FIFO_AC_VI;
6178         priority[5] = BRCMF_FWS_FIFO_AC_VI;
6179         priority[6] = BRCMF_FWS_FIFO_AC_VO;
6180         priority[7] = BRCMF_FWS_FIFO_AC_VO;
6181 }
6182
6183 static void brcmf_wifi_prioritize_acparams(const
6184         struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
6185 {
6186         u8 aci;
6187         u8 aifsn;
6188         u8 ecwmin;
6189         u8 ecwmax;
6190         u8 acm;
6191         u8 ranking_basis[EDCF_AC_COUNT];
6192         u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
6193         u8 index;
6194
6195         for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
6196                 aifsn  = acp->ACI & EDCF_AIFSN_MASK;
6197                 acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
6198                 ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
6199                 ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
6200                 brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
6201                           aci, aifsn, acm, ecwmin, ecwmax);
6202                 /* Default AC_VO will be the lowest ranking value */
6203                 ranking_basis[aci] = aifsn + ecwmin + ecwmax;
6204                 /* Initialise priority starting at 0 (AC_BE) */
6205                 aci_prio[aci] = 0;
6206
6207                 /* If ACM is set, STA can't use this AC as per 802.11.
6208                  * Change the ranking to BE
6209                  */
6210                 if (aci != AC_BE && aci != AC_BK && acm == 1)
6211                         ranking_basis[aci] = ranking_basis[AC_BE];
6212         }
6213
6214         /* Ranking method which works for AC priority
6215          * swapping when values for cwmin, cwmax and aifsn are varied
6216          * Compare each aci_prio against each other aci_prio
6217          */
6218         for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
6219                 for (index = 0; index < EDCF_AC_COUNT; index++) {
6220                         if (index != aci) {
6221                                 /* Smaller ranking value has higher priority,
6222                                  * so increment priority for each ACI which has
6223                                  * a higher ranking value
6224                                  */
6225                                 if (ranking_basis[aci] < ranking_basis[index])
6226                                         aci_prio[aci]++;
6227                         }
6228                 }
6229         }
6230
6231         /* By now, aci_prio[] will be in range of 0 to 3.
6232          * Use ACI prio to get the new priority value for
6233          * each 802.1d traffic type, in this range.
6234          */
6235         if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
6236               aci_prio[AC_BK] == aci_prio[AC_VI] &&
6237               aci_prio[AC_VI] == aci_prio[AC_VO])) {
6238                 /* 802.1d 0,3 maps to BE */
6239                 priority[0] = aci_prio[AC_BE];
6240                 priority[3] = aci_prio[AC_BE];
6241
6242                 /* 802.1d 1,2 maps to BK */
6243                 priority[1] = aci_prio[AC_BK];
6244                 priority[2] = aci_prio[AC_BK];
6245
6246                 /* 802.1d 4,5 maps to VO */
6247                 priority[4] = aci_prio[AC_VI];
6248                 priority[5] = aci_prio[AC_VI];
6249
6250                 /* 802.1d 6,7 maps to VO */
6251                 priority[6] = aci_prio[AC_VO];
6252                 priority[7] = aci_prio[AC_VO];
6253         } else {
6254                 /* Initialize to default priority */
6255                 brcmf_init_wmm_prio(priority);
6256         }
6257
6258         brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
6259                   priority[0], priority[1], priority[2], priority[3]);
6260
6261         brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
6262                   priority[4], priority[5], priority[6], priority[7]);
6263 }
6264
6265 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
6266                                struct brcmf_if *ifp)
6267 {
6268         struct brcmf_pub *drvr = cfg->pub;
6269         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
6270         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6271         struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
6272         u32 req_len;
6273         u32 resp_len;
6274         s32 err = 0;
6275
6276         brcmf_clear_assoc_ies(cfg);
6277
6278         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
6279                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
6280         if (err) {
6281                 bphy_err(drvr, "could not get assoc info (%d)\n", err);
6282                 return err;
6283         }
6284         assoc_info =
6285                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
6286         req_len = le32_to_cpu(assoc_info->req_len);
6287         resp_len = le32_to_cpu(assoc_info->resp_len);
6288         if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
6289                 bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
6290                          req_len, resp_len);
6291                 return -EINVAL;
6292         }
6293         if (req_len) {
6294                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
6295                                                cfg->extra_buf,
6296                                                WL_ASSOC_INFO_MAX);
6297                 if (err) {
6298                         bphy_err(drvr, "could not get assoc req (%d)\n", err);
6299                         return err;
6300                 }
6301                 conn_info->req_ie_len = req_len;
6302                 conn_info->req_ie =
6303                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
6304                             GFP_KERNEL);
6305                 if (!conn_info->req_ie)
6306                         conn_info->req_ie_len = 0;
6307         } else {
6308                 conn_info->req_ie_len = 0;
6309                 conn_info->req_ie = NULL;
6310         }
6311         if (resp_len) {
6312                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
6313                                                cfg->extra_buf,
6314                                                WL_ASSOC_INFO_MAX);
6315                 if (err) {
6316                         bphy_err(drvr, "could not get assoc resp (%d)\n", err);
6317                         return err;
6318                 }
6319                 conn_info->resp_ie_len = resp_len;
6320                 conn_info->resp_ie =
6321                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
6322                             GFP_KERNEL);
6323                 if (!conn_info->resp_ie)
6324                         conn_info->resp_ie_len = 0;
6325
6326                 err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
6327                                                edcf_acparam_info,
6328                                                sizeof(edcf_acparam_info));
6329                 if (err) {
6330                         brcmf_err("could not get wme_ac_sta (%d)\n", err);
6331                         return err;
6332                 }
6333
6334                 brcmf_wifi_prioritize_acparams(edcf_acparam_info,
6335                                                cfg->ac_priority);
6336         } else {
6337                 conn_info->resp_ie_len = 0;
6338                 conn_info->resp_ie = NULL;
6339         }
6340         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
6341                   conn_info->req_ie_len, conn_info->resp_ie_len);
6342
6343         return err;
6344 }
6345
6346 static s32
6347 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
6348                        struct net_device *ndev,
6349                        const struct brcmf_event_msg *e)
6350 {
6351         struct brcmf_if *ifp = netdev_priv(ndev);
6352         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6353         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6354         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6355         struct ieee80211_channel *notify_channel = NULL;
6356         struct ieee80211_supported_band *band;
6357         struct brcmf_bss_info_le *bi;
6358         struct brcmu_chan ch;
6359         struct cfg80211_roam_info roam_info = {};
6360         u32 freq;
6361         s32 err = 0;
6362         u8 *buf;
6363
6364         brcmf_dbg(TRACE, "Enter\n");
6365
6366         brcmf_get_assoc_ies(cfg, ifp);
6367         memcpy(profile->bssid, e->addr, ETH_ALEN);
6368         brcmf_update_bss_info(cfg, ifp);
6369
6370         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
6371         if (buf == NULL) {
6372                 err = -ENOMEM;
6373                 goto done;
6374         }
6375
6376         /* data sent to dongle has to be little endian */
6377         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
6378         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
6379                                      buf, WL_BSS_INFO_MAX);
6380
6381         if (err)
6382                 goto done;
6383
6384         bi = (struct brcmf_bss_info_le *)(buf + 4);
6385         ch.chspec = le16_to_cpu(bi->chanspec);
6386         cfg->d11inf.decchspec(&ch);
6387
6388         if (ch.band == BRCMU_CHAN_BAND_2G)
6389                 band = wiphy->bands[NL80211_BAND_2GHZ];
6390         else
6391                 band = wiphy->bands[NL80211_BAND_5GHZ];
6392
6393         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
6394         notify_channel = ieee80211_get_channel(wiphy, freq);
6395
6396 done:
6397         kfree(buf);
6398
6399         roam_info.links[0].channel = notify_channel;
6400         roam_info.links[0].bssid = profile->bssid;
6401         roam_info.req_ie = conn_info->req_ie;
6402         roam_info.req_ie_len = conn_info->req_ie_len;
6403         roam_info.resp_ie = conn_info->resp_ie;
6404         roam_info.resp_ie_len = conn_info->resp_ie_len;
6405
6406         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6407         brcmf_dbg(CONN, "Report roaming result\n");
6408
6409         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6410                 cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
6411                 brcmf_dbg(CONN, "Report port authorized\n");
6412         }
6413
6414         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6415         brcmf_dbg(TRACE, "Exit\n");
6416         return err;
6417 }
6418
6419 static s32
6420 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6421                        struct net_device *ndev, const struct brcmf_event_msg *e,
6422                        bool completed)
6423 {
6424         struct brcmf_if *ifp = netdev_priv(ndev);
6425         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6426         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6427         struct cfg80211_connect_resp_params conn_params;
6428
6429         brcmf_dbg(TRACE, "Enter\n");
6430
6431         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6432                                &ifp->vif->sme_state)) {
6433                 memset(&conn_params, 0, sizeof(conn_params));
6434                 if (completed) {
6435                         brcmf_get_assoc_ies(cfg, ifp);
6436                         brcmf_update_bss_info(cfg, ifp);
6437                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6438                                 &ifp->vif->sme_state);
6439                         conn_params.status = WLAN_STATUS_SUCCESS;
6440                 } else {
6441                         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS,
6442                                   &ifp->vif->sme_state);
6443                         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
6444                                   &ifp->vif->sme_state);
6445                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6446                 }
6447                 conn_params.links[0].bssid = profile->bssid;
