drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2010 Broadcom Corporation
   4  */
   5
   6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/vmalloc.h>
  12 #include <net/cfg80211.h>
  13 #include <net/netlink.h>
  14 #include <uapi/linux/if_arp.h>
  15
  16 #include <brcmu_utils.h>
  17 #include <defs.h>
  18 #include <brcmu_wifi.h>
  19 #include <brcm_hw_ids.h>
  20 #include "core.h"
  21 #include "debug.h"
  22 #include "tracepoint.h"
  23 #include "fwil_types.h"
  24 #include "p2p.h"
  25 #include "btcoex.h"
  26 #include "pno.h"
  27 #include "fwsignal.h"
  28 #include "cfg80211.h"
  29 #include "feature.h"
  30 #include "fwil.h"
  31 #include "proto.h"
  32 #include "vendor.h"
  33 #include "bus.h"
  34 #include "common.h"
  35
  36 #define BRCMF_SCAN_IE_LEN_MAX           2048
  37
  38 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  39 #define WPA_OUI_TYPE                    1
  40 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  41 #define WME_OUI_TYPE                    2
  42 #define WPS_OUI_TYPE                    4
  43
  44 #define VS_IE_FIXED_HDR_LEN             6
  45 #define WPA_IE_VERSION_LEN              2
  46 #define WPA_IE_MIN_OUI_LEN              4
  47 #define WPA_IE_SUITE_COUNT_LEN          2
  48
  49 #define WPA_CIPHER_NONE                 0       /* None */
  50 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  51 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  52 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  53 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  54
  55 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  56 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  57 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  58 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  59 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  60 #define RSN_AKM_SAE                     8       /* SAE */
  61 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  62 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  63 #define RSN_CAP_MFPR_MASK               BIT(6)
  64 #define RSN_CAP_MFPC_MASK               BIT(7)
  65 #define RSN_PMKID_COUNT_LEN             2
  66
  67 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  68                                                  * string :"add", "del" (+ NUL)
  69                                                  */
  70 #define VNDR_IE_COUNT_OFFSET            4
  71 #define VNDR_IE_PKTFLAG_OFFSET          8
  72 #define VNDR_IE_VSIE_OFFSET             12
  73 #define VNDR_IE_HDR_SIZE                12
  74 #define VNDR_IE_PARSE_LIMIT             5
  75
  76 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  77 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  78
  79 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  80 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  81 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  82
  83 #define BRCMF_SCAN_CHANNEL_TIME         40
  84 #define BRCMF_SCAN_UNASSOC_TIME         40
  85 #define BRCMF_SCAN_PASSIVE_TIME         120
  86
  87 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  88
  89 #define BRCMF_PS_MAX_TIMEOUT_MS         2000
  90
  91 /* Dump obss definitions */
  92 #define ACS_MSRMNT_DELAY                80
  93 #define CHAN_NOISE_DUMMY                (-80)
  94 #define OBSS_TOKEN_IDX                  15
  95 #define IBSS_TOKEN_IDX                  15
  96 #define TX_TOKEN_IDX                    14
  97 #define CTG_TOKEN_IDX                   13
  98 #define PKT_TOKEN_IDX                   15
  99 #define IDLE_TOKEN_IDX                  12
 100
 101 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 102         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 103
 104 #define BRCMF_MAX_CHANSPEC_LIST \
 105         (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
 106
 107 struct brcmf_dump_survey {
 108         u32 obss;
 109         u32 ibss;
 110         u32 no_ctg;
 111         u32 no_pckt;
 112         u32 tx;
 113         u32 idle;
 114 };
 115
 116 struct cca_stats_n_flags {
 117         u32 msrmnt_time; /* Time for Measurement (msec) */
 118         u32 msrmnt_done; /* flag set when measurement complete */
 119         char buf[1];
 120 };
 121
 122 struct cca_msrmnt_query {
 123         u32 msrmnt_query;
 124         u32 time_req;
 125 };
 126
 127 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 128 {
 129         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 130                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 131                           vif->sme_state);
 132                 return false;
 133         }
 134         return true;
 135 }
 136
 137 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 138 #define RATETAB_ENT(_rateid, _flags) \
 139         {                                                               \
 140                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 141                 .hw_value       = (_rateid),                            \
 142                 .flags          = (_flags),                             \
 143         }
 144
 145 static struct ieee80211_rate __wl_rates[] = {
 146         RATETAB_ENT(BRCM_RATE_1M, 0),
 147         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 148         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(BRCM_RATE_6M, 0),
 151         RATETAB_ENT(BRCM_RATE_9M, 0),
 152         RATETAB_ENT(BRCM_RATE_12M, 0),
 153         RATETAB_ENT(BRCM_RATE_18M, 0),
 154         RATETAB_ENT(BRCM_RATE_24M, 0),
 155         RATETAB_ENT(BRCM_RATE_36M, 0),
 156         RATETAB_ENT(BRCM_RATE_48M, 0),
 157         RATETAB_ENT(BRCM_RATE_54M, 0),
 158 };
 159
 160 #define wl_g_rates              (__wl_rates + 0)
 161 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 162 #define wl_a_rates              (__wl_rates + 4)
 163 #define wl_a_rates_size         (wl_g_rates_size - 4)
 164
 165 #define CHAN2G(_channel, _freq) {                               \
 166         .band                   = NL80211_BAND_2GHZ,            \
 167         .center_freq            = (_freq),                      \
 168         .hw_value               = (_channel),                   \
 169         .max_antenna_gain       = 0,                            \
 170         .max_power              = 30,                           \
 171 }
 172
 173 #define CHAN5G(_channel) {                                      \
 174         .band                   = NL80211_BAND_5GHZ,            \
 175         .center_freq            = 5000 + (5 * (_channel)),      \
 176         .hw_value               = (_channel),                   \
 177         .max_antenna_gain       = 0,                            \
 178         .max_power              = 30,                           \
 179 }
 180
 181 static struct ieee80211_channel __wl_2ghz_channels[] = {
 182         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 183         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 184         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 185         CHAN2G(13, 2472), CHAN2G(14, 2484)
 186 };
 187
 188 static struct ieee80211_channel __wl_5ghz_channels[] = {
 189         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 190         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 191         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 192         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 193         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 194         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 195 };
 196
 197 /* Band templates duplicated per wiphy. The channel info
 198  * above is added to the band during setup.
 199  */
 200 static const struct ieee80211_supported_band __wl_band_2ghz = {
 201         .band = NL80211_BAND_2GHZ,
 202         .bitrates = wl_g_rates,
 203         .n_bitrates = wl_g_rates_size,
 204 };
 205
 206 static const struct ieee80211_supported_band __wl_band_5ghz = {
 207         .band = NL80211_BAND_5GHZ,
 208         .bitrates = wl_a_rates,
 209         .n_bitrates = wl_a_rates_size,
 210 };
 211
 212 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 213  * By default world regulatory domain defined in reg.c puts the flags
 214  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 215  * With respect to these flags, wpa_supplicant doesn't * start p2p
 216  * operations on 5GHz channels. All the changes in world regulatory
 217  * domain are to be done here.
 218  */
 219 static const struct ieee80211_regdomain brcmf_regdom = {
 220         .n_reg_rules = 4,
 221         .alpha2 =  "99",
 222         .reg_rules = {
 223                 /* IEEE 802.11b/g, channels 1..11 */
 224                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 225                 /* If any */
 226                 /* IEEE 802.11 channel 14 - Only JP enables
 227                  * this and for 802.11b only
 228                  */
 229                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 230                 /* IEEE 802.11a, channel 36..64 */
 231                 REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
 232                 /* IEEE 802.11a, channel 100..165 */
 233                 REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
 234 };
 235
 236 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 237  * are supported. A pointer to this array and the number of entries is passed
 238  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 239  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 240  * device does not support MFP then the number of suites will be decreased by 1
 241  */
 242 static const u32 brcmf_cipher_suites[] = {
 243         WLAN_CIPHER_SUITE_WEP40,
 244         WLAN_CIPHER_SUITE_WEP104,
 245         WLAN_CIPHER_SUITE_TKIP,
 246         WLAN_CIPHER_SUITE_CCMP,
 247         /* Keep as last entry: */
 248         WLAN_CIPHER_SUITE_AES_CMAC
 249 };
 250
 251 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 252 struct brcmf_vs_tlv {
 253         u8 id;
 254         u8 len;
 255         u8 oui[3];
 256         u8 oui_type;
 257 };
 258
 259 struct parsed_vndr_ie_info {
 260         u8 *ie_ptr;
 261         u32 ie_len;     /* total length including id & length field */
 262         struct brcmf_vs_tlv vndrie;
 263 };
 264
 265 struct parsed_vndr_ies {
 266         u32 count;
 267         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 268 };
 269
 270 #define WL_INTERFACE_CREATE_VER_1               1
 271 #define WL_INTERFACE_CREATE_VER_2               2
 272 #define WL_INTERFACE_CREATE_VER_3               3
 273 #define WL_INTERFACE_CREATE_VER_MAX             WL_INTERFACE_CREATE_VER_3
 274
 275 #define WL_INTERFACE_MAC_DONT_USE       0x0
 276 #define WL_INTERFACE_MAC_USE            0x2
 277
 278 #define WL_INTERFACE_CREATE_STA         0x0
 279 #define WL_INTERFACE_CREATE_AP          0x1
 280
 281 struct wl_interface_create_v1 {
 282         u16     ver;                    /* structure version */
 283         u32     flags;                  /* flags for operation */
 284         u8      mac_addr[ETH_ALEN];     /* MAC address */
 285         u32     wlc_index;              /* optional for wlc index */
 286 };
 287
 288 struct wl_interface_create_v2 {
 289         u16     ver;                    /* structure version */
 290         u8      pad1[2];
 291         u32     flags;                  /* flags for operation */
 292         u8      mac_addr[ETH_ALEN];     /* MAC address */
 293         u8      iftype;                 /* type of interface created */
 294         u8      pad2;
 295         u32     wlc_index;              /* optional for wlc index */
 296 };
 297
 298 struct wl_interface_create_v3 {
 299         u16 ver;                        /* structure version */
 300         u16 len;                        /* length of structure + data */
 301         u16 fixed_len;                  /* length of structure */
 302         u8 iftype;                      /* type of interface created */
 303         u8 wlc_index;                   /* optional for wlc index */
 304         u32 flags;                      /* flags for operation */
 305         u8 mac_addr[ETH_ALEN];          /* MAC address */
 306         u8 bssid[ETH_ALEN];             /* optional for BSSID */
 307         u8 if_index;                    /* interface index request */
 308         u8 pad[3];
 309         u8 data[];                      /* Optional for specific data */
 310 };
 311
 312 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 313 {
 314         switch (band) {
 315         case NL80211_BAND_2GHZ:
 316                 return WLC_BAND_2G;
 317         case NL80211_BAND_5GHZ:
 318                 return WLC_BAND_5G;
 319         default:
 320                 WARN_ON(1);
 321                 break;
 322         }
 323         return 0;
 324 }
 325
 326 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 327                                struct cfg80211_chan_def *ch)
 328 {
 329         struct brcmu_chan ch_inf;
 330         s32 primary_offset;
 331
 332         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 333                   ch->chan->center_freq, ch->center_freq1, ch->width);
 334         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 335         primary_offset = ch->chan->center_freq - ch->center_freq1;
 336         switch (ch->width) {
 337         case NL80211_CHAN_WIDTH_20:
 338         case NL80211_CHAN_WIDTH_20_NOHT:
 339                 ch_inf.bw = BRCMU_CHAN_BW_20;
 340                 WARN_ON(primary_offset != 0);
 341                 break;
 342         case NL80211_CHAN_WIDTH_40:
 343                 ch_inf.bw = BRCMU_CHAN_BW_40;
 344                 if (primary_offset > 0)
 345                         ch_inf.sb = BRCMU_CHAN_SB_U;
 346                 else
 347                         ch_inf.sb = BRCMU_CHAN_SB_L;
 348                 break;
 349         case NL80211_CHAN_WIDTH_80:
 350                 ch_inf.bw = BRCMU_CHAN_BW_80;
 351                 if (primary_offset == -30)
 352                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 353                 else if (primary_offset == -10)
 354                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 355                 else if (primary_offset == 10)
 356                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 357                 else
 358                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 359                 break;
 360         case NL80211_CHAN_WIDTH_160:
 361                 ch_inf.bw = BRCMU_CHAN_BW_160;
 362                 if (primary_offset == -70)
 363                         ch_inf.sb = BRCMU_CHAN_SB_LLL;
 364                 else if (primary_offset == -50)
 365                         ch_inf.sb = BRCMU_CHAN_SB_LLU;
 366                 else if (primary_offset == -30)
 367                         ch_inf.sb = BRCMU_CHAN_SB_LUL;
 368                 else if (primary_offset == -10)
 369                         ch_inf.sb = BRCMU_CHAN_SB_LUU;
 370                 else if (primary_offset == 10)
 371                         ch_inf.sb = BRCMU_CHAN_SB_ULL;
 372                 else if (primary_offset == 30)
 373                         ch_inf.sb = BRCMU_CHAN_SB_ULU;
 374                 else if (primary_offset == 50)
 375                         ch_inf.sb = BRCMU_CHAN_SB_UUL;
 376                 else
 377                         ch_inf.sb = BRCMU_CHAN_SB_UUU;
 378                 break;
 379         case NL80211_CHAN_WIDTH_80P80:
 380         case NL80211_CHAN_WIDTH_5:
 381         case NL80211_CHAN_WIDTH_10:
 382         default:
 383                 WARN_ON_ONCE(1);
 384         }
 385         switch (ch->chan->band) {
 386         case NL80211_BAND_2GHZ:
 387                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 388                 break;
 389         case NL80211_BAND_5GHZ:
 390                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 391                 break;
 392         case NL80211_BAND_60GHZ:
 393         default:
 394                 WARN_ON_ONCE(1);
 395         }
 396         d11inf->encchspec(&ch_inf);
 397
 398         brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
 399         return ch_inf.chspec;
 400 }
 401
 402 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 403                         struct ieee80211_channel *ch)
 404 {
 405         struct brcmu_chan ch_inf;
 406
 407         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 408         ch_inf.bw = BRCMU_CHAN_BW_20;
 409         d11inf->encchspec(&ch_inf);
 410
 411         return ch_inf.chspec;
 412 }
 413
 414 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 415  * triples, returning a pointer to the substring whose first element
 416  * matches tag
 417  */
 418 static const struct brcmf_tlv *
 419 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 420 {
 421         const struct brcmf_tlv *elt = buf;
 422         int totlen = buflen;
 423
 424         /* find tagged parameter */
 425         while (totlen >= TLV_HDR_LEN) {
 426                 int len = elt->len;
 427
 428                 /* validate remaining totlen */
 429                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 430                         return elt;
 431
 432                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 433                 totlen -= (len + TLV_HDR_LEN);
 434         }
 435
 436         return NULL;
 437 }
 438
 439 /* Is any of the tlvs the expected entry? If
 440  * not update the tlvs buffer pointer/length.
 441  */
 442 static bool
 443 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 444                  const u8 *oui, u32 oui_len, u8 type)
 445 {
 446         /* If the contents match the OUI and the type */
 447         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 448             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 449             type == ie[TLV_BODY_OFF + oui_len]) {
 450                 return true;
 451         }
 452
 453         if (tlvs == NULL)
 454                 return false;
 455         /* point to the next ie */
 456         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 457         /* calculate the length of the rest of the buffer */
 458         *tlvs_len -= (int)(ie - *tlvs);
 459         /* update the pointer to the start of the buffer */
 460         *tlvs = ie;
 461
 462         return false;
 463 }
 464
 465 static struct brcmf_vs_tlv *
 466 brcmf_find_wpaie(const u8 *parse, u32 len)
 467 {
 468         const struct brcmf_tlv *ie;
 469
 470         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 471                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 472                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 473                         return (struct brcmf_vs_tlv *)ie;
 474         }
 475         return NULL;
 476 }
 477
 478 static struct brcmf_vs_tlv *
 479 brcmf_find_wpsie(const u8 *parse, u32 len)
 480 {
 481         const struct brcmf_tlv *ie;
 482
 483         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 484                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 485                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 486                         return (struct brcmf_vs_tlv *)ie;
 487         }
 488         return NULL;
 489 }
 490
 491 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 492                                      struct brcmf_cfg80211_vif *vif,
 493                                      enum nl80211_iftype new_type)
 494 {
 495         struct brcmf_cfg80211_vif *pos;
 496         bool check_combos = false;
 497         int ret = 0;
 498         struct iface_combination_params params = {
 499                 .num_different_channels = 1,
 500         };
 501
 502         list_for_each_entry(pos, &cfg->vif_list, list)
 503                 if (pos == vif) {
 504                         params.iftype_num[new_type]++;
 505                 } else {
 506                         /* concurrent interfaces so need check combinations */
 507                         check_combos = true;
 508                         params.iftype_num[pos->wdev.iftype]++;
 509                 }
 510
 511         if (check_combos)
 512                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 513
 514         return ret;
 515 }
 516
 517 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 518                                   enum nl80211_iftype new_type)
 519 {
 520         struct brcmf_cfg80211_vif *pos;
 521         struct iface_combination_params params = {
 522                 .num_different_channels = 1,
 523         };
 524
 525         list_for_each_entry(pos, &cfg->vif_list, list)
 526                 params.iftype_num[pos->wdev.iftype]++;
 527
 528         params.iftype_num[new_type]++;
 529         return cfg80211_check_combinations(cfg->wiphy, &params);
 530 }
 531
 532 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 533                                  struct brcmf_wsec_key_le *key_le)
 534 {
 535         key_le->index = cpu_to_le32(key->index);
 536         key_le->len = cpu_to_le32(key->len);
 537         key_le->algo = cpu_to_le32(key->algo);
 538         key_le->flags = cpu_to_le32(key->flags);
 539         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 540         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 541         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 542         memcpy(key_le->data, key->data, sizeof(key->data));
 543         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 544 }
 545
 546 static int
 547 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 548 {
 549         struct brcmf_pub *drvr = ifp->drvr;
 550         int err;
 551         struct brcmf_wsec_key_le key_le;
 552
 553         convert_key_from_CPU(key, &key_le);
 554
 555         brcmf_netdev_wait_pend8021x(ifp);
 556
 557         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 558                                         sizeof(key_le));
 559
 560         if (err)
 561                 bphy_err(drvr, "wsec_key error (%d)\n", err);
 562         return err;
 563 }
 564
 565 static void
 566 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 567 {
 568         struct brcmf_cfg80211_vif *vif;
 569         struct brcmf_if *ifp;
 570
 571         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 572         ifp = vif->ifp;
 573
 574         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 575             (wdev->iftype == NL80211_IFTYPE_AP) ||
 576             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 577                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 578                                                 ADDR_DIRECT);
 579         else
 580                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 581                                                 ADDR_INDIRECT);
 582 }
 583
 584 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 585 {
 586         int bsscfgidx;
 587
 588         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 589                 /* bsscfgidx 1 is reserved for legacy P2P */
 590                 if (bsscfgidx == 1)
 591                         continue;
 592                 if (!drvr->iflist[bsscfgidx])
 593                         return bsscfgidx;
 594         }
 595
 596         return -ENOMEM;
 597 }
 598
 599 static void brcmf_set_vif_sta_macaddr(struct brcmf_if *ifp, u8 *mac_addr)
 600 {
 601         u8 mac_idx = ifp->drvr->sta_mac_idx;
 602
 603         /* set difference MAC address with locally administered bit */
 604         memcpy(mac_addr, ifp->mac_addr, ETH_ALEN);
 605         mac_addr[0] |= 0x02;
 606         mac_addr[3] ^= mac_idx ? 0xC0 : 0xA0;
 607         mac_idx++;
 608         mac_idx = mac_idx % 2;
 609         ifp->drvr->sta_mac_idx = mac_idx;
 610 }
 611
 612 static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
 613 {
 614         struct wl_interface_create_v1 iface_v1;
 615         struct wl_interface_create_v2 iface_v2;
 616         struct wl_interface_create_v3 iface_v3;
 617         u32 iface_create_ver;
 618         int err;
 619
 620         /* interface_create version 1 */
 621         memset(&iface_v1, 0, sizeof(iface_v1));
 622         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 623         iface_v1.flags = WL_INTERFACE_CREATE_STA |
 624                          WL_INTERFACE_MAC_USE;
 625         if (!is_zero_ether_addr(macaddr))
 626                 memcpy(iface_v1.mac_addr, macaddr, ETH_ALEN);
 627         else
 628                 brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 629
 630         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 631                                        &iface_v1,
 632                                        sizeof(iface_v1));
 633         if (err) {
 634                 brcmf_info("failed to create interface(v1), err=%d\n",
 635                            err);
 636         } else {
 637                 brcmf_dbg(INFO, "interface created(v1)\n");
 638                 return 0;
 639         }
 640
 641         /* interface_create version 2 */
 642         memset(&iface_v2, 0, sizeof(iface_v2));
 643         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 644         iface_v2.flags = WL_INTERFACE_MAC_USE;
 645         iface_v2.iftype = WL_INTERFACE_CREATE_STA;
 646         if (!is_zero_ether_addr(macaddr))
 647                 memcpy(iface_v2.mac_addr, macaddr, ETH_ALEN);
 648         else
 649                 brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 650
 651         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 652                                        &iface_v2,
 653                                        sizeof(iface_v2));
 654         if (err) {
 655                 brcmf_info("failed to create interface(v2), err=%d\n",
 656                            err);
 657         } else {
 658                 brcmf_dbg(INFO, "interface created(v2)\n");
 659                 return 0;
 660         }
 661
 662         /* interface_create version 3+ */
 663         /* get supported version from firmware side */
 664         iface_create_ver = 0;
 665         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 666                                        &iface_create_ver);
 667         if (err) {
 668                 brcmf_err("fail to get supported version, err=%d\n", err);
 669                 return -EOPNOTSUPP;
 670         }
 671
 672         switch (iface_create_ver) {
 673         case WL_INTERFACE_CREATE_VER_3:
 674                 memset(&iface_v3, 0, sizeof(iface_v3));
 675                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 676                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 677                 iface_v3.iftype = WL_INTERFACE_CREATE_STA;
 678                 if (!is_zero_ether_addr(macaddr))
 679                         memcpy(iface_v3.mac_addr, macaddr, ETH_ALEN);
 680                 else
 681                         brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 682
 683                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 684                                                &iface_v3,
 685                                                sizeof(iface_v3));
 686
 687                 if (!err)
 688                         brcmf_dbg(INFO, "interface created(v3)\n");
 689                 break;
 690         default:
 691                 brcmf_err("not support interface create(v%d)\n",
 692                           iface_create_ver);
 693                 err = -EOPNOTSUPP;
 694                 break;
 695         }
 696
 697         if (err) {
 698                 brcmf_info("station interface creation failed (%d)\n",
 699                            err);
 700                 return -EIO;
 701         }
 702
 703         return 0;
 704 }
 705
 706 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 707 {
 708         struct wl_interface_create_v1 iface_v1;
 709         struct wl_interface_create_v2 iface_v2;
 710         struct wl_interface_create_v3 iface_v3;
 711         u32 iface_create_ver;
 712         struct brcmf_pub *drvr = ifp->drvr;
 713         struct brcmf_mbss_ssid_le mbss_ssid_le;
 714         int bsscfgidx;
 715         int err;
 716
 717         /* interface_create version 1 */
 718         memset(&iface_v1, 0, sizeof(iface_v1));
 719         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 720         iface_v1.flags = WL_INTERFACE_CREATE_AP |
 721                          WL_INTERFACE_MAC_USE;
 722
 723         brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 724
 725         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 726                                        &iface_v1,
 727                                        sizeof(iface_v1));
 728         if (err) {
 729                 brcmf_info("failed to create interface(v1), err=%d\n",
 730                            err);
 731         } else {
 732                 brcmf_dbg(INFO, "interface created(v1)\n");
 733                 return 0;
 734         }
 735
 736         /* interface_create version 2 */
 737         memset(&iface_v2, 0, sizeof(iface_v2));
 738         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 739         iface_v2.flags = WL_INTERFACE_MAC_USE;
 740         iface_v2.iftype = WL_INTERFACE_CREATE_AP;
 741
 742         brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 743
 744         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 745                                        &iface_v2,
 746                                        sizeof(iface_v2));
 747         if (err) {
 748                 brcmf_info("failed to create interface(v2), err=%d\n",
 749                            err);
 750         } else {
 751                 brcmf_dbg(INFO, "interface created(v2)\n");
 752                 return 0;
 753         }
 754
 755         /* interface_create version 3+ */
 756         /* get supported version from firmware side */
 757         iface_create_ver = 0;
 758         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 759                                        &iface_create_ver);
 760         if (err) {
 761                 brcmf_err("fail to get supported version, err=%d\n", err);
 762                 return -EOPNOTSUPP;
 763         }
 764
 765         switch (iface_create_ver) {
 766         case WL_INTERFACE_CREATE_VER_3:
 767                 memset(&iface_v3, 0, sizeof(iface_v3));
 768                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 769                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 770                 iface_v3.iftype = WL_INTERFACE_CREATE_AP;
 771                 brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 772
 773                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 774                                                &iface_v3,
 775                                                sizeof(iface_v3));
 776
 777                 if (!err)
 778                         brcmf_dbg(INFO, "interface created(v3)\n");
 779                 break;
 780         default:
 781                 brcmf_err("not support interface create(v%d)\n",
 782                           iface_create_ver);
 783                 err = -EOPNOTSUPP;
 784                 break;
 785         }
 786
 787         if (err) {
 788                 brcmf_info("Does not support interface_create (%d)\n",
 789                            err);
 790                 memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 791                 bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 792                 if (bsscfgidx < 0)
 793                         return bsscfgidx;
 794
 795                 mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 796                 mbss_ssid_le.SSID_len = cpu_to_le32(5);
 797                 sprintf(mbss_ssid_le.SSID, "ssid%d", bsscfgidx);
 798
 799                 err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 800                                                 sizeof(mbss_ssid_le));
 801
 802                 if (err < 0)
 803                         bphy_err(drvr, "setting ssid failed %d\n", err);
 804         }
 805
 806         return err;
 807 }
 808
 809 /**
 810  * brcmf_apsta_add_vif() - create a new AP or STA virtual interface
 811  *
 812  * @wiphy: wiphy device of new interface.
 813  * @name: name of the new interface.
 814  * @params: contains mac address for AP or STA device.
 815  * @type: interface type.
 816  */
 817 static
 818 struct wireless_dev *brcmf_apsta_add_vif(struct wiphy *wiphy, const char *name,
 819                                          struct vif_params *params,
 820                                          enum nl80211_iftype type)
 821 {
 822         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 823         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 824         struct brcmf_pub *drvr = cfg->pub;
 825         struct brcmf_cfg80211_vif *vif;
 826         int err;
 827
 828         if (type != NL80211_IFTYPE_STATION && type != NL80211_IFTYPE_AP)
 829                 return ERR_PTR(-EINVAL);
 830
 831         if (brcmf_cfg80211_vif_event_armed(cfg))
 832                 return ERR_PTR(-EBUSY);
 833
 834         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 835
 836         vif = brcmf_alloc_vif(cfg, type);
 837         if (IS_ERR(vif))
 838                 return (struct wireless_dev *)vif;
 839
 840         brcmf_cfg80211_arm_vif_event(cfg, vif);
 841
 842         if (type == NL80211_IFTYPE_STATION)
 843                 err = brcmf_cfg80211_request_sta_if(ifp, params->macaddr);
 844         else
 845                 err = brcmf_cfg80211_request_ap_if(ifp);
 846         if (err) {
 847                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 848                 goto fail;
 849         }
 850
 851         /* wait for firmware event */
 852         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 853                                             BRCMF_VIF_EVENT_TIMEOUT);
 854         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 855         if (!err) {
 856                 bphy_err(drvr, "timeout occurred\n");
 857                 err = -EIO;
 858                 goto fail;
 859         }
 860
 861         /* interface created in firmware */
 862         ifp = vif->ifp;
 863         if (!ifp) {
 864                 bphy_err(drvr, "no if pointer provided\n");
 865                 err = -ENOENT;
 866                 goto fail;
 867         }
 868
 869         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 870         err = brcmf_net_attach(ifp, true);
 871         if (err) {
 872                 bphy_err(drvr, "Registering netdevice failed\n");
 873                 free_netdev(ifp->ndev);
 874                 goto fail;
 875         }
 876
 877         return &ifp->vif->wdev;
 878
 879 fail:
 880         brcmf_free_vif(vif);
 881         return ERR_PTR(err);
 882 }
 883
 884 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 885 {
 886         enum nl80211_iftype iftype;
 887
 888         iftype = vif->wdev.iftype;
 889         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 890 }
 891
 892 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 893 {
 894         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 895 }
 896
 897 /**
 898  * brcmf_mon_add_vif() - create monitor mode virtual interface
 899  *
 900  * @wiphy: wiphy device of new interface.
 901  * @name: name of the new interface.
 902  */
 903 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
 904                                               const char *name)
 905 {
 906         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 907         struct brcmf_cfg80211_vif *vif;
 908         struct net_device *ndev;
 909         struct brcmf_if *ifp;
 910         int err;
 911
 912         if (cfg->pub->mon_if) {
 913                 err = -EEXIST;
 914                 goto err_out;
 915         }
 916
 917         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
 918         if (IS_ERR(vif)) {
 919                 err = PTR_ERR(vif);
 920                 goto err_out;
 921         }
 922
 923         ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
 924         if (!ndev) {
 925                 err = -ENOMEM;
 926                 goto err_free_vif;
 927         }
 928         ndev->type = ARPHRD_IEEE80211_RADIOTAP;
 929         ndev->ieee80211_ptr = &vif->wdev;
 930         ndev->needs_free_netdev = true;
 931         ndev->priv_destructor = brcmf_cfg80211_free_netdev;
 932         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
 933
 934         ifp = netdev_priv(ndev);
 935         ifp->vif = vif;
 936         ifp->ndev = ndev;
 937         ifp->drvr = cfg->pub;
 938
 939         vif->ifp = ifp;
 940         vif->wdev.netdev = ndev;
 941
 942         err = brcmf_net_mon_attach(ifp);
 943         if (err) {
 944                 brcmf_err("Failed to attach %s device\n", ndev->name);
 945                 free_netdev(ndev);
 946                 goto err_free_vif;
 947         }
 948
 949         cfg->pub->mon_if = ifp;
 950
 951         return &vif->wdev;
 952
 953 err_free_vif:
 954         brcmf_free_vif(vif);
 955 err_out:
 956         return ERR_PTR(err);
 957 }
 958
 959 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 960 {
 961         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 962         struct net_device *ndev = wdev->netdev;
 963
 964         ndev->netdev_ops->ndo_stop(ndev);
 965
 966         brcmf_net_detach(ndev, true);
 967
 968         cfg->pub->mon_if = NULL;
 969
 970         return 0;
 971 }
 972
 973 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 974                                                      const char *name,
 975                                                      unsigned char name_assign_type,
 976                                                      enum nl80211_iftype type,
 977                                                      struct vif_params *params)
 978 {
 979         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 980         struct brcmf_pub *drvr = cfg->pub;
 981         struct wireless_dev *wdev;
 982         int err;
 983
 984         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 985         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 986         if (err) {
 987                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 988                 return ERR_PTR(err);
 989         }
 990         switch (type) {
 991         case NL80211_IFTYPE_ADHOC:
 992         case NL80211_IFTYPE_AP_VLAN:
 993         case NL80211_IFTYPE_WDS:
 994         case NL80211_IFTYPE_MESH_POINT:
 995                 return ERR_PTR(-EOPNOTSUPP);
 996         case NL80211_IFTYPE_MONITOR:
 997                 return brcmf_mon_add_vif(wiphy, name);
 998         case NL80211_IFTYPE_STATION:
 999         case NL80211_IFTYPE_AP:
1000                 wdev = brcmf_apsta_add_vif(wiphy, name, params, type);
1001                 break;
1002         case NL80211_IFTYPE_P2P_CLIENT:
1003         case NL80211_IFTYPE_P2P_GO:
1004         case NL80211_IFTYPE_P2P_DEVICE:
1005                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
1006                 break;
1007         case NL80211_IFTYPE_UNSPECIFIED:
1008         default:
1009                 return ERR_PTR(-EINVAL);
1010         }
1011
1012         if (IS_ERR(wdev))
1013                 bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
1014                          type, (int)PTR_ERR(wdev));
1015         else
1016                 brcmf_cfg80211_update_proto_addr_mode(wdev);
1017
1018         return wdev;
1019 }
1020
1021 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
1022 {
1023         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
1024                 brcmf_set_mpc(ifp, mpc);
1025 }
1026
1027 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
1028 {
1029         struct brcmf_pub *drvr = ifp->drvr;
1030         s32 err = 0;
1031
1032         if (check_vif_up(ifp->vif)) {
1033                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
1034                 if (err) {
1035                         bphy_err(drvr, "fail to set mpc\n");
1036                         return;
1037                 }
1038                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
1039         }
1040 }
1041
1042 static void brcmf_scan_params_v2_to_v1(struct brcmf_scan_params_v2_le *params_v2_le,
1043                                        struct brcmf_scan_params_le *params_le)
1044 {
1045         size_t params_size;
1046         u32 ch;
1047         int n_channels, n_ssids;
1048
1049         memcpy(&params_le->ssid_le, &params_v2_le->ssid_le,
1050                sizeof(params_le->ssid_le));
1051         memcpy(&params_le->bssid, &params_v2_le->bssid,
1052                sizeof(params_le->bssid));
1053
1054         params_le->bss_type = params_v2_le->bss_type;
1055         params_le->scan_type = le32_to_cpu(params_v2_le->scan_type);
1056         params_le->nprobes = params_v2_le->nprobes;
1057         params_le->active_time = params_v2_le->active_time;
1058         params_le->passive_time = params_v2_le->passive_time;
1059         params_le->home_time = params_v2_le->home_time;
1060         params_le->channel_num = params_v2_le->channel_num;
1061
1062         ch = le32_to_cpu(params_v2_le->channel_num);
1063         n_channels = ch & BRCMF_SCAN_PARAMS_COUNT_MASK;
1064         n_ssids = ch >> BRCMF_SCAN_PARAMS_NSSID_SHIFT;
1065
1066         params_size = sizeof(u16) * n_channels;
1067         if (n_ssids > 0) {
1068                 params_size = roundup(params_size, sizeof(u32));
1069                 params_size += sizeof(struct brcmf_ssid_le) * n_ssids;
1070         }
1071
1072         memcpy(&params_le->channel_list[0],
1073                &params_v2_le->channel_list[0], params_size);
1074 }
1075
1076 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1077                              struct brcmf_scan_params_v2_le *params_le,
1078                              struct cfg80211_scan_request *request)
1079 {
1080         u32 n_ssids;
1081         u32 n_channels;
1082         s32 i;
1083         s32 offset;
1084         u16 chanspec;
1085         char *ptr;
1086         int length;
1087         struct brcmf_ssid_le ssid_le;
1088
1089         eth_broadcast_addr(params_le->bssid);
1090
1091         length = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1092
1093         params_le->version = cpu_to_le16(BRCMF_SCAN_PARAMS_VERSION_V2);
1094         params_le->bss_type = DOT11_BSSTYPE_ANY;
1095         params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_ACTIVE);
1096         params_le->channel_num = 0;
1097         params_le->nprobes = cpu_to_le32(-1);
1098         params_le->active_time = cpu_to_le32(-1);
1099         params_le->passive_time = cpu_to_le32(-1);
1100         params_le->home_time = cpu_to_le32(-1);
1101         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1102
1103         /* Scan abort */
1104         if (!request) {
1105                 length += sizeof(u16);
1106                 params_le->channel_num = cpu_to_le32(1);
1107                 params_le->channel_list[0] = cpu_to_le16(-1);
1108                 params_le->length = cpu_to_le16(length);
1109                 return;
1110         }
1111
1112         n_ssids = request->n_ssids;
1113         n_channels = request->n_channels;
1114
1115         /* Copy channel array if applicable */
1116         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1117                   n_channels);
1118         if (n_channels > 0) {
1119                 length += roundup(sizeof(u16) * n_channels, sizeof(u32));
1120                 for (i = 0; i < n_channels; i++) {
1121                         chanspec = channel_to_chanspec(&cfg->d11inf,
1122                                                        request->channels[i]);
1123                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1124                                   request->channels[i]->hw_value, chanspec);
1125                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1126                 }
1127         } else {
1128                 brcmf_dbg(SCAN, "Scanning all channels\n");
1129         }
1130
1131         /* Copy ssid array if applicable */
1132         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1133         if (n_ssids > 0) {
1134                 offset = offsetof(struct brcmf_scan_params_v2_le, channel_list) +
1135                                 n_channels * sizeof(u16);
1136                 offset = roundup(offset, sizeof(u32));
1137                 length += sizeof(ssid_le) * n_ssids,
1138                 ptr = (char *)params_le + offset;
1139                 for (i = 0; i < n_ssids; i++) {
1140                         memset(&ssid_le, 0, sizeof(ssid_le));
1141                         ssid_le.SSID_len =
1142                                         cpu_to_le32(request->ssids[i].ssid_len);
1143                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1144                                request->ssids[i].ssid_len);
1145                         if (!ssid_le.SSID_len)
1146                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1147                         else
1148                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1149                                           i, ssid_le.SSID, ssid_le.SSID_len);
1150                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1151                         ptr += sizeof(ssid_le);
1152                 }
1153         } else {
1154                 brcmf_dbg(SCAN, "Performing passive scan\n");
1155                 params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_PASSIVE);
1156         }
1157         params_le->length = cpu_to_le16(length);
1158         /* Adding mask to channel numbers */
1159         params_le->channel_num =
1160                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1161                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1162 }
1163
1164 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
1165                                 struct brcmf_if *ifp, bool aborted,
1166                                 bool fw_abort)
1167 {
1168         struct brcmf_pub *drvr = cfg->pub;
1169         struct brcmf_scan_params_v2_le params_v2_le;
1170         struct cfg80211_scan_request *scan_request;
1171         u64 reqid;
1172         u32 bucket;
1173         s32 err = 0;
1174
1175         brcmf_dbg(SCAN, "Enter\n");
1176
1177         /* clear scan request, because the FW abort can cause a second call */
1178         /* to this functon and might cause a double cfg80211_scan_done      */
1179         scan_request = cfg->scan_request;
1180         cfg->scan_request = NULL;
1181
1182         if (timer_pending(&cfg->escan_timeout))
1183                 del_timer_sync(&cfg->escan_timeout);
1184
1185         if (fw_abort) {
1186                 /* Do a scan abort to stop the driver's scan engine */
1187                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
1188
1189                 brcmf_escan_prep(cfg, &params_v2_le, NULL);
1190
1191                 /* E-Scan (or anyother type) can be aborted by SCAN */
1192                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1193                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1194                                                      &params_v2_le,
1195                                                      sizeof(params_v2_le));
1196                 } else {
1197                         struct brcmf_scan_params_le params_le;
1198
1199                         brcmf_scan_params_v2_to_v1(&params_v2_le, &params_le);
1200                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1201                                                      &params_le,
1202                                                      sizeof(params_le));
1203                 }
1204
1205                 if (err)
1206                         bphy_err(drvr, "Scan abort failed\n");
1207         }
1208
1209         brcmf_scan_config_mpc(ifp, 1);
1210
1211         /*
1212          * e-scan can be initiated internally
1213          * which takes precedence.
1214          */
1215         if (cfg->int_escan_map) {
1216                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
1217                           cfg->int_escan_map);
1218                 while (cfg->int_escan_map) {
1219                         bucket = __ffs(cfg->int_escan_map);
1220                         cfg->int_escan_map &= ~BIT(bucket);
1221                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
1222                                                                bucket);
1223                         if (!aborted) {
1224                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
1225                                           reqid);
1226                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
1227                                                             reqid);
1228                         }
1229                 }
1230         } else if (scan_request) {
1231                 struct cfg80211_scan_info info = {
1232                         .aborted = aborted,
1233                 };
1234
1235                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
1236                           aborted ? "Aborted" : "Done");
1237                 cfg80211_scan_done(scan_request, &info);
1238         }
1239         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
1240                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
1241
1242         return err;
1243 }
1244
1245 static int brcmf_cfg80211_del_apsta_iface(struct wiphy *wiphy,
1246                                           struct wireless_dev *wdev)
1247 {
1248         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1249         struct net_device *ndev = wdev->netdev;
1250         struct brcmf_if *ifp = netdev_priv(ndev);
1251         struct brcmf_pub *drvr = cfg->pub;
1252         int ret;
1253         int err;
1254
1255         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
1256
1257         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
1258         if (err) {
1259                 bphy_err(drvr, "interface_remove failed %d\n", err);
1260                 goto err_unarm;
1261         }
1262
1263         /* wait for firmware event */
1264         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
1265                                             BRCMF_VIF_EVENT_TIMEOUT);
1266         if (!ret) {
1267                 bphy_err(drvr, "timeout occurred\n");
1268                 err = -EIO;
1269                 goto err_unarm;
1270         }
1271
1272         brcmf_remove_interface(ifp, true);
1273
1274 err_unarm:
1275         brcmf_cfg80211_arm_vif_event(cfg, NULL);
1276         return err;
1277 }
1278
1279 static
1280 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
1281 {
1282         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1283         struct net_device *ndev = wdev->netdev;
1284
1285         if (ndev && ndev == cfg_to_ndev(cfg))
1286                 return -ENOTSUPP;
1287
1288         /* vif event pending in firmware */
1289         if (brcmf_cfg80211_vif_event_armed(cfg))
1290                 return -EBUSY;
1291
1292         if (ndev) {
1293                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
1294                     cfg->escan_info.ifp == netdev_priv(ndev))
1295                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
1296                                                     true, true);
1297
1298                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
1299         }
1300
1301         switch (wdev->iftype) {
1302         case NL80211_IFTYPE_ADHOC:
1303         case NL80211_IFTYPE_AP_VLAN:
1304         case NL80211_IFTYPE_WDS:
1305         case NL80211_IFTYPE_MESH_POINT:
1306                 return -EOPNOTSUPP;
1307         case NL80211_IFTYPE_MONITOR:
1308                 return brcmf_mon_del_vif(wiphy, wdev);
1309         case NL80211_IFTYPE_STATION:
1310         case NL80211_IFTYPE_AP:
1311                 return brcmf_cfg80211_del_apsta_iface(wiphy, wdev);
1312         case NL80211_IFTYPE_P2P_CLIENT:
1313         case NL80211_IFTYPE_P2P_GO:
1314         case NL80211_IFTYPE_P2P_DEVICE:
1315                 return brcmf_p2p_del_vif(wiphy, wdev);
1316         case NL80211_IFTYPE_UNSPECIFIED:
1317         default:
1318                 return -EINVAL;
1319         }
1320         return -EOPNOTSUPP;
1321 }
1322
1323 static s32
1324 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
1325                          enum nl80211_iftype type,
1326                          struct vif_params *params)
1327 {
1328         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1329         struct brcmf_if *ifp = netdev_priv(ndev);
1330         struct brcmf_cfg80211_vif *vif = ifp->vif;
1331         struct brcmf_pub *drvr = cfg->pub;
1332         s32 infra = 0;
1333         s32 ap = 0;
1334         s32 err = 0;
1335
1336         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
1337                   type);
1338
1339         /* WAR: There are a number of p2p interface related problems which
1340          * need to be handled initially (before doing the validate).
1341          * wpa_supplicant tends to do iface changes on p2p device/client/go
1342          * which are not always possible/allowed. However we need to return
1343          * OK otherwise the wpa_supplicant wont start. The situation differs
1344          * on configuration and setup (p2pon=1 module param). The first check
1345          * is to see if the request is a change to station for p2p iface.
1346          */
1347         if ((type == NL80211_IFTYPE_STATION) &&
1348             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
1349              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
1350              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
1351                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
1352                 /* Now depending on whether module param p2pon=1 was used the
1353                  * response needs to be either 0 or EOPNOTSUPP. The reason is
1354                  * that if p2pon=1 is used, but a newer supplicant is used then
1355                  * we should return an error, as this combination wont work.
1356                  * In other situations 0 is returned and supplicant will start
1357                  * normally. It will give a trace in cfg80211, but it is the
1358                  * only way to get it working. Unfortunately this will result
1359                  * in situation where we wont support new supplicant in
1360                  * combination with module param p2pon=1, but that is the way
1361                  * it is. If the user tries this then unloading of driver might
1362                  * fail/lock.
1363                  */
1364                 if (cfg->p2p.p2pdev_dynamically)
1365                         return -EOPNOTSUPP;
1366                 else
1367                         return 0;
1368         }
1369         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
1370         if (err) {
1371                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
1372                 return err;
1373         }
1374         switch (type) {
1375         case NL80211_IFTYPE_MONITOR:
1376         case NL80211_IFTYPE_WDS:
1377                 bphy_err(drvr, "type (%d) : currently we do not support this type\n",
1378                          type);
1379                 return -EOPNOTSUPP;
1380         case NL80211_IFTYPE_ADHOC:
1381                 infra = 0;
1382                 break;
1383         case NL80211_IFTYPE_STATION:
1384                 infra = 1;
1385                 break;
1386         case NL80211_IFTYPE_AP:
1387         case NL80211_IFTYPE_P2P_GO:
1388                 ap = 1;
1389                 break;
1390         default:
1391                 err = -EINVAL;
1392                 goto done;
1393         }
1394
1395         if (ap) {
1396                 if (type == NL80211_IFTYPE_P2P_GO) {
1397                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
1398                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1399                 }
1400                 if (!err) {
1401                         brcmf_dbg(INFO, "IF Type = AP\n");
1402                 }
1403         } else {
1404                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1405                 if (err) {
1406                         bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1407                         err = -EAGAIN;
1408                         goto done;
1409                 }
1410                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1411                           "Adhoc" : "Infra");
1412         }
1413         ndev->ieee80211_ptr->iftype = type;
1414
1415         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1416
1417 done:
1418         brcmf_dbg(TRACE, "Exit\n");
1419
1420         return err;
1421 }
1422
1423 static s32
1424 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1425                 struct cfg80211_scan_request *request)
1426 {
1427         struct brcmf_pub *drvr = cfg->pub;
1428         s32 params_size = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE +
1429                           offsetof(struct brcmf_escan_params_le, params_v2_le);
1430         struct brcmf_escan_params_le *params;
1431         s32 err = 0;
1432
1433         brcmf_dbg(SCAN, "E-SCAN START\n");
1434
1435         if (request != NULL) {
1436                 /* Allocate space for populating ssids in struct */
1437                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1438
1439                 /* Allocate space for populating ssids in struct */
1440                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1441         }
1442
1443         params = kzalloc(params_size, GFP_KERNEL);
1444         if (!params) {
1445                 err = -ENOMEM;
1446                 goto exit;
1447         }
1448         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1449         brcmf_escan_prep(cfg, &params->params_v2_le, request);
1450
1451         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
1452
1453         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1454                 struct brcmf_escan_params_le *params_v1;
1455
1456                 params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1457                 params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
1458                 params_v1 = kzalloc(params_size, GFP_KERNEL);
1459                 if (!params_v1) {
1460                         err = -ENOMEM;
1461                         goto exit_params;
1462                 }
1463                 params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1464                 brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
1465                 kfree(params);
1466                 params = params_v1;
1467         }
1468
1469         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1470         params->sync_id = cpu_to_le16(0x1234);
1471
1472         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1473         if (err) {
1474                 if (err == -EBUSY)
1475                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1476                 else
1477                         bphy_err(drvr, "error (%d)\n", err);
1478         }
1479
1480 exit_params:
1481         kfree(params);
1482 exit:
1483         return err;
1484 }
1485
1486 static s32
1487 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1488 {
1489         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1490         s32 err;
1491         struct brcmf_scan_results *results;
1492         struct escan_info *escan = &cfg->escan_info;
1493
1494         brcmf_dbg(SCAN, "Enter\n");
1495         escan->ifp = ifp;
1496         escan->wiphy = cfg->wiphy;
1497         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1498
1499         brcmf_scan_config_mpc(ifp, 0);
1500         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1501         results->version = 0;
1502         results->count = 0;
1503         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1504
1505         err = escan->run(cfg, ifp, request);
1506         if (err)
1507                 brcmf_scan_config_mpc(ifp, 1);
1508         return err;
1509 }
1510
1511 static s32
1512 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1513 {
1514         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1515         struct brcmf_pub *drvr = cfg->pub;
1516         struct brcmf_cfg80211_vif *vif;
1517         s32 err = 0;
1518
1519         brcmf_dbg(TRACE, "Enter\n");
1520         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1521         if (!check_vif_up(vif))
1522                 return -EIO;
1523
1524         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1525                 bphy_err(drvr, "Scanning already: status (%lu)\n",
1526                          cfg->scan_status);
1527                 return -EAGAIN;
1528         }
1529         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1530                 bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1531                          cfg->scan_status);
1532                 return -EAGAIN;
1533         }
1534         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1535                 bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1536                          cfg->scan_status);
1537                 return -EAGAIN;
1538         }
1539         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1540                 bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1541                 return -EAGAIN;
1542         }
1543
1544         /* If scan req comes for p2p0, send it over primary I/F */
1545         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1546                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1547
1548         brcmf_dbg(SCAN, "START ESCAN\n");
1549
1550         cfg->scan_request = request;
1551         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1552
1553         cfg->escan_info.run = brcmf_run_escan;
1554         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1555         if (err)
1556                 goto scan_out;
1557
1558         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1559                                     request->ie, request->ie_len);
1560         if (err)
1561                 goto scan_out;
1562
1563         err = brcmf_do_escan(vif->ifp, request);
1564         if (err)
1565                 goto scan_out;
1566
1567         /* Arm scan timeout timer */
1568         mod_timer(&cfg->escan_timeout,
1569                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1570
1571         return 0;
1572
1573 scan_out:
1574         bphy_err(drvr, "scan error (%d)\n", err);
1575         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1576         cfg->scan_request = NULL;
1577         return err;
1578 }
1579
1580 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1581 {
1582         struct brcmf_if *ifp = netdev_priv(ndev);
1583         struct brcmf_pub *drvr = ifp->drvr;
1584         s32 err = 0;
1585
1586         err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1587         if (err)
1588                 bphy_err(drvr, "Error (%d)\n", err);
1589
1590         return err;
1591 }
1592
1593 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1594 {
1595         struct brcmf_if *ifp = netdev_priv(ndev);
1596         struct brcmf_pub *drvr = ifp->drvr;
1597         s32 err = 0;
1598
1599         err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1600                                       frag_threshold);
1601         if (err)
1602                 bphy_err(drvr, "Error (%d)\n", err);
1603
1604         return err;
1605 }
1606
1607 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1608 {
1609         struct brcmf_if *ifp = netdev_priv(ndev);
1610         struct brcmf_pub *drvr = ifp->drvr;
1611         s32 err = 0;
1612         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1613
1614         err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1615         if (err) {
1616                 bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1617                 return err;
1618         }
1619         return err;
1620 }
1621
1622 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1623 {
1624         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1625         struct net_device *ndev = cfg_to_ndev(cfg);
1626         struct brcmf_if *ifp = netdev_priv(ndev);
1627         s32 err = 0;
1628
1629         brcmf_dbg(TRACE, "Enter\n");
1630         if (!check_vif_up(ifp->vif))
1631                 return -EIO;
1632
1633         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1634             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1635                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1636                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1637                 if (!err)
1638                         goto done;
1639         }
1640         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1641             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1642                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1643                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1644                 if (!err)
1645                         goto done;
1646         }
1647         if (changed & WIPHY_PARAM_RETRY_LONG
1648             && (cfg->conf->retry_long != wiphy->retry_long)) {
1649                 cfg->conf->retry_long = wiphy->retry_long;
1650                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1651                 if (!err)
1652                         goto done;
1653         }
1654         if (changed & WIPHY_PARAM_RETRY_SHORT
1655             && (cfg->conf->retry_short != wiphy->retry_short)) {
1656                 cfg->conf->retry_short = wiphy->retry_short;
1657                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1658                 if (!err)
1659                         goto done;
1660         }
1661
1662 done:
1663         brcmf_dbg(TRACE, "Exit\n");
1664         return err;
1665 }
1666
1667 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1668 {
1669         memset(prof, 0, sizeof(*prof));
1670 }
1671
1672 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1673 {
1674         u16 reason;
1675
1676         switch (e->event_code) {
1677         case BRCMF_E_DEAUTH:
1678         case BRCMF_E_DEAUTH_IND:
1679         case BRCMF_E_DISASSOC_IND:
1680                 reason = e->reason;
1681                 break;
1682         case BRCMF_E_LINK:
1683         default:
1684                 reason = 0;
1685                 break;
1686         }
1687         return reason;
1688 }
1689
1690 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1691 {
1692         struct brcmf_pub *drvr = ifp->drvr;
1693         struct brcmf_wsec_pmk_le pmk;
1694         int err;
1695
1696         memset(&pmk, 0, sizeof(pmk));
1697
1698         /* pass pmk directly */
1699         pmk.key_len = cpu_to_le16(pmk_len);
1700         pmk.flags = cpu_to_le16(0);
1701         memcpy(pmk.key, pmk_data, pmk_len);
1702
1703         /* store psk in firmware */
1704         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1705                                      &pmk, sizeof(pmk));
1706         if (err < 0)
1707                 bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1708                          pmk_len);
1709
1710         return err;
1711 }
1712
1713 static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
1714                                   u16 pwd_len)
1715 {
1716         struct brcmf_pub *drvr = ifp->drvr;
1717         struct brcmf_wsec_sae_pwd_le sae_pwd;
1718         int err;
1719
1720         if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
1721                 bphy_err(drvr, "sae_password must be less than %d\n",
1722                          BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
1723                 return -EINVAL;
1724         }
1725
1726         sae_pwd.key_len = cpu_to_le16(pwd_len);
1727         memcpy(sae_pwd.key, pwd_data, pwd_len);
1728
1729         err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
1730                                        sizeof(sae_pwd));
1731         if (err < 0)
1732                 bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
1733                          pwd_len);
1734
1735         return err;
1736 }
1737
1738 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1739                             bool locally_generated)
1740 {
1741         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1742         struct brcmf_pub *drvr = cfg->pub;
1743         bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1744         s32 err = 0;
1745
1746         brcmf_dbg(TRACE, "Enter\n");
1747
1748         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1749                 if (bus_up) {
1750                         brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1751                         err = brcmf_fil_cmd_data_set(vif->ifp,
1752                                                      BRCMF_C_DISASSOC, NULL, 0);
1753                         if (err)
1754                                 bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1755                                          err);
1756                 }
1757
1758                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1759                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1760                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1761                                               locally_generated, GFP_KERNEL);
1762         }
1763         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1764         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
1765         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
1766         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1767         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1768         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1769                 if (bus_up)
1770                         brcmf_set_pmk(vif->ifp, NULL, 0);
1771                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1772         }
1773         brcmf_dbg(TRACE, "Exit\n");
1774 }
1775
1776 static s32
1777 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1778                       struct cfg80211_ibss_params *params)
1779 {
1780         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1781         struct brcmf_if *ifp = netdev_priv(ndev);
1782         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1783         struct brcmf_pub *drvr = cfg->pub;
1784         struct brcmf_join_params join_params;
1785         size_t join_params_size = 0;
1786         s32 err = 0;
1787         s32 wsec = 0;
1788         s32 bcnprd;
1789         u16 chanspec;
1790         u32 ssid_len;
1791
1792         brcmf_dbg(TRACE, "Enter\n");
1793         if (!check_vif_up(ifp->vif))
1794                 return -EIO;
1795
1796         if (params->ssid)
1797                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1798         else {
1799                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1800                 return -EOPNOTSUPP;
1801         }
1802
1803         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1804
1805         if (params->bssid)
1806                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1807         else
1808                 brcmf_dbg(CONN, "No BSSID specified\n");
1809
1810         if (params->chandef.chan)
1811                 brcmf_dbg(CONN, "channel: %d\n",
1812                           params->chandef.chan->center_freq);
1813         else
1814                 brcmf_dbg(CONN, "no channel specified\n");
1815
1816         if (params->channel_fixed)
1817                 brcmf_dbg(CONN, "fixed channel required\n");
1818         else
1819                 brcmf_dbg(CONN, "no fixed channel required\n");
1820
1821         if (params->ie && params->ie_len)
1822                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1823         else
1824                 brcmf_dbg(CONN, "no ie specified\n");
1825
1826         if (params->beacon_interval)
1827                 brcmf_dbg(CONN, "beacon interval: %d\n",
1828                           params->beacon_interval);
1829         else
1830                 brcmf_dbg(CONN, "no beacon interval specified\n");
1831
1832         if (params->basic_rates)
1833                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1834         else
1835                 brcmf_dbg(CONN, "no basic rates specified\n");
1836
1837         if (params->privacy)
1838                 brcmf_dbg(CONN, "privacy required\n");
1839         else
1840                 brcmf_dbg(CONN, "no privacy required\n");
1841
1842         /* Configure Privacy for starter */
1843         if (params->privacy)
1844                 wsec |= WEP_ENABLED;
1845
1846         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1847         if (err) {
1848                 bphy_err(drvr, "wsec failed (%d)\n", err);
1849                 goto done;
1850         }
1851
1852         /* Configure Beacon Interval for starter */
1853         if (params->beacon_interval)
1854                 bcnprd = params->beacon_interval;
1855         else
1856                 bcnprd = 100;
1857
1858         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1859         if (err) {
1860                 bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1861                 goto done;
1862         }
1863
1864         /* Configure required join parameter */
1865         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1866
1867         /* SSID */
1868         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1869         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1870         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1871         join_params_size = sizeof(join_params.ssid_le);
1872
1873         /* BSSID */
1874         if (params->bssid) {
1875                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1876                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1877                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1878         } else {
1879                 eth_broadcast_addr(join_params.params_le.bssid);
1880                 eth_zero_addr(profile->bssid);
1881         }
1882
1883         /* Channel */
1884         if (params->chandef.chan) {
1885                 u32 target_channel;
1886
1887                 cfg->channel =
1888                         ieee80211_frequency_to_channel(
1889                                 params->chandef.chan->center_freq);
1890                 if (params->channel_fixed) {
1891                         /* adding chanspec */
1892                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1893                                                        &params->chandef);
1894                         join_params.params_le.chanspec_list[0] =
1895                                 cpu_to_le16(chanspec);
1896                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1897                         join_params_size += sizeof(join_params.params_le);
1898                 }
1899
1900                 /* set channel for starter */
1901                 target_channel = cfg->channel;
1902                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1903                                             target_channel);
1904                 if (err) {
1905                         bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1906                         goto done;
1907                 }
1908         } else
1909                 cfg->channel = 0;
1910
1911         cfg->ibss_starter = false;
1912
1913
1914         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1915                                      &join_params, join_params_size);
1916         if (err) {
1917                 bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1918                 goto done;
1919         }
1920
1921 done:
1922         if (err)
1923                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1924         brcmf_dbg(TRACE, "Exit\n");
1925         return err;
1926 }
1927
1928 static s32
1929 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1930 {
1931         struct brcmf_if *ifp = netdev_priv(ndev);
1932
1933         brcmf_dbg(TRACE, "Enter\n");
1934         if (!check_vif_up(ifp->vif)) {
1935                 /* When driver is being unloaded, it can end up here. If an
1936                  * error is returned then later on a debug trace in the wireless
1937                  * core module will be printed. To avoid this 0 is returned.