6448                 conn_params.req_ie = conn_info->req_ie;
6449                 conn_params.req_ie_len = conn_info->req_ie_len;
6450                 conn_params.resp_ie = conn_info->resp_ie;
6451                 conn_params.resp_ie_len = conn_info->resp_ie_len;
6452                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6453                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
6454                           completed ? "succeeded" : "failed");
6455         }
6456         brcmf_dbg(TRACE, "Exit\n");
6457         return 0;
6458 }
6459
6460 static s32
6461 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6462                                struct net_device *ndev,
6463                                const struct brcmf_event_msg *e, void *data)
6464 {
6465         struct brcmf_pub *drvr = cfg->pub;
6466         static int generation;
6467         u32 event = e->event_code;
6468         u32 reason = e->reason;
6469         struct station_info *sinfo;
6470
6471         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6472                   brcmf_fweh_event_name(event), event, reason);
6473         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6474             ndev != cfg_to_ndev(cfg)) {
6475                 brcmf_dbg(CONN, "AP mode link down\n");
6476                 complete(&cfg->vif_disabled);
6477                 return 0;
6478         }
6479
6480         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6481             (reason == BRCMF_E_STATUS_SUCCESS)) {
6482                 if (!data) {
6483                         bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6484                         return -EINVAL;
6485                 }
6486
6487                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6488                 if (!sinfo)
6489                         return -ENOMEM;
6490
6491                 sinfo->assoc_req_ies = data;
6492                 sinfo->assoc_req_ies_len = e->datalen;
6493                 generation++;
6494                 sinfo->generation = generation;
6495                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6496
6497                 kfree(sinfo);
6498         } else if ((event == BRCMF_E_DISASSOC_IND) ||
6499                    (event == BRCMF_E_DEAUTH_IND) ||
6500                    (event == BRCMF_E_DEAUTH)) {
6501                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6502         }
6503         return 0;
6504 }
6505
6506 static s32
6507 brcmf_notify_connect_status(struct brcmf_if *ifp,
6508                             const struct brcmf_event_msg *e, void *data)
6509 {
6510         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6511         struct net_device *ndev = ifp->ndev;
6512         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6513         struct ieee80211_channel *chan;
6514         s32 err = 0;
6515
6516         if ((e->event_code == BRCMF_E_DEAUTH) ||
6517             (e->event_code == BRCMF_E_DEAUTH_IND) ||
6518             (e->event_code == BRCMF_E_DISASSOC_IND) ||
6519             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6520                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6521         }
6522
6523         if (brcmf_is_apmode(ifp->vif)) {
6524                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6525         } else if (brcmf_is_linkup(ifp->vif, e)) {
6526                 brcmf_dbg(CONN, "Linkup\n");
6527                 if (brcmf_is_ibssmode(ifp->vif)) {
6528                         brcmf_inform_ibss(cfg, ndev, e->addr);
6529                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6530                         memcpy(profile->bssid, e->addr, ETH_ALEN);
6531                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6532                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6533                                   &ifp->vif->sme_state);
6534                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6535                                 &ifp->vif->sme_state);
6536                 } else
6537                         brcmf_bss_connect_done(cfg, ndev, e, true);
6538                 brcmf_net_setcarrier(ifp, true);
6539         } else if (brcmf_is_linkdown(ifp->vif, e)) {
6540                 brcmf_dbg(CONN, "Linkdown\n");
6541                 if (!brcmf_is_ibssmode(ifp->vif) &&
6542                     (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6543                               &ifp->vif->sme_state) ||
6544                      test_bit(BRCMF_VIF_STATUS_CONNECTING,
6545                               &ifp->vif->sme_state))) {
6546                         if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6547                                      &ifp->vif->sme_state) &&
6548                             memcmp(profile->bssid, e->addr, ETH_ALEN))
6549                                 return err;
6550
6551                         brcmf_bss_connect_done(cfg, ndev, e, false);
6552                         brcmf_link_down(ifp->vif,
6553                                         brcmf_map_fw_linkdown_reason(e),
6554                                         e->event_code &
6555                                         (BRCMF_E_DEAUTH_IND |
6556                                         BRCMF_E_DISASSOC_IND)
6557                                         ? false : true);
6558                         brcmf_init_prof(ndev_to_prof(ndev));
6559                         if (ndev != cfg_to_ndev(cfg))
6560                                 complete(&cfg->vif_disabled);
6561                         brcmf_net_setcarrier(ifp, false);
6562                 }
6563         } else if (brcmf_is_nonetwork(cfg, e)) {
6564                 if (brcmf_is_ibssmode(ifp->vif))
6565                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6566                                   &ifp->vif->sme_state);
6567                 else
6568                         brcmf_bss_connect_done(cfg, ndev, e, false);
6569         }
6570
6571         return err;
6572 }
6573
6574 static s32
6575 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6576                             const struct brcmf_event_msg *e, void *data)
6577 {
6578         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6579         u32 event = e->event_code;
6580         u32 status = e->status;
6581
6582         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6583                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6584                              &ifp->vif->sme_state)) {
6585                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6586                 } else {
6587                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6588                         brcmf_net_setcarrier(ifp, true);
6589                 }
6590         }
6591
6592         return 0;
6593 }
6594
6595 static s32
6596 brcmf_notify_mic_status(struct brcmf_if *ifp,
6597                         const struct brcmf_event_msg *e, void *data)
6598 {
6599         u16 flags = e->flags;
6600         enum nl80211_key_type key_type;
6601
6602         if (flags & BRCMF_EVENT_MSG_GROUP)
6603                 key_type = NL80211_KEYTYPE_GROUP;
6604         else
6605                 key_type = NL80211_KEYTYPE_PAIRWISE;
6606
6607         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6608                                      NULL, GFP_KERNEL);
6609
6610         return 0;
6611 }
6612
6613 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6614                              const struct brcmf_event_msg *e, void *data)
6615 {
6616         struct brcmf_cfg80211_vif *vif = ifp->vif;
6617         struct brcmf_rssi_be *info = data;
6618         s32 rssi, snr = 0, noise = 0;
6619         s32 low, high, last;
6620
6621         if (e->datalen >= sizeof(*info)) {
6622                 rssi = be32_to_cpu(info->rssi);
6623                 snr = be32_to_cpu(info->snr);
6624                 noise = be32_to_cpu(info->noise);
6625         } else if (e->datalen >= sizeof(rssi)) {
6626                 rssi = be32_to_cpu(*(__be32 *)data);
6627         } else {
6628                 brcmf_err("insufficient RSSI event data\n");
6629                 return 0;
6630         }
6631
6632         low = vif->cqm_rssi_low;
6633         high = vif->cqm_rssi_high;
6634         last = vif->cqm_rssi_last;
6635
6636         brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6637                   rssi, snr, noise, low, high, last);
6638
6639         vif->cqm_rssi_last = rssi;
6640
6641         if (rssi <= low || rssi == 0) {
6642                 brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6643                 cfg80211_cqm_rssi_notify(ifp->ndev,
6644                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6645                                          rssi, GFP_KERNEL);
6646         } else if (rssi > high) {
6647                 brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6648                 cfg80211_cqm_rssi_notify(ifp->ndev,
6649                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6650                                          rssi, GFP_KERNEL);
6651         }
6652
6653         return 0;
6654 }
6655
6656 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6657                                   const struct brcmf_event_msg *e, void *data)
6658 {
6659         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6660         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6661         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6662         struct brcmf_cfg80211_vif *vif;
6663
6664         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6665                   ifevent->action, ifevent->flags, ifevent->ifidx,
6666                   ifevent->bsscfgidx);
6667
6668         spin_lock(&event->vif_event_lock);
6669         event->action = ifevent->action;
6670         vif = event->vif;
6671
6672         switch (ifevent->action) {
6673         case BRCMF_E_IF_ADD:
6674                 /* waiting process may have timed out */
6675                 if (!cfg->vif_event.vif) {
6676                         spin_unlock(&event->vif_event_lock);
6677                         return -EBADF;
6678                 }
6679
6680                 ifp->vif = vif;
6681                 vif->ifp = ifp;
6682                 if (ifp->ndev) {
6683                         vif->wdev.netdev = ifp->ndev;
6684                         ifp->ndev->ieee80211_ptr = &vif->wdev;
6685                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6686                 }
6687                 spin_unlock(&event->vif_event_lock);
6688                 wake_up(&event->vif_wq);
6689                 return 0;
6690
6691         case BRCMF_E_IF_DEL:
6692                 spin_unlock(&event->vif_event_lock);
6693                 /* event may not be upon user request */
6694                 if (brcmf_cfg80211_vif_event_armed(cfg))
6695                         wake_up(&event->vif_wq);
6696                 return 0;
6697
6698         case BRCMF_E_IF_CHANGE:
6699                 spin_unlock(&event->vif_event_lock);
6700                 wake_up(&event->vif_wq);
6701                 return 0;
6702
6703         default:
6704                 spin_unlock(&event->vif_event_lock);
6705                 break;
6706         }
6707         return -EINVAL;
6708 }
6709
6710 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6711 {
6712         conf->frag_threshold = (u32)-1;
6713         conf->rts_threshold = (u32)-1;
6714         conf->retry_short = (u32)-1;
6715         conf->retry_long = (u32)-1;
6716 }
6717
6718 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6719 {
6720         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6721                             brcmf_notify_connect_status);
6722         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6723                             brcmf_notify_connect_status);
6724         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6725                             brcmf_notify_connect_status);