1938                  */
1939                 return 0;
1940         }
1941
1942         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1943         brcmf_net_setcarrier(ifp, false);
1944
1945         brcmf_dbg(TRACE, "Exit\n");
1946
1947         return 0;
1948 }
1949
1950 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1951                                  struct cfg80211_connect_params *sme)
1952 {
1953         struct brcmf_if *ifp = netdev_priv(ndev);
1954         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1955         struct brcmf_pub *drvr = ifp->drvr;
1956         struct brcmf_cfg80211_security *sec;
1957         s32 val = 0;
1958         s32 err = 0;
1959
1960         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1961                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1962         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1963                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1964         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
1965                 val = WPA3_AUTH_SAE_PSK;
1966         else
1967                 val = WPA_AUTH_DISABLED;
1968         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1969         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1970         if (err) {
1971                 bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1972                 return err;
1973         }
1974         sec = &profile->sec;
1975         sec->wpa_versions = sme->crypto.wpa_versions;
1976         return err;
1977 }
1978
1979 static s32 brcmf_set_auth_type(struct net_device *ndev,
1980                                struct cfg80211_connect_params *sme)
1981 {
1982         struct brcmf_if *ifp = netdev_priv(ndev);
1983         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1984         struct brcmf_pub *drvr = ifp->drvr;
1985         struct brcmf_cfg80211_security *sec;
1986         s32 val = 0;
1987         s32 err = 0;
1988
1989         switch (sme->auth_type) {
1990         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1991                 val = 0;
1992                 brcmf_dbg(CONN, "open system\n");
1993                 break;
1994         case NL80211_AUTHTYPE_SHARED_KEY:
1995                 val = 1;
1996                 brcmf_dbg(CONN, "shared key\n");
1997                 break;
1998         case NL80211_AUTHTYPE_SAE:
1999                 val = 3;
2000                 brcmf_dbg(CONN, "SAE authentication\n");
2001                 break;
2002         default:
2003                 val = 2;
2004                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
2005                 break;
2006         }
2007
2008         err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2009         if (err) {
2010                 bphy_err(drvr, "set auth failed (%d)\n", err);
2011                 return err;
2012         }
2013         sec = &profile->sec;
2014         sec->auth_type = sme->auth_type;
2015         return err;
2016 }
2017
2018 static s32
2019 brcmf_set_wsec_mode(struct net_device *ndev,
2020                     struct cfg80211_connect_params *sme)
2021 {
2022         struct brcmf_if *ifp = netdev_priv(ndev);
2023         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2024         struct brcmf_pub *drvr = ifp->drvr;
2025         struct brcmf_cfg80211_security *sec;
2026         s32 pval = 0;
2027         s32 gval = 0;
2028         s32 wsec;
2029         s32 err = 0;
2030
2031         if (sme->crypto.n_ciphers_pairwise) {
2032                 switch (sme->crypto.ciphers_pairwise[0]) {
2033                 case WLAN_CIPHER_SUITE_WEP40:
2034                 case WLAN_CIPHER_SUITE_WEP104:
2035                         pval = WEP_ENABLED;
2036                         break;
2037                 case WLAN_CIPHER_SUITE_TKIP:
2038                         pval = TKIP_ENABLED;
2039                         break;
2040                 case WLAN_CIPHER_SUITE_CCMP:
2041                         pval = AES_ENABLED;
2042                         break;
2043                 case WLAN_CIPHER_SUITE_AES_CMAC:
2044                         pval = AES_ENABLED;
2045                         break;
2046                 default:
2047                         bphy_err(drvr, "invalid cipher pairwise (%d)\n",
2048                                  sme->crypto.ciphers_pairwise[0]);
2049                         return -EINVAL;
2050                 }
2051         }
2052         if (sme->crypto.cipher_group) {
2053                 switch (sme->crypto.cipher_group) {
2054                 case WLAN_CIPHER_SUITE_WEP40:
2055                 case WLAN_CIPHER_SUITE_WEP104:
2056                         gval = WEP_ENABLED;
2057                         break;
2058                 case WLAN_CIPHER_SUITE_TKIP:
2059                         gval = TKIP_ENABLED;
2060                         break;
2061                 case WLAN_CIPHER_SUITE_CCMP:
2062                         gval = AES_ENABLED;
2063                         break;
2064                 case WLAN_CIPHER_SUITE_AES_CMAC:
2065                         gval = AES_ENABLED;
2066                         break;
2067                 default:
2068                         bphy_err(drvr, "invalid cipher group (%d)\n",
2069                                  sme->crypto.cipher_group);
2070                         return -EINVAL;
2071                 }
2072         }
2073
2074         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
2075         /* In case of privacy, but no security and WPS then simulate */
2076         /* setting AES. WPS-2.0 allows no security                   */
2077         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
2078             sme->privacy)
2079                 pval = AES_ENABLED;
2080
2081         wsec = pval | gval;
2082         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2083         if (err) {
2084                 bphy_err(drvr, "error (%d)\n", err);
2085                 return err;
2086         }
2087
2088         sec = &profile->sec;
2089         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
2090         sec->cipher_group = sme->crypto.cipher_group;
2091
2092         return err;
2093 }
2094
2095 static s32
2096 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
2097 {
2098         struct brcmf_if *ifp = netdev_priv(ndev);
2099         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2100         struct brcmf_pub *drvr = ifp->drvr;
2101         s32 val;
2102         s32 err;
2103         const struct brcmf_tlv *rsn_ie;
2104         const u8 *ie;
2105         u32 ie_len;
2106         u32 offset;
2107         u16 rsn_cap;
2108         u32 mfp;
2109         u16 count;
2110
2111         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2112         profile->is_ft = false;
2113
2114         if (!sme->crypto.n_akm_suites)
2115                 return 0;
2116
2117         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
2118         if (err) {
2119                 bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
2120                 return err;
2121         }
2122         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
2123                 switch (sme->crypto.akm_suites[0]) {
2124                 case WLAN_AKM_SUITE_8021X:
2125                         val = WPA_AUTH_UNSPECIFIED;
2126                         if (sme->want_1x)
2127                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2128                         break;
2129                 case WLAN_AKM_SUITE_PSK:
2130                         val = WPA_AUTH_PSK;
2131                         break;
2132                 default:
2133                         bphy_err(drvr, "invalid akm suite (%d)\n",
2134                                  sme->crypto.akm_suites[0]);
2135                         return -EINVAL;
2136                 }
2137         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
2138                 switch (sme->crypto.akm_suites[0]) {
2139                 case WLAN_AKM_SUITE_8021X:
2140                         val = WPA2_AUTH_UNSPECIFIED;
2141                         if (sme->want_1x)
2142                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2143                         break;
2144                 case WLAN_AKM_SUITE_8021X_SHA256:
2145                         val = WPA2_AUTH_1X_SHA256;
2146                         if (sme->want_1x)
2147                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2148                         break;
2149                 case WLAN_AKM_SUITE_PSK_SHA256:
2150                         val = WPA2_AUTH_PSK_SHA256;
2151                         break;
2152                 case WLAN_AKM_SUITE_PSK:
2153                         val = WPA2_AUTH_PSK;
2154                         break;
2155                 case WLAN_AKM_SUITE_FT_8021X:
2156                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
2157                         profile->is_ft = true;
2158                         if (sme->want_1x)
2159                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2160                         break;
2161                 case WLAN_AKM_SUITE_FT_PSK:
2162                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
2163                         profile->is_ft = true;
2164                         break;
2165                 default:
2166                         bphy_err(drvr, "invalid akm suite (%d)\n",
2167                                  sme->crypto.akm_suites[0]);
2168                         return -EINVAL;
2169                 }
2170         } else if (val & WPA3_AUTH_SAE_PSK) {
2171                 switch (sme->crypto.akm_suites[0]) {
2172                 case WLAN_AKM_SUITE_SAE:
2173                         val = WPA3_AUTH_SAE_PSK;
2174                         if (sme->crypto.sae_pwd) {
2175                                 brcmf_dbg(INFO, "using SAE offload\n");
2176                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2177                         }
2178                         break;
2179                 case WLAN_AKM_SUITE_FT_OVER_SAE:
2180                         val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
2181                         profile->is_ft = true;
2182                         if (sme->crypto.sae_pwd) {
2183                                 brcmf_dbg(INFO, "using SAE offload\n");
2184                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2185                         }
2186                         break;
2187                 default:
2188                         bphy_err(drvr, "invalid akm suite (%d)\n",
2189                                  sme->crypto.akm_suites[0]);
2190                         return -EINVAL;
2191                 }
2192         }
2193
2194         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
2195                 brcmf_dbg(INFO, "using 1X offload\n");
2196
2197         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2198                 goto skip_mfp_config;
2199         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
2200          * IE will not be verified, just a quick search for MFP config
2201          */
2202         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
2203                                   WLAN_EID_RSN);
2204         if (!rsn_ie)
2205                 goto skip_mfp_config;
2206         ie = (const u8 *)rsn_ie;
2207         ie_len = rsn_ie->len + TLV_HDR_LEN;
2208         /* Skip unicast suite */
2209         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
2210         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2211                 goto skip_mfp_config;
2212         /* Skip multicast suite */
2213         count = ie[offset] + (ie[offset + 1] << 8);
2214         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2215         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2216                 goto skip_mfp_config;
2217         /* Skip auth key management suite(s) */
2218         count = ie[offset] + (ie[offset + 1] << 8);
2219         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2220         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
2221                 goto skip_mfp_config;
2222         /* Ready to read capabilities */
2223         mfp = BRCMF_MFP_NONE;
2224         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
2225         if (rsn_cap & RSN_CAP_MFPR_MASK)
2226                 mfp = BRCMF_MFP_REQUIRED;
2227         else if (rsn_cap & RSN_CAP_MFPC_MASK)
2228                 mfp = BRCMF_MFP_CAPABLE;
2229         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
2230
2231 skip_mfp_config:
2232         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
2233         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
2234         if (err) {
2235                 bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
2236                 return err;
2237         }
2238
2239         return err;
2240 }
2241
2242 static s32
2243 brcmf_set_sharedkey(struct net_device *ndev,
2244                     struct cfg80211_connect_params *sme)
2245 {
2246         struct brcmf_if *ifp = netdev_priv(ndev);
2247         struct brcmf_pub *drvr = ifp->drvr;
2248         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2249         struct brcmf_cfg80211_security *sec;
2250         struct brcmf_wsec_key key;
2251         s32 val;
2252         s32 err = 0;
2253
2254         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
2255
2256         if (sme->key_len == 0)
2257                 return 0;
2258
2259         sec = &profile->sec;
2260         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
2261                   sec->wpa_versions, sec->cipher_pairwise);
2262
2263         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
2264                                  NL80211_WPA_VERSION_3))
2265                 return 0;
2266
2267         if (!(sec->cipher_pairwise &
2268             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
2269                 return 0;
2270
2271         memset(&key, 0, sizeof(key));
2272         key.len = (u32) sme->key_len;
2273         key.index = (u32) sme->key_idx;
2274         if (key.len > sizeof(key.data)) {
2275                 bphy_err(drvr, "Too long key length (%u)\n", key.len);
2276                 return -EINVAL;
2277         }
2278         memcpy(key.data, sme->key, key.len);
2279         key.flags = BRCMF_PRIMARY_KEY;
2280         switch (sec->cipher_pairwise) {
2281         case WLAN_CIPHER_SUITE_WEP40:
2282                 key.algo = CRYPTO_ALGO_WEP1;
2283                 break;
2284         case WLAN_CIPHER_SUITE_WEP104:
2285                 key.algo = CRYPTO_ALGO_WEP128;
2286                 break;
2287         default:
2288                 bphy_err(drvr, "Invalid algorithm (%d)\n",
2289                          sme->crypto.ciphers_pairwise[0]);
2290                 return -EINVAL;
2291         }
2292         /* Set the new key/index */
2293         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
2294                   key.len, key.index, key.algo);
2295         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
2296         err = send_key_to_dongle(ifp, &key);
2297         if (err)
2298                 return err;
2299
2300         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
2301                 brcmf_dbg(CONN, "set auth_type to shared key\n");
2302                 val = WL_AUTH_SHARED_KEY;       /* shared key */
2303                 err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2304                 if (err)
2305                         bphy_err(drvr, "set auth failed (%d)\n", err);
2306         }
2307         return err;
2308 }
2309
2310 static
2311 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
2312                                            enum nl80211_auth_type type)
2313 {
2314         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
2315             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
2316                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
2317                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2318         }
2319         return type;
2320 }
2321
2322 static void brcmf_set_join_pref(struct brcmf_if *ifp,
2323                                 struct cfg80211_bss_selection *bss_select)
2324 {
2325         struct brcmf_pub *drvr = ifp->drvr;
2326         struct brcmf_join_pref_params join_pref_params[2];
2327         enum nl80211_band band;
2328         int err, i = 0;
2329
2330         join_pref_params[i].len = 2;
2331         join_pref_params[i].rssi_gain = 0;
2332
2333         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
2334                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
2335
2336         switch (bss_select->behaviour) {
2337         case __NL80211_BSS_SELECT_ATTR_INVALID:
2338                 brcmf_c_set_joinpref_default(ifp);
2339                 return;
2340         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
2341                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
2342                 band = bss_select->param.band_pref;
2343                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2344                 i++;
2345                 break;
2346         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2347                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2348                 band = bss_select->param.adjust.band;
2349                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2350                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2351                 i++;
2352                 break;
2353         case NL80211_BSS_SELECT_ATTR_RSSI:
2354         default:
2355                 break;
2356         }
2357         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2358         join_pref_params[i].len = 2;
2359         join_pref_params[i].rssi_gain = 0;
2360         join_pref_params[i].band = 0;
2361         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2362                                        sizeof(join_pref_params));
2363         if (err)
2364                 bphy_err(drvr, "Set join_pref error (%d)\n", err);
2365 }
2366
2367 static s32
2368 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2369                        struct cfg80211_connect_params *sme)
2370 {
2371         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2372         struct brcmf_if *ifp = netdev_priv(ndev);
2373         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2374         struct ieee80211_channel *chan = sme->channel;
2375         struct brcmf_pub *drvr = ifp->drvr;
2376         struct brcmf_join_params join_params;
2377         size_t join_params_size;
2378         const struct brcmf_tlv *rsn_ie;
2379         const struct brcmf_vs_tlv *wpa_ie;
2380         const void *ie;
2381         u32 ie_len;
2382         struct brcmf_ext_join_params_le *ext_join_params;
2383         u16 chanspec;
2384         s32 err = 0;
2385         u32 ssid_len;
2386
2387         brcmf_dbg(TRACE, "Enter\n");
2388         if (!check_vif_up(ifp->vif))
2389                 return -EIO;
2390
2391         if (!sme->ssid) {
2392                 bphy_err(drvr, "Invalid ssid\n");
2393                 return -EOPNOTSUPP;
2394         }
2395
2396         if (sme->channel_hint)
2397                 chan = sme->channel_hint;
2398
2399         if (sme->bssid_hint)
2400                 sme->bssid = sme->bssid_hint;
2401
2402         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2403                 /* A normal (non P2P) connection request setup. */
2404                 ie = NULL;
2405                 ie_len = 0;
2406                 /* find the WPA_IE */
2407                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2408                 if (wpa_ie) {
2409                         ie = wpa_ie;
2410                         ie_len = wpa_ie->len + TLV_HDR_LEN;
2411                 } else {
2412                         /* find the RSN_IE */
2413                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2414                                                   sme->ie_len,
2415                                                   WLAN_EID_RSN);
2416                         if (rsn_ie) {
2417                                 ie = rsn_ie;
2418                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
2419                         }
2420                 }
2421                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2422         }
2423
2424         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2425                                     sme->ie, sme->ie_len);
2426         if (err)
2427                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2428         else
2429                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2430
2431         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2432
2433         if (chan) {
2434                 cfg->channel =
2435                         ieee80211_frequency_to_channel(chan->center_freq);
2436                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2437                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2438                           cfg->channel, chan->center_freq, chanspec);
2439         } else {
2440                 cfg->channel = 0;
2441                 chanspec = 0;
2442         }
2443
2444         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2445
2446         err = brcmf_set_wpa_version(ndev, sme);
2447         if (err) {
2448                 bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2449                 goto done;
2450         }
2451
2452         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2453         err = brcmf_set_auth_type(ndev, sme);
2454         if (err) {
2455                 bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2456                 goto done;
2457         }
2458
2459         err = brcmf_set_wsec_mode(ndev, sme);
2460         if (err) {
2461                 bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2462                 goto done;
2463         }
2464
2465         err = brcmf_set_key_mgmt(ndev, sme);
2466         if (err) {
2467                 bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2468                 goto done;
2469         }
2470
2471         err = brcmf_set_sharedkey(ndev, sme);
2472         if (err) {
2473                 bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2474                 goto done;
2475         }
2476
2477         if (sme->crypto.psk &&
2478             profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2479                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2480                         err = -EINVAL;
2481                         goto done;
2482                 }
2483                 brcmf_dbg(INFO, "using PSK offload\n");
2484                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2485         }
2486
2487         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2488                 /* enable firmware supplicant for this interface */
2489                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2490                 if (err < 0) {
2491                         bphy_err(drvr, "failed to enable fw supplicant\n");
2492                         goto done;
2493                 }
2494         }
2495
2496         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2497                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2498                                     BRCMF_WSEC_MAX_PSK_LEN);
2499         else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2500                 /* clean up user-space RSNE */
2501                 err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
2502                 if (err) {
2503                         bphy_err(drvr, "failed to clean up user-space RSNE\n");
2504                         goto done;
2505                 }
2506                 err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
2507                                              sme->crypto.sae_pwd_len);
2508                 if (!err && sme->crypto.psk)
2509                         err = brcmf_set_pmk(ifp, sme->crypto.psk,
2510                                             BRCMF_WSEC_MAX_PSK_LEN);
2511         }
2512         if (err)
2513                 goto done;
2514
2515         /* Join with specific BSSID and cached SSID
2516          * If SSID is zero join based on BSSID only
2517          */
2518         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2519                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2520         if (cfg->channel)
2521                 join_params_size += sizeof(u16);
2522         ext_join_params = kzalloc(sizeof(*ext_join_params), GFP_KERNEL);
2523         if (ext_join_params == NULL) {
2524                 err = -ENOMEM;
2525                 goto done;
2526         }
2527         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2528         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2529         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2530         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2531                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2532                           ext_join_params->ssid_le.SSID, ssid_len);
2533
2534         /* Set up join scan parameters */
2535         ext_join_params->scan_le.scan_type = -1;
2536         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2537
2538         if (sme->bssid)
2539                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2540         else
2541                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2542
2543         if (cfg->channel) {
2544                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2545
2546                 ext_join_params->assoc_le.chanspec_list[0] =
2547                         cpu_to_le16(chanspec);
2548                 /* Increase dwell time to receive probe response or detect
2549                  * beacon from target AP at a noisy air only during connect
2550                  * command.
2551                  */
2552                 ext_join_params->scan_le.active_time =
2553                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2554                 ext_join_params->scan_le.passive_time =
2555                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2556                 /* To sync with presence period of VSDB GO send probe request
2557                  * more frequently. Probe request will be stopped when it gets
2558                  * probe response from target AP/GO.
2559                  */
2560                 ext_join_params->scan_le.nprobes =
2561                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2562                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2563         } else {
2564                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2565                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2566                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2567         }
2568
2569         brcmf_set_join_pref(ifp, &sme->bss_select);
2570
2571         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2572                                          join_params_size);
2573         kfree(ext_join_params);
2574         if (!err)
2575                 /* This is it. join command worked, we are done */
2576                 goto done;
2577
2578         /* join command failed, fallback to set ssid */
2579         memset(&join_params, 0, sizeof(join_params));
2580         join_params_size = sizeof(join_params.ssid_le);
2581
2582         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2583         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2584
2585         if (sme->bssid)
2586                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2587         else
2588                 eth_broadcast_addr(join_params.params_le.bssid);
2589
2590         if (cfg->channel) {
2591                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2592                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2593                 join_params_size += sizeof(join_params.params_le);
2594         }
2595         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2596                                      &join_params, join_params_size);
2597         if (err)
2598                 bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2599
2600 done:
2601         if (err)
2602                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2603         brcmf_dbg(TRACE, "Exit\n");
2604         return err;
2605 }
2606
2607 static s32
2608 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2609                        u16 reason_code)
2610 {
2611         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2612         struct brcmf_if *ifp = netdev_priv(ndev);
2613         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2614         struct brcmf_pub *drvr = cfg->pub;
2615         struct brcmf_scb_val_le scbval;
2616         s32 err = 0;
2617
2618         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2619         if (!check_vif_up(ifp->vif))
2620                 return -EIO;
2621
2622         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2623         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2624         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &ifp->vif->sme_state);
2625         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &ifp->vif->sme_state);
2626         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2627
2628         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2629         scbval.val = cpu_to_le32(reason_code);
2630         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2631                                      &scbval, sizeof(scbval));
2632         if (err)
2633                 bphy_err(drvr, "error (%d)\n", err);
2634
2635         brcmf_dbg(TRACE, "Exit\n");
2636         return err;
2637 }
2638
2639 static s32
2640 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2641                             enum nl80211_tx_power_setting type, s32 mbm)
2642 {
2643         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2644         struct net_device *ndev = cfg_to_ndev(cfg);
2645         struct brcmf_if *ifp = netdev_priv(ndev);
2646         struct brcmf_pub *drvr = cfg->pub;
2647         s32 err;
2648         s32 disable;
2649         u32 qdbm = 127;
2650
2651         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2652         if (!check_vif_up(ifp->vif))
2653                 return -EIO;
2654
2655         switch (type) {
2656         case NL80211_TX_POWER_AUTOMATIC:
2657                 break;
2658         case NL80211_TX_POWER_LIMITED:
2659         case NL80211_TX_POWER_FIXED:
2660                 if (mbm < 0) {
2661                         bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2662                         err = -EINVAL;
2663                         goto done;
2664                 }
2665                 qdbm =  MBM_TO_DBM(4 * mbm);
2666                 if (qdbm > 127)
2667                         qdbm = 127;
2668                 qdbm |= WL_TXPWR_OVERRIDE;
2669                 break;
2670         default:
2671                 bphy_err(drvr, "Unsupported type %d\n", type);
2672                 err = -EINVAL;
2673                 goto done;
2674         }
2675         /* Make sure radio is off or on as far as software is concerned */
2676         disable = WL_RADIO_SW_DISABLE << 16;
2677         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2678         if (err)
2679                 bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2680
2681         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2682         if (err)
2683                 bphy_err(drvr, "qtxpower error (%d)\n", err);
2684
2685 done:
2686         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2687         return err;
2688 }
2689
2690 static s32
2691 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2692                             s32 *dbm)
2693 {
2694         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2695         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2696         struct brcmf_pub *drvr = cfg->pub;
2697         s32 qdbm = 0;
2698         s32 err;
2699
2700         brcmf_dbg(TRACE, "Enter\n");
2701         if (!check_vif_up(vif))
2702                 return -EIO;
2703
2704         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2705         if (err) {
2706                 bphy_err(drvr, "error (%d)\n", err);
2707                 goto done;
2708         }
2709         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2710
2711 done:
2712         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2713         return err;
2714 }
2715
2716 static s32
2717 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2718                                   int link_id, u8 key_idx, bool unicast,
2719                                   bool multicast)
2720 {
2721         struct brcmf_if *ifp = netdev_priv(ndev);
2722         struct brcmf_pub *drvr = ifp->drvr;
2723         u32 index;
2724         u32 wsec;
2725         s32 err = 0;
2726
2727         brcmf_dbg(TRACE, "Enter\n");
2728         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2729         if (!check_vif_up(ifp->vif))
2730                 return -EIO;
2731
2732         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2733         if (err) {
2734                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2735                 goto done;
2736         }
2737
2738         if (wsec & WEP_ENABLED) {
2739                 /* Just select a new current key */
2740                 index = key_idx;
2741                 err = brcmf_fil_cmd_int_set(ifp,
2742                                             BRCMF_C_SET_KEY_PRIMARY, index);
2743                 if (err)
2744                         bphy_err(drvr, "error (%d)\n", err);
2745         }
2746 done:
2747         brcmf_dbg(TRACE, "Exit\n");
2748         return err;
2749 }
2750
2751 static s32
2752 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2753                        int link_id, u8 key_idx, bool pairwise,
2754                        const u8 *mac_addr)
2755 {
2756         struct brcmf_if *ifp = netdev_priv(ndev);
2757         struct brcmf_wsec_key *key;
2758         s32 err;
2759
2760         brcmf_dbg(TRACE, "Enter\n");
2761         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2762
2763         if (!check_vif_up(ifp->vif))
2764                 return -EIO;
2765
2766         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2767                 /* we ignore this key index in this case */
2768                 return -EINVAL;
2769         }
2770
2771         key = &ifp->vif->profile.key[key_idx];
2772
2773         if (key->algo == CRYPTO_ALGO_OFF) {
2774                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2775                 return -EINVAL;
2776         }
2777
2778         memset(key, 0, sizeof(*key));
2779         key->index = (u32)key_idx;
2780         key->flags = BRCMF_PRIMARY_KEY;
2781
2782         /* Clear the key/index */
2783         err = send_key_to_dongle(ifp, key);
2784
2785         brcmf_dbg(TRACE, "Exit\n");
2786         return err;
2787 }
2788
2789 static s32
2790 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2791                        int link_id, u8 key_idx, bool pairwise,
2792                        const u8 *mac_addr, struct key_params *params)
2793 {
2794         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2795         struct brcmf_if *ifp = netdev_priv(ndev);
2796         struct brcmf_pub *drvr = cfg->pub;
2797         struct brcmf_wsec_key *key;
2798         s32 val;
2799         s32 wsec;
2800         s32 err;
2801         u8 keybuf[8];
2802         bool ext_key;
2803
2804         brcmf_dbg(TRACE, "Enter\n");
2805         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2806         if (!check_vif_up(ifp->vif))
2807                 return -EIO;
2808
2809         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2810                 /* we ignore this key index in this case */
2811                 bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2812                 return -EINVAL;
2813         }
2814
2815         if (params->key_len == 0)
2816                 return brcmf_cfg80211_del_key(wiphy, ndev, -1, key_idx,
2817                                               pairwise, mac_addr);
2818
2819         if (params->key_len > sizeof(key->data)) {
2820                 bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2821                 return -EINVAL;
2822         }
2823
2824         ext_key = false;
2825         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2826             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2827                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2828                 ext_key = true;
2829         }
2830
2831         key = &ifp->vif->profile.key[key_idx];
2832         memset(key, 0, sizeof(*key));
2833         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2834                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2835         key->len = params->key_len;
2836         key->index = key_idx;
2837         memcpy(key->data, params->key, key->len);
2838         if (!ext_key)
2839                 key->flags = BRCMF_PRIMARY_KEY;
2840
2841         if (params->seq && params->seq_len == 6) {
2842                 /* rx iv */
2843                 u8 *ivptr;
2844
2845                 ivptr = (u8 *)params->seq;
2846                 key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2847                         (ivptr[3] << 8) | ivptr[2];
2848                 key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2849                 key->iv_initialized = true;
2850         }
2851
2852         switch (params->cipher) {
2853         case WLAN_CIPHER_SUITE_WEP40:
2854                 key->algo = CRYPTO_ALGO_WEP1;
2855                 val = WEP_ENABLED;
2856                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2857                 break;
2858         case WLAN_CIPHER_SUITE_WEP104:
2859                 key->algo = CRYPTO_ALGO_WEP128;
2860                 val = WEP_ENABLED;
2861                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2862                 break;
2863         case WLAN_CIPHER_SUITE_TKIP:
2864                 if (!brcmf_is_apmode(ifp->vif)) {
2865                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2866                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2867                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2868                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2869                 }
2870                 key->algo = CRYPTO_ALGO_TKIP;
2871                 val = TKIP_ENABLED;
2872                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2873                 break;
2874         case WLAN_CIPHER_SUITE_AES_CMAC:
2875                 key->algo = CRYPTO_ALGO_AES_CCM;
2876                 val = AES_ENABLED;
2877                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2878                 break;
2879         case WLAN_CIPHER_SUITE_CCMP:
2880                 key->algo = CRYPTO_ALGO_AES_CCM;
2881                 val = AES_ENABLED;
2882                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2883                 break;
2884         default:
2885                 bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2886                 err = -EINVAL;
2887                 goto done;
2888         }
2889
2890         err = send_key_to_dongle(ifp, key);
2891         if (ext_key || err)
2892                 goto done;
2893
2894         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2895         if (err) {
2896                 bphy_err(drvr, "get wsec error (%d)\n", err);
2897                 goto done;
2898         }
2899         wsec |= val;
2900         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2901         if (err) {
2902                 bphy_err(drvr, "set wsec error (%d)\n", err);
2903                 goto done;
2904         }
2905
2906 done:
2907         brcmf_dbg(TRACE, "Exit\n");
2908         return err;
2909 }
2910
2911 static s32
2912 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2913                        int link_id, u8 key_idx, bool pairwise,
2914                        const u8 *mac_addr, void *cookie,
2915                        void (*callback)(void *cookie,
2916                                         struct key_params *params))
2917 {
2918         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2919         struct key_params params;
2920         struct brcmf_if *ifp = netdev_priv(ndev);
2921         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2922         struct brcmf_pub *drvr = cfg->pub;
2923         struct brcmf_cfg80211_security *sec;
2924         s32 wsec;
2925         s32 err = 0;
2926
2927         brcmf_dbg(TRACE, "Enter\n");
2928         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2929         if (!check_vif_up(ifp->vif))
2930                 return -EIO;
2931
2932         memset(&params, 0, sizeof(params));
2933
2934         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2935         if (err) {
2936                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2937                 /* Ignore this error, may happen during DISASSOC */
2938                 err = -EAGAIN;
2939                 goto done;
2940         }
2941         if (wsec & WEP_ENABLED) {
2942                 sec = &profile->sec;
2943                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2944                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2945                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2946                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2947                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2948                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2949                 }
2950         } else if (wsec & TKIP_ENABLED) {
2951                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2952                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2953         } else if (wsec & AES_ENABLED) {
2954                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2955                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2956         } else  {
2957                 bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2958                 err = -EINVAL;
2959                 goto done;
2960         }
2961         callback(cookie, &params);
2962
2963 done:
2964         brcmf_dbg(TRACE, "Exit\n");
2965         return err;
2966 }
2967
2968 static s32
2969 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2970                                        struct net_device *ndev, int link_id,
2971                                        u8 key_idx)
2972 {
2973         struct brcmf_if *ifp = netdev_priv(ndev);
2974
2975         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2976
2977         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2978                 return 0;
2979
2980         brcmf_dbg(INFO, "Not supported\n");
2981
2982         return -EOPNOTSUPP;
2983 }
2984
2985 static void
2986 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2987 {
2988         struct brcmf_pub *drvr = ifp->drvr;
2989         s32 err;
2990         u8 key_idx;
2991         struct brcmf_wsec_key *key;
2992         s32 wsec;
2993
2994         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2995                 key = &ifp->vif->profile.key[key_idx];
2996                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2997                     (key->algo == CRYPTO_ALGO_WEP128))
2998                         break;
2999         }
3000         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
3001                 return;
3002
3003         err = send_key_to_dongle(ifp, key);
3004         if (err) {
3005                 bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
3006                 return;
3007         }
3008         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
3009         if (err) {
3010                 bphy_err(drvr, "get wsec error (%d)\n", err);
3011                 return;
3012         }
3013         wsec |= WEP_ENABLED;
3014         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3015         if (err)
3016                 bphy_err(drvr, "set wsec error (%d)\n", err);
3017 }
3018
3019 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
3020 {
3021         struct nl80211_sta_flag_update *sfu;
3022
3023         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
3024         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
3025         sfu = &si->sta_flags;
3026         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
3027                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3028                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
3029                     BIT(NL80211_STA_FLAG_AUTHORIZED);
3030         if (fw_sta_flags & BRCMF_STA_WME)
3031                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
3032         if (fw_sta_flags & BRCMF_STA_AUTHE)
3033                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3034         if (fw_sta_flags & BRCMF_STA_ASSOC)
3035                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3036         if (fw_sta_flags & BRCMF_STA_AUTHO)
3037                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3038 }
3039
3040 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
3041 {
3042         struct brcmf_pub *drvr = ifp->drvr;
3043         struct {
3044                 __le32 len;
3045                 struct brcmf_bss_info_le bss_le;
3046         } *buf;
3047         u16 capability;
3048         int err;
3049
3050         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3051         if (!buf)
3052                 return;
3053
3054         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
3055         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
3056                                      WL_BSS_INFO_MAX);
3057         if (err) {
3058                 bphy_err(drvr, "Failed to get bss info (%d)\n", err);
3059                 goto out_kfree;
3060         }
3061         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
3062         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
3063         si->bss_param.dtim_period = buf->bss_le.dtim_period;
3064         capability = le16_to_cpu(buf->bss_le.capability);
3065         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
3066                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
3067         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3068                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
3069         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
3070                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
3071
3072 out_kfree:
3073         kfree(buf);
3074 }
3075
3076 static s32
3077 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
3078                                 struct station_info *sinfo)
3079 {
3080         struct brcmf_pub *drvr = ifp->drvr;
3081         struct brcmf_scb_val_le scbval;
3082         struct brcmf_pktcnt_le pktcnt;
3083         s32 err;
3084         u32 rate;
3085         u32 rssi;
3086
3087         /* Get the current tx rate */
3088         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
3089         if (err < 0) {
3090                 bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
3091                 return err;
3092         }
3093         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3094         sinfo->txrate.legacy = rate * 5;
3095
3096         memset(&scbval, 0, sizeof(scbval));
3097         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
3098                                      sizeof(scbval));
3099         if (err) {
3100                 bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
3101                 return err;
3102         }
3103         rssi = le32_to_cpu(scbval.val);
3104         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3105         sinfo->signal = rssi;
3106
3107         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
3108                                      sizeof(pktcnt));
3109         if (err) {
3110                 bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
3111                 return err;
3112         }
3113         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
3114                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
3115                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
3116                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3117         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
3118         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
3119         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
3120         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
3121
3122         return 0;
3123 }
3124
3125 static s32
3126 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
3127                            const u8 *mac, struct station_info *sinfo)
3128 {
3129         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3130         struct brcmf_if *ifp = netdev_priv(ndev);
3131         struct brcmf_pub *drvr = cfg->pub;
3132         struct brcmf_scb_val_le scb_val;
3133         s32 err = 0;
3134         struct brcmf_sta_info_le sta_info_le;
3135         u32 sta_flags;
3136         u32 is_tdls_peer;
3137         s32 total_rssi_avg = 0;
3138         s32 total_rssi = 0;
3139         s32 count_rssi = 0;
3140         int rssi;
3141         u32 i;
3142
3143         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
3144         if (!check_vif_up(ifp->vif))
3145                 return -EIO;
3146
3147         if (brcmf_is_ibssmode(ifp->vif))
3148                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
3149
3150         memset(&sta_info_le, 0, sizeof(sta_info_le));
3151         memcpy(&sta_info_le, mac, ETH_ALEN);
3152         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
3153                                        &sta_info_le,
3154                                        sizeof(sta_info_le));
3155         is_tdls_peer = !err;
3156         if (err) {
3157                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
3158                                                &sta_info_le,
3159                                                sizeof(sta_info_le));
3160                 if (err < 0) {
3161                         bphy_err(drvr, "GET STA INFO failed, %d\n", err);
3162                         goto done;
3163                 }
3164         }
3165         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
3166         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
3167         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
3168         sta_flags = le32_to_cpu(sta_info_le.flags);
3169         brcmf_convert_sta_flags(sta_flags, sinfo);
3170         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3171         if (is_tdls_peer)
3172                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3173         else
3174                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3175         if (sta_flags & BRCMF_STA_ASSOC) {
3176                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
3177                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
3178                 brcmf_fill_bss_param(ifp, sinfo);
3179         }
3180         if (sta_flags & BRCMF_STA_SCBSTATS) {
3181                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3182                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
3183                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
3184                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
3185                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
3186                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
3187                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
3188                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
3189                 if (sinfo->tx_packets) {
3190                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3191                         sinfo->txrate.legacy =
3192                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
3193                 }
3194                 if (sinfo->rx_packets) {
3195                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
3196                         sinfo->rxrate.legacy =
3197                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
3198                 }
3199                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
3200                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
3201                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
3202                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
3203                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
3204                 }
3205                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
3206                         if (sta_info_le.rssi[i] == 0 ||
3207                             sta_info_le.rx_lastpkt_rssi[i] == 0)
3208                                 continue;
3209                         sinfo->chains |= BIT(count_rssi);
3210                         sinfo->chain_signal[count_rssi] =
3211                                 sta_info_le.rx_lastpkt_rssi[i];
3212                         sinfo->chain_signal_avg[count_rssi] =
3213                                 sta_info_le.rssi[i];
3214                         total_rssi += sta_info_le.rx_lastpkt_rssi[i];
3215                         total_rssi_avg += sta_info_le.rssi[i];
3216                         count_rssi++;
3217                 }
3218                 if (count_rssi) {
3219                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3220                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
3221                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
3222                         sinfo->filled |=
3223                                 BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
3224                         sinfo->signal = total_rssi / count_rssi;
3225                         sinfo->signal_avg = total_rssi_avg / count_rssi;
3226                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
3227                         &ifp->vif->sme_state)) {
3228                         memset(&scb_val, 0, sizeof(scb_val));
3229                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
3230                                                      &scb_val, sizeof(scb_val));
3231                         if (err) {
3232                                 bphy_err(drvr, "Could not get rssi (%d)\n",
3233                                          err);
3234                                 goto done;
3235                         } else {
3236                                 rssi = le32_to_cpu(scb_val.val);
3237                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3238                                 sinfo->signal = rssi;
3239                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
3240                         }
3241                 }
3242         }
3243 done:
3244         brcmf_dbg(TRACE, "Exit\n");
3245         return err;
3246 }
3247
3248 static int
3249 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
3250                             int idx, u8 *mac, struct station_info *sinfo)
3251 {
3252         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3253         struct brcmf_if *ifp = netdev_priv(ndev);
3254         struct brcmf_pub *drvr = cfg->pub;
3255         s32 err;
3256
3257         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
3258
3259         if (idx == 0) {
3260                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
3261                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
3262                                              &cfg->assoclist,
3263                                              sizeof(cfg->assoclist));
3264                 if (err) {
3265                         /* GET_ASSOCLIST unsupported by firmware of older chips */
3266                         if (err == -EBADE)
3267                                 bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
3268                         else
3269                                 bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
3270                                          err);
3271
3272                         cfg->assoclist.count = 0;
3273                         return -EOPNOTSUPP;
3274                 }
3275         }
3276         if (idx < le32_to_cpu(cfg->assoclist.count)) {
3277                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
3278                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
3279         }
3280         return -ENOENT;
3281 }
3282
3283 static s32
3284 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
3285                            bool enabled, s32 timeout)
3286 {
3287         s32 pm;
3288         s32 err = 0;
3289         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3290         struct brcmf_if *ifp = netdev_priv(ndev);
3291         struct brcmf_pub *drvr = cfg->pub;
3292
3293         brcmf_dbg(TRACE, "Enter\n");
3294
3295         /*
3296          * Powersave enable/disable request is coming from the
3297          * cfg80211 even before the interface is up. In that
3298          * scenario, driver will be storing the power save
3299          * preference in cfg struct to apply this to
3300          * FW later while initializing the dongle
3301          */
3302         cfg->pwr_save = enabled;
3303         if (!check_vif_up(ifp->vif)) {
3304
3305                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
3306                 goto done;
3307         }
3308
3309         pm = enabled ? PM_FAST : PM_OFF;
3310         /* Do not enable the power save after assoc if it is a p2p interface */
3311         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
3312                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
3313                 pm = PM_OFF;
3314         }
3315         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
3316
3317         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
3318         if (err) {
3319                 if (err == -ENODEV)
3320                         bphy_err(drvr, "net_device is not ready yet\n");
3321                 else
3322                         bphy_err(drvr, "error (%d)\n", err);
3323         }
3324
3325         err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
3326                                 min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
3327         if (err)
3328                 bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
3329
3330 done:
3331         brcmf_dbg(TRACE, "Exit\n");
3332         return err;
3333 }
3334
3335 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
3336                                    struct brcmf_bss_info_le *bi)
3337 {
3338         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3339         struct brcmf_pub *drvr = cfg->pub;
3340         struct cfg80211_bss *bss;
3341         enum nl80211_band band;
3342         struct brcmu_chan ch;
3343         u16 channel;
3344         u32 freq;
3345         u16 notify_capability;
3346         u16 notify_interval;
3347         u8 *notify_ie;
3348         size_t notify_ielen;
3349         struct cfg80211_inform_bss bss_data = {};
3350
3351         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
3352                 bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
3353                 return -EINVAL;
3354         }
3355
3356         if (!bi->ctl_ch) {
3357                 ch.chspec = le16_to_cpu(bi->chanspec);
3358                 cfg->d11inf.decchspec(&ch);
3359                 bi->ctl_ch = ch.control_ch_num;
3360         }
3361         channel = bi->ctl_ch;
3362
3363         if (channel <= CH_MAX_2G_CHANNEL)
3364                 band = NL80211_BAND_2GHZ;
3365         else
3366                 band = NL80211_BAND_5GHZ;
3367
3368         freq = ieee80211_channel_to_frequency(channel, band);
3369         bss_data.chan = ieee80211_get_channel(wiphy, freq);
3370         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3371         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3372
3373         notify_capability = le16_to_cpu(bi->capability);
3374         notify_interval = le16_to_cpu(bi->beacon_period);
3375         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3376         notify_ielen = le32_to_cpu(bi->ie_length);
3377         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3378
3379         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3380         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3381         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3382         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3383         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3384
3385         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3386                                        CFG80211_BSS_FTYPE_UNKNOWN,
3387                                        (const u8 *)bi->BSSID,
3388                                        0, notify_capability,
3389                                        notify_interval, notify_ie,
3390                                        notify_ielen, GFP_KERNEL);
3391
3392         if (!bss)
3393                 return -ENOMEM;
3394
3395         cfg80211_put_bss(wiphy, bss);
3396
3397         return 0;
3398 }
3399
3400 static struct brcmf_bss_info_le *
3401 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3402 {
3403         if (bss == NULL)
3404                 return list->bss_info_le;
3405         return (struct brcmf_bss_info_le *)((unsigned long)bss +
3406                                             le32_to_cpu(bss->length));
3407 }
3408
3409 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3410 {
3411         struct brcmf_pub *drvr = cfg->pub;
3412         struct brcmf_scan_results *bss_list;
3413         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
3414         s32 err = 0;
3415         int i;
3416
3417         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3418         if (bss_list->count != 0 &&
3419             bss_list->version != BRCMF_BSS_INFO_VERSION) {
3420                 bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3421                          bss_list->version);
3422                 return -EOPNOTSUPP;
3423         }
3424         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3425         for (i = 0; i < bss_list->count; i++) {
3426                 bi = next_bss_le(bss_list, bi);
3427                 err = brcmf_inform_single_bss(cfg, bi);
3428                 if (err)
3429                         break;
3430         }
3431         return err;
3432 }
3433
3434 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3435                              struct net_device *ndev, const u8 *bssid)
3436 {
3437         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3438         struct brcmf_pub *drvr = cfg->pub;
3439         struct ieee80211_channel *notify_channel;
3440         struct brcmf_bss_info_le *bi = NULL;
3441         struct ieee80211_supported_band *band;
3442         struct cfg80211_bss *bss;
3443         struct brcmu_chan ch;
3444         u8 *buf = NULL;
3445         s32 err = 0;
3446         u32 freq;
3447         u16 notify_capability;
3448         u16 notify_interval;
3449         u8 *notify_ie;
3450         size_t notify_ielen;
3451         s32 notify_signal;
3452
3453         brcmf_dbg(TRACE, "Enter\n");
3454
3455         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3456         if (buf == NULL) {
3457                 err = -ENOMEM;
3458                 goto CleanUp;
3459         }
3460
3461         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3462
3463         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3464                                      buf, WL_BSS_INFO_MAX);
3465         if (err) {
3466                 bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3467                 goto CleanUp;
3468         }
3469
3470         bi = (struct brcmf_bss_info_le *)(buf + 4);
3471
3472         ch.chspec = le16_to_cpu(bi->chanspec);
3473         cfg->d11inf.decchspec(&ch);
3474
3475         if (ch.band == BRCMU_CHAN_BAND_2G)
3476                 band = wiphy->bands[NL80211_BAND_2GHZ];
3477         else
3478                 band = wiphy->bands[NL80211_BAND_5GHZ];
3479
3480         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3481         cfg->channel = freq;
3482         notify_channel = ieee80211_get_channel(wiphy, freq);
3483
3484         notify_capability = le16_to_cpu(bi->capability);
3485         notify_interval = le16_to_cpu(bi->beacon_period);
3486         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3487         notify_ielen = le32_to_cpu(bi->ie_length);
3488         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3489
3490         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3491         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3492         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3493         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3494
3495         bss = cfg80211_inform_bss(wiphy, notify_channel,
3496                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3497                                   notify_capability, notify_interval,
3498                                   notify_ie, notify_ielen, notify_signal,
3499                                   GFP_KERNEL);
3500
3501         if (!bss) {
3502                 err = -ENOMEM;
3503                 goto CleanUp;
3504         }
3505
3506         cfg80211_put_bss(wiphy, bss);
3507
3508 CleanUp:
3509
3510         kfree(buf);
3511
3512         brcmf_dbg(TRACE, "Exit\n");
3513
3514         return err;
3515 }
3516
3517 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3518                                  struct brcmf_if *ifp)
3519 {
3520         struct brcmf_pub *drvr = cfg->pub;
3521         struct brcmf_bss_info_le *bi = NULL;
3522         s32 err = 0;
3523
3524         brcmf_dbg(TRACE, "Enter\n");
3525         if (brcmf_is_ibssmode(ifp->vif))
3526                 return err;
3527
3528         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3529         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3530                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3531         if (err) {
3532                 bphy_err(drvr, "Could not get bss info %d\n", err);
3533                 goto update_bss_info_out;
3534         }
3535         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3536         err = brcmf_inform_single_bss(cfg, bi);
3537
3538 update_bss_info_out:
3539         brcmf_dbg(TRACE, "Exit");
3540         return err;
3541 }
3542
3543 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3544 {
3545         struct escan_info *escan = &cfg->escan_info;
3546
3547         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3548         if (cfg->int_escan_map || cfg->scan_request) {
3549                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3550                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3551         }
3552         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3553         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3554 }
3555
3556 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3557 {
3558         struct brcmf_cfg80211_info *cfg =
3559                         container_of(work, struct brcmf_cfg80211_info,
3560                                      escan_timeout_work);
3561
3562         brcmf_inform_bss(cfg);
3563         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3564 }
3565
3566 static void brcmf_escan_timeout(struct timer_list *t)
3567 {
3568         struct brcmf_cfg80211_info *cfg =
3569                         from_timer(cfg, t, escan_timeout);
3570         struct brcmf_pub *drvr = cfg->pub;
3571
3572         if (cfg->int_escan_map || cfg->scan_request) {
3573                 bphy_err(drvr, "timer expired\n");
3574                 schedule_work(&cfg->escan_timeout_work);
3575         }
3576 }
3577
3578 static s32
3579 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3580                               struct brcmf_bss_info_le *bss,
3581                               struct brcmf_bss_info_le *bss_info_le)
3582 {
3583         struct brcmu_chan ch_bss, ch_bss_info_le;
3584
3585         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3586         cfg->d11inf.decchspec(&ch_bss);
3587         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3588         cfg->d11inf.decchspec(&ch_bss_info_le);
3589
3590         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3591                 ch_bss.band == ch_bss_info_le.band &&
3592                 bss_info_le->SSID_len == bss->SSID_len &&
3593                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3594                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3595                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3596                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3597                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3598
3599                         /* preserve max RSSI if the measurements are
3600                         * both on-channel or both off-channel
3601                         */
3602                         if (bss_info_rssi > bss_rssi)
3603                                 bss->RSSI = bss_info_le->RSSI;
3604                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3605                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3606                         /* preserve the on-channel rssi measurement
3607                         * if the new measurement is off channel
3608                         */
3609                         bss->RSSI = bss_info_le->RSSI;
3610                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3611                 }
3612                 return 1;
3613         }
3614         return 0;
3615 }
3616
3617 static s32
3618 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3619                              const struct brcmf_event_msg *e, void *data)
3620 {
3621         struct brcmf_pub *drvr = ifp->drvr;
3622         struct brcmf_cfg80211_info *cfg = drvr->config;
3623         s32 status;
3624         struct brcmf_escan_result_le *escan_result_le;
3625         u32 escan_buflen;
3626         struct brcmf_bss_info_le *bss_info_le;
3627         struct brcmf_bss_info_le *bss = NULL;
3628         u32 bi_length;
3629         struct brcmf_scan_results *list;
3630         u32 i;
3631         bool aborted;
3632
3633         status = e->status;
3634
3635         if (status == BRCMF_E_STATUS_ABORT)
3636                 goto exit;
3637
3638         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3639                 bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3640                          ifp->bsscfgidx);
3641                 return -EPERM;
3642         }
3643
3644         if (status == BRCMF_E_STATUS_PARTIAL) {
3645                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3646                 if (e->datalen < sizeof(*escan_result_le)) {
3647                         bphy_err(drvr, "invalid event data length\n");
3648                         goto exit;
3649                 }
3650                 escan_result_le = (struct brcmf_escan_result_le *) data;
3651                 if (!escan_result_le) {
3652                         bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3653                         goto exit;
3654                 }
3655                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3656                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3657                     escan_buflen > e->datalen ||
3658                     escan_buflen < sizeof(*escan_result_le)) {
3659                         bphy_err(drvr, "Invalid escan buffer length: %d\n",
3660                                  escan_buflen);
3661                         goto exit;
3662                 }
3663                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3664                         bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3665                                  escan_result_le->bss_count);
3666                         goto exit;
3667                 }
3668                 bss_info_le = &escan_result_le->bss_info_le;
3669
3670                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3671                         goto exit;
3672
3673                 if (!cfg->int_escan_map && !cfg->scan_request) {
3674                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3675                         goto exit;
3676                 }
3677
3678                 bi_length = le32_to_cpu(bss_info_le->length);
3679                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3680                         bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3681                                  bi_length);
3682                         goto exit;
3683                 }
3684
3685                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3686                                         BIT(NL80211_IFTYPE_ADHOC))) {
3687                         if (le16_to_cpu(bss_info_le->capability) &
3688                                                 WLAN_CAPABILITY_IBSS) {
3689                                 bphy_err(drvr, "Ignoring IBSS result\n");
3690                                 goto exit;
3691                         }
3692                 }
3693
3694                 list = (struct brcmf_scan_results *)
3695                                 cfg->escan_info.escan_buf;
3696                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3697                         bphy_err(drvr, "Buffer is too small: ignoring\n");
3698                         goto exit;
3699                 }
3700
3701                 for (i = 0; i < list->count; i++) {
3702                         bss = bss ? (struct brcmf_bss_info_le *)
3703                                 ((unsigned char *)bss +
3704                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3705                         if (brcmf_compare_update_same_bss(cfg, bss,
3706                                                           bss_info_le))
3707                                 goto exit;
3708                 }
3709                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3710                        bi_length);
3711                 list->version = le32_to_cpu(bss_info_le->version);
3712                 list->buflen += bi_length;
3713                 list->count++;
3714         } else {
3715                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3716                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3717                         goto exit;
3718                 if (cfg->int_escan_map || cfg->scan_request) {
3719                         brcmf_inform_bss(cfg);
3720                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3721                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3722                 } else
3723                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3724                                   status);
3725         }
3726 exit:
3727         return 0;
3728 }
3729
3730 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3731 {
3732         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3733                             brcmf_cfg80211_escan_handler);
3734         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3735         /* Init scan_timeout timer */
3736         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3737         INIT_WORK(&cfg->escan_timeout_work,
3738                   brcmf_cfg80211_escan_timeout_worker);
3739 }
3740
3741 static struct cfg80211_scan_request *
3742 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3743         struct cfg80211_scan_request *req;
3744         size_t req_size;
3745
3746         req_size = sizeof(*req) +
3747                    n_netinfo * sizeof(req->channels[0]) +
3748                    n_netinfo * sizeof(*req->ssids);
3749
3750         req = kzalloc(req_size, GFP_KERNEL);
3751         if (req) {
3752                 req->wiphy = wiphy;
3753                 req->ssids = (void *)(&req->channels[0]) +
3754                              n_netinfo * sizeof(req->channels[0]);
3755         }
3756         return req;
3757 }
3758
3759 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3760                                          u8 *ssid, u8 ssid_len, u8 channel)
3761 {
3762         struct ieee80211_channel *chan;
3763         enum nl80211_band band;
3764         int freq, i;
3765
3766         if (channel <= CH_MAX_2G_CHANNEL)
3767                 band = NL80211_BAND_2GHZ;
3768         else
3769                 band = NL80211_BAND_5GHZ;
3770
3771         freq = ieee80211_channel_to_frequency(channel, band);
3772         if (!freq)
3773                 return -EINVAL;
3774
3775         chan = ieee80211_get_channel(req->wiphy, freq);
3776         if (!chan)
3777                 return -EINVAL;
3778
3779         for (i = 0; i < req->n_channels; i++) {
3780                 if (req->channels[i] == chan)
3781                         break;
3782         }
3783         if (i == req->n_channels) {
3784                 req->n_channels++;
3785                 req->channels[i] = chan;
3786         }
3787
3788         for (i = 0; i < req->n_ssids; i++) {
3789                 if (req->ssids[i].ssid_len == ssid_len &&
3790                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3791                         break;
3792         }
3793         if (i == req->n_ssids) {
3794                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3795                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3796         }
3797         return 0;
3798 }
3799
3800 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3801                                       struct cfg80211_scan_request *request)
3802 {
3803         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3804         int err;
3805
3806         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3807                 if (cfg->int_escan_map)
3808                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3809                                   cfg->int_escan_map);
3810                 /* Abort any on-going scan */
3811                 brcmf_abort_scanning(cfg);
3812         }
3813
3814         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3815         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3816         cfg->escan_info.run = brcmf_run_escan;
3817         err = brcmf_do_escan(ifp, request);
3818         if (err) {
3819                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3820                 return err;
3821         }
3822         cfg->int_escan_map = fwmap;
3823         return 0;
3824 }
3825
3826 static struct brcmf_pno_net_info_le *
3827 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3828 {
3829         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3830         struct brcmf_pno_net_info_le *netinfo;
3831
3832         switch (pfn_v1->version) {
3833         default:
3834                 WARN_ON(1);
3835                 fallthrough;
3836         case cpu_to_le32(1):
3837                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3838                 break;
3839         case cpu_to_le32(2):
3840                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3841                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3842                 break;
3843         }
3844
3845         return netinfo;
3846 }
3847
3848 /* PFN result doesn't have all the info which are required by the supplicant
3849  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3850  * via wl_inform_single_bss in the required format. Escan does require the
3851  * scan request in the form of cfg80211_scan_request. For timebeing, create
3852  * cfg80211_scan_request one out of the received PNO event.
3853  */
3854 static s32
3855 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3856                                 const struct brcmf_event_msg *e, void *data)
3857 {
3858         struct brcmf_pub *drvr = ifp->drvr;
3859         struct brcmf_cfg80211_info *cfg = drvr->config;
3860         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3861         struct cfg80211_scan_request *request = NULL;
3862         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3863         int i, err = 0;
3864         struct brcmf_pno_scanresults_le *pfn_result;
3865         u32 bucket_map;
3866         u32 result_count;
3867         u32 status;
3868         u32 datalen;
3869
3870         brcmf_dbg(SCAN, "Enter\n");
3871
3872         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3873                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3874                 return 0;
3875         }
3876
3877         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3878                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3879                 return 0;
3880         }
3881
3882         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3883         result_count = le32_to_cpu(pfn_result->count);
3884         status = le32_to_cpu(pfn_result->status);
3885
3886         /* PFN event is limited to fit 512 bytes so we may get
3887          * multiple NET_FOUND events. For now place a warning here.
3888          */
3889         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3890         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3891         if (!result_count) {
3892                 bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3893                 goto out_err;
3894         }
3895
3896         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3897         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3898         if (datalen < result_count * sizeof(*netinfo)) {
3899                 bphy_err(drvr, "insufficient event data\n");
3900                 goto out_err;
3901         }
3902
3903         request = brcmf_alloc_internal_escan_request(wiphy,
3904                                                      result_count);
3905         if (!request) {
3906                 err = -ENOMEM;
3907                 goto out_err;
3908         }
3909
3910         bucket_map = 0;
3911         for (i = 0; i < result_count; i++) {
3912                 netinfo = &netinfo_start[i];
3913
3914                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3915                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3916                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3917                           netinfo->SSID, netinfo->channel);
3918                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3919                 err = brcmf_internal_escan_add_info(request,
3920                                                     netinfo->SSID,
3921                                                     netinfo->SSID_len,
3922                                                     netinfo->channel);
3923                 if (err)
3924                         goto out_err;
3925         }
3926
3927         if (!bucket_map)
3928                 goto free_req;
3929
3930         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3931         if (!err)
3932                 goto free_req;
3933
3934 out_err:
3935         cfg80211_sched_scan_stopped(wiphy, 0);
3936 free_req:
3937         kfree(request);
3938         return err;
3939 }
3940
3941 static int
3942 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3943                                 struct net_device *ndev,
3944                                 struct cfg80211_sched_scan_request *req)
3945 {
3946         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3947         struct brcmf_if *ifp = netdev_priv(ndev);
3948         struct brcmf_pub *drvr = cfg->pub;
3949
3950         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3951                   req->n_match_sets, req->n_ssids);
3952
3953         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3954                 bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3955                          cfg->scan_status);
3956                 return -EAGAIN;
3957         }
3958
3959         if (req->n_match_sets <= 0) {
3960                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3961                           req->n_match_sets);
3962                 return -EINVAL;
3963         }
3964
3965         return brcmf_pno_start_sched_scan(ifp, req);
3966 }
3967
3968 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3969                                           struct net_device *ndev, u64 reqid)
3970 {
3971         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3972         struct brcmf_if *ifp = netdev_priv(ndev);
3973
3974         brcmf_dbg(SCAN, "enter\n");
3975         brcmf_pno_stop_sched_scan(ifp, reqid);
3976         if (cfg->int_escan_map)
3977                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3978         return 0;
3979 }
3980
3981 static __always_inline void brcmf_delay(u32 ms)
3982 {
3983         if (ms < 1000 / HZ) {
3984                 cond_resched();
3985                 mdelay(ms);
3986         } else {
3987                 msleep(ms);
3988         }
3989 }
3990
3991 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3992                                      u8 *pattern, u32 patternsize, u8 *mask,
3993                                      u32 packet_offset)
3994 {
3995         struct brcmf_fil_wowl_pattern_le *filter;
3996         u32 masksize;
3997         u32 patternoffset;
3998         u8 *buf;
3999         u32 bufsize;
4000         s32 ret;
4001
4002         masksize = (patternsize + 7) / 8;
4003         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
4004
4005         bufsize = sizeof(*filter) + patternsize + masksize;
4006         buf = kzalloc(bufsize, GFP_KERNEL);
4007         if (!buf)
4008                 return -ENOMEM;
4009         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
4010
4011         memcpy(filter->cmd, cmd, 4);
4012         filter->masksize = cpu_to_le32(masksize);
4013         filter->offset = cpu_to_le32(packet_offset);
4014         filter->patternoffset = cpu_to_le32(patternoffset);
4015         filter->patternsize = cpu_to_le32(patternsize);
4016         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
4017
4018         if ((mask) && (masksize))
4019                 memcpy(buf + sizeof(*filter), mask, masksize);
4020         if ((pattern) && (patternsize))
4021                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
4022
4023         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
4024
4025         kfree(buf);
4026         return ret;
4027 }
4028
4029 static s32
4030 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
4031                       void *data)
4032 {
4033         struct brcmf_pub *drvr = ifp->drvr;
4034         struct brcmf_cfg80211_info *cfg = drvr->config;
4035         struct brcmf_pno_scanresults_le *pfn_result;
4036         struct brcmf_pno_net_info_le *netinfo;
4037
4038         brcmf_dbg(SCAN, "Enter\n");
4039
4040         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
4041                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
4042                 return 0;
4043         }
4044
4045         pfn_result = (struct brcmf_pno_scanresults_le *)data;
4046
4047         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
4048                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
4049                 return 0;
4050         }
4051
4052         if (le32_to_cpu(pfn_result->count) < 1) {
4053                 bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
4054                          le32_to_cpu(pfn_result->count));
4055                 return -EINVAL;
4056         }
4057
4058         netinfo = brcmf_get_netinfo_array(pfn_result);
4059         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
4060                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
4061         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
4062         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
4063         cfg->wowl.nd->n_channels = 1;
4064         cfg->wowl.nd->channels[0] =
4065                 ieee80211_channel_to_frequency(netinfo->channel,
4066                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
4067                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
4068         cfg->wowl.nd_info->n_matches = 1;
4069         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
4070
4071         /* Inform (the resume task) that the net detect information was recvd */
4072         cfg->wowl.nd_data_completed = true;
4073         wake_up(&cfg->wowl.nd_data_wait);
4074
4075         return 0;
4076 }
4077
4078 #ifdef CONFIG_PM
4079
4080 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4081 {
4082         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4083         struct brcmf_pub *drvr = cfg->pub;
4084         struct brcmf_wowl_wakeind_le wake_ind_le;
4085         struct cfg80211_wowlan_wakeup wakeup_data;
4086         struct cfg80211_wowlan_wakeup *wakeup;
4087         u32 wakeind;
4088         s32 err;
4089         int timeout;
4090
4091         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
4092                                        sizeof(wake_ind_le));
4093         if (err) {
4094                 bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
4095                 return;
4096         }
4097
4098         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
4099         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
4100                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
4101                        BRCMF_WOWL_PFN_FOUND)) {
4102                 wakeup = &wakeup_data;
4103                 memset(&wakeup_data, 0, sizeof(wakeup_data));
4104                 wakeup_data.pattern_idx = -1;
4105
4106                 if (wakeind & BRCMF_WOWL_MAGIC) {
4107                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
4108                         wakeup_data.magic_pkt = true;
4109                 }
4110                 if (wakeind & BRCMF_WOWL_DIS) {
4111                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
4112                         wakeup_data.disconnect = true;
4113                 }
4114                 if (wakeind & BRCMF_WOWL_BCN) {
4115                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
4116                         wakeup_data.disconnect = true;
4117                 }
4118                 if (wakeind & BRCMF_WOWL_RETR) {
4119                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
4120                         wakeup_data.disconnect = true;
4121                 }
4122                 if (wakeind & BRCMF_WOWL_NET) {
4123                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
4124                         /* For now always map to pattern 0, no API to get
4125                          * correct information available at the moment.