6726         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6727                             brcmf_notify_connect_status);
6728         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6729                             brcmf_notify_connect_status);
6730         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6731                             brcmf_notify_connect_status);
6732         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6733                             brcmf_notify_roaming_status);
6734         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6735                             brcmf_notify_mic_status);
6736         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6737                             brcmf_notify_connect_status);
6738         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6739                             brcmf_notify_sched_scan_results);
6740         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6741                             brcmf_notify_vif_event);
6742         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6743                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6744         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6745                             brcmf_p2p_notify_listen_complete);
6746         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6747                             brcmf_p2p_notify_action_frame_rx);
6748         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6749                             brcmf_p2p_notify_action_tx_complete);
6750         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6751                             brcmf_p2p_notify_action_tx_complete);
6752         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6753                             brcmf_notify_connect_status);
6754         brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
6755 }
6756
6757 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6758 {
6759         kfree(cfg->conf);
6760         cfg->conf = NULL;
6761         kfree(cfg->extra_buf);
6762         cfg->extra_buf = NULL;
6763         kfree(cfg->wowl.nd);
6764         cfg->wowl.nd = NULL;
6765         kfree(cfg->wowl.nd_info);
6766         cfg->wowl.nd_info = NULL;
6767         kfree(cfg->escan_info.escan_buf);
6768         cfg->escan_info.escan_buf = NULL;
6769 }
6770
6771 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
6772 {
6773         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
6774         if (!cfg->conf)
6775                 goto init_priv_mem_out;
6776         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
6777         if (!cfg->extra_buf)
6778                 goto init_priv_mem_out;
6779         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
6780         if (!cfg->wowl.nd)
6781                 goto init_priv_mem_out;
6782         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
6783                                     sizeof(struct cfg80211_wowlan_nd_match *),
6784                                     GFP_KERNEL);
6785         if (!cfg->wowl.nd_info)
6786                 goto init_priv_mem_out;
6787         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
6788         if (!cfg->escan_info.escan_buf)
6789                 goto init_priv_mem_out;
6790
6791         return 0;
6792
6793 init_priv_mem_out:
6794         brcmf_deinit_priv_mem(cfg);
6795
6796         return -ENOMEM;
6797 }
6798
6799 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
6800 {
6801         s32 err = 0;
6802
6803         cfg->scan_request = NULL;
6804         cfg->pwr_save = true;
6805         cfg->dongle_up = false;         /* dongle is not up yet */
6806         err = brcmf_init_priv_mem(cfg);
6807         if (err)
6808                 return err;
6809         brcmf_register_event_handlers(cfg);
6810         mutex_init(&cfg->usr_sync);
6811         brcmf_init_escan(cfg);
6812         brcmf_init_conf(cfg->conf);
6813         brcmf_init_wmm_prio(cfg->ac_priority);
6814         init_completion(&cfg->vif_disabled);
6815         return err;
6816 }
6817
6818 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
6819 {
6820         cfg->dongle_up = false; /* dongle down */
6821         brcmf_abort_scanning(cfg);
6822         brcmf_deinit_priv_mem(cfg);
6823         brcmf_clear_assoc_ies(cfg);
6824 }
6825
6826 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
6827 {
6828         init_waitqueue_head(&event->vif_wq);
6829         spin_lock_init(&event->vif_event_lock);
6830 }
6831
6832 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
6833 {
6834         struct brcmf_pub *drvr = ifp->drvr;
6835         s32 err;
6836         u32 bcn_timeout;
6837         __le32 roamtrigger[2];
6838         __le32 roam_delta[2];
6839
6840         /* Configure beacon timeout value based upon roaming setting */
6841         if (ifp->drvr->settings->roamoff)
6842                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
6843         else
6844                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
6845         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
6846         if (err) {
6847                 bphy_err(drvr, "bcn_timeout error (%d)\n", err);
6848                 goto roam_setup_done;
6849         }
6850
6851         /* Enable/Disable built-in roaming to allow supplicant to take care of
6852          * roaming.
6853          */
6854         brcmf_dbg(INFO, "Internal Roaming = %s\n",
6855                   ifp->drvr->settings->roamoff ? "Off" : "On");
6856         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
6857                                       ifp->drvr->settings->roamoff);
6858         if (err) {
6859                 bphy_err(drvr, "roam_off error (%d)\n", err);
6860                 goto roam_setup_done;
6861         }
6862
6863         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
6864         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
6865         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
6866                                      (void *)roamtrigger, sizeof(roamtrigger));
6867         if (err)
6868                 bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
6869
6870         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
6871         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
6872         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
6873                                      (void *)roam_delta, sizeof(roam_delta));
6874         if (err)
6875                 bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
6876
6877         return 0;
6878
6879 roam_setup_done:
6880         return err;
6881 }
6882
6883 static s32
6884 brcmf_dongle_scantime(struct brcmf_if *ifp)
6885 {
6886         struct brcmf_pub *drvr = ifp->drvr;
6887         s32 err = 0;
6888
6889         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
6890                                     BRCMF_SCAN_CHANNEL_TIME);
6891         if (err) {
6892                 bphy_err(drvr, "Scan assoc time error (%d)\n", err);
6893                 goto dongle_scantime_out;
6894         }
6895         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
6896                                     BRCMF_SCAN_UNASSOC_TIME);
6897         if (err) {
6898                 bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
6899                 goto dongle_scantime_out;
6900         }
6901
6902         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
6903                                     BRCMF_SCAN_PASSIVE_TIME);
6904         if (err) {
6905                 bphy_err(drvr, "Scan passive time error (%d)\n", err);
6906                 goto dongle_scantime_out;
6907         }
6908
6909 dongle_scantime_out:
6910         return err;
6911 }
6912
6913 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6914                                            struct brcmu_chan *ch)
6915 {
6916         u32 ht40_flag;
6917
6918         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6919         if (ch->sb == BRCMU_CHAN_SB_U) {
6920                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6921                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6922                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6923         } else {
6924                 /* It should be one of
6925                  * IEEE80211_CHAN_NO_HT40 or
6926                  * IEEE80211_CHAN_NO_HT40PLUS
6927                  */
6928                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6929                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6930                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6931         }
6932 }
6933
6934 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6935                                     u32 bw_cap[])
6936 {
6937         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6938         struct brcmf_pub *drvr = cfg->pub;
6939         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6940         struct ieee80211_supported_band *band;
6941         struct ieee80211_channel *channel;
6942         struct brcmf_chanspec_list *list;
6943         struct brcmu_chan ch;
6944         int err;
6945         u8 *pbuf;
6946         u32 i, j;
6947         u32 total;
6948         u32 chaninfo;
6949
6950         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6951
6952         if (pbuf == NULL)
6953                 return -ENOMEM;
6954
6955         list = (struct brcmf_chanspec_list *)pbuf;
6956
6957         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6958                                        BRCMF_DCMD_MEDLEN);
6959         if (err) {
6960                 bphy_err(drvr, "get chanspecs error (%d)\n", err);
6961                 goto fail_pbuf;
6962         }
6963
6964         band = wiphy->bands[NL80211_BAND_2GHZ];
6965         if (band)
6966                 for (i = 0; i < band->n_channels; i++)
6967                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6968         band = wiphy->bands[NL80211_BAND_5GHZ];
6969         if (band)
6970                 for (i = 0; i < band->n_channels; i++)
6971                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6972
6973         total = le32_to_cpu(list->count);
6974         if (total > BRCMF_MAX_CHANSPEC_LIST) {
6975                 bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6976                          total);
6977                 err = -EINVAL;
6978                 goto fail_pbuf;
6979         }
6980
6981         for (i = 0; i < total; i++) {
6982                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6983                 cfg->d11inf.decchspec(&ch);
6984
6985                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6986                         band = wiphy->bands[NL80211_BAND_2GHZ];
6987                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6988                         band = wiphy->bands[NL80211_BAND_5GHZ];
6989                 } else {
6990                         bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
6991                                  ch.chspec);
6992                         continue;
6993                 }
6994                 if (!band)
6995                         continue;
6996                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6997                     ch.bw == BRCMU_CHAN_BW_40)
6998                         continue;
6999                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
7000                     ch.bw == BRCMU_CHAN_BW_80)
7001                         continue;
7002
7003                 channel = NULL;
7004                 for (j = 0; j < band->n_channels; j++) {
7005                         if (band->channels[j].hw_value == ch.control_ch_num) {
7006                                 channel = &band->channels[j];
7007                                 break;
7008                         }
7009                 }
7010                 if (!channel) {
7011                         /* It seems firmware supports some channel we never
7012                          * considered. Something new in IEEE standard?