4126                          */
4127                         wakeup_data.pattern_idx = 0;
4128                 }
4129                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
4130                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
4131                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
4132                                 cfg->wowl.nd_data_completed,
4133                                 BRCMF_ND_INFO_TIMEOUT);
4134                         if (!timeout)
4135                                 bphy_err(drvr, "No result for wowl net detect\n");
4136                         else
4137                                 wakeup_data.net_detect = cfg->wowl.nd_info;
4138                 }
4139                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
4140                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
4141                         wakeup_data.gtk_rekey_failure = true;
4142                 }
4143         } else {
4144                 wakeup = NULL;
4145         }
4146         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
4147 }
4148
4149 #else
4150
4151 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4152 {
4153 }
4154
4155 #endif /* CONFIG_PM */
4156
4157 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
4158 {
4159         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4160         struct net_device *ndev = cfg_to_ndev(cfg);
4161         struct brcmf_if *ifp = netdev_priv(ndev);
4162
4163         brcmf_dbg(TRACE, "Enter\n");
4164
4165         if (cfg->wowl.active) {
4166                 brcmf_report_wowl_wakeind(wiphy, ifp);
4167                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
4168                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
4169                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4170                         brcmf_configure_arp_nd_offload(ifp, true);
4171                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
4172                                       cfg->wowl.pre_pmmode);
4173                 cfg->wowl.active = false;
4174                 if (cfg->wowl.nd_enabled) {
4175                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
4176                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4177                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4178                                             brcmf_notify_sched_scan_results);
4179                         cfg->wowl.nd_enabled = false;
4180                 }
4181         }
4182         return 0;
4183 }
4184
4185 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
4186                                  struct brcmf_if *ifp,
4187                                  struct cfg80211_wowlan *wowl)
4188 {
4189         u32 wowl_config;
4190         struct brcmf_wowl_wakeind_le wowl_wakeind;
4191         u32 i;
4192
4193         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
4194
4195         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4196                 brcmf_configure_arp_nd_offload(ifp, false);
4197         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
4198         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
4199
4200         wowl_config = 0;
4201         if (wowl->disconnect)
4202                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
4203         if (wowl->magic_pkt)
4204                 wowl_config |= BRCMF_WOWL_MAGIC;
4205         if ((wowl->patterns) && (wowl->n_patterns)) {
4206                 wowl_config |= BRCMF_WOWL_NET;
4207                 for (i = 0; i < wowl->n_patterns; i++) {
4208                         brcmf_config_wowl_pattern(ifp, "add",
4209                                 (u8 *)wowl->patterns[i].pattern,
4210                                 wowl->patterns[i].pattern_len,
4211                                 (u8 *)wowl->patterns[i].mask,
4212                                 wowl->patterns[i].pkt_offset);
4213                 }
4214         }
4215         if (wowl->nd_config) {
4216                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
4217                                                 wowl->nd_config);
4218                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
4219
4220                 cfg->wowl.nd_data_completed = false;
4221                 cfg->wowl.nd_enabled = true;
4222                 /* Now reroute the event for PFN to the wowl function. */
4223                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4224                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4225                                     brcmf_wowl_nd_results);
4226         }
4227         if (wowl->gtk_rekey_failure)
4228                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
4229         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4230                 wowl_config |= BRCMF_WOWL_UNASSOC;
4231
4232         memcpy(&wowl_wakeind, "clear", 6);
4233         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
4234                                  sizeof(wowl_wakeind));
4235         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
4236         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
4237         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
4238         cfg->wowl.active = true;
4239 }
4240
4241 static int brcmf_keepalive_start(struct brcmf_if *ifp, unsigned int interval)
4242 {
4243         struct brcmf_mkeep_alive_pkt_le kalive = {0};
4244         int ret = 0;
4245
4246         /* Configure Null function/data keepalive */
4247         kalive.version = cpu_to_le16(1);
4248         kalive.period_msec = cpu_to_le32(interval * MSEC_PER_SEC);
4249         kalive.len_bytes = cpu_to_le16(0);
4250         kalive.keep_alive_id = 0;
4251
4252         ret = brcmf_fil_iovar_data_set(ifp, "mkeep_alive", &kalive, sizeof(kalive));
4253         if (ret)
4254                 brcmf_err("keep-alive packet config failed, ret=%d\n", ret);
4255
4256         return ret;
4257 }
4258
4259 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
4260                                   struct cfg80211_wowlan *wowl)
4261 {
4262         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4263         struct net_device *ndev = cfg_to_ndev(cfg);
4264         struct brcmf_if *ifp = netdev_priv(ndev);
4265         struct brcmf_cfg80211_vif *vif;
4266
4267         brcmf_dbg(TRACE, "Enter\n");
4268
4269         /* if the primary net_device is not READY there is nothing
4270          * we can do but pray resume goes smoothly.
4271          */
4272         if (!check_vif_up(ifp->vif))
4273                 goto exit;
4274
4275         /* Stop scheduled scan */
4276         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
4277                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
4278
4279         /* end any scanning */
4280         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
4281                 brcmf_abort_scanning(cfg);
4282
4283         if (wowl == NULL) {
4284                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
4285                 list_for_each_entry(vif, &cfg->vif_list, list) {
4286                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
4287                                 continue;
4288                         /* While going to suspend if associated with AP
4289                          * disassociate from AP to save power while system is
4290                          * in suspended state
4291                          */
4292                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
4293                         /* Make sure WPA_Supplicant receives all the event
4294                          * generated due to DISASSOC call to the fw to keep
4295                          * the state fw and WPA_Supplicant state consistent
4296                          */
4297                         brcmf_delay(500);
4298                 }
4299                 /* Configure MPC */
4300                 brcmf_set_mpc(ifp, 1);
4301
4302         } else {
4303                 /* Configure WOWL paramaters */
4304                 brcmf_configure_wowl(cfg, ifp, wowl);
4305
4306                 /* Prevent disassociation due to inactivity with keep-alive */
4307                 brcmf_keepalive_start(ifp, 30);
4308         }
4309
4310 exit:
4311         brcmf_dbg(TRACE, "Exit\n");
4312         /* clear any scanning activity */
4313         cfg->scan_status = 0;
4314         return 0;
4315 }
4316
4317 static s32
4318 brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
4319                   bool alive)
4320 {
4321         struct brcmf_pmk_op_v3_le *pmk_op;
4322         int length = offsetof(struct brcmf_pmk_op_v3_le, pmk);
4323         int ret;
4324
4325         pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
4326         pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
4327
4328         if (!pmksa) {
4329                 /* Flush operation, operate on entire list */
4330                 pmk_op->count = cpu_to_le16(0);
4331         } else {
4332                 /* Single PMK operation */
4333                 pmk_op->count = cpu_to_le16(1);
4334                 length += sizeof(struct brcmf_pmksa_v3);
4335                 memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
4336                 memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4337                 pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
4338                 pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
4339         }
4340
4341         pmk_op->length = cpu_to_le16(length);
4342
4343         ret = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_op, sizeof(*pmk_op));
4344         kfree(pmk_op);
4345         return ret;
4346 }
4347
4348 static __used s32
4349 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
4350 {
4351         struct brcmf_pmk_list_le *pmk_list;
4352         int i;
4353         u32 npmk;
4354
4355         pmk_list = &cfg->pmk_list;
4356         npmk = le32_to_cpu(pmk_list->npmk);
4357
4358         brcmf_dbg(CONN, "No of elements %d\n", npmk);
4359         for (i = 0; i < npmk; i++)
4360                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
4361
4362         return brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
4363                         sizeof(*pmk_list));
4364 }
4365
4366 static s32
4367 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4368                          struct cfg80211_pmksa *pmksa)
4369 {
4370         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4371         struct brcmf_if *ifp = netdev_priv(ndev);
4372         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4373         struct brcmf_pub *drvr = cfg->pub;
4374         s32 err;
4375         u32 npmk, i;
4376
4377         brcmf_dbg(TRACE, "Enter\n");
4378         if (!check_vif_up(ifp->vif))
4379                 return -EIO;
4380
4381         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmksa->bssid);
4382         brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmksa->pmkid);
4383
4384         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4385                 return brcmf_pmksa_v3_op(ifp, pmksa, true);
4386
4387         /* TODO: implement PMKID_V2 */
4388
4389         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4390         for (i = 0; i < npmk; i++)
4391                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4392                         break;
4393         if (i < BRCMF_MAXPMKID) {
4394                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4395                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4396                 if (i == npmk) {
4397                         npmk++;
4398                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
4399                 }
4400         } else {
4401                 bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4402                 return -EINVAL;
4403         }
4404
4405         err = brcmf_update_pmklist(cfg, ifp);
4406
4407         brcmf_dbg(TRACE, "Exit\n");
4408         return err;
4409 }
4410
4411 static s32
4412 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4413                          struct cfg80211_pmksa *pmksa)
4414 {
4415         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4416         struct brcmf_if *ifp = netdev_priv(ndev);
4417         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4418         struct brcmf_pub *drvr = cfg->pub;
4419         s32 err;
4420         u32 npmk, i;
4421
4422         brcmf_dbg(TRACE, "Enter\n");
4423         if (!check_vif_up(ifp->vif))
4424                 return -EIO;
4425
4426         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4427
4428         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4429                 return brcmf_pmksa_v3_op(ifp, pmksa, false);
4430
4431         /* TODO: implement PMKID_V2 */
4432
4433         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4434         for (i = 0; i < npmk; i++)
4435                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4436                         break;
4437
4438         if ((npmk > 0) && (i < npmk)) {
4439                 for (; i < (npmk - 1); i++) {
4440                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4441                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4442                                WLAN_PMKID_LEN);
4443                 }
4444                 memset(&pmk[i], 0, sizeof(*pmk));
4445                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4446         } else {
4447                 bphy_err(drvr, "Cache entry not found\n");
4448                 return -EINVAL;
4449         }
4450
4451         err = brcmf_update_pmklist(cfg, ifp);
4452
4453         brcmf_dbg(TRACE, "Exit\n");
4454         return err;
4455
4456 }
4457
4458 static s32
4459 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4460 {
4461         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4462         struct brcmf_if *ifp = netdev_priv(ndev);
4463         s32 err;
4464
4465         brcmf_dbg(TRACE, "Enter\n");
4466         if (!check_vif_up(ifp->vif))
4467                 return -EIO;
4468
4469         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4470                 return brcmf_pmksa_v3_op(ifp, NULL, false);
4471
4472         /* TODO: implement PMKID_V2 */
4473
4474         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4475         err = brcmf_update_pmklist(cfg, ifp);
4476
4477         brcmf_dbg(TRACE, "Exit\n");
4478         return err;
4479
4480 }
4481
4482 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4483 {
4484         struct brcmf_pub *drvr = ifp->drvr;
4485         s32 err;
4486         s32 wpa_val;
4487
4488         /* set auth */
4489         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4490         if (err < 0) {
4491                 bphy_err(drvr, "auth error %d\n", err);
4492                 return err;
4493         }
4494         /* set wsec */
4495         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4496         if (err < 0) {
4497                 bphy_err(drvr, "wsec error %d\n", err);
4498                 return err;
4499         }
4500         /* set upper-layer auth */
4501         if (brcmf_is_ibssmode(ifp->vif))
4502                 wpa_val = WPA_AUTH_NONE;
4503         else
4504                 wpa_val = WPA_AUTH_DISABLED;
4505         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4506         if (err < 0) {
4507                 bphy_err(drvr, "wpa_auth error %d\n", err);
4508                 return err;
4509         }
4510
4511         return 0;
4512 }
4513
4514 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4515 {
4516         if (is_rsn_ie)
4517                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4518
4519         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4520 }
4521
4522 static s32
4523 brcmf_configure_wpaie(struct brcmf_if *ifp,
4524                       const struct brcmf_vs_tlv *wpa_ie,
4525                       bool is_rsn_ie)
4526 {
4527         struct brcmf_pub *drvr = ifp->drvr;
4528         u32 auth = 0; /* d11 open authentication */
4529         u16 count;
4530         s32 err = 0;
4531         s32 len;
4532         u32 i;
4533         u32 wsec;
4534         u32 pval = 0;
4535         u32 gval = 0;
4536         u32 wpa_auth = 0;
4537         u32 offset;
4538         u8 *data;
4539         u16 rsn_cap;
4540         u32 wme_bss_disable;
4541         u32 mfp;
4542
4543         brcmf_dbg(TRACE, "Enter\n");
4544         if (wpa_ie == NULL)
4545                 goto exit;
4546
4547         len = wpa_ie->len + TLV_HDR_LEN;
4548         data = (u8 *)wpa_ie;
4549         offset = TLV_HDR_LEN;
4550         if (!is_rsn_ie)
4551                 offset += VS_IE_FIXED_HDR_LEN;
4552         else
4553                 offset += WPA_IE_VERSION_LEN;
4554
4555         /* check for multicast cipher suite */
4556         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4557                 err = -EINVAL;
4558                 bphy_err(drvr, "no multicast cipher suite\n");
4559                 goto exit;
4560         }
4561
4562         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4563                 err = -EINVAL;
4564                 bphy_err(drvr, "ivalid OUI\n");
4565                 goto exit;
4566         }
4567         offset += TLV_OUI_LEN;
4568
4569         /* pick up multicast cipher */
4570         switch (data[offset]) {
4571         case WPA_CIPHER_NONE:
4572                 gval = 0;
4573                 break;
4574         case WPA_CIPHER_WEP_40:
4575         case WPA_CIPHER_WEP_104:
4576                 gval = WEP_ENABLED;
4577                 break;
4578         case WPA_CIPHER_TKIP:
4579                 gval = TKIP_ENABLED;
4580                 break;
4581         case WPA_CIPHER_AES_CCM:
4582                 gval = AES_ENABLED;
4583                 break;
4584         default:
4585                 err = -EINVAL;
4586                 bphy_err(drvr, "Invalid multi cast cipher info\n");
4587                 goto exit;
4588         }
4589
4590         offset++;
4591         /* walk thru unicast cipher list and pick up what we recognize */
4592         count = data[offset] + (data[offset + 1] << 8);
4593         offset += WPA_IE_SUITE_COUNT_LEN;
4594         /* Check for unicast suite(s) */
4595         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4596                 err = -EINVAL;
4597                 bphy_err(drvr, "no unicast cipher suite\n");
4598                 goto exit;
4599         }
4600         for (i = 0; i < count; i++) {
4601                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4602                         err = -EINVAL;
4603                         bphy_err(drvr, "ivalid OUI\n");
4604                         goto exit;
4605                 }
4606                 offset += TLV_OUI_LEN;
4607                 switch (data[offset]) {
4608                 case WPA_CIPHER_NONE:
4609                         break;
4610                 case WPA_CIPHER_WEP_40:
4611                 case WPA_CIPHER_WEP_104:
4612                         pval |= WEP_ENABLED;
4613                         break;
4614                 case WPA_CIPHER_TKIP:
4615                         pval |= TKIP_ENABLED;
4616                         break;
4617                 case WPA_CIPHER_AES_CCM:
4618                         pval |= AES_ENABLED;
4619                         break;
4620                 default:
4621                         bphy_err(drvr, "Invalid unicast security info\n");
4622                 }
4623                 offset++;
4624         }
4625         /* walk thru auth management suite list and pick up what we recognize */
4626         count = data[offset] + (data[offset + 1] << 8);
4627         offset += WPA_IE_SUITE_COUNT_LEN;
4628         /* Check for auth key management suite(s) */
4629         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4630                 err = -EINVAL;
4631                 bphy_err(drvr, "no auth key mgmt suite\n");
4632                 goto exit;
4633         }
4634         for (i = 0; i < count; i++) {
4635                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4636                         err = -EINVAL;
4637                         bphy_err(drvr, "ivalid OUI\n");
4638                         goto exit;
4639                 }
4640                 offset += TLV_OUI_LEN;
4641                 switch (data[offset]) {
4642                 case RSN_AKM_NONE:
4643                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4644                         wpa_auth |= WPA_AUTH_NONE;
4645                         break;
4646                 case RSN_AKM_UNSPECIFIED:
4647                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4648                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4649                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4650                         break;
4651                 case RSN_AKM_PSK:
4652                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4653                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4654                                     (wpa_auth |= WPA_AUTH_PSK);
4655                         break;
4656                 case RSN_AKM_SHA256_PSK:
4657                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4658                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4659                         break;
4660                 case RSN_AKM_SHA256_1X:
4661                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4662                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4663                         break;
4664                 case RSN_AKM_SAE:
4665                         brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4666                         wpa_auth |= WPA3_AUTH_SAE_PSK;
4667                         break;
4668                 default:
4669                         bphy_err(drvr, "Invalid key mgmt info\n");
4670                 }
4671                 offset++;
4672         }
4673
4674         mfp = BRCMF_MFP_NONE;
4675         if (is_rsn_ie) {
4676                 wme_bss_disable = 1;
4677                 if ((offset + RSN_CAP_LEN) <= len) {
4678                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4679                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4680                                 wme_bss_disable = 0;
4681                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4682                                 brcmf_dbg(TRACE, "MFP Required\n");
4683                                 mfp = BRCMF_MFP_REQUIRED;
4684                                 /* Firmware only supports mfp required in
4685                                  * combination with WPA2_AUTH_PSK_SHA256,
4686                                  * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4687                                  */
4688                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4689                                                   WPA2_AUTH_1X_SHA256 |
4690                                                   WPA3_AUTH_SAE_PSK))) {
4691                                         err = -EINVAL;
4692                                         goto exit;
4693                                 }
4694                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4695                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4696                                  * is to be included in the rsn ie.
4697                                  */
4698                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4699                                         wpa_auth |= WPA2_AUTH_PSK;
4700                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4701                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4702                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4703                                 brcmf_dbg(TRACE, "MFP Capable\n");
4704                                 mfp = BRCMF_MFP_CAPABLE;
4705                         }
4706                 }
4707                 offset += RSN_CAP_LEN;
4708                 /* set wme_bss_disable to sync RSN Capabilities */
4709                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4710                                                wme_bss_disable);
4711                 if (err < 0) {
4712                         bphy_err(drvr, "wme_bss_disable error %d\n", err);
4713                         goto exit;
4714                 }
4715
4716                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4717                 offset += RSN_PMKID_COUNT_LEN;
4718
4719                 /* See if there is BIP wpa suite left for MFP */
4720                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4721                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4722                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4723                                                         &data[offset],
4724                                                         WPA_IE_MIN_OUI_LEN);
4725                         if (err < 0) {
4726                                 bphy_err(drvr, "bip error %d\n", err);
4727                                 goto exit;
4728                         }
4729                 }
4730         }
4731         /* FOR WPS , set SES_OW_ENABLED */
4732         wsec = (pval | gval | SES_OW_ENABLED);
4733
4734         /* set auth */
4735         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4736         if (err < 0) {
4737                 bphy_err(drvr, "auth error %d\n", err);
4738                 goto exit;
4739         }
4740         /* set wsec */
4741         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4742         if (err < 0) {
4743                 bphy_err(drvr, "wsec error %d\n", err);
4744                 goto exit;
4745         }
4746         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4747          * will overwrite the values set by MFP
4748          */
4749         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4750                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4751                 if (err < 0) {
4752                         bphy_err(drvr, "mfp error %d\n", err);
4753                         goto exit;
4754                 }
4755         }
4756         /* set upper-layer auth */
4757         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4758         if (err < 0) {
4759                 bphy_err(drvr, "wpa_auth error %d\n", err);
4760                 goto exit;
4761         }
4762
4763 exit:
4764         return err;
4765 }
4766
4767 static s32
4768 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4769                      struct parsed_vndr_ies *vndr_ies)
4770 {
4771         struct brcmf_vs_tlv *vndrie;
4772         struct brcmf_tlv *ie;
4773         struct parsed_vndr_ie_info *parsed_info;
4774         s32 remaining_len;
4775
4776         remaining_len = (s32)vndr_ie_len;
4777         memset(vndr_ies, 0, sizeof(*vndr_ies));
4778
4779         ie = (struct brcmf_tlv *)vndr_ie_buf;
4780         while (ie) {
4781                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4782                         goto next;
4783                 vndrie = (struct brcmf_vs_tlv *)ie;
4784                 /* len should be bigger than OUI length + one */
4785                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4786                         brcmf_err("invalid vndr ie. length is too small %d\n",
4787                                   vndrie->len);
4788                         goto next;
4789                 }
4790                 /* if wpa or wme ie, do not add ie */
4791                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4792                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4793                     (vndrie->oui_type == WME_OUI_TYPE))) {
4794                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4795                         goto next;
4796                 }
4797
4798                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4799
4800                 /* save vndr ie information */
4801                 parsed_info->ie_ptr = (char *)vndrie;
4802                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4803                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4804
4805                 vndr_ies->count++;
4806
4807                 brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4808                           parsed_info->vndrie.oui,
4809                           parsed_info->vndrie.oui_type);
4810
4811                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4812                         break;
4813 next:
4814                 remaining_len -= (ie->len + TLV_HDR_LEN);
4815                 if (remaining_len <= TLV_HDR_LEN)
4816                         ie = NULL;
4817                 else
4818                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4819                                 TLV_HDR_LEN);
4820         }
4821         return 0;
4822 }
4823
4824 static u32
4825 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4826 {
4827         strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4828
4829         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4830
4831         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4832
4833         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4834
4835         return ie_len + VNDR_IE_HDR_SIZE;
4836 }
4837
4838 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4839                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4840 {
4841         struct brcmf_pub *drvr;
4842         struct brcmf_if *ifp;
4843         struct vif_saved_ie *saved_ie;
4844         s32 err = 0;
4845         u8  *iovar_ie_buf;
4846         u8  *curr_ie_buf;
4847         u8  *mgmt_ie_buf = NULL;
4848         int mgmt_ie_buf_len;
4849         u32 *mgmt_ie_len;
4850         u32 del_add_ie_buf_len = 0;
4851         u32 total_ie_buf_len = 0;
4852         u32 parsed_ie_buf_len = 0;
4853         struct parsed_vndr_ies old_vndr_ies;
4854         struct parsed_vndr_ies new_vndr_ies;
4855         struct parsed_vndr_ie_info *vndrie_info;
4856         s32 i;
4857         u8 *ptr;
4858         int remained_buf_len;
4859
4860         if (!vif)
4861                 return -ENODEV;
4862         ifp = vif->ifp;
4863         drvr = ifp->drvr;
4864         saved_ie = &vif->saved_ie;
4865
4866         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4867                   pktflag);
4868         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4869         if (!iovar_ie_buf)
4870                 return -ENOMEM;
4871         curr_ie_buf = iovar_ie_buf;
4872         switch (pktflag) {
4873         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4874                 mgmt_ie_buf = saved_ie->probe_req_ie;
4875                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4876                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4877                 break;
4878         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4879                 mgmt_ie_buf = saved_ie->probe_res_ie;
4880                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4881                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4882                 break;
4883         case BRCMF_VNDR_IE_BEACON_FLAG:
4884                 mgmt_ie_buf = saved_ie->beacon_ie;
4885                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4886                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4887                 break;
4888         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4889                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4890                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4891                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4892                 break;
4893         case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4894                 mgmt_ie_buf = saved_ie->assoc_res_ie;
4895                 mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4896                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4897                 break;
4898         default:
4899                 err = -EPERM;
4900                 bphy_err(drvr, "not suitable type\n");
4901                 goto exit;
4902         }
4903
4904         if (vndr_ie_len > mgmt_ie_buf_len) {
4905                 err = -ENOMEM;
4906                 bphy_err(drvr, "extra IE size too big\n");
4907                 goto exit;
4908         }
4909
4910         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4911         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4912                 ptr = curr_ie_buf;
4913                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4914                 for (i = 0; i < new_vndr_ies.count; i++) {
4915                         vndrie_info = &new_vndr_ies.ie_info[i];
4916                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4917                                vndrie_info->ie_len);
4918                         parsed_ie_buf_len += vndrie_info->ie_len;
4919                 }
4920         }
4921
4922         if (mgmt_ie_buf && *mgmt_ie_len) {
4923                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4924                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4925                             parsed_ie_buf_len) == 0)) {
4926                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4927                         goto exit;
4928                 }
4929
4930                 /* parse old vndr_ie */
4931                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4932
4933                 /* make a command to delete old ie */
4934                 for (i = 0; i < old_vndr_ies.count; i++) {
4935                         vndrie_info = &old_vndr_ies.ie_info[i];
4936
4937                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4938                                   vndrie_info->vndrie.id,
4939                                   vndrie_info->vndrie.len,
4940                                   vndrie_info->vndrie.oui);
4941
4942                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4943                                                            vndrie_info->ie_ptr,
4944                                                            vndrie_info->ie_len,
4945                                                            "del");
4946                         curr_ie_buf += del_add_ie_buf_len;
4947                         total_ie_buf_len += del_add_ie_buf_len;
4948                 }
4949         }
4950
4951         *mgmt_ie_len = 0;
4952         /* Add if there is any extra IE */
4953         if (mgmt_ie_buf && parsed_ie_buf_len) {
4954                 ptr = mgmt_ie_buf;
4955
4956                 remained_buf_len = mgmt_ie_buf_len;
4957
4958                 /* make a command to add new ie */
4959                 for (i = 0; i < new_vndr_ies.count; i++) {
4960                         vndrie_info = &new_vndr_ies.ie_info[i];
4961
4962                         /* verify remained buf size before copy data */
4963                         if (remained_buf_len < (vndrie_info->vndrie.len +
4964                                                         VNDR_IE_VSIE_OFFSET)) {
4965                                 bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4966                                          remained_buf_len);
4967                                 break;
4968                         }
4969                         remained_buf_len -= (vndrie_info->ie_len +
4970                                              VNDR_IE_VSIE_OFFSET);
4971
4972                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4973                                   vndrie_info->vndrie.id,
4974                                   vndrie_info->vndrie.len,
4975                                   vndrie_info->vndrie.oui);
4976
4977                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4978                                                            vndrie_info->ie_ptr,
4979                                                            vndrie_info->ie_len,
4980                                                            "add");
4981
4982                         /* save the parsed IE in wl struct */
4983                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4984                                vndrie_info->ie_len);
4985                         *mgmt_ie_len += vndrie_info->ie_len;
4986
4987                         curr_ie_buf += del_add_ie_buf_len;
4988                         total_ie_buf_len += del_add_ie_buf_len;
4989                 }
4990         }
4991         if (total_ie_buf_len) {
4992                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4993                                                  total_ie_buf_len);
4994                 if (err)
4995                         bphy_err(drvr, "vndr ie set error : %d\n", err);
4996         }
4997
4998 exit:
4999         kfree(iovar_ie_buf);
5000         return err;
5001 }
5002
5003 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
5004 {
5005         static const s32 pktflags[] = {
5006                 BRCMF_VNDR_IE_PRBREQ_FLAG,
5007                 BRCMF_VNDR_IE_PRBRSP_FLAG,
5008                 BRCMF_VNDR_IE_BEACON_FLAG
5009         };
5010         int i;
5011
5012         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
5013                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
5014
5015         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
5016         return 0;
5017 }
5018
5019 static s32
5020 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
5021                         struct cfg80211_beacon_data *beacon)
5022 {
5023         struct brcmf_pub *drvr = vif->ifp->drvr;
5024         s32 err;
5025
5026         /* Set Beacon IEs to FW */
5027         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
5028                                     beacon->tail, beacon->tail_len);
5029         if (err) {
5030                 bphy_err(drvr, "Set Beacon IE Failed\n");
5031                 return err;
5032         }
5033         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
5034
5035         /* Set Probe Response IEs to FW */
5036         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
5037                                     beacon->proberesp_ies,
5038                                     beacon->proberesp_ies_len);
5039         if (err)
5040                 bphy_err(drvr, "Set Probe Resp IE Failed\n");
5041         else
5042                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
5043
5044         /* Set Assoc Response IEs to FW */
5045         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
5046                                     beacon->assocresp_ies,
5047                                     beacon->assocresp_ies_len);
5048         if (err)
5049                 brcmf_err("Set Assoc Resp IE Failed\n");
5050         else
5051                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
5052
5053         return err;
5054 }
5055
5056 static s32
5057 brcmf_parse_configure_security(struct brcmf_if *ifp,
5058                                struct cfg80211_ap_settings *settings,
5059                                enum nl80211_iftype dev_role)
5060 {
5061         const struct brcmf_tlv *rsn_ie;
5062         const struct brcmf_vs_tlv *wpa_ie;
5063         s32 err = 0;
5064
5065         /* find the RSN_IE */
5066         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5067                                   settings->beacon.tail_len, WLAN_EID_RSN);
5068
5069         /* find the WPA_IE */
5070         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
5071                                   settings->beacon.tail_len);
5072
5073         if (wpa_ie || rsn_ie) {
5074                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
5075                 if (wpa_ie) {
5076                         /* WPA IE */
5077                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
5078                         if (err < 0)
5079                                 return err;
5080                 } else {
5081                         struct brcmf_vs_tlv *tmp_ie;
5082
5083                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
5084
5085                         /* RSN IE */
5086                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
5087                         if (err < 0)
5088                                 return err;
5089                 }
5090         } else {
5091                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
5092                 brcmf_configure_opensecurity(ifp);
5093         }
5094
5095         return err;
5096 }
5097
5098 static s32
5099 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
5100                         struct cfg80211_ap_settings *settings)
5101 {
5102         s32 ie_offset;
5103         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5104         struct brcmf_if *ifp = netdev_priv(ndev);
5105         struct brcmf_pub *drvr = cfg->pub;
5106         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5107         struct cfg80211_crypto_settings *crypto = &settings->crypto;
5108         const struct brcmf_tlv *ssid_ie;
5109         const struct brcmf_tlv *country_ie;
5110         struct brcmf_ssid_le ssid_le;
5111         s32 err = -EPERM;
5112         struct brcmf_join_params join_params;
5113         enum nl80211_iftype dev_role;
5114         struct brcmf_fil_bss_enable_le bss_enable;
5115         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
5116         bool mbss;
5117         int is_11d;
5118         bool supports_11d;
5119
5120         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
5121                   settings->chandef.chan->hw_value,
5122                   settings->chandef.center_freq1, settings->chandef.width,
5123                   settings->beacon_interval, settings->dtim_period);
5124         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
5125                   settings->ssid, settings->ssid_len, settings->auth_type,
5126                   settings->inactivity_timeout);
5127         dev_role = ifp->vif->wdev.iftype;
5128         mbss = ifp->vif->mbss;
5129
5130         /* store current 11d setting */
5131         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
5132                                   &ifp->vif->is_11d)) {
5133                 is_11d = supports_11d = false;
5134         } else {
5135                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5136                                               settings->beacon.tail_len,
5137                                               WLAN_EID_COUNTRY);
5138                 is_11d = country_ie ? 1 : 0;
5139                 supports_11d = true;
5140         }
5141
5142         memset(&ssid_le, 0, sizeof(ssid_le));
5143         if (settings->ssid == NULL || settings->ssid_len == 0) {
5144                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
5145                 ssid_ie = brcmf_parse_tlvs(
5146                                 (u8 *)&settings->beacon.head[ie_offset],
5147                                 settings->beacon.head_len - ie_offset,
5148                                 WLAN_EID_SSID);
5149                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
5150                         return -EINVAL;
5151
5152                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
5153                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
5154                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
5155         } else {
5156                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
5157                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
5158         }
5159
5160         if (!mbss) {
5161                 brcmf_set_mpc(ifp, 0);
5162                 brcmf_configure_arp_nd_offload(ifp, false);
5163         }
5164
5165         /* Parameters shared by all radio interfaces */
5166         if (!mbss) {
5167                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
5168                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5169                                                     is_11d);
5170                         if (err < 0) {
5171                                 bphy_err(drvr, "Regulatory Set Error, %d\n",
5172                                          err);
5173                                 goto exit;
5174                         }
5175                 }
5176                 if (settings->beacon_interval) {
5177                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
5178                                                     settings->beacon_interval);
5179                         if (err < 0) {
5180                                 bphy_err(drvr, "Beacon Interval Set Error, %d\n",
5181                                          err);
5182                                 goto exit;
5183                         }
5184                 }
5185                 if (settings->dtim_period) {
5186                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
5187                                                     settings->dtim_period);
5188                         if (err < 0) {
5189                                 bphy_err(drvr, "DTIM Interval Set Error, %d\n",
5190                                          err);
5191                                 goto exit;
5192                         }
5193                 }
5194
5195                 if ((dev_role == NL80211_IFTYPE_AP) &&
5196                     ((ifp->ifidx == 0) ||
5197                      (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
5198                       !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
5199                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5200                         if (err < 0) {
5201                                 bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
5202                                          err);
5203                                 goto exit;
5204                         }
5205                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
5206                 }
5207
5208                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
5209                 if (err < 0) {
5210                         bphy_err(drvr, "SET INFRA error %d\n", err);
5211                         goto exit;
5212                 }
5213         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
5214                 /* Multiple-BSS should use same 11d configuration */
5215                 err = -EINVAL;
5216                 goto exit;
5217         }
5218
5219         /* Interface specific setup */
5220         if (dev_role == NL80211_IFTYPE_AP) {
5221                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
5222                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
5223
5224                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
5225                 if (err < 0) {
5226                         bphy_err(drvr, "setting AP mode failed %d\n",
5227                                  err);
5228                         goto exit;
5229                 }
5230                 if (!mbss) {
5231                         /* Firmware 10.x requires setting channel after enabling
5232                          * AP and before bringing interface up.