7013                          */
7014                         bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
7015                                  ch.control_ch_num);
7016                         continue;
7017                 }
7018
7019                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
7020                         continue;
7021
7022                 /* assuming the chanspecs order is HT20,
7023                  * HT40 upper, HT40 lower, and VHT80.
7024                  */
7025                 switch (ch.bw) {
7026                 case BRCMU_CHAN_BW_160:
7027                         channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
7028                         break;
7029                 case BRCMU_CHAN_BW_80:
7030                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
7031                         break;
7032                 case BRCMU_CHAN_BW_40:
7033                         brcmf_update_bw40_channel_flag(channel, &ch);
7034                         break;
7035                 default:
7036                         wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
7037                                    ch.bw);
7038                         fallthrough;
7039                 case BRCMU_CHAN_BW_20:
7040                         /* enable the channel and disable other bandwidths
7041                          * for now as mentioned order assure they are enabled
7042                          * for subsequent chanspecs.
7043                          */
7044                         channel->flags = IEEE80211_CHAN_NO_HT40 |
7045                                          IEEE80211_CHAN_NO_80MHZ |
7046                                          IEEE80211_CHAN_NO_160MHZ;
7047                         ch.bw = BRCMU_CHAN_BW_20;
7048                         cfg->d11inf.encchspec(&ch);
7049                         chaninfo = ch.chspec;
7050                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
7051                                                        &chaninfo);
7052                         if (!err) {
7053                                 if (chaninfo & WL_CHAN_RADAR)
7054                                         channel->flags |=
7055                                                 (IEEE80211_CHAN_RADAR |
7056                                                  IEEE80211_CHAN_NO_IR);
7057                                 if (chaninfo & WL_CHAN_PASSIVE)
7058                                         channel->flags |=
7059                                                 IEEE80211_CHAN_NO_IR;
7060                         }
7061                 }
7062         }
7063
7064 fail_pbuf:
7065         kfree(pbuf);
7066         return err;
7067 }
7068
7069 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
7070 {
7071         struct brcmf_pub *drvr = cfg->pub;
7072         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7073         struct ieee80211_supported_band *band;
7074         struct brcmf_fil_bwcap_le band_bwcap;
7075         struct brcmf_chanspec_list *list;
7076         u8 *pbuf;
7077         u32 val;
7078         int err;
7079         struct brcmu_chan ch;
7080         u32 num_chan;
7081         int i, j;
7082
7083         /* verify support for bw_cap command */
7084         val = WLC_BAND_5G;
7085         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
7086
7087         if (!err) {
7088                 /* only set 2G bandwidth using bw_cap command */
7089                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
7090                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
7091                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
7092                                                sizeof(band_bwcap));
7093         } else {
7094                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
7095                 val = WLC_N_BW_40ALL;
7096                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
7097         }
7098
7099         if (!err) {
7100                 /* update channel info in 2G band */
7101                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7102
7103                 if (pbuf == NULL)
7104                         return -ENOMEM;
7105
7106                 ch.band = BRCMU_CHAN_BAND_2G;
7107                 ch.bw = BRCMU_CHAN_BW_40;
7108                 ch.sb = BRCMU_CHAN_SB_NONE;
7109                 ch.chnum = 0;
7110                 cfg->d11inf.encchspec(&ch);
7111
7112                 /* pass encoded chanspec in query */
7113                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
7114
7115                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
7116                                                BRCMF_DCMD_MEDLEN);
7117                 if (err) {
7118                         bphy_err(drvr, "get chanspecs error (%d)\n", err);
7119                         kfree(pbuf);
7120                         return err;
7121                 }
7122
7123                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
7124                 list = (struct brcmf_chanspec_list *)pbuf;
7125                 num_chan = le32_to_cpu(list->count);
7126                 if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
7127                         bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7128                                  num_chan);
7129                         kfree(pbuf);
7130                         return -EINVAL;
7131                 }
7132
7133                 for (i = 0; i < num_chan; i++) {
7134                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
7135                         cfg->d11inf.decchspec(&ch);
7136                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
7137                                 continue;
7138                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
7139                                 continue;
7140                         for (j = 0; j < band->n_channels; j++) {
7141                                 if (band->channels[j].hw_value == ch.control_ch_num)
7142                                         break;
7143                         }
7144                         if (WARN_ON(j == band->n_channels))
7145                                 continue;
7146
7147                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
7148                 }
7149                 kfree(pbuf);
7150         }
7151         return err;
7152 }
7153
7154 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
7155 {
7156         struct brcmf_pub *drvr = ifp->drvr;
7157         u32 band, mimo_bwcap;
7158         int err;
7159
7160         band = WLC_BAND_2G;
7161         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7162         if (!err) {
7163                 bw_cap[NL80211_BAND_2GHZ] = band;
7164                 band = WLC_BAND_5G;
7165                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7166                 if (!err) {
7167                         bw_cap[NL80211_BAND_5GHZ] = band;
7168                         return;
7169                 }
7170                 WARN_ON(1);
7171                 return;
7172         }
7173         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
7174         mimo_bwcap = 0;
7175         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
7176         if (err)
7177                 /* assume 20MHz if firmware does not give a clue */
7178                 mimo_bwcap = WLC_N_BW_20ALL;
7179
7180         switch (mimo_bwcap) {
7181         case WLC_N_BW_40ALL:
7182                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
7183                 fallthrough;
7184         case WLC_N_BW_20IN2G_40IN5G:
7185                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
7186                 fallthrough;
7187         case WLC_N_BW_20ALL:
7188                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
7189                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
7190                 break;
7191         default:
7192                 bphy_err(drvr, "invalid mimo_bw_cap value\n");
7193         }
7194 }
7195
7196 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
7197                                 u32 bw_cap[2], u32 nchain)
7198 {
7199         band->ht_cap.ht_supported = true;
7200         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
7201                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
7202                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7203         }
7204         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
7205         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
7206         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
7207         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
7208         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
7209         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
7210 }
7211
7212 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
7213 {
7214         u16 mcs_map;
7215         int i;
7216
7217         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
7218                 mcs_map = (mcs_map << 2) | supp;
7219
7220         return cpu_to_le16(mcs_map);
7221 }
7222
7223 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
7224                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
7225                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
7226 {
7227         __le16 mcs_map;
7228
7229         /* not allowed in 2.4G band */
7230         if (band->band == NL80211_BAND_2GHZ)
7231                 return;
7232
7233         band->vht_cap.vht_supported = true;
7234         /* 80MHz is mandatory */
7235         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
7236         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
7237                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
7238                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
7239         }
7240         /* all support 256-QAM */
7241         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
7242         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
7243         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
7244
7245         /* Beamforming support information */
7246         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
7247                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
7248         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
7249                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
7250         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
7251                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
7252         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
7253                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
7254
7255         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
7256                 band->vht_cap.cap |=
7257                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
7258                 band->vht_cap.cap |= ((txstreams - 1) <<
7259                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
7260                 band->vht_cap.cap |=
7261                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
7262         }
7263 }
7264
7265 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
7266 {
7267         struct brcmf_pub *drvr = cfg->pub;
7268         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7269         struct wiphy *wiphy = cfg_to_wiphy(cfg);
7270         u32 nmode = 0;
7271         u32 vhtmode = 0;
7272         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
7273         u32 rxchain;
7274         u32 nchain;
7275         int err;
7276         s32 i;
7277         struct ieee80211_supported_band *band;
7278         u32 txstreams = 0;
7279         u32 txbf_bfe_cap = 0;
7280         u32 txbf_bfr_cap = 0;
7281
7282         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
7283         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
7284         if (err) {
7285                 bphy_err(drvr, "nmode error (%d)\n", err);
7286         } else {
7287                 brcmf_get_bwcap(ifp, bw_cap);
7288         }
7289         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
7290                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
7291                   bw_cap[NL80211_BAND_5GHZ]);
7292
7293         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
7294         if (err) {
7295                 /* rxchain unsupported by firmware of older chips */
7296                 if (err == -EBADE)
7297                         bphy_info_once(drvr, "rxchain unsupported\n");
7298                 else
7299                         bphy_err(drvr, "rxchain error (%d)\n", err);
7300
7301                 nchain = 1;
7302         } else {
7303                 for (nchain = 0; rxchain; nchain++)
7304                         rxchain = rxchain & (rxchain - 1);
7305         }
7306         brcmf_dbg(INFO, "nchain=%d\n", nchain);
7307
7308         err = brcmf_construct_chaninfo(cfg, bw_cap);
7309         if (err) {
7310                 bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
7311                 return err;
7312         }
7313
7314         if (vhtmode) {
7315                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
7316                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
7317                                               &txbf_bfe_cap);
7318                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
7319                                               &txbf_bfr_cap);
7320         }
7321
7322         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
7323                 band = wiphy->bands[i];
7324                 if (band == NULL)
7325                         continue;
7326
7327                 if (nmode)
7328                         brcmf_update_ht_cap(band, bw_cap, nchain);
7329                 if (vhtmode)
7330                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
7331                                              txbf_bfe_cap, txbf_bfr_cap);
7332         }
7333
7334         return 0;
7335 }
7336
7337 static const struct ieee80211_txrx_stypes
7338 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
7339         [NL80211_IFTYPE_STATION] = {
7340                 .tx = 0xffff,
7341                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7342                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7343         },
7344         [NL80211_IFTYPE_P2P_CLIENT] = {
7345                 .tx = 0xffff,
7346                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7347                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7348         },
7349         [NL80211_IFTYPE_P2P_GO] = {
7350                 .tx = 0xffff,
7351                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7352                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7353                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7354                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7355                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7356                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7357                       BIT(IEEE80211_STYPE_ACTION >> 4)
7358         },
7359         [NL80211_IFTYPE_P2P_DEVICE] = {
7360                 .tx = 0xffff,
7361                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7362                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7363         },
7364         [NL80211_IFTYPE_AP] = {
7365                 .tx = 0xffff,
7366                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7367                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7368                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7369                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7370                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7371                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7372                       BIT(IEEE80211_STYPE_ACTION >> 4)
7373         }
7374 };
7375
7376 /**
7377  * brcmf_setup_ifmodes() - determine interface modes and combinations.
7378  *
7379  * @wiphy: wiphy object.
7380  * @ifp: interface object needed for feat module api.
7381  *
7382  * The interface modes and combinations are determined dynamically here
7383  * based on firmware functionality.
7384  *
7385  * no p2p and no mbss:
7386  *
7387  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7388  *
7389  * no p2p and mbss:
7390  *
7391  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7392  *      #AP <= 4, matching BI, channels = 1, 4 total
7393  *
7394  * no p2p and rsdb:
7395  *      #STA <= 1, #AP <= 2, channels = 2, 4 total
7396  *
7397  * p2p, no mchan, and mbss:
7398  *
7399  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
7400  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7401  *      #AP <= 4, matching BI, channels = 1, 4 total
7402  *
7403  * p2p, mchan, and mbss:
7404  *
7405  *      #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
7406  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7407  *      #AP <= 4, matching BI, channels = 1, 4 total
7408  *
7409  * p2p, rsdb, and no mbss:
7410  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
7411  *       channels = 2, 4 total
7412  */
7413 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
7414 {
7415         struct ieee80211_iface_combination *combo = NULL;
7416         struct ieee80211_iface_limit *c0_limits = NULL;
7417         struct ieee80211_iface_limit *p2p_limits = NULL;
7418         struct ieee80211_iface_limit *mbss_limits = NULL;
7419         bool mon_flag, mbss, p2p, rsdb, mchan;
7420         int i, c, n_combos, n_limits;
7421
7422         mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
7423         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
7424         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
7425         rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
7426         mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
7427
7428         n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7429         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7430         if (!combo)
7431                 goto err;
7432
7433         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7434                                  BIT(NL80211_IFTYPE_ADHOC) |
7435                                  BIT(NL80211_IFTYPE_AP);
7436         if (mon_flag)
7437                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7438         if (p2p)
7439                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7440                                           BIT(NL80211_IFTYPE_P2P_GO) |
7441                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
7442
7443         c = 0;
7444         i = 0;
7445         n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7446         c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7447         if (!c0_limits)
7448                 goto err;
7449
7450         combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7451         c0_limits[i].max = 1 + (p2p && mchan);
7452         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7453         if (mon_flag) {
7454                 c0_limits[i].max = 1;
7455                 c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7456         }
7457         if (p2p) {
7458                 c0_limits[i].max = 1;
7459                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7460                 c0_limits[i].max = 1 + rsdb;
7461                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7462                                        BIT(NL80211_IFTYPE_P2P_GO);
7463         }
7464         if (p2p && rsdb) {
7465                 c0_limits[i].max = 2;
7466                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7467                 combo[c].max_interfaces = 4;
7468         } else if (p2p) {
7469                 combo[c].max_interfaces = i;
7470         } else if (rsdb) {
7471                 c0_limits[i].max = 2;
7472                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7473                 combo[c].max_interfaces = 3;
7474         } else {
7475                 c0_limits[i].max = 1;
7476                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7477                 combo[c].max_interfaces = i;
7478         }
7479         combo[c].n_limits = i;
7480         combo[c].limits = c0_limits;
7481
7482         if (p2p && !rsdb) {
7483                 c++;
7484                 i = 0;
7485                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7486                 if (!p2p_limits)
7487                         goto err;
7488                 p2p_limits[i].max = 1;
7489                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7490                 p2p_limits[i].max = 1;
7491                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7492                 p2p_limits[i].max = 1;
7493                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7494                 p2p_limits[i].max = 1;
7495                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7496                 combo[c].num_different_channels = 1;
7497                 combo[c].max_interfaces = i;
7498                 combo[c].n_limits = i;
7499                 combo[c].limits = p2p_limits;
7500         }
7501
7502         if (mbss) {
7503                 c++;
7504                 i = 0;
7505                 n_limits = 1 + mon_flag;
7506                 mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7507                                       GFP_KERNEL);
7508                 if (!mbss_limits)
7509                         goto err;
7510                 mbss_limits[i].max = 4;
7511                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7512                 if (mon_flag) {
7513                         mbss_limits[i].max = 1;
7514                         mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7515                 }
7516                 combo[c].beacon_int_infra_match = true;
7517                 combo[c].num_different_channels = 1;
7518                 combo[c].max_interfaces = 4 + mon_flag;
7519                 combo[c].n_limits = i;
7520                 combo[c].limits = mbss_limits;
7521         }
7522
7523         wiphy->n_iface_combinations = n_combos;
7524         wiphy->iface_combinations = combo;
7525         return 0;
7526
7527 err:
7528         kfree(c0_limits);
7529         kfree(p2p_limits);
7530         kfree(mbss_limits);
7531         kfree(combo);
7532         return -ENOMEM;
7533 }
7534
7535 #ifdef CONFIG_PM
7536 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7537         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7538         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
7539         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7540         .pattern_min_len = 1,
7541         .max_pkt_offset = 1500,
7542 };
7543 #endif
7544
7545 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7546 {
7547 #ifdef CONFIG_PM