5233                          */
5234                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5235                         if (err < 0) {
5236                                 bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5237                                          chanspec, err);
5238                                 goto exit;
5239                         }
5240                 }
5241                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5242                 if (err < 0) {
5243                         bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
5244                         goto exit;
5245                 }
5246
5247                 if (crypto->psk) {
5248                         brcmf_dbg(INFO, "using PSK offload\n");
5249                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
5250                         err = brcmf_set_pmk(ifp, crypto->psk,
5251                                             BRCMF_WSEC_MAX_PSK_LEN);
5252                         if (err < 0)
5253                                 goto exit;
5254                 }
5255                 if (crypto->sae_pwd) {
5256                         brcmf_dbg(INFO, "using SAE offload\n");
5257                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
5258                         err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
5259                                                      crypto->sae_pwd_len);
5260                         if (err < 0)
5261                                 goto exit;
5262                 }
5263                 if (profile->use_fwauth == 0)
5264                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5265
5266                 err = brcmf_parse_configure_security(ifp, settings,
5267                                                      NL80211_IFTYPE_AP);
5268                 if (err < 0) {
5269                         bphy_err(drvr, "brcmf_parse_configure_security error\n");
5270                         goto exit;
5271                 }
5272
5273                 /* On DOWN the firmware removes the WEP keys, reconfigure
5274                  * them if they were set.
5275                  */
5276                 brcmf_cfg80211_reconfigure_wep(ifp);
5277
5278                 memset(&join_params, 0, sizeof(join_params));
5279                 /* join parameters starts with ssid */
5280                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
5281                 /* create softap */
5282                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5283                                              &join_params, sizeof(join_params));
5284                 if (err < 0) {
5285                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5286                         goto exit;
5287                 }
5288
5289                 err = brcmf_fil_iovar_int_set(ifp, "closednet",
5290                                               settings->hidden_ssid);
5291                 if (err) {
5292                         bphy_err(drvr, "%s closednet error (%d)\n",
5293                                  settings->hidden_ssid ?
5294                                  "enabled" : "disabled",
5295                                  err);
5296                         goto exit;
5297                 }
5298
5299                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
5300         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
5301                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5302                 if (err < 0) {
5303                         bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5304                                  chanspec, err);
5305                         goto exit;
5306                 }
5307
5308                 err = brcmf_parse_configure_security(ifp, settings,
5309                                                      NL80211_IFTYPE_P2P_GO);
5310                 if (err < 0) {
5311                         brcmf_err("brcmf_parse_configure_security error\n");
5312                         goto exit;
5313                 }
5314
5315                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
5316                                                 sizeof(ssid_le));
5317                 if (err < 0) {
5318                         bphy_err(drvr, "setting ssid failed %d\n", err);
5319                         goto exit;
5320                 }
5321                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5322                 bss_enable.enable = cpu_to_le32(1);
5323                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5324                                                sizeof(bss_enable));
5325                 if (err < 0) {
5326                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5327                         goto exit;
5328                 }
5329
5330                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
5331         } else {
5332                 WARN_ON(1);
5333         }
5334
5335         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
5336         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5337         brcmf_net_setcarrier(ifp, true);
5338
5339 exit:
5340         if ((err) && (!mbss)) {
5341                 brcmf_set_mpc(ifp, 1);
5342                 brcmf_configure_arp_nd_offload(ifp, true);
5343         }
5344         return err;
5345 }
5346
5347 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
5348                                   unsigned int link_id)
5349 {
5350         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5351         struct brcmf_if *ifp = netdev_priv(ndev);
5352         struct brcmf_pub *drvr = cfg->pub;
5353         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5354         s32 err;
5355         struct brcmf_fil_bss_enable_le bss_enable;
5356         struct brcmf_join_params join_params;
5357
5358         brcmf_dbg(TRACE, "Enter\n");
5359
5360         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
5361                 /* Due to most likely deauths outstanding we sleep */
5362                 /* first to make sure they get processed by fw. */
5363                 msleep(400);
5364
5365                 if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
5366                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
5367                                 brcmf_set_pmk(ifp, NULL, 0);
5368                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
5369                                 brcmf_set_sae_password(ifp, NULL, 0);
5370                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5371                 }
5372
5373                 if (ifp->vif->mbss) {
5374                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5375                         return err;
5376                 }
5377
5378                 /* First BSS doesn't get a full reset */
5379                 if (ifp->bsscfgidx == 0)
5380                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
5381
5382                 memset(&join_params, 0, sizeof(join_params));
5383                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5384                                              &join_params, sizeof(join_params));
5385                 if (err < 0)
5386                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5387                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5388                 if (err < 0)
5389                         bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
5390                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
5391                 if (err < 0)
5392                         bphy_err(drvr, "setting AP mode failed %d\n", err);
5393                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
5394                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
5395                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5396                                       ifp->vif->is_11d);
5397                 /* Bring device back up so it can be used again */
5398                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5399                 if (err < 0)
5400                         bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
5401
5402                 brcmf_vif_clear_mgmt_ies(ifp->vif);
5403         } else {
5404                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5405                 bss_enable.enable = cpu_to_le32(0);
5406                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5407                                                sizeof(bss_enable));
5408                 if (err < 0)
5409                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5410         }
5411         brcmf_set_mpc(ifp, 1);
5412         brcmf_configure_arp_nd_offload(ifp, true);
5413         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5414         brcmf_net_setcarrier(ifp, false);
5415
5416         return err;
5417 }
5418
5419 static s32
5420 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5421                              struct cfg80211_beacon_data *info)
5422 {
5423         struct brcmf_if *ifp = netdev_priv(ndev);
5424
5425         brcmf_dbg(TRACE, "Enter\n");
5426
5427         return brcmf_config_ap_mgmt_ie(ifp->vif, info);
5428 }
5429
5430 static int
5431 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5432                            struct station_del_parameters *params)
5433 {
5434         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5435         struct brcmf_pub *drvr = cfg->pub;
5436         struct brcmf_scb_val_le scbval;
5437         struct brcmf_if *ifp = netdev_priv(ndev);
5438         s32 err;
5439
5440         if (!params->mac)
5441                 return -EFAULT;
5442
5443         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5444
5445         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5446                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5447         if (!check_vif_up(ifp->vif))
5448                 return -EIO;
5449
5450         memcpy(&scbval.ea, params->mac, ETH_ALEN);
5451         scbval.val = cpu_to_le32(params->reason_code);
5452         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5453                                      &scbval, sizeof(scbval));
5454         if (err)
5455                 bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5456                          err);
5457
5458         brcmf_dbg(TRACE, "Exit\n");
5459         return err;
5460 }
5461
5462 static int
5463 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5464                               const u8 *mac, struct station_parameters *params)
5465 {
5466         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5467         struct brcmf_pub *drvr = cfg->pub;
5468         struct brcmf_if *ifp = netdev_priv(ndev);
5469         s32 err;
5470
5471         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5472                   params->sta_flags_mask, params->sta_flags_set);
5473
5474         /* Ignore all 00 MAC */
5475         if (is_zero_ether_addr(mac))
5476                 return 0;
5477
5478         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5479                 return 0;
5480
5481         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5482                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5483                                              (void *)mac, ETH_ALEN);
5484         else
5485                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5486                                              (void *)mac, ETH_ALEN);
5487         if (err < 0)
5488                 bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5489
5490         return err;
5491 }
5492
5493 static void
5494 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5495                                                struct wireless_dev *wdev,
5496                                                struct mgmt_frame_regs *upd)
5497 {
5498         struct brcmf_cfg80211_vif *vif;
5499
5500         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5501
5502         vif->mgmt_rx_reg = upd->interface_stypes;
5503 }
5504
5505
5506 static int
5507 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5508                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5509 {
5510         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5511         struct ieee80211_channel *chan = params->chan;
5512         struct brcmf_pub *drvr = cfg->pub;
5513         const u8 *buf = params->buf;
5514         size_t len = params->len;
5515         const struct ieee80211_mgmt *mgmt;
5516         struct brcmf_cfg80211_vif *vif;
5517         s32 err = 0;
5518         s32 ie_offset;
5519         s32 ie_len;
5520         struct brcmf_fil_action_frame_le *action_frame;
5521         struct brcmf_fil_af_params_le *af_params;
5522         bool ack;
5523         s32 chan_nr;
5524         u32 freq;
5525
5526         brcmf_dbg(TRACE, "Enter\n");
5527
5528         *cookie = 0;
5529
5530         mgmt = (const struct ieee80211_mgmt *)buf;
5531
5532         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5533                 bphy_err(drvr, "Driver only allows MGMT packet type\n");
5534                 return -EPERM;
5535         }
5536
5537         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5538
5539         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5540                 /* Right now the only reason to get a probe response */
5541                 /* is for p2p listen response or for p2p GO from     */
5542                 /* wpa_supplicant. Unfortunately the probe is send   */
5543                 /* on primary ndev, while dongle wants it on the p2p */
5544                 /* vif. Since this is only reason for a probe        */
5545                 /* response to be sent, the vif is taken from cfg.   */
5546                 /* If ever desired to send proberesp for non p2p     */
5547                 /* response then data should be checked for          */
5548                 /* "DIRECT-". Note in future supplicant will take    */
5549                 /* dedicated p2p wdev to do this and then this 'hack'*/
5550                 /* is not needed anymore.                            */
5551                 ie_offset =  DOT11_MGMT_HDR_LEN +
5552                              DOT11_BCN_PRB_FIXED_LEN;
5553                 ie_len = len - ie_offset;
5554                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5555                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5556                 err = brcmf_vif_set_mgmt_ie(vif,
5557                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
5558                                             &buf[ie_offset],
5559                                             ie_len);
5560                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5561                                         GFP_KERNEL);
5562         } else if (ieee80211_is_action(mgmt->frame_control)) {
5563                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5564                         bphy_err(drvr, "invalid action frame length\n");
5565                         err = -EINVAL;
5566                         goto exit;
5567                 }
5568                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5569                 if (af_params == NULL) {
5570                         bphy_err(drvr, "unable to allocate frame\n");
5571                         err = -ENOMEM;
5572                         goto exit;
5573                 }
5574                 action_frame = &af_params->action_frame;
5575                 /* Add the packet Id */
5576                 action_frame->packet_id = cpu_to_le32(*cookie);
5577                 /* Add BSSID */
5578                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5579                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5580                 /* Add the length exepted for 802.11 header  */
5581                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5582                 /* Add the channel. Use the one specified as parameter if any or
5583                  * the current one (got from the firmware) otherwise
5584                  */
5585                 if (chan)
5586                         freq = chan->center_freq;
5587                 else
5588                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5589                                               &freq);
5590                 chan_nr = ieee80211_frequency_to_channel(freq);
5591                 af_params->channel = cpu_to_le32(chan_nr);
5592                 af_params->dwell_time = cpu_to_le32(params->wait);
5593                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5594                        le16_to_cpu(action_frame->len));
5595
5596                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5597                           *cookie, le16_to_cpu(action_frame->len), freq);
5598
5599                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5600                                                   af_params);
5601
5602                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5603                                         GFP_KERNEL);
5604                 kfree(af_params);
5605         } else {
5606                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5607                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5608         }
5609
5610 exit:
5611         return err;
5612 }
5613
5614 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5615                                                     struct net_device *ndev,
5616                                                     s32 rssi_low, s32 rssi_high)
5617 {
5618         struct brcmf_cfg80211_vif *vif;
5619         struct brcmf_if *ifp;
5620         int err = 0;
5621
5622         brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5623
5624         ifp = netdev_priv(ndev);
5625         vif = ifp->vif;
5626
5627         if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5628                 /* The firmware will send an event when the RSSI is less than or
5629                  * equal to a configured level and the previous RSSI event was
5630                  * less than or equal to a different level. Set a third level
5631                  * so that we also detect the transition from rssi <= rssi_high
5632                  * to rssi > rssi_high.
5633                  */
5634                 struct brcmf_rssi_event_le config = {
5635                         .rate_limit_msec = cpu_to_le32(0),
5636                         .rssi_level_num = 3,
5637                         .rssi_levels = {
5638                                 clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5639                                 clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5640                                 S8_MAX,
5641                         },
5642                 };
5643
5644                 err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5645                                                sizeof(config));
5646                 if (err) {
5647                         err = -EINVAL;
5648                 } else {
5649                         vif->cqm_rssi_low = rssi_low;
5650                         vif->cqm_rssi_high = rssi_high;
5651                 }
5652         }
5653
5654         return err;
5655 }
5656
5657 static int
5658 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5659                                         struct wireless_dev *wdev,
5660                                         u64 cookie)
5661 {
5662         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5663         struct brcmf_pub *drvr = cfg->pub;
5664         struct brcmf_cfg80211_vif *vif;
5665         int err = 0;
5666
5667         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5668
5669         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5670         if (vif == NULL) {
5671                 bphy_err(drvr, "No p2p device available for probe response\n");
5672                 err = -ENODEV;
5673                 goto exit;
5674         }
5675         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5676 exit:
5677         return err;
5678 }
5679
5680 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5681                                       struct wireless_dev *wdev,
5682                                       unsigned int link_id,
5683                                       struct cfg80211_chan_def *chandef)
5684 {
5685         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5686         struct net_device *ndev = wdev->netdev;
5687         struct brcmf_pub *drvr = cfg->pub;
5688         struct brcmu_chan ch;
5689         enum nl80211_band band = 0;
5690         enum nl80211_chan_width width = 0;
5691         u32 chanspec;
5692         int freq, err;
5693
5694         if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5695                 return -ENODEV;
5696
5697         err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5698         if (err) {
5699                 bphy_err(drvr, "chanspec failed (%d)\n", err);
5700                 return err;
5701         }
5702
5703         ch.chspec = chanspec;
5704         cfg->d11inf.decchspec(&ch);
5705
5706         switch (ch.band) {
5707         case BRCMU_CHAN_BAND_2G:
5708                 band = NL80211_BAND_2GHZ;
5709                 break;
5710         case BRCMU_CHAN_BAND_5G:
5711                 band = NL80211_BAND_5GHZ;
5712                 break;
5713         }
5714
5715         switch (ch.bw) {
5716         case BRCMU_CHAN_BW_80:
5717                 width = NL80211_CHAN_WIDTH_80;
5718                 break;
5719         case BRCMU_CHAN_BW_40:
5720                 width = NL80211_CHAN_WIDTH_40;
5721                 break;
5722         case BRCMU_CHAN_BW_20:
5723                 width = NL80211_CHAN_WIDTH_20;
5724                 break;
5725         case BRCMU_CHAN_BW_80P80:
5726                 width = NL80211_CHAN_WIDTH_80P80;
5727                 break;
5728         case BRCMU_CHAN_BW_160:
5729                 width = NL80211_CHAN_WIDTH_160;
5730                 break;
5731         }
5732
5733         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5734         chandef->chan = ieee80211_get_channel(wiphy, freq);
5735         chandef->width = width;
5736         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5737         chandef->center_freq2 = 0;
5738
5739         return 0;
5740 }
5741
5742 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5743                                            struct wireless_dev *wdev,
5744                                            enum nl80211_crit_proto_id proto,
5745                                            u16 duration)
5746 {
5747         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5748         struct brcmf_cfg80211_vif *vif;
5749
5750         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5751
5752         /* only DHCP support for now */
5753         if (proto != NL80211_CRIT_PROTO_DHCP)
5754                 return -EINVAL;
5755
5756         /* suppress and abort scanning */
5757         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5758         brcmf_abort_scanning(cfg);
5759
5760         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5761 }
5762
5763 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5764                                            struct wireless_dev *wdev)
5765 {
5766         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5767         struct brcmf_cfg80211_vif *vif;
5768
5769         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5770
5771         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5772         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5773 }
5774
5775 static s32
5776 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5777                              const struct brcmf_event_msg *e, void *data)
5778 {
5779         switch (e->reason) {
5780         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5781                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5782                 break;
5783         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5784                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5785                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5786                 break;
5787         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5788                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5789                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5790                 break;
5791         }
5792
5793         return 0;
5794 }
5795
5796 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5797 {
5798         int ret;
5799
5800         switch (oper) {
5801         case NL80211_TDLS_DISCOVERY_REQ:
5802                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5803                 break;
5804         case NL80211_TDLS_SETUP:
5805                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5806                 break;
5807         case NL80211_TDLS_TEARDOWN:
5808                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5809                 break;
5810         default:
5811                 brcmf_err("unsupported operation: %d\n", oper);
5812                 ret = -EOPNOTSUPP;
5813         }
5814         return ret;
5815 }
5816
5817 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5818                                     struct net_device *ndev, const u8 *peer,
5819                                     enum nl80211_tdls_operation oper)
5820 {
5821         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5822         struct brcmf_pub *drvr = cfg->pub;
5823         struct brcmf_if *ifp;
5824         struct brcmf_tdls_iovar_le info;
5825         int ret = 0;
5826
5827         ret = brcmf_convert_nl80211_tdls_oper(oper);
5828         if (ret < 0)
5829                 return ret;
5830
5831         ifp = netdev_priv(ndev);
5832         memset(&info, 0, sizeof(info));
5833         info.mode = (u8)ret;
5834         if (peer)
5835                 memcpy(info.ea, peer, ETH_ALEN);
5836
5837         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5838                                        &info, sizeof(info));
5839         if (ret < 0)
5840                 bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5841
5842         return ret;
5843 }
5844
5845 static int
5846 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5847                                   struct net_device *ndev,
5848                                   struct cfg80211_connect_params *sme,
5849                                   u32 changed)
5850 {
5851         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5852         struct brcmf_pub *drvr = cfg->pub;
5853         struct brcmf_if *ifp;
5854         int err;
5855
5856         if (!(changed & UPDATE_ASSOC_IES))
5857                 return 0;
5858
5859         ifp = netdev_priv(ndev);
5860         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5861                                     sme->ie, sme->ie_len);
5862         if (err)
5863                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5864         else
5865                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5866
5867         return err;
5868 }
5869
5870 #ifdef CONFIG_PM
5871 static int
5872 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5873                               struct cfg80211_gtk_rekey_data *gtk)
5874 {
5875         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5876         struct brcmf_pub *drvr = cfg->pub;
5877         struct brcmf_if *ifp = netdev_priv(ndev);
5878         struct brcmf_gtk_keyinfo_le gtk_le;
5879         int ret;
5880
5881         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5882
5883         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5884         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5885         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5886                sizeof(gtk_le.replay_counter));
5887
5888         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5889                                        sizeof(gtk_le));
5890         if (ret < 0)
5891                 bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5892
5893         return ret;
5894 }
5895 #endif
5896
5897 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5898                                   const struct cfg80211_pmk_conf *conf)
5899 {
5900         struct brcmf_if *ifp;
5901
5902         brcmf_dbg(TRACE, "enter\n");
5903
5904         /* expect using firmware supplicant for 1X */
5905         ifp = netdev_priv(dev);
5906         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5907                 return -EINVAL;
5908
5909         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5910                 return -ERANGE;
5911
5912         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5913 }
5914
5915 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5916                                   const u8 *aa)
5917 {
5918         struct brcmf_if *ifp;
5919
5920         brcmf_dbg(TRACE, "enter\n");
5921         ifp = netdev_priv(dev);
5922         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5923                 return -EINVAL;
5924
5925         return brcmf_set_pmk(ifp, NULL, 0);
5926 }
5927
5928 static struct cfg80211_ops brcmf_cfg80211_ops = {
5929         .add_virtual_intf = brcmf_cfg80211_add_iface,
5930         .del_virtual_intf = brcmf_cfg80211_del_iface,
5931         .change_virtual_intf = brcmf_cfg80211_change_iface,
5932         .scan = brcmf_cfg80211_scan,
5933         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5934         .join_ibss = brcmf_cfg80211_join_ibss,
5935         .leave_ibss = brcmf_cfg80211_leave_ibss,
5936         .get_station = brcmf_cfg80211_get_station,
5937         .dump_station = brcmf_cfg80211_dump_station,
5938         .set_tx_power = brcmf_cfg80211_set_tx_power,
5939         .get_tx_power = brcmf_cfg80211_get_tx_power,
5940         .add_key = brcmf_cfg80211_add_key,
5941         .del_key = brcmf_cfg80211_del_key,
5942         .get_key = brcmf_cfg80211_get_key,
5943         .set_default_key = brcmf_cfg80211_config_default_key,
5944         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5945         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5946         .connect = brcmf_cfg80211_connect,
5947         .disconnect = brcmf_cfg80211_disconnect,
5948         .suspend = brcmf_cfg80211_suspend,
5949         .resume = brcmf_cfg80211_resume,
5950         .set_pmksa = brcmf_cfg80211_set_pmksa,
5951         .del_pmksa = brcmf_cfg80211_del_pmksa,
5952         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5953         .start_ap = brcmf_cfg80211_start_ap,
5954         .stop_ap = brcmf_cfg80211_stop_ap,
5955         .change_beacon = brcmf_cfg80211_change_beacon,
5956         .del_station = brcmf_cfg80211_del_station,
5957         .change_station = brcmf_cfg80211_change_station,
5958         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5959         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5960         .update_mgmt_frame_registrations =
5961                 brcmf_cfg80211_update_mgmt_frame_registrations,
5962         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5963         .set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
5964         .remain_on_channel = brcmf_p2p_remain_on_channel,
5965         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5966         .get_channel = brcmf_cfg80211_get_channel,
5967         .start_p2p_device = brcmf_p2p_start_device,
5968         .stop_p2p_device = brcmf_p2p_stop_device,
5969         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5970         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5971         .tdls_oper = brcmf_cfg80211_tdls_oper,
5972         .update_connect_params = brcmf_cfg80211_update_conn_params,
5973         .set_pmk = brcmf_cfg80211_set_pmk,
5974         .del_pmk = brcmf_cfg80211_del_pmk,
5975 };
5976
5977 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
5978 {
5979         struct cfg80211_ops *ops;
5980
5981         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5982                        GFP_KERNEL);
5983
5984         if (ops && settings->roamoff)
5985                 ops->update_connect_params = NULL;
5986
5987         return ops;
5988 }
5989
5990 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5991                                            enum nl80211_iftype type)
5992 {
5993         struct brcmf_cfg80211_vif *vif_walk;
5994         struct brcmf_cfg80211_vif *vif;
5995         bool mbss;
5996         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
5997
5998         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5999                   sizeof(*vif));
6000         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
6001         if (!vif)
6002                 return ERR_PTR(-ENOMEM);
6003
6004         vif->wdev.wiphy = cfg->wiphy;
6005         vif->wdev.iftype = type;
6006
6007         brcmf_init_prof(&vif->profile);
6008
6009         if (type == NL80211_IFTYPE_AP &&
6010             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
6011                 mbss = false;
6012                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
6013                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
6014                                 mbss = true;
6015                                 break;
6016                         }
6017                 }
6018                 vif->mbss = mbss;
6019         }
6020
6021         list_add_tail(&vif->list, &cfg->vif_list);
6022         return vif;
6023 }
6024
6025 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
6026 {
6027         list_del(&vif->list);
6028         kfree(vif);
6029 }
6030
6031 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
6032 {
6033         struct brcmf_cfg80211_vif *vif;
6034         struct brcmf_if *ifp;
6035
6036         ifp = netdev_priv(ndev);
6037         vif = ifp->vif;
6038
6039         if (vif)
6040                 brcmf_free_vif(vif);
6041 }
6042
6043 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
6044                             const struct brcmf_event_msg *e)
6045 {
6046         u32 event = e->event_code;
6047         u32 status = e->status;
6048
6049         if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
6050              vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
6051             event == BRCMF_E_PSK_SUP &&
6052             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
6053                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6054         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
6055                 brcmf_dbg(CONN, "Processing set ssid\n");
6056                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
6057                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
6058                     vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
6059                         return true;
6060
6061                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6062         }
6063
6064         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
6065             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
6066                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6067                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6068                 return true;
6069         }
6070         return false;
6071 }
6072
6073 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
6074                             const struct brcmf_event_msg *e)
6075 {
6076         u32 event = e->event_code;
6077         u16 flags = e->flags;
6078
6079         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
6080             (event == BRCMF_E_DISASSOC_IND) ||
6081             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
6082                 brcmf_dbg(CONN, "Processing link down\n");
6083                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6084                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6085                 return true;
6086         }
6087         return false;
6088 }
6089
6090 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
6091                                const struct brcmf_event_msg *e)
6092 {
6093         u32 event = e->event_code;
6094         u32 status = e->status;
6095
6096         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
6097                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
6098                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
6099                 return true;
6100         }
6101
6102         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
6103                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
6104                 return true;
6105         }
6106
6107         if (event == BRCMF_E_PSK_SUP &&
6108             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
6109                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
6110                           status);
6111                 return true;
6112         }
6113
6114         return false;
6115 }
6116
6117 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
6118 {
6119         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6120
6121         kfree(conn_info->req_ie);
6122         conn_info->req_ie = NULL;
6123         conn_info->req_ie_len = 0;
6124         kfree(conn_info->resp_ie);
6125         conn_info->resp_ie = NULL;
6126         conn_info->resp_ie_len = 0;
6127 }
6128
6129 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
6130 {
6131         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6132
6133         if (!cfg)
6134                 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
6135                        (prio ^ 2) : prio;
6136
6137         /* For those AC(s) with ACM flag set to 1, convert its 4-level priority
6138          * to an 8-level precedence which is the same as BE's
6139          */
6140         if (prio > PRIO_8021D_EE &&
6141             cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
6142                 return cfg->ac_priority[prio] * 2;
6143
6144         /* Conversion of 4-level priority to 8-level precedence */
6145         if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
6146             prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
6147                 return cfg->ac_priority[prio] * 2;
6148         else
6149                 return cfg->ac_priority[prio] * 2 + 1;
6150 }
6151
6152 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
6153 {
6154         /* Prio here refers to the 802.1d priority in range of 0 to 7.
6155          * ACI here refers to the WLAN AC Index in range of 0 to 3.
6156          * This function will return ACI corresponding to input prio.
6157          */
6158         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6159
6160         if (cfg)
6161                 return cfg->ac_priority[prio];
6162
6163         return prio;
6164 }
6165
6166 static void brcmf_init_wmm_prio(u8 *priority)
6167 {
6168         /* Initialize AC priority array to default
6169          * 802.1d priority as per following table:
6170          * 802.1d prio 0,3 maps to BE
6171          * 802.1d prio 1,2 maps to BK
6172          * 802.1d prio 4,5 maps to VI
6173          * 802.1d prio 6,7 maps to VO
6174          */
6175         priority[0] = BRCMF_FWS_FIFO_AC_BE;
6176         priority[3] = BRCMF_FWS_FIFO_AC_BE;
6177         priority[1] = BRCMF_FWS_FIFO_AC_BK;
6178         priority[2] = BRCMF_FWS_FIFO_AC_BK;
6179         priority[4] = BRCMF_FWS_FIFO_AC_VI;
6180         priority[5] = BRCMF_FWS_FIFO_AC_VI;
6181         priority[6] = BRCMF_FWS_FIFO_AC_VO;
6182         priority[7] = BRCMF_FWS_FIFO_AC_VO;
6183 }
6184
6185 static void brcmf_wifi_prioritize_acparams(const
6186         struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
6187 {
6188         u8 aci;
6189         u8 aifsn;
6190         u8 ecwmin;
6191         u8 ecwmax;
6192         u8 acm;
6193         u8 ranking_basis[EDCF_AC_COUNT];
6194         u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
6195         u8 index;
6196
6197         for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
6198                 aifsn  = acp->ACI & EDCF_AIFSN_MASK;
6199                 acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
6200                 ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
6201                 ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
6202                 brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
6203                           aci, aifsn, acm, ecwmin, ecwmax);
6204                 /* Default AC_VO will be the lowest ranking value */
6205                 ranking_basis[aci] = aifsn + ecwmin + ecwmax;
6206                 /* Initialise priority starting at 0 (AC_BE) */
6207                 aci_prio[aci] = 0;
6208
6209                 /* If ACM is set, STA can't use this AC as per 802.11.
6210                  * Change the ranking to BE
6211                  */
6212                 if (aci != AC_BE && aci != AC_BK && acm == 1)
6213                         ranking_basis[aci] = ranking_basis[AC_BE];
6214         }
6215
6216         /* Ranking method which works for AC priority
6217          * swapping when values for cwmin, cwmax and aifsn are varied
6218          * Compare each aci_prio against each other aci_prio
6219          */
6220         for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
6221                 for (index = 0; index < EDCF_AC_COUNT; index++) {
6222                         if (index != aci) {
6223                                 /* Smaller ranking value has higher priority,
6224                                  * so increment priority for each ACI which has
6225                                  * a higher ranking value
6226                                  */
6227                                 if (ranking_basis[aci] < ranking_basis[index])
6228                                         aci_prio[aci]++;
6229                         }
6230                 }
6231         }
6232
6233         /* By now, aci_prio[] will be in range of 0 to 3.
6234          * Use ACI prio to get the new priority value for
6235          * each 802.1d traffic type, in this range.