7548         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7549         struct brcmf_pub *drvr = cfg->pub;
7550         struct wiphy_wowlan_support *wowl;
7551
7552         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7553                        GFP_KERNEL);
7554         if (!wowl) {
7555                 bphy_err(drvr, "only support basic wowlan features\n");
7556                 wiphy->wowlan = &brcmf_wowlan_support;
7557                 return;
7558         }
7559
7560         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7561                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7562                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7563                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7564                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
7565                 }
7566         }
7567         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7568                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7569                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7570         }
7571
7572         wiphy->wowlan = wowl;
7573 #endif
7574 }
7575
7576 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7577 {
7578         struct brcmf_pub *drvr = ifp->drvr;
7579         const struct ieee80211_iface_combination *combo;
7580         struct ieee80211_supported_band *band;
7581         u16 max_interfaces = 0;
7582         bool gscan;
7583         __le32 bandlist[3];
7584         u32 n_bands;
7585         int err, i;
7586
7587         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7588         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7589         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7590
7591         err = brcmf_setup_ifmodes(wiphy, ifp);
7592         if (err)
7593                 return err;
7594
7595         for (i = 0, combo = wiphy->iface_combinations;
7596              i < wiphy->n_iface_combinations; i++, combo++) {
7597                 max_interfaces = max(max_interfaces, combo->max_interfaces);
7598         }
7599
7600         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7601              i++) {
7602                 u8 *addr = drvr->addresses[i].addr;
7603
7604                 memcpy(addr, drvr->mac, ETH_ALEN);
7605                 if (i) {
7606                         addr[0] |= BIT(1);
7607                         addr[ETH_ALEN - 1] ^= i;
7608                 }
7609         }
7610         wiphy->addresses = drvr->addresses;
7611         wiphy->n_addresses = i;
7612
7613         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7614         wiphy->cipher_suites = brcmf_cipher_suites;
7615         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7616         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7617                 wiphy->n_cipher_suites--;
7618         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7619                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7620                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7621
7622         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7623                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
7624                         WIPHY_FLAG_HAVE_AP_SME |
7625                         WIPHY_FLAG_OFFCHAN_TX |
7626                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7627         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7628                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7629         if (!ifp->drvr->settings->roamoff)
7630                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7631         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7632                 wiphy_ext_feature_set(wiphy,
7633                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7634                 wiphy_ext_feature_set(wiphy,
7635                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7636                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7637                         wiphy_ext_feature_set(wiphy,
7638                                               NL80211_EXT_FEATURE_SAE_OFFLOAD);
7639         }
7640         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7641                 wiphy_ext_feature_set(wiphy,
7642                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7643                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7644                         wiphy_ext_feature_set(wiphy,
7645                                               NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7646         }
7647         wiphy->mgmt_stypes = brcmf_txrx_stypes;
7648         wiphy->max_remain_on_channel_duration = 5000;
7649         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7650                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7651                 brcmf_pno_wiphy_params(wiphy, gscan);
7652         }
7653         /* vendor commands/events support */
7654         wiphy->vendor_commands = brcmf_vendor_cmds;
7655         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7656
7657         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7658                 brcmf_wiphy_wowl_params(wiphy, ifp);
7659         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7660                                      sizeof(bandlist));
7661         if (err) {
7662                 bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7663                 return err;
7664         }
7665         /* first entry in bandlist is number of bands */
7666         n_bands = le32_to_cpu(bandlist[0]);
7667         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7668                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7669                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7670                                        GFP_KERNEL);
7671                         if (!band)
7672                                 return -ENOMEM;
7673
7674                         band->channels = kmemdup(&__wl_2ghz_channels,
7675                                                  sizeof(__wl_2ghz_channels),
7676                                                  GFP_KERNEL);
7677                         if (!band->channels) {
7678                                 kfree(band);
7679                                 return -ENOMEM;
7680                         }
7681
7682                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7683                         wiphy->bands[NL80211_BAND_2GHZ] = band;
7684                 }
7685                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7686                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7687                                        GFP_KERNEL);
7688                         if (!band)
7689                                 return -ENOMEM;
7690
7691                         band->channels = kmemdup(&__wl_5ghz_channels,
7692                                                  sizeof(__wl_5ghz_channels),
7693                                                  GFP_KERNEL);
7694                         if (!band->channels) {
7695                                 kfree(band);
7696                                 return -ENOMEM;
7697                         }
7698
7699                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7700                         wiphy->bands[NL80211_BAND_5GHZ] = band;
7701                 }
7702         }
7703
7704         if (wiphy->bands[NL80211_BAND_5GHZ] &&
7705             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7706                 wiphy_ext_feature_set(wiphy,
7707                                       NL80211_EXT_FEATURE_DFS_OFFLOAD);
7708
7709         wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7710
7711         wiphy_read_of_freq_limits(wiphy);
7712
7713         return 0;
7714 }
7715
7716 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7717 {
7718         struct brcmf_pub *drvr = cfg->pub;
7719         struct net_device *ndev;
7720         struct wireless_dev *wdev;
7721         struct brcmf_if *ifp;
7722         s32 power_mode;
7723         s32 err = 0;
7724
7725         if (cfg->dongle_up)
7726                 return err;
7727
7728         ndev = cfg_to_ndev(cfg);
7729         wdev = ndev->ieee80211_ptr;
7730         ifp = netdev_priv(ndev);
7731
7732         /* make sure RF is ready for work */
7733         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7734
7735         brcmf_dongle_scantime(ifp);
7736
7737         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7738         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7739         if (err)
7740                 goto default_conf_out;
7741         brcmf_dbg(INFO, "power save set to %s\n",
7742                   (power_mode ? "enabled" : "disabled"));
7743
7744         err = brcmf_dongle_roam(ifp);
7745         if (err)
7746                 goto default_conf_out;
7747         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7748                                           NULL);
7749         if (err)
7750                 goto default_conf_out;
7751
7752         brcmf_configure_arp_nd_offload(ifp, true);
7753
7754         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7755         if (err) {
7756                 bphy_err(drvr, "failed to set frameburst mode\n");
7757                 goto default_conf_out;
7758         }
7759
7760         cfg->dongle_up = true;
7761 default_conf_out:
7762
7763         return err;
7764
7765 }
7766
7767 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
7768 {
7769         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7770
7771         return brcmf_config_dongle(ifp->drvr->config);
7772 }
7773
7774 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
7775 {
7776         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7777
7778         /*
7779          * While going down, if associated with AP disassociate
7780          * from AP to save power
7781          */
7782         if (check_vif_up(ifp->vif)) {
7783                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
7784
7785                 /* Make sure WPA_Supplicant receives all the event
7786                    generated due to DISASSOC call to the fw to keep
7787                    the state fw and WPA_Supplicant state consistent
7788                  */
7789                 brcmf_delay(500);
7790         }
7791
7792         brcmf_abort_scanning(cfg);
7793         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7794
7795         return 0;
7796 }
7797
7798 s32 brcmf_cfg80211_up(struct net_device *ndev)
7799 {
7800         struct brcmf_if *ifp = netdev_priv(ndev);
7801         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7802         s32 err = 0;
7803
7804         mutex_lock(&cfg->usr_sync);
7805         err = __brcmf_cfg80211_up(ifp);
7806         mutex_unlock(&cfg->usr_sync);
7807
7808         return err;
7809 }
7810
7811 s32 brcmf_cfg80211_down(struct net_device *ndev)
7812 {
7813         struct brcmf_if *ifp = netdev_priv(ndev);
7814         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7815         s32 err = 0;
7816
7817         mutex_lock(&cfg->usr_sync);
7818         err = __brcmf_cfg80211_down(ifp);
7819         mutex_unlock(&cfg->usr_sync);
7820
7821         return err;
7822 }
7823
7824 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
7825 {
7826         struct wireless_dev *wdev = &ifp->vif->wdev;
7827
7828         return wdev->iftype;
7829 }
7830
7831 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
7832                              unsigned long state)
7833 {
7834         struct brcmf_cfg80211_vif *vif;
7835
7836         list_for_each_entry(vif, &cfg->vif_list, list) {
7837                 if (test_bit(state, &vif->sme_state))
7838                         return true;
7839         }
7840         return false;
7841 }
7842
7843 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
7844                                     u8 action)
7845 {
7846         u8 evt_action;
7847
7848         spin_lock(&event->vif_event_lock);
7849         evt_action = event->action;
7850         spin_unlock(&event->vif_event_lock);
7851         return evt_action == action;
7852 }
7853
7854 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
7855                                   struct brcmf_cfg80211_vif *vif)
7856 {
7857         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7858
7859         spin_lock(&event->vif_event_lock);
7860         event->vif = vif;
7861         event->action = 0;
7862         spin_unlock(&event->vif_event_lock);
7863 }
7864
7865 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
7866 {
7867         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7868         bool armed;
7869
7870         spin_lock(&event->vif_event_lock);
7871         armed = event->vif != NULL;
7872         spin_unlock(&event->vif_event_lock);
7873
7874         return armed;
7875 }
7876
7877 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
7878                                   u8 action, ulong timeout)
7879 {
7880         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7881
7882         return wait_event_timeout(event->vif_wq,
7883                                   vif_event_equals(event, action), timeout);
7884 }
7885
7886 static bool brmcf_use_iso3166_ccode_fallback(struct brcmf_pub *drvr)
7887 {
7888         if (drvr->settings->trivial_ccode_map)
7889                 return true;
7890
7891         switch (drvr->bus_if->chip) {
7892         case BRCM_CC_43430_CHIP_ID:
7893         case BRCM_CC_4345_CHIP_ID:
7894         case BRCM_CC_4356_CHIP_ID:
7895         case BRCM_CC_43602_CHIP_ID:
7896                 return true;
7897         default:
7898                 return false;
7899         }
7900 }
7901
7902 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
7903                                         struct brcmf_fil_country_le *ccreq)
7904 {
7905         struct brcmfmac_pd_cc *country_codes;
7906         struct brcmfmac_pd_cc_entry *cc;
7907         s32 found_index;
7908         int i;
7909
7910         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
7911             (alpha2[1] == ccreq->country_abbrev[1])) {
7912                 brcmf_dbg(TRACE, "Country code already set\n");
7913                 return -EAGAIN;
7914         }
7915
7916         country_codes = drvr->settings->country_codes;
7917         if (!country_codes) {
7918                 if (brmcf_use_iso3166_ccode_fallback(drvr)) {
7919                         brcmf_dbg(TRACE, "No country codes configured for device, using ISO3166 code and 0 rev\n");
7920                         memset(ccreq, 0, sizeof(*ccreq));
7921                         ccreq->country_abbrev[0] = alpha2[0];
7922                         ccreq->country_abbrev[1] = alpha2[1];
7923                         ccreq->ccode[0] = alpha2[0];
7924                         ccreq->ccode[1] = alpha2[1];
7925                         return 0;
7926                 }
7927
7928                 brcmf_dbg(TRACE, "No country codes configured for device\n");
7929                 return -EINVAL;
7930         }
7931
7932         found_index = -1;
7933         for (i = 0; i < country_codes->table_size; i++) {
7934                 cc = &country_codes->table[i];
7935                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
7936                         found_index = i;
7937                 if ((cc->iso3166[0] == alpha2[0]) &&
7938                     (cc->iso3166[1] == alpha2[1])) {
7939                         found_index = i;
7940                         break;
7941                 }
7942         }
7943         if (found_index == -1) {
7944                 brcmf_dbg(TRACE, "No country code match found\n");
7945                 return -EINVAL;
7946         }
7947         memset(ccreq, 0, sizeof(*ccreq));
7948         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
7949         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
7950                BRCMF_COUNTRY_BUF_SZ);
7951         ccreq->country_abbrev[0] = alpha2[0];
7952         ccreq->country_abbrev[1] = alpha2[1];
7953         ccreq->country_abbrev[2] = 0;
7954
7955         return 0;
7956 }
7957
7958 static int
7959 brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
7960 {
7961         int i;
7962         char *token;
7963         char delim[] = "\n ";
7964         unsigned long val;
7965         int err = 0;
7966
7967         token = strsep(&buf, delim);
7968         while (token) {
7969                 if (!strcmp(token, "OBSS")) {
7970                         for (i = 0; i < OBSS_TOKEN_IDX; i++)
7971                                 token = strsep(&buf, delim);
7972                         err = kstrtoul(token, 10, &val);
7973                         if (err)
7974                                 break;
7975                         survey->obss = val;
7976                 }
7977
7978                 if (!strcmp(token, "IBSS")) {
7979                         for (i = 0; i < IBSS_TOKEN_IDX; i++)
7980                                 token = strsep(&buf, delim);
7981                         err = kstrtoul(token, 10, &val);
7982                         if (err)
7983                                 break;
7984                         survey->ibss = val;
7985                 }
7986
7987                 if (!strcmp(token, "TXDur")) {
7988                         for (i = 0; i < TX_TOKEN_IDX; i++)
7989                                 token = strsep(&buf, delim);
7990                         err = kstrtoul(token, 10, &val);
7991                         if (err)
7992                                 break;
7993                         survey->tx = val;
7994                 }
7995
7996                 if (!strcmp(token, "Category")) {
7997                         for (i = 0; i < CTG_TOKEN_IDX; i++)
7998                                 token = strsep(&buf, delim);
7999                         err = kstrtoul(token, 10, &val);
8000                         if (err)
8001                                 break;
8002                         survey->no_ctg = val;
8003                 }
8004
8005                 if (!strcmp(token, "Packet")) {
8006                         for (i = 0; i < PKT_TOKEN_IDX; i++)
8007                                 token = strsep(&buf, delim);
8008                         err = kstrtoul(token, 10, &val);
8009                         if (err)
8010                                 break;
8011                         survey->no_pckt = val;
8012                 }
8013
8014                 if (!strcmp(token, "Opp(time):")) {
8015                         for (i = 0; i < IDLE_TOKEN_IDX; i++)
8016                                 token = strsep(&buf, delim);
8017                         err = kstrtoul(token, 10, &val);
8018                         if (err)
8019                                 break;
8020                         survey->idle = val;
8021                 }
8022
8023                 token = strsep(&buf, delim);
8024         }
8025
8026         return err;
8027 }
8028
8029 static int
8030 brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
8031                 struct brcmf_dump_survey *survey)
8032 {
8033         struct cca_stats_n_flags *results;
8034         char *buf;
8035         int err;
8036
8037         buf = kzalloc(sizeof(char) * BRCMF_DCMD_MEDLEN, GFP_KERNEL);
8038         if (!buf)
8039                 return -ENOMEM;
8040
8041         memcpy(buf, &req, sizeof(struct cca_msrmnt_query));
8042         err = brcmf_fil_iovar_data_get(ifp, "dump_obss",
8043                                        buf, BRCMF_DCMD_MEDLEN);
8044         if (err) {
8045                 brcmf_err("dump_obss error (%d)\n", err);
8046                 err = -EINVAL;
8047                 goto exit;
8048         }
8049         results = (struct cca_stats_n_flags *)(buf);
8050
8051         if (req.msrmnt_query)
8052                 brcmf_parse_dump_obss(results->buf, survey);
8053
8054 exit:
8055         kfree(buf);
8056         return err;
8057 }
8058
8059 static s32
8060 brcmf_set_channel(struct brcmf_cfg80211_info *cfg, struct ieee80211_channel *chan)
8061 {
8062         u16 chspec = 0;
8063         int err = 0;
8064         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8065
8066         if (chan->flags & IEEE80211_CHAN_DISABLED)
8067                 return -EINVAL;
8068
8069         /* set_channel */
8070         chspec = channel_to_chanspec(&cfg->d11inf, chan);
8071         if (chspec != INVCHANSPEC) {
8072                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chspec);
8073                 if (err) {
8074                         brcmf_err("set chanspec 0x%04x fail, reason %d\n", chspec, err);
8075                         err = -EINVAL;
8076                 }
8077         } else {
8078                 brcmf_err("failed to convert host chanspec to fw chanspec\n");
8079                 err = -EINVAL;
8080         }
8081
8082         return err;
8083 }
8084
8085 static int
8086 brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
8087                            int idx, struct survey_info *info)
8088 {
8089         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8090         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8091         struct brcmf_dump_survey survey = {};
8092         struct ieee80211_supported_band *band;
8093         enum nl80211_band band_id;
8094         struct cca_msrmnt_query req;
8095         u32 noise;
8096         int err;
8097
8098         brcmf_dbg(TRACE, "Enter: channel idx=%d\n", idx);
8099
8100         /* Do not run survey when VIF in CONNECTING / CONNECTED states */
8101         if ((test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) ||
8102             (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))) {
8103                 return -EBUSY;
8104         }
8105
8106         for (band_id = 0; band_id < NUM_NL80211_BANDS; band_id++) {
8107                 band = wiphy->bands[band_id];
8108                 if (!band)
8109                         continue;
8110                 if (idx >= band->n_channels) {
8111                         idx -= band->n_channels;
8112                         continue;
8113                 }
8114
8115                 info->channel = &band->channels[idx];
8116                 break;
8117         }
8118         if (band_id == NUM_NL80211_BANDS)
8119                 return -ENOENT;
8120
8121         /* Setting current channel to the requested channel */
8122         info->filled = 0;
8123         if (brcmf_set_channel(cfg, info->channel))
8124                 return 0;
8125
8126         /* Disable mpc */
8127         brcmf_set_mpc(ifp, 0);
8128
8129         /* Set interface up, explicitly. */
8130         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
8131         if (err) {
8132                 brcmf_err("set interface up failed, err = %d\n", err);
8133                 goto exit;
8134         }
8135
8136         /* Get noise value */
8137         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
8138         if (err) {
8139                 brcmf_err("Get Phy Noise failed, use dummy value\n");
8140                 noise = CHAN_NOISE_DUMMY;
8141         }
8142
8143         /* Start Measurement for obss stats on current channel */