6236          */
6237         if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
6238               aci_prio[AC_BK] == aci_prio[AC_VI] &&
6239               aci_prio[AC_VI] == aci_prio[AC_VO])) {
6240                 /* 802.1d 0,3 maps to BE */
6241                 priority[0] = aci_prio[AC_BE];
6242                 priority[3] = aci_prio[AC_BE];
6243
6244                 /* 802.1d 1,2 maps to BK */
6245                 priority[1] = aci_prio[AC_BK];
6246                 priority[2] = aci_prio[AC_BK];
6247
6248                 /* 802.1d 4,5 maps to VO */
6249                 priority[4] = aci_prio[AC_VI];
6250                 priority[5] = aci_prio[AC_VI];
6251
6252                 /* 802.1d 6,7 maps to VO */
6253                 priority[6] = aci_prio[AC_VO];
6254                 priority[7] = aci_prio[AC_VO];
6255         } else {
6256                 /* Initialize to default priority */
6257                 brcmf_init_wmm_prio(priority);
6258         }
6259
6260         brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
6261                   priority[0], priority[1], priority[2], priority[3]);
6262
6263         brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
6264                   priority[4], priority[5], priority[6], priority[7]);
6265 }
6266
6267 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
6268                                struct brcmf_if *ifp)
6269 {
6270         struct brcmf_pub *drvr = cfg->pub;
6271         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
6272         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6273         struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
6274         u32 req_len;
6275         u32 resp_len;
6276         s32 err = 0;
6277
6278         brcmf_clear_assoc_ies(cfg);
6279
6280         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
6281                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
6282         if (err) {
6283                 bphy_err(drvr, "could not get assoc info (%d)\n", err);
6284                 return err;
6285         }
6286         assoc_info =
6287                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
6288         req_len = le32_to_cpu(assoc_info->req_len);
6289         resp_len = le32_to_cpu(assoc_info->resp_len);
6290         if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
6291                 bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
6292                          req_len, resp_len);
6293                 return -EINVAL;
6294         }
6295         if (req_len) {
6296                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
6297                                                cfg->extra_buf,
6298                                                WL_ASSOC_INFO_MAX);
6299                 if (err) {
6300                         bphy_err(drvr, "could not get assoc req (%d)\n", err);
6301                         return err;
6302                 }
6303                 conn_info->req_ie_len = req_len;
6304                 conn_info->req_ie =
6305                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
6306                             GFP_KERNEL);
6307                 if (!conn_info->req_ie)
6308                         conn_info->req_ie_len = 0;
6309         } else {
6310                 conn_info->req_ie_len = 0;
6311                 conn_info->req_ie = NULL;
6312         }
6313         if (resp_len) {
6314                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
6315                                                cfg->extra_buf,
6316                                                WL_ASSOC_INFO_MAX);
6317                 if (err) {
6318                         bphy_err(drvr, "could not get assoc resp (%d)\n", err);
6319                         return err;
6320                 }
6321                 conn_info->resp_ie_len = resp_len;
6322                 conn_info->resp_ie =
6323                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
6324                             GFP_KERNEL);
6325                 if (!conn_info->resp_ie)
6326                         conn_info->resp_ie_len = 0;
6327
6328                 err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
6329                                                edcf_acparam_info,
6330                                                sizeof(edcf_acparam_info));
6331                 if (err) {
6332                         brcmf_err("could not get wme_ac_sta (%d)\n", err);
6333                         return err;
6334                 }
6335
6336                 brcmf_wifi_prioritize_acparams(edcf_acparam_info,
6337                                                cfg->ac_priority);
6338         } else {
6339                 conn_info->resp_ie_len = 0;
6340                 conn_info->resp_ie = NULL;
6341         }
6342         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
6343                   conn_info->req_ie_len, conn_info->resp_ie_len);
6344
6345         return err;
6346 }
6347
6348 static s32
6349 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
6350                        struct net_device *ndev,
6351                        const struct brcmf_event_msg *e)
6352 {
6353         struct brcmf_if *ifp = netdev_priv(ndev);
6354         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6355         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6356         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6357         struct ieee80211_channel *notify_channel = NULL;
6358         struct ieee80211_supported_band *band;
6359         struct brcmf_bss_info_le *bi;
6360         struct brcmu_chan ch;
6361         struct cfg80211_roam_info roam_info = {};
6362         u32 freq;
6363         s32 err = 0;
6364         u8 *buf;
6365
6366         brcmf_dbg(TRACE, "Enter\n");
6367
6368         brcmf_get_assoc_ies(cfg, ifp);
6369         memcpy(profile->bssid, e->addr, ETH_ALEN);
6370         brcmf_update_bss_info(cfg, ifp);
6371
6372         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
6373         if (buf == NULL) {
6374                 err = -ENOMEM;
6375                 goto done;
6376         }
6377
6378         /* data sent to dongle has to be little endian */
6379         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
6380         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
6381                                      buf, WL_BSS_INFO_MAX);
6382
6383         if (err)
6384                 goto done;
6385
6386         bi = (struct brcmf_bss_info_le *)(buf + 4);
6387         ch.chspec = le16_to_cpu(bi->chanspec);
6388         cfg->d11inf.decchspec(&ch);
6389
6390         if (ch.band == BRCMU_CHAN_BAND_2G)
6391                 band = wiphy->bands[NL80211_BAND_2GHZ];
6392         else
6393                 band = wiphy->bands[NL80211_BAND_5GHZ];
6394
6395         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
6396         notify_channel = ieee80211_get_channel(wiphy, freq);
6397
6398 done:
6399         kfree(buf);
6400
6401         roam_info.links[0].channel = notify_channel;
6402         roam_info.links[0].bssid = profile->bssid;
6403         roam_info.req_ie = conn_info->req_ie;
6404         roam_info.req_ie_len = conn_info->req_ie_len;
6405         roam_info.resp_ie = conn_info->resp_ie;
6406         roam_info.resp_ie_len = conn_info->resp_ie_len;
6407
6408         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6409         brcmf_dbg(CONN, "Report roaming result\n");
6410
6411         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6412                 cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
6413                 brcmf_dbg(CONN, "Report port authorized\n");
6414         }
6415
6416         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6417         brcmf_dbg(TRACE, "Exit\n");
6418         return err;
6419 }
6420
6421 static s32
6422 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6423                        struct net_device *ndev, const struct brcmf_event_msg *e,
6424                        bool completed)
6425 {
6426         struct brcmf_if *ifp = netdev_priv(ndev);
6427         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6428         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6429         struct cfg80211_connect_resp_params conn_params;
6430
6431         brcmf_dbg(TRACE, "Enter\n");
6432
6433         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6434                                &ifp->vif->sme_state)) {
6435                 memset(&conn_params, 0, sizeof(conn_params));
6436                 if (completed) {
6437                         brcmf_get_assoc_ies(cfg, ifp);
6438                         brcmf_update_bss_info(cfg, ifp);
6439                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6440                                 &ifp->vif->sme_state);
6441                         conn_params.status = WLAN_STATUS_SUCCESS;
6442                 } else {
6443                         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS,
6444                                   &ifp->vif->sme_state);
6445                         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
6446                                   &ifp->vif->sme_state);
6447                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6448                 }
6449                 conn_params.links[0].bssid = profile->bssid;
6450                 conn_params.req_ie = conn_info->req_ie;
6451                 conn_params.req_ie_len = conn_info->req_ie_len;
6452                 conn_params.resp_ie = conn_info->resp_ie;
6453                 conn_params.resp_ie_len = conn_info->resp_ie_len;
6454                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6455                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
6456                           completed ? "succeeded" : "failed");
6457         }
6458         brcmf_dbg(TRACE, "Exit\n");
6459         return 0;
6460 }
6461
6462 static s32
6463 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6464                                struct net_device *ndev,
6465                                const struct brcmf_event_msg *e, void *data)
6466 {
6467         struct brcmf_pub *drvr = cfg->pub;
6468         static int generation;
6469         u32 event = e->event_code;
6470         u32 reason = e->reason;
6471         struct station_info *sinfo;
6472
6473         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6474                   brcmf_fweh_event_name(event), event, reason);
6475         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6476             ndev != cfg_to_ndev(cfg)) {
6477                 brcmf_dbg(CONN, "AP mode link down\n");
6478                 complete(&cfg->vif_disabled);
6479                 return 0;
6480         }
6481
6482         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6483             (reason == BRCMF_E_STATUS_SUCCESS)) {
6484                 if (!data) {
6485                         bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6486                         return -EINVAL;
6487                 }
6488
6489                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6490                 if (!sinfo)
6491                         return -ENOMEM;
6492
6493                 sinfo->assoc_req_ies = data;
6494                 sinfo->assoc_req_ies_len = e->datalen;
6495                 generation++;
6496                 sinfo->generation = generation;
6497                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6498
6499                 kfree(sinfo);
6500         } else if ((event == BRCMF_E_DISASSOC_IND) ||
6501                    (event == BRCMF_E_DEAUTH_IND) ||
6502                    (event == BRCMF_E_DEAUTH)) {
6503                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6504         }
6505         return 0;
6506 }
6507
6508 static s32
6509 brcmf_notify_connect_status(struct brcmf_if *ifp,
6510                             const struct brcmf_event_msg *e, void *data)
6511 {
6512         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6513         struct net_device *ndev = ifp->ndev;
6514         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6515         struct ieee80211_channel *chan;
6516         s32 err = 0;
6517
6518         if ((e->event_code == BRCMF_E_DEAUTH) ||
6519             (e->event_code == BRCMF_E_DEAUTH_IND) ||
6520             (e->event_code == BRCMF_E_DISASSOC_IND) ||
6521             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6522                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6523         }
6524
6525         if (brcmf_is_apmode(ifp->vif)) {
6526                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6527         } else if (brcmf_is_linkup(ifp->vif, e)) {
6528                 brcmf_dbg(CONN, "Linkup\n");
6529                 if (brcmf_is_ibssmode(ifp->vif)) {
6530                         brcmf_inform_ibss(cfg, ndev, e->addr);
6531                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6532                         memcpy(profile->bssid, e->addr, ETH_ALEN);
6533                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6534                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6535                                   &ifp->vif->sme_state);
6536                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6537                                 &ifp->vif->sme_state);
6538                 } else
6539                         brcmf_bss_connect_done(cfg, ndev, e, true);
6540                 brcmf_net_setcarrier(ifp, true);
6541         } else if (brcmf_is_linkdown(ifp->vif, e)) {
6542                 brcmf_dbg(CONN, "Linkdown\n");
6543                 if (!brcmf_is_ibssmode(ifp->vif) &&
6544                     (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6545                               &ifp->vif->sme_state) ||
6546                      test_bit(BRCMF_VIF_STATUS_CONNECTING,
6547                               &ifp->vif->sme_state))) {
6548                         if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6549                                      &ifp->vif->sme_state) &&
6550                             memcmp(profile->bssid, e->addr, ETH_ALEN))
6551                                 return err;
6552
6553                         brcmf_bss_connect_done(cfg, ndev, e, false);
6554                         brcmf_link_down(ifp->vif,
6555                                         brcmf_map_fw_linkdown_reason(e),
6556                                         e->event_code &
6557                                         (BRCMF_E_DEAUTH_IND |
6558                                         BRCMF_E_DISASSOC_IND)
6559                                         ? false : true);
6560                         brcmf_init_prof(ndev_to_prof(ndev));
6561                         if (ndev != cfg_to_ndev(cfg))
6562                                 complete(&cfg->vif_disabled);
6563                         brcmf_net_setcarrier(ifp, false);
6564                 }
6565         } else if (brcmf_is_nonetwork(cfg, e)) {
6566                 if (brcmf_is_ibssmode(ifp->vif))
6567                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6568                                   &ifp->vif->sme_state);
6569                 else
6570                         brcmf_bss_connect_done(cfg, ndev, e, false);
6571         }
6572
6573         return err;
6574 }
6575
6576 static s32
6577 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6578                             const struct brcmf_event_msg *e, void *data)
6579 {
6580         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6581         u32 event = e->event_code;
6582         u32 status = e->status;
6583
6584         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6585                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6586                              &ifp->vif->sme_state)) {
6587                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6588                 } else {
6589                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6590                         brcmf_net_setcarrier(ifp, true);
6591                 }
6592         }
6593
6594         return 0;
6595 }
6596
6597 static s32
6598 brcmf_notify_mic_status(struct brcmf_if *ifp,
6599                         const struct brcmf_event_msg *e, void *data)
6600 {
6601         u16 flags = e->flags;
6602         enum nl80211_key_type key_type;
6603
6604         if (flags & BRCMF_EVENT_MSG_GROUP)
6605                 key_type = NL80211_KEYTYPE_GROUP;
6606         else
6607                 key_type = NL80211_KEYTYPE_PAIRWISE;
6608
6609         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6610                                      NULL, GFP_KERNEL);
6611
6612         return 0;
6613 }
6614
6615 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6616                              const struct brcmf_event_msg *e, void *data)
6617 {
6618         struct brcmf_cfg80211_vif *vif = ifp->vif;
6619         struct brcmf_rssi_be *info = data;
6620         s32 rssi, snr = 0, noise = 0;
6621         s32 low, high, last;
6622
6623         if (e->datalen >= sizeof(*info)) {
6624                 rssi = be32_to_cpu(info->rssi);
6625                 snr = be32_to_cpu(info->snr);
6626                 noise = be32_to_cpu(info->noise);
6627         } else if (e->datalen >= sizeof(rssi)) {
6628                 rssi = be32_to_cpu(*(__be32 *)data);
6629         } else {
6630                 brcmf_err("insufficient RSSI event data\n");
6631                 return 0;
6632         }
6633
6634         low = vif->cqm_rssi_low;
6635         high = vif->cqm_rssi_high;
6636         last = vif->cqm_rssi_last;
6637
6638         brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6639                   rssi, snr, noise, low, high, last);
6640
6641         vif->cqm_rssi_last = rssi;
6642
6643         if (rssi <= low || rssi == 0) {
6644                 brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6645                 cfg80211_cqm_rssi_notify(ifp->ndev,
6646                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6647                                          rssi, GFP_KERNEL);
6648         } else if (rssi > high) {
6649                 brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6650                 cfg80211_cqm_rssi_notify(ifp->ndev,
6651                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6652                                          rssi, GFP_KERNEL);
6653         }
6654
6655         return 0;
6656 }
6657
6658 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6659                                   const struct brcmf_event_msg *e, void *data)
6660 {
6661         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6662         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6663         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6664         struct brcmf_cfg80211_vif *vif;
6665
6666         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6667                   ifevent->action, ifevent->flags, ifevent->ifidx,
6668                   ifevent->bsscfgidx);
6669
6670         spin_lock(&event->vif_event_lock);
6671         event->action = ifevent->action;
6672         vif = event->vif;
6673
6674         switch (ifevent->action) {
6675         case BRCMF_E_IF_ADD:
6676                 /* waiting process may have timed out */
6677                 if (!cfg->vif_event.vif) {
6678                         spin_unlock(&event->vif_event_lock);
6679                         return -EBADF;
6680                 }
6681
6682                 ifp->vif = vif;
6683                 vif->ifp = ifp;
6684                 if (ifp->ndev) {
6685                         vif->wdev.netdev = ifp->ndev;
6686                         ifp->ndev->ieee80211_ptr = &vif->wdev;
6687                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6688                 }
6689                 spin_unlock(&event->vif_event_lock);
6690                 wake_up(&event->vif_wq);
6691                 return 0;
6692
6693         case BRCMF_E_IF_DEL:
6694                 spin_unlock(&event->vif_event_lock);
6695                 /* event may not be upon user request */
6696                 if (brcmf_cfg80211_vif_event_armed(cfg))
6697                         wake_up(&event->vif_wq);
6698                 return 0;
6699
6700         case BRCMF_E_IF_CHANGE:
6701                 spin_unlock(&event->vif_event_lock);
6702                 wake_up(&event->vif_wq);
6703                 return 0;
6704
6705         default:
6706                 spin_unlock(&event->vif_event_lock);
6707                 break;
6708         }
6709         return -EINVAL;
6710 }
6711
6712 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6713 {
6714         conf->frag_threshold = (u32)-1;
6715         conf->rts_threshold = (u32)-1;
6716         conf->retry_short = (u32)-1;
6717         conf->retry_long = (u32)-1;
6718 }
6719
6720 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6721 {
6722         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6723                             brcmf_notify_connect_status);
6724         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6725                             brcmf_notify_connect_status);
6726         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6727                             brcmf_notify_connect_status);
6728         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6729                             brcmf_notify_connect_status);
6730         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6731                             brcmf_notify_connect_status);
6732         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6733                             brcmf_notify_connect_status);
6734         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6735                             brcmf_notify_roaming_status);
6736         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6737                             brcmf_notify_mic_status);
6738         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6739                             brcmf_notify_connect_status);
6740         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6741                             brcmf_notify_sched_scan_results);
6742         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6743                             brcmf_notify_vif_event);
6744         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6745                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6746         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6747                             brcmf_p2p_notify_listen_complete);
6748         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6749                             brcmf_p2p_notify_action_frame_rx);
6750         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6751                             brcmf_p2p_notify_action_tx_complete);
6752         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6753                             brcmf_p2p_notify_action_tx_complete);
6754         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6755                             brcmf_notify_connect_status);
6756         brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
6757 }
6758
6759 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6760 {
6761         kfree(cfg->conf);
6762         cfg->conf = NULL;
6763         kfree(cfg->extra_buf);
6764         cfg->extra_buf = NULL;
6765         kfree(cfg->wowl.nd);
6766         cfg->wowl.nd = NULL;
6767         kfree(cfg->wowl.nd_info);
6768         cfg->wowl.nd_info = NULL;
6769         kfree(cfg->escan_info.escan_buf);
6770         cfg->escan_info.escan_buf = NULL;
6771 }
6772
6773 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
6774 {
6775         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
6776         if (!cfg->conf)
6777                 goto init_priv_mem_out;
6778         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
6779         if (!cfg->extra_buf)
6780                 goto init_priv_mem_out;
6781         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
6782         if (!cfg->wowl.nd)
6783                 goto init_priv_mem_out;
6784         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
6785                                     sizeof(struct cfg80211_wowlan_nd_match *),
6786                                     GFP_KERNEL);
6787         if (!cfg->wowl.nd_info)
6788                 goto init_priv_mem_out;
6789         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
6790         if (!cfg->escan_info.escan_buf)
6791                 goto init_priv_mem_out;
6792
6793         return 0;
6794
6795 init_priv_mem_out:
6796         brcmf_deinit_priv_mem(cfg);
6797
6798         return -ENOMEM;
6799 }
6800
6801 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
6802 {
6803         s32 err = 0;
6804
6805         cfg->scan_request = NULL;
6806         cfg->pwr_save = true;
6807         cfg->dongle_up = false;         /* dongle is not up yet */
6808         err = brcmf_init_priv_mem(cfg);
6809         if (err)
6810                 return err;
6811         brcmf_register_event_handlers(cfg);
6812         mutex_init(&cfg->usr_sync);
6813         brcmf_init_escan(cfg);
6814         brcmf_init_conf(cfg->conf);
6815         brcmf_init_wmm_prio(cfg->ac_priority);
6816         init_completion(&cfg->vif_disabled);
6817         return err;
6818 }
6819
6820 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
6821 {
6822         cfg->dongle_up = false; /* dongle down */
6823         brcmf_abort_scanning(cfg);
6824         brcmf_deinit_priv_mem(cfg);
6825         brcmf_clear_assoc_ies(cfg);
6826 }
6827
6828 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
6829 {
6830         init_waitqueue_head(&event->vif_wq);
6831         spin_lock_init(&event->vif_event_lock);
6832 }
6833
6834 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
6835 {
6836         struct brcmf_pub *drvr = ifp->drvr;
6837         s32 err;
6838         u32 bcn_timeout;
6839         __le32 roamtrigger[2];
6840         __le32 roam_delta[2];
6841
6842         /* Configure beacon timeout value based upon roaming setting */
6843         if (ifp->drvr->settings->roamoff)
6844                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
6845         else
6846                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
6847         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
6848         if (err) {
6849                 bphy_err(drvr, "bcn_timeout error (%d)\n", err);
6850                 goto roam_setup_done;
6851         }
6852
6853         /* Enable/Disable built-in roaming to allow supplicant to take care of
6854          * roaming.
6855          */
6856         brcmf_dbg(INFO, "Internal Roaming = %s\n",
6857                   ifp->drvr->settings->roamoff ? "Off" : "On");
6858         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
6859                                       ifp->drvr->settings->roamoff);
6860         if (err) {
6861                 bphy_err(drvr, "roam_off error (%d)\n", err);
6862                 goto roam_setup_done;
6863         }
6864
6865         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
6866         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
6867         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
6868                                      (void *)roamtrigger, sizeof(roamtrigger));
6869         if (err)
6870                 bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
6871
6872         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
6873         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
6874         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
6875                                      (void *)roam_delta, sizeof(roam_delta));
6876         if (err)
6877                 bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
6878
6879         return 0;
6880
6881 roam_setup_done:
6882         return err;
6883 }
6884
6885 static s32
6886 brcmf_dongle_scantime(struct brcmf_if *ifp)
6887 {
6888         struct brcmf_pub *drvr = ifp->drvr;
6889         s32 err = 0;
6890
6891         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
6892                                     BRCMF_SCAN_CHANNEL_TIME);
6893         if (err) {
6894                 bphy_err(drvr, "Scan assoc time error (%d)\n", err);
6895                 goto dongle_scantime_out;
6896         }
6897         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
6898                                     BRCMF_SCAN_UNASSOC_TIME);
6899         if (err) {
6900                 bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
6901                 goto dongle_scantime_out;
6902         }
6903
6904         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
6905                                     BRCMF_SCAN_PASSIVE_TIME);
6906         if (err) {
6907                 bphy_err(drvr, "Scan passive time error (%d)\n", err);
6908                 goto dongle_scantime_out;
6909         }
6910
6911 dongle_scantime_out:
6912         return err;
6913 }
6914
6915 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6916                                            struct brcmu_chan *ch)
6917 {
6918         u32 ht40_flag;
6919
6920         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6921         if (ch->sb == BRCMU_CHAN_SB_U) {
6922                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6923                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6924                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6925         } else {
6926                 /* It should be one of
6927                  * IEEE80211_CHAN_NO_HT40 or
6928                  * IEEE80211_CHAN_NO_HT40PLUS
6929                  */
6930                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6931                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6932                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6933         }
6934 }
6935
6936 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6937                                     u32 bw_cap[])
6938 {
6939         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6940         struct brcmf_pub *drvr = cfg->pub;
6941         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6942         struct ieee80211_supported_band *band;
6943         struct ieee80211_channel *channel;
6944         struct brcmf_chanspec_list *list;
6945         struct brcmu_chan ch;
6946         int err;
6947         u8 *pbuf;
6948         u32 i, j;
6949         u32 total;
6950         u32 chaninfo;
6951
6952         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6953
6954         if (pbuf == NULL)
6955                 return -ENOMEM;
6956
6957         list = (struct brcmf_chanspec_list *)pbuf;
6958
6959         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6960                                        BRCMF_DCMD_MEDLEN);
6961         if (err) {
6962                 bphy_err(drvr, "get chanspecs error (%d)\n", err);
6963                 goto fail_pbuf;
6964         }
6965
6966         band = wiphy->bands[NL80211_BAND_2GHZ];
6967         if (band)
6968                 for (i = 0; i < band->n_channels; i++)
6969                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6970         band = wiphy->bands[NL80211_BAND_5GHZ];
6971         if (band)
6972                 for (i = 0; i < band->n_channels; i++)
6973                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6974
6975         total = le32_to_cpu(list->count);
6976         if (total > BRCMF_MAX_CHANSPEC_LIST) {
6977                 bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6978                          total);
6979                 err = -EINVAL;
6980                 goto fail_pbuf;
6981         }
6982
6983         for (i = 0; i < total; i++) {
6984                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6985                 cfg->d11inf.decchspec(&ch);
6986
6987                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6988                         band = wiphy->bands[NL80211_BAND_2GHZ];
6989                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6990                         band = wiphy->bands[NL80211_BAND_5GHZ];
6991                 } else {
6992                         bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
6993                                  ch.chspec);
6994                         continue;
6995                 }
6996                 if (!band)
6997                         continue;
6998                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6999                     ch.bw == BRCMU_CHAN_BW_40)
7000                         continue;
7001                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
7002                     ch.bw == BRCMU_CHAN_BW_80)
7003                         continue;
7004
7005                 channel = NULL;
7006                 for (j = 0; j < band->n_channels; j++) {
7007                         if (band->channels[j].hw_value == ch.control_ch_num) {
7008                                 channel = &band->channels[j];
7009                                 break;
7010                         }
7011                 }
7012                 if (!channel) {
7013                         /* It seems firmware supports some channel we never
7014                          * considered. Something new in IEEE standard?
7015                          */
7016                         bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
7017                                  ch.control_ch_num);
7018                         continue;
7019                 }
7020
7021                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
7022                         continue;
7023
7024                 /* assuming the chanspecs order is HT20,
7025                  * HT40 upper, HT40 lower, and VHT80.
7026                  */
7027                 switch (ch.bw) {
7028                 case BRCMU_CHAN_BW_160:
7029                         channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
7030                         break;
7031                 case BRCMU_CHAN_BW_80:
7032                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
7033                         break;
7034                 case BRCMU_CHAN_BW_40:
7035                         brcmf_update_bw40_channel_flag(channel, &ch);
7036                         break;
7037                 default:
7038                         wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
7039                                    ch.bw);
7040                         fallthrough;
7041                 case BRCMU_CHAN_BW_20:
7042                         /* enable the channel and disable other bandwidths
7043                          * for now as mentioned order assure they are enabled
7044                          * for subsequent chanspecs.
7045                          */
7046                         channel->flags = IEEE80211_CHAN_NO_HT40 |
7047                                          IEEE80211_CHAN_NO_80MHZ |
7048                                          IEEE80211_CHAN_NO_160MHZ;
7049                         ch.bw = BRCMU_CHAN_BW_20;
7050                         cfg->d11inf.encchspec(&ch);
7051                         chaninfo = ch.chspec;
7052                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
7053                                                        &chaninfo);
7054                         if (!err) {
7055                                 if (chaninfo & WL_CHAN_RADAR)
7056                                         channel->flags |=
7057                                                 (IEEE80211_CHAN_RADAR |
7058                                                  IEEE80211_CHAN_NO_IR);
7059                                 if (chaninfo & WL_CHAN_PASSIVE)
7060                                         channel->flags |=
7061                                                 IEEE80211_CHAN_NO_IR;
7062                         }
7063                 }
7064         }
7065
7066 fail_pbuf:
7067         kfree(pbuf);
7068         return err;
7069 }
7070
7071 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
7072 {
7073         struct brcmf_pub *drvr = cfg->pub;
7074         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7075         struct ieee80211_supported_band *band;
7076         struct brcmf_fil_bwcap_le band_bwcap;
7077         struct brcmf_chanspec_list *list;
7078         u8 *pbuf;
7079         u32 val;
7080         int err;
7081         struct brcmu_chan ch;
7082         u32 num_chan;
7083         int i, j;
7084
7085         /* verify support for bw_cap command */
7086         val = WLC_BAND_5G;
7087         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
7088
7089         if (!err) {
7090                 /* only set 2G bandwidth using bw_cap command */
7091                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
7092                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
7093                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
7094                                                sizeof(band_bwcap));
7095         } else {
7096                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
7097                 val = WLC_N_BW_40ALL;
7098                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
7099         }
7100
7101         if (!err) {
7102                 /* update channel info in 2G band */
7103                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7104
7105                 if (pbuf == NULL)
7106                         return -ENOMEM;
7107
7108                 ch.band = BRCMU_CHAN_BAND_2G;
7109                 ch.bw = BRCMU_CHAN_BW_40;
7110                 ch.sb = BRCMU_CHAN_SB_NONE;
7111                 ch.chnum = 0;
7112                 cfg->d11inf.encchspec(&ch);
7113
7114                 /* pass encoded chanspec in query */
7115                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
7116
7117                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
7118                                                BRCMF_DCMD_MEDLEN);
7119                 if (err) {
7120                         bphy_err(drvr, "get chanspecs error (%d)\n", err);
7121                         kfree(pbuf);
7122                         return err;
7123                 }
7124
7125                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
7126                 list = (struct brcmf_chanspec_list *)pbuf;
7127                 num_chan = le32_to_cpu(list->count);
7128                 if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
7129                         bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7130                                  num_chan);
7131                         kfree(pbuf);
7132                         return -EINVAL;
7133                 }
7134
7135                 for (i = 0; i < num_chan; i++) {
7136                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
7137                         cfg->d11inf.decchspec(&ch);
7138                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
7139                                 continue;
7140                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
7141                                 continue;
7142                         for (j = 0; j < band->n_channels; j++) {
7143                                 if (band->channels[j].hw_value == ch.control_ch_num)
7144                                         break;
7145                         }
7146                         if (WARN_ON(j == band->n_channels))
7147                                 continue;
7148
7149                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
7150                 }
7151                 kfree(pbuf);
7152         }
7153         return err;
7154 }
7155
7156 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
7157 {
7158         struct brcmf_pub *drvr = ifp->drvr;
7159         u32 band, mimo_bwcap;
7160         int err;
7161
7162         band = WLC_BAND_2G;
7163         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7164         if (!err) {
7165                 bw_cap[NL80211_BAND_2GHZ] = band;
7166                 band = WLC_BAND_5G;
7167                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7168                 if (!err) {
7169                         bw_cap[NL80211_BAND_5GHZ] = band;
7170                         return;
7171                 }
7172                 WARN_ON(1);
7173                 return;
7174         }
7175         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
7176         mimo_bwcap = 0;
7177         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
7178         if (err)
7179                 /* assume 20MHz if firmware does not give a clue */
7180                 mimo_bwcap = WLC_N_BW_20ALL;
7181
7182         switch (mimo_bwcap) {
7183         case WLC_N_BW_40ALL:
7184                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
7185                 fallthrough;
7186         case WLC_N_BW_20IN2G_40IN5G:
7187                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
7188                 fallthrough;
7189         case WLC_N_BW_20ALL:
7190                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
7191                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
7192                 break;
7193         default:
7194                 bphy_err(drvr, "invalid mimo_bw_cap value\n");
7195         }
7196 }
7197
7198 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
7199                                 u32 bw_cap[2], u32 nchain)
7200 {
7201         band->ht_cap.ht_supported = true;
7202         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
7203                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
7204                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7205         }
7206         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
7207         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
7208         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
7209         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
7210         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
7211         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
7212 }
7213
7214 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
7215 {
7216         u16 mcs_map;
7217         int i;
7218
7219         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
7220                 mcs_map = (mcs_map << 2) | supp;
7221
7222         return cpu_to_le16(mcs_map);
7223 }
7224
7225 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
7226                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
7227                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
7228 {
7229         __le16 mcs_map;
7230
7231         /* not allowed in 2.4G band */
7232         if (band->band == NL80211_BAND_2GHZ)
7233                 return;
7234
7235         band->vht_cap.vht_supported = true;
7236         /* 80MHz is mandatory */
7237         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
7238         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
7239                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
7240                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
7241         }
7242         /* all support 256-QAM */
7243         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
7244         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
7245         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
7246
7247         /* Beamforming support information */
7248         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
7249                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
7250         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
7251                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
7252         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
7253                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
7254         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
7255                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
7256
7257         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
7258                 band->vht_cap.cap |=
7259                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
7260                 band->vht_cap.cap |= ((txstreams - 1) <<
7261                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
7262                 band->vht_cap.cap |=
7263                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
7264         }
7265 }
7266
7267 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
7268 {
7269         struct brcmf_pub *drvr = cfg->pub;
7270         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7271         struct wiphy *wiphy = cfg_to_wiphy(cfg);
7272         u32 nmode = 0;
7273         u32 vhtmode = 0;
7274         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
7275         u32 rxchain;
7276         u32 nchain;
7277         int err;
7278         s32 i;
7279         struct ieee80211_supported_band *band;
7280         u32 txstreams = 0;
7281         u32 txbf_bfe_cap = 0;
7282         u32 txbf_bfr_cap = 0;
7283
7284         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
7285         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
7286         if (err) {
7287                 bphy_err(drvr, "nmode error (%d)\n", err);
7288         } else {
7289                 brcmf_get_bwcap(ifp, bw_cap);
7290         }
7291         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
7292                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
7293                   bw_cap[NL80211_BAND_5GHZ]);
7294
7295         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
7296         if (err) {
7297                 /* rxchain unsupported by firmware of older chips */
7298                 if (err == -EBADE)
7299                         bphy_info_once(drvr, "rxchain unsupported\n");
7300                 else
7301                         bphy_err(drvr, "rxchain error (%d)\n", err);
7302
7303                 nchain = 1;
7304         } else {
7305                 for (nchain = 0; rxchain; nchain++)
7306                         rxchain = rxchain & (rxchain - 1);
7307         }
7308         brcmf_dbg(INFO, "nchain=%d\n", nchain);
7309
7310         err = brcmf_construct_chaninfo(cfg, bw_cap);
7311         if (err) {
7312                 bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
7313                 return err;
7314         }
7315
7316         if (vhtmode) {
7317                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
7318                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
7319                                               &txbf_bfe_cap);
7320                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
7321                                               &txbf_bfr_cap);
7322         }
7323
7324         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
7325                 band = wiphy->bands[i];
7326                 if (band == NULL)
7327                         continue;
7328
7329                 if (nmode)
7330                         brcmf_update_ht_cap(band, bw_cap, nchain);
7331                 if (vhtmode)
7332                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
7333                                              txbf_bfe_cap, txbf_bfr_cap);
7334         }
7335
7336         return 0;
7337 }
7338
7339 static const struct ieee80211_txrx_stypes
7340 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
7341         [NL80211_IFTYPE_STATION] = {
7342                 .tx = 0xffff,
7343                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7344                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7345         },
7346         [NL80211_IFTYPE_P2P_CLIENT] = {
7347                 .tx = 0xffff,
7348                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7349                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7350         },
7351         [NL80211_IFTYPE_P2P_GO] = {
7352                 .tx = 0xffff,
7353                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7354                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7355                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7356                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7357                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7358                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7359                       BIT(IEEE80211_STYPE_ACTION >> 4)
7360         },
7361         [NL80211_IFTYPE_P2P_DEVICE] = {
7362                 .tx = 0xffff,
7363                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7364                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7365         },
7366         [NL80211_IFTYPE_AP] = {
7367                 .tx = 0xffff,
7368                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7369                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7370                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7371                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7372                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7373                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7374                       BIT(IEEE80211_STYPE_ACTION >> 4)
7375         }
7376 };
7377
7378 /**
7379  * brcmf_setup_ifmodes() - determine interface modes and combinations.