8144         req.msrmnt_query = 0;
8145         req.time_req = ACS_MSRMNT_DELAY;
8146         err = brcmf_dump_obss(ifp, req, &survey);
8147         if (err)
8148                 goto exit;
8149
8150         /* Add 10 ms for IOVAR completion */
8151         msleep(ACS_MSRMNT_DELAY + 10);
8152
8153         /* Issue IOVAR to collect measurement results */
8154         req.msrmnt_query = 1;
8155         err = brcmf_dump_obss(ifp, req, &survey);
8156         if (err)
8157                 goto exit;
8158
8159         info->noise = noise;
8160         info->time = ACS_MSRMNT_DELAY;
8161         info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
8162         info->time_rx = survey.obss + survey.ibss + survey.no_ctg +
8163                 survey.no_pckt;
8164         info->time_tx = survey.tx;
8165         info->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_TIME |
8166                 SURVEY_INFO_TIME_BUSY | SURVEY_INFO_TIME_RX |
8167                 SURVEY_INFO_TIME_TX;
8168
8169         brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
8170                   ieee80211_frequency_to_channel(info->channel->center_freq),
8171                   ACS_MSRMNT_DELAY);
8172         brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
8173                   info->noise, info->time_busy, info->time_rx, info->time_tx);
8174
8175 exit:
8176         if (!brcmf_is_apmode(ifp->vif))
8177                 brcmf_set_mpc(ifp, 1);
8178         return err;
8179 }
8180
8181 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
8182                                         struct regulatory_request *req)
8183 {
8184         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8185         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
8186         struct brcmf_pub *drvr = cfg->pub;
8187         struct brcmf_fil_country_le ccreq;
8188         s32 err;
8189         int i;
8190
8191         /* The country code gets set to "00" by default at boot, ignore */
8192         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
8193                 return;
8194
8195         /* ignore non-ISO3166 country codes */
8196         for (i = 0; i < 2; i++)
8197                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
8198                         bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
8199                                  req->alpha2[0], req->alpha2[1]);
8200                         return;
8201                 }
8202
8203         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
8204                   req->alpha2[0], req->alpha2[1]);
8205
8206         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
8207         if (err) {
8208                 bphy_err(drvr, "Country code iovar returned err = %d\n", err);
8209                 return;
8210         }
8211
8212         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
8213         if (err)
8214                 return;
8215
8216         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
8217         if (err) {
8218                 bphy_err(drvr, "Firmware rejected country setting\n");
8219                 return;
8220         }
8221         brcmf_setup_wiphybands(cfg);
8222 }
8223
8224 static void brcmf_free_wiphy(struct wiphy *wiphy)
8225 {
8226         int i;
8227
8228         if (!wiphy)
8229                 return;
8230
8231         if (wiphy->iface_combinations) {
8232                 for (i = 0; i < wiphy->n_iface_combinations; i++)
8233                         kfree(wiphy->iface_combinations[i].limits);
8234         }
8235         kfree(wiphy->iface_combinations);
8236         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8237                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
8238                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
8239         }
8240         if (wiphy->bands[NL80211_BAND_5GHZ]) {
8241                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
8242                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
8243         }
8244 #if IS_ENABLED(CONFIG_PM)
8245         if (wiphy->wowlan != &brcmf_wowlan_support)
8246                 kfree(wiphy->wowlan);
8247 #endif
8248 }
8249
8250 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
8251                                                   struct cfg80211_ops *ops,
8252                                                   bool p2pdev_forced)
8253 {
8254         struct wiphy *wiphy = drvr->wiphy;
8255         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
8256         struct brcmf_cfg80211_info *cfg;
8257         struct brcmf_cfg80211_vif *vif;
8258         struct brcmf_if *ifp;
8259         s32 err = 0;
8260         s32 io_type;
8261         u16 *cap = NULL;
8262
8263         if (!ndev) {
8264                 bphy_err(drvr, "ndev is invalid\n");
8265                 return NULL;
8266         }
8267
8268         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
8269         if (!cfg) {
8270                 bphy_err(drvr, "Could not allocate wiphy device\n");
8271                 return NULL;
8272         }
8273
8274         cfg->wiphy = wiphy;
8275         cfg->pub = drvr;
8276         init_vif_event(&cfg->vif_event);
8277         INIT_LIST_HEAD(&cfg->vif_list);
8278
8279         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
8280         if (IS_ERR(vif))
8281                 goto wiphy_out;
8282
8283         ifp = netdev_priv(ndev);
8284         vif->ifp = ifp;
8285         vif->wdev.netdev = ndev;
8286         ndev->ieee80211_ptr = &vif->wdev;
8287         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
8288
8289         err = wl_init_priv(cfg);
8290         if (err) {
8291                 bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
8292                 brcmf_free_vif(vif);
8293                 goto wiphy_out;
8294         }
8295         ifp->vif = vif;
8296
8297         /* determine d11 io type before wiphy setup */
8298         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
8299         if (err) {
8300                 bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
8301                 goto priv_out;
8302         }
8303         cfg->d11inf.io_type = (u8)io_type;
8304         brcmu_d11_attach(&cfg->d11inf);
8305
8306         /* regulatory notifer below needs access to cfg so
8307          * assign it now.
8308          */
8309         drvr->config = cfg;
8310
8311         err = brcmf_setup_wiphy(wiphy, ifp);
8312         if (err < 0)
8313                 goto priv_out;
8314
8315         brcmf_dbg(INFO, "Registering custom regulatory\n");
8316         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
8317         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
8318         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
8319
8320         /* firmware defaults to 40MHz disabled in 2G band. We signal
8321          * cfg80211 here that we do and have it decide we can enable
8322          * it. But first check if device does support 2G operation.
8323          */
8324         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8325                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
8326                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8327         }
8328 #ifdef CONFIG_PM
8329         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
8330                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
8331 #endif
8332         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DUMP_OBSS))
8333                 ops->dump_survey = brcmf_cfg80211_dump_survey;
8334
8335         err = wiphy_register(wiphy);
8336         if (err < 0) {
8337                 bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
8338                 goto priv_out;
8339         }
8340
8341         err = brcmf_setup_wiphybands(cfg);
8342         if (err) {
8343                 bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
8344                 goto wiphy_unreg_out;
8345         }
8346
8347         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
8348          * setup 40MHz in 2GHz band and enable OBSS scanning.
8349          */
8350         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
8351                 err = brcmf_enable_bw40_2g(cfg);
8352                 if (!err)
8353                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
8354                                                       BRCMF_OBSS_COEX_AUTO);
8355                 else
8356                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8357         }
8358
8359         err = brcmf_fweh_activate_events(ifp);
8360         if (err) {
8361                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8362                 goto wiphy_unreg_out;
8363         }
8364
8365         err = brcmf_p2p_attach(cfg, p2pdev_forced);
8366         if (err) {
8367                 bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
8368                 goto wiphy_unreg_out;
8369         }
8370         err = brcmf_btcoex_attach(cfg);
8371         if (err) {
8372                 bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
8373                 brcmf_p2p_detach(&cfg->p2p);
8374                 goto wiphy_unreg_out;
8375         }
8376         err = brcmf_pno_attach(cfg);
8377         if (err) {
8378                 bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
8379                 brcmf_btcoex_detach(cfg);
8380                 brcmf_p2p_detach(&cfg->p2p);
8381                 goto wiphy_unreg_out;
8382         }
8383
8384         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
8385                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
8386                 if (err) {
8387                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
8388                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
8389                 } else {
8390                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
8391                                             brcmf_notify_tdls_peer_event);
8392                 }
8393         }
8394
8395         /* (re-) activate FWEH event handling */
8396         err = brcmf_fweh_activate_events(ifp);
8397         if (err) {
8398                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8399                 goto detach;
8400         }
8401
8402         /* Fill in some of the advertised nl80211 supported features */
8403         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
8404                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
8405 #ifdef CONFIG_PM
8406                 if (wiphy->wowlan &&
8407                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
8408                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8409 #endif
8410         }
8411
8412         return cfg;
8413
8414 detach:
8415         brcmf_pno_detach(cfg);
8416         brcmf_btcoex_detach(cfg);
8417         brcmf_p2p_detach(&cfg->p2p);
8418 wiphy_unreg_out:
8419         wiphy_unregister(cfg->wiphy);
8420 priv_out:
8421         wl_deinit_priv(cfg);
8422         brcmf_free_vif(vif);
8423         ifp->vif = NULL;
8424 wiphy_out:
8425         brcmf_free_wiphy(wiphy);
8426         kfree(cfg);
8427         return NULL;
8428 }
8429
8430 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
8431 {
8432         if (!cfg)
8433                 return;
8434
8435         brcmf_pno_detach(cfg);
8436         brcmf_btcoex_detach(cfg);
8437         wiphy_unregister(cfg->wiphy);
8438         wl_deinit_priv(cfg);
8439         brcmf_free_wiphy(cfg->wiphy);
8440         kfree(cfg);
8441 }