7380  *
7381  * @wiphy: wiphy object.
7382  * @ifp: interface object needed for feat module api.
7383  *
7384  * The interface modes and combinations are determined dynamically here
7385  * based on firmware functionality.
7386  *
7387  * no p2p and no mbss:
7388  *
7389  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7390  *
7391  * no p2p and mbss:
7392  *
7393  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7394  *      #AP <= 4, matching BI, channels = 1, 4 total
7395  *
7396  * no p2p and rsdb:
7397  *      #STA <= 1, #AP <= 2, channels = 2, 4 total
7398  *
7399  * p2p, no mchan, and mbss:
7400  *
7401  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
7402  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7403  *      #AP <= 4, matching BI, channels = 1, 4 total
7404  *
7405  * p2p, mchan, and mbss:
7406  *
7407  *      #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
7408  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7409  *      #AP <= 4, matching BI, channels = 1, 4 total
7410  *
7411  * p2p, rsdb, and no mbss:
7412  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
7413  *       channels = 2, 4 total
7414  */
7415 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
7416 {
7417         struct ieee80211_iface_combination *combo = NULL;
7418         struct ieee80211_iface_limit *c0_limits = NULL;
7419         struct ieee80211_iface_limit *p2p_limits = NULL;
7420         struct ieee80211_iface_limit *mbss_limits = NULL;
7421         bool mon_flag, mbss, p2p, rsdb, mchan;
7422         int i, c, n_combos, n_limits;
7423
7424         mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
7425         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
7426         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
7427         rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
7428         mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
7429
7430         n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7431         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7432         if (!combo)
7433                 goto err;
7434
7435         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7436                                  BIT(NL80211_IFTYPE_ADHOC) |
7437                                  BIT(NL80211_IFTYPE_AP);
7438         if (mon_flag)
7439                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7440         if (p2p)
7441                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7442                                           BIT(NL80211_IFTYPE_P2P_GO) |
7443                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
7444
7445         c = 0;
7446         i = 0;
7447         n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7448         c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7449         if (!c0_limits)
7450                 goto err;
7451
7452         combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7453         c0_limits[i].max = 1 + (p2p && mchan);
7454         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7455         if (mon_flag) {
7456                 c0_limits[i].max = 1;
7457                 c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7458         }
7459         if (p2p) {
7460                 c0_limits[i].max = 1;
7461                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7462                 c0_limits[i].max = 1 + rsdb;
7463                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7464                                        BIT(NL80211_IFTYPE_P2P_GO);
7465         }
7466         if (p2p && rsdb) {
7467                 c0_limits[i].max = 2;
7468                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7469                 combo[c].max_interfaces = 4;
7470         } else if (p2p) {
7471                 combo[c].max_interfaces = i;
7472         } else if (rsdb) {
7473                 c0_limits[i].max = 2;
7474                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7475                 combo[c].max_interfaces = 3;
7476         } else {
7477                 c0_limits[i].max = 1;
7478                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7479                 combo[c].max_interfaces = i;
7480         }
7481         combo[c].n_limits = i;
7482         combo[c].limits = c0_limits;
7483
7484         if (p2p && !rsdb) {
7485                 c++;
7486                 i = 0;
7487                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7488                 if (!p2p_limits)
7489                         goto err;
7490                 p2p_limits[i].max = 1;
7491                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7492                 p2p_limits[i].max = 1;
7493                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7494                 p2p_limits[i].max = 1;
7495                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7496                 p2p_limits[i].max = 1;
7497                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7498                 combo[c].num_different_channels = 1;
7499                 combo[c].max_interfaces = i;
7500                 combo[c].n_limits = i;
7501                 combo[c].limits = p2p_limits;
7502         }
7503
7504         if (mbss) {
7505                 c++;
7506                 i = 0;
7507                 n_limits = 1 + mon_flag;
7508                 mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7509                                       GFP_KERNEL);
7510                 if (!mbss_limits)
7511                         goto err;
7512                 mbss_limits[i].max = 4;
7513                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7514                 if (mon_flag) {
7515                         mbss_limits[i].max = 1;
7516                         mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7517                 }
7518                 combo[c].beacon_int_infra_match = true;
7519                 combo[c].num_different_channels = 1;
7520                 combo[c].max_interfaces = 4 + mon_flag;
7521                 combo[c].n_limits = i;
7522                 combo[c].limits = mbss_limits;
7523         }
7524
7525         wiphy->n_iface_combinations = n_combos;
7526         wiphy->iface_combinations = combo;
7527         return 0;
7528
7529 err:
7530         kfree(c0_limits);
7531         kfree(p2p_limits);
7532         kfree(mbss_limits);
7533         kfree(combo);
7534         return -ENOMEM;
7535 }
7536
7537 #ifdef CONFIG_PM
7538 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7539         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7540         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
7541         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7542         .pattern_min_len = 1,
7543         .max_pkt_offset = 1500,
7544 };
7545 #endif
7546
7547 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7548 {
7549 #ifdef CONFIG_PM
7550         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7551         struct brcmf_pub *drvr = cfg->pub;
7552         struct wiphy_wowlan_support *wowl;
7553
7554         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7555                        GFP_KERNEL);
7556         if (!wowl) {
7557                 bphy_err(drvr, "only support basic wowlan features\n");
7558                 wiphy->wowlan = &brcmf_wowlan_support;
7559                 return;
7560         }
7561
7562         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7563                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7564                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7565                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7566                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
7567                 }
7568         }
7569         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7570                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7571                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7572         }
7573
7574         wiphy->wowlan = wowl;
7575 #endif
7576 }
7577
7578 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7579 {
7580         struct brcmf_pub *drvr = ifp->drvr;
7581         const struct ieee80211_iface_combination *combo;
7582         struct ieee80211_supported_band *band;
7583         u16 max_interfaces = 0;
7584         bool gscan;
7585         __le32 bandlist[3];
7586         u32 n_bands;
7587         int err, i;
7588
7589         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7590         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7591         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7592
7593         err = brcmf_setup_ifmodes(wiphy, ifp);
7594         if (err)
7595                 return err;
7596
7597         for (i = 0, combo = wiphy->iface_combinations;
7598              i < wiphy->n_iface_combinations; i++, combo++) {
7599                 max_interfaces = max(max_interfaces, combo->max_interfaces);
7600         }
7601
7602         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7603              i++) {
7604                 u8 *addr = drvr->addresses[i].addr;
7605
7606                 memcpy(addr, drvr->mac, ETH_ALEN);
7607                 if (i) {
7608                         addr[0] |= BIT(1);
7609                         addr[ETH_ALEN - 1] ^= i;
7610                 }
7611         }
7612         wiphy->addresses = drvr->addresses;
7613         wiphy->n_addresses = i;
7614
7615         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7616         wiphy->cipher_suites = brcmf_cipher_suites;
7617         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7618         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7619                 wiphy->n_cipher_suites--;
7620         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7621                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7622                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7623
7624         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7625                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
7626                         WIPHY_FLAG_HAVE_AP_SME |
7627                         WIPHY_FLAG_OFFCHAN_TX |
7628                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7629         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7630                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7631         if (!ifp->drvr->settings->roamoff)
7632                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7633         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7634                 wiphy_ext_feature_set(wiphy,
7635                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7636                 wiphy_ext_feature_set(wiphy,
7637                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7638                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7639                         wiphy_ext_feature_set(wiphy,
7640                                               NL80211_EXT_FEATURE_SAE_OFFLOAD);
7641         }
7642         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7643                 wiphy_ext_feature_set(wiphy,
7644                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7645                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7646                         wiphy_ext_feature_set(wiphy,
7647                                               NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7648         }
7649         wiphy->mgmt_stypes = brcmf_txrx_stypes;
7650         wiphy->max_remain_on_channel_duration = 5000;
7651         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7652                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7653                 brcmf_pno_wiphy_params(wiphy, gscan);
7654         }
7655         /* vendor commands/events support */
7656         wiphy->vendor_commands = brcmf_vendor_cmds;
7657         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7658
7659         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7660                 brcmf_wiphy_wowl_params(wiphy, ifp);
7661         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7662                                      sizeof(bandlist));
7663         if (err) {
7664                 bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7665                 return err;
7666         }
7667         /* first entry in bandlist is number of bands */
7668         n_bands = le32_to_cpu(bandlist[0]);
7669         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7670                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7671                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7672                                        GFP_KERNEL);
7673                         if (!band)
7674                                 return -ENOMEM;
7675
7676                         band->channels = kmemdup(&__wl_2ghz_channels,
7677                                                  sizeof(__wl_2ghz_channels),
7678                                                  GFP_KERNEL);
7679                         if (!band->channels) {
7680                                 kfree(band);
7681                                 return -ENOMEM;
7682                         }
7683
7684                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7685                         wiphy->bands[NL80211_BAND_2GHZ] = band;
7686                 }
7687                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7688                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7689                                        GFP_KERNEL);
7690                         if (!band)
7691                                 return -ENOMEM;
7692
7693                         band->channels = kmemdup(&__wl_5ghz_channels,
7694                                                  sizeof(__wl_5ghz_channels),
7695                                                  GFP_KERNEL);
7696                         if (!band->channels) {
7697                                 kfree(band);
7698                                 return -ENOMEM;
7699                         }
7700
7701                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7702                         wiphy->bands[NL80211_BAND_5GHZ] = band;
7703                 }
7704         }
7705
7706         if (wiphy->bands[NL80211_BAND_5GHZ] &&
7707             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7708                 wiphy_ext_feature_set(wiphy,
7709                                       NL80211_EXT_FEATURE_DFS_OFFLOAD);
7710
7711         wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7712
7713         wiphy_read_of_freq_limits(wiphy);
7714
7715         return 0;
7716 }
7717
7718 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7719 {
7720         struct brcmf_pub *drvr = cfg->pub;
7721         struct net_device *ndev;
7722         struct wireless_dev *wdev;
7723         struct brcmf_if *ifp;
7724         s32 power_mode;
7725         s32 err = 0;
7726
7727         if (cfg->dongle_up)
7728                 return err;
7729
7730         ndev = cfg_to_ndev(cfg);
7731         wdev = ndev->ieee80211_ptr;
7732         ifp = netdev_priv(ndev);
7733
7734         /* make sure RF is ready for work */
7735         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7736
7737         brcmf_dongle_scantime(ifp);
7738
7739         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7740         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7741         if (err)
7742                 goto default_conf_out;
7743         brcmf_dbg(INFO, "power save set to %s\n",
7744                   (power_mode ? "enabled" : "disabled"));
7745
7746         err = brcmf_dongle_roam(ifp);
7747         if (err)
7748                 goto default_conf_out;
7749         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7750                                           NULL);
7751         if (err)
7752                 goto default_conf_out;
7753
7754         brcmf_configure_arp_nd_offload(ifp, true);
7755
7756         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7757         if (err) {
7758                 bphy_err(drvr, "failed to set frameburst mode\n");
7759                 goto default_conf_out;
7760         }
7761
7762         cfg->dongle_up = true;
7763 default_conf_out:
7764
7765         return err;
7766
7767 }
7768
7769 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
7770 {
7771         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7772
7773         return brcmf_config_dongle(ifp->drvr->config);
7774 }
7775
7776 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
7777 {
7778         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7779
7780         /*
7781          * While going down, if associated with AP disassociate
7782          * from AP to save power
7783          */
7784         if (check_vif_up(ifp->vif)) {
7785                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
7786
7787                 /* Make sure WPA_Supplicant receives all the event
7788                    generated due to DISASSOC call to the fw to keep
7789                    the state fw and WPA_Supplicant state consistent
7790                  */
7791                 brcmf_delay(500);
7792         }
7793
7794         brcmf_abort_scanning(cfg);
7795         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7796
7797         return 0;
7798 }
7799
7800 s32 brcmf_cfg80211_up(struct net_device *ndev)
7801 {
7802         struct brcmf_if *ifp = netdev_priv(ndev);
7803         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7804         s32 err = 0;
7805
7806         mutex_lock(&cfg->usr_sync);
7807         err = __brcmf_cfg80211_up(ifp);
7808         mutex_unlock(&cfg->usr_sync);
7809
7810         return err;
7811 }
7812
7813 s32 brcmf_cfg80211_down(struct net_device *ndev)
7814 {
7815         struct brcmf_if *ifp = netdev_priv(ndev);
7816         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7817         s32 err = 0;
7818
7819         mutex_lock(&cfg->usr_sync);
7820         err = __brcmf_cfg80211_down(ifp);
7821         mutex_unlock(&cfg->usr_sync);
7822
7823         return err;
7824 }
7825
7826 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
7827 {
7828         struct wireless_dev *wdev = &ifp->vif->wdev;
7829
7830         return wdev->iftype;
7831 }
7832
7833 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
7834                              unsigned long state)
7835 {
7836         struct brcmf_cfg80211_vif *vif;
7837
7838         list_for_each_entry(vif, &cfg->vif_list, list) {
7839                 if (test_bit(state, &vif->sme_state))
7840                         return true;
7841         }
7842         return false;
7843 }
7844
7845 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
7846                                     u8 action)
7847 {
7848         u8 evt_action;
7849
7850         spin_lock(&event->vif_event_lock);
7851         evt_action = event->action;
7852         spin_unlock(&event->vif_event_lock);
7853         return evt_action == action;
7854 }
7855
7856 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
7857                                   struct brcmf_cfg80211_vif *vif)
7858 {
7859         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7860
7861         spin_lock(&event->vif_event_lock);
7862         event->vif = vif;
7863         event->action = 0;
7864         spin_unlock(&event->vif_event_lock);
7865 }
7866
7867 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
7868 {
7869         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7870         bool armed;
7871
7872         spin_lock(&event->vif_event_lock);
7873         armed = event->vif != NULL;
7874         spin_unlock(&event->vif_event_lock);
7875
7876         return armed;
7877 }
7878
7879 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
7880                                   u8 action, ulong timeout)
7881 {
7882         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7883
7884         return wait_event_timeout(event->vif_wq,
7885                                   vif_event_equals(event, action), timeout);
7886 }
7887
7888 static bool brmcf_use_iso3166_ccode_fallback(struct brcmf_pub *drvr)
7889 {
7890         if (drvr->settings->trivial_ccode_map)
7891                 return true;
7892
7893         switch (drvr->bus_if->chip) {
7894         case BRCM_CC_43430_CHIP_ID:
7895         case BRCM_CC_4345_CHIP_ID:
7896         case BRCM_CC_4356_CHIP_ID:
7897         case BRCM_CC_43602_CHIP_ID:
7898                 return true;
7899         default:
7900                 return false;
7901         }
7902 }
7903
7904 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
7905                                         struct brcmf_fil_country_le *ccreq)
7906 {
7907         struct brcmfmac_pd_cc *country_codes;
7908         struct brcmfmac_pd_cc_entry *cc;
7909         s32 found_index;
7910         int i;
7911
7912         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
7913             (alpha2[1] == ccreq->country_abbrev[1])) {
7914                 brcmf_dbg(TRACE, "Country code already set\n");
7915                 return -EAGAIN;
7916         }
7917
7918         country_codes = drvr->settings->country_codes;
7919         if (!country_codes) {
7920                 if (brmcf_use_iso3166_ccode_fallback(drvr)) {
7921                         brcmf_dbg(TRACE, "No country codes configured for device, using ISO3166 code and 0 rev\n");
7922                         memset(ccreq, 0, sizeof(*ccreq));
7923                         ccreq->country_abbrev[0] = alpha2[0];
7924                         ccreq->country_abbrev[1] = alpha2[1];
7925                         ccreq->ccode[0] = alpha2[0];
7926                         ccreq->ccode[1] = alpha2[1];
7927                         return 0;
7928                 }
7929
7930                 brcmf_dbg(TRACE, "No country codes configured for device\n");
7931                 return -EINVAL;
7932         }
7933
7934         found_index = -1;
7935         for (i = 0; i < country_codes->table_size; i++) {
7936                 cc = &country_codes->table[i];
7937                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
7938                         found_index = i;
7939                 if ((cc->iso3166[0] == alpha2[0]) &&
7940                     (cc->iso3166[1] == alpha2[1])) {
7941                         found_index = i;
7942                         break;
7943                 }
7944         }
7945         if (found_index == -1) {
7946                 brcmf_dbg(TRACE, "No country code match found\n");
7947                 return -EINVAL;
7948         }
7949         memset(ccreq, 0, sizeof(*ccreq));
7950         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
7951         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
7952                BRCMF_COUNTRY_BUF_SZ);
7953         ccreq->country_abbrev[0] = alpha2[0];
7954         ccreq->country_abbrev[1] = alpha2[1];
7955         ccreq->country_abbrev[2] = 0;
7956
7957         return 0;
7958 }
7959
7960 static int
7961 brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
7962 {
7963         int i;
7964         char *token;
7965         char delim[] = "\n ";
7966         unsigned long val;
7967         int err = 0;
7968
7969         token = strsep(&buf, delim);
7970         while (token) {
7971                 if (!strcmp(token, "OBSS")) {
7972                         for (i = 0; i < OBSS_TOKEN_IDX; i++)
7973                                 token = strsep(&buf, delim);
7974                         err = kstrtoul(token, 10, &val);
7975                         if (err)
7976                                 break;
7977                         survey->obss = val;
7978                 }
7979
7980                 if (!strcmp(token, "IBSS")) {
7981                         for (i = 0; i < IBSS_TOKEN_IDX; i++)
7982                                 token = strsep(&buf, delim);
7983                         err = kstrtoul(token, 10, &val);
7984                         if (err)
7985                                 break;
7986                         survey->ibss = val;
7987                 }
7988
7989                 if (!strcmp(token, "TXDur")) {
7990                         for (i = 0; i < TX_TOKEN_IDX; i++)
7991                                 token = strsep(&buf, delim);
7992                         err = kstrtoul(token, 10, &val);
7993                         if (err)
7994                                 break;
7995                         survey->tx = val;
7996                 }
7997
7998                 if (!strcmp(token, "Category")) {
7999                         for (i = 0; i < CTG_TOKEN_IDX; i++)
8000                                 token = strsep(&buf, delim);
8001                         err = kstrtoul(token, 10, &val);
8002                         if (err)
8003                                 break;
8004                         survey->no_ctg = val;
8005                 }
8006
8007                 if (!strcmp(token, "Packet")) {
8008                         for (i = 0; i < PKT_TOKEN_IDX; i++)
8009                                 token = strsep(&buf, delim);
8010                         err = kstrtoul(token, 10, &val);
8011                         if (err)
8012                                 break;
8013                         survey->no_pckt = val;
8014                 }
8015
8016                 if (!strcmp(token, "Opp(time):")) {
8017                         for (i = 0; i < IDLE_TOKEN_IDX; i++)
8018                                 token = strsep(&buf, delim);
8019                         err = kstrtoul(token, 10, &val);
8020                         if (err)
8021                                 break;
8022                         survey->idle = val;
8023                 }
8024
8025                 token = strsep(&buf, delim);
8026         }
8027
8028         return err;
8029 }
8030
8031 static int
8032 brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
8033                 struct brcmf_dump_survey *survey)
8034 {
8035         struct cca_stats_n_flags *results;
8036         char *buf;
8037         int err;
8038
8039         buf = kzalloc(sizeof(char) * BRCMF_DCMD_MEDLEN, GFP_KERNEL);
8040         if (!buf)
8041                 return -ENOMEM;
8042
8043         memcpy(buf, &req, sizeof(struct cca_msrmnt_query));
8044         err = brcmf_fil_iovar_data_get(ifp, "dump_obss",
8045                                        buf, BRCMF_DCMD_MEDLEN);
8046         if (err) {
8047                 brcmf_err("dump_obss error (%d)\n", err);
8048                 err = -EINVAL;
8049                 goto exit;
8050         }
8051         results = (struct cca_stats_n_flags *)(buf);
8052
8053         if (req.msrmnt_query)
8054                 brcmf_parse_dump_obss(results->buf, survey);
8055
8056 exit:
8057         kfree(buf);
8058         return err;
8059 }
8060
8061 static s32
8062 brcmf_set_channel(struct brcmf_cfg80211_info *cfg, struct ieee80211_channel *chan)
8063 {
8064         u16 chspec = 0;
8065         int err = 0;
8066         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8067
8068         if (chan->flags & IEEE80211_CHAN_DISABLED)
8069                 return -EINVAL;
8070
8071         /* set_channel */
8072         chspec = channel_to_chanspec(&cfg->d11inf, chan);
8073         if (chspec != INVCHANSPEC) {
8074                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chspec);
8075                 if (err) {
8076                         brcmf_err("set chanspec 0x%04x fail, reason %d\n", chspec, err);
8077                         err = -EINVAL;
8078                 }
8079         } else {
8080                 brcmf_err("failed to convert host chanspec to fw chanspec\n");
8081                 err = -EINVAL;
8082         }
8083
8084         return err;
8085 }
8086
8087 static int
8088 brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
8089                            int idx, struct survey_info *info)
8090 {
8091         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8092         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8093         struct brcmf_dump_survey survey = {};
8094         struct ieee80211_supported_band *band;
8095         enum nl80211_band band_id;
8096         struct cca_msrmnt_query req;
8097         u32 noise;
8098         int err;
8099
8100         brcmf_dbg(TRACE, "Enter: channel idx=%d\n", idx);
8101
8102         /* Do not run survey when VIF in CONNECTING / CONNECTED states */
8103         if ((test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) ||
8104             (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))) {
8105                 return -EBUSY;
8106         }
8107
8108         for (band_id = 0; band_id < NUM_NL80211_BANDS; band_id++) {
8109                 band = wiphy->bands[band_id];
8110                 if (!band)
8111                         continue;
8112                 if (idx >= band->n_channels) {
8113                         idx -= band->n_channels;
8114                         continue;
8115                 }
8116
8117                 info->channel = &band->channels[idx];
8118                 break;
8119         }
8120         if (band_id == NUM_NL80211_BANDS)
8121                 return -ENOENT;
8122
8123         /* Setting current channel to the requested channel */
8124         info->filled = 0;
8125         if (brcmf_set_channel(cfg, info->channel))
8126                 return 0;
8127
8128         /* Disable mpc */
8129         brcmf_set_mpc(ifp, 0);
8130
8131         /* Set interface up, explicitly. */
8132         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
8133         if (err) {
8134                 brcmf_err("set interface up failed, err = %d\n", err);
8135                 goto exit;
8136         }
8137
8138         /* Get noise value */
8139         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
8140         if (err) {
8141                 brcmf_err("Get Phy Noise failed, use dummy value\n");
8142                 noise = CHAN_NOISE_DUMMY;
8143         }
8144
8145         /* Start Measurement for obss stats on current channel */
8146         req.msrmnt_query = 0;
8147         req.time_req = ACS_MSRMNT_DELAY;
8148         err = brcmf_dump_obss(ifp, req, &survey);
8149         if (err)
8150                 goto exit;
8151
8152         /* Add 10 ms for IOVAR completion */
8153         msleep(ACS_MSRMNT_DELAY + 10);
8154
8155         /* Issue IOVAR to collect measurement results */
8156         req.msrmnt_query = 1;
8157         err = brcmf_dump_obss(ifp, req, &survey);
8158         if (err)
8159                 goto exit;
8160
8161         info->noise = noise;
8162         info->time = ACS_MSRMNT_DELAY;
8163         info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
8164         info->time_rx = survey.obss + survey.ibss + survey.no_ctg +
8165                 survey.no_pckt;
8166         info->time_tx = survey.tx;
8167         info->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_TIME |
8168                 SURVEY_INFO_TIME_BUSY | SURVEY_INFO_TIME_RX |
8169                 SURVEY_INFO_TIME_TX;
8170
8171         brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
8172                   ieee80211_frequency_to_channel(info->channel->center_freq),
8173                   ACS_MSRMNT_DELAY);
8174         brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
8175                   info->noise, info->time_busy, info->time_rx, info->time_tx);
8176
8177 exit:
8178         if (!brcmf_is_apmode(ifp->vif))
8179                 brcmf_set_mpc(ifp, 1);
8180         return err;
8181 }
8182
8183 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
8184                                         struct regulatory_request *req)
8185 {
8186         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8187         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
8188         struct brcmf_pub *drvr = cfg->pub;
8189         struct brcmf_fil_country_le ccreq;
8190         s32 err;
8191         int i;
8192
8193         /* The country code gets set to "00" by default at boot, ignore */
8194         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
8195                 return;
8196
8197         /* ignore non-ISO3166 country codes */
8198         for (i = 0; i < 2; i++)
8199                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
8200                         bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
8201                                  req->alpha2[0], req->alpha2[1]);
8202                         return;
8203                 }
8204
8205         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
8206                   req->alpha2[0], req->alpha2[1]);
8207
8208         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
8209         if (err) {
8210                 bphy_err(drvr, "Country code iovar returned err = %d\n", err);
8211                 return;
8212         }
8213
8214         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
8215         if (err)
8216                 return;
8217
8218         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
8219         if (err) {
8220                 bphy_err(drvr, "Firmware rejected country setting\n");
8221                 return;
8222         }
8223         brcmf_setup_wiphybands(cfg);
8224 }
8225
8226 static void brcmf_free_wiphy(struct wiphy *wiphy)
8227 {
8228         int i;
8229
8230         if (!wiphy)
8231                 return;
8232
8233         if (wiphy->iface_combinations) {
8234                 for (i = 0; i < wiphy->n_iface_combinations; i++)
8235                         kfree(wiphy->iface_combinations[i].limits);
8236         }
8237         kfree(wiphy->iface_combinations);
8238         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8239                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
8240                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
8241         }
8242         if (wiphy->bands[NL80211_BAND_5GHZ]) {
8243                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
8244                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
8245         }
8246 #if IS_ENABLED(CONFIG_PM)
8247         if (wiphy->wowlan != &brcmf_wowlan_support)
8248                 kfree(wiphy->wowlan);
8249 #endif
8250 }
8251
8252 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
8253                                                   struct cfg80211_ops *ops,
8254                                                   bool p2pdev_forced)
8255 {
8256         struct wiphy *wiphy = drvr->wiphy;
8257         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
8258         struct brcmf_cfg80211_info *cfg;
8259         struct brcmf_cfg80211_vif *vif;
8260         struct brcmf_if *ifp;
8261         s32 err = 0;
8262         s32 io_type;
8263         u16 *cap = NULL;
8264
8265         if (!ndev) {
8266                 bphy_err(drvr, "ndev is invalid\n");
8267                 return NULL;
8268         }
8269
8270         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
8271         if (!cfg) {
8272                 bphy_err(drvr, "Could not allocate wiphy device\n");
8273                 return NULL;
8274         }
8275
8276         cfg->wiphy = wiphy;
8277         cfg->pub = drvr;
8278         init_vif_event(&cfg->vif_event);
8279         INIT_LIST_HEAD(&cfg->vif_list);
8280
8281         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
8282         if (IS_ERR(vif))
8283                 goto wiphy_out;
8284
8285         ifp = netdev_priv(ndev);
8286         vif->ifp = ifp;
8287         vif->wdev.netdev = ndev;
8288         ndev->ieee80211_ptr = &vif->wdev;
8289         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
8290
8291         err = wl_init_priv(cfg);
8292         if (err) {
8293                 bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
8294                 brcmf_free_vif(vif);
8295                 goto wiphy_out;
8296         }
8297         ifp->vif = vif;
8298
8299         /* determine d11 io type before wiphy setup */
8300         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
8301         if (err) {
8302                 bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
8303                 goto priv_out;
8304         }
8305         cfg->d11inf.io_type = (u8)io_type;
8306         brcmu_d11_attach(&cfg->d11inf);
8307
8308         /* regulatory notifer below needs access to cfg so
8309          * assign it now.
8310          */
8311         drvr->config = cfg;
8312
8313         err = brcmf_setup_wiphy(wiphy, ifp);
8314         if (err < 0)
8315                 goto priv_out;
8316
8317         brcmf_dbg(INFO, "Registering custom regulatory\n");
8318         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
8319         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
8320         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
8321
8322         /* firmware defaults to 40MHz disabled in 2G band. We signal
8323          * cfg80211 here that we do and have it decide we can enable
8324          * it. But first check if device does support 2G operation.
8325          */
8326         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8327                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
8328                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8329         }
8330 #ifdef CONFIG_PM
8331         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
8332                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
8333 #endif
8334         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DUMP_OBSS))
8335                 ops->dump_survey = brcmf_cfg80211_dump_survey;
8336
8337         err = wiphy_register(wiphy);
8338         if (err < 0) {
8339                 bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
8340                 goto priv_out;
8341         }
8342
8343         err = brcmf_setup_wiphybands(cfg);
8344         if (err) {
8345                 bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
8346                 goto wiphy_unreg_out;
8347         }
8348
8349         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
8350          * setup 40MHz in 2GHz band and enable OBSS scanning.
8351          */
8352         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
8353                 err = brcmf_enable_bw40_2g(cfg);
8354                 if (!err)
8355                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
8356                                                       BRCMF_OBSS_COEX_AUTO);
8357                 else
8358                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8359         }
8360
8361         err = brcmf_fweh_activate_events(ifp);
8362         if (err) {
8363                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8364                 goto wiphy_unreg_out;
8365         }
8366
8367         err = brcmf_p2p_attach(cfg, p2pdev_forced);
8368         if (err) {
8369                 bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
8370                 goto wiphy_unreg_out;
8371         }
8372         err = brcmf_btcoex_attach(cfg);
8373         if (err) {
8374                 bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
8375                 brcmf_p2p_detach(&cfg->p2p);
8376                 goto wiphy_unreg_out;
8377         }
8378         err = brcmf_pno_attach(cfg);
8379         if (err) {
8380                 bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
8381                 brcmf_btcoex_detach(cfg);
8382                 brcmf_p2p_detach(&cfg->p2p);
8383                 goto wiphy_unreg_out;
8384         }
8385
8386         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
8387                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
8388                 if (err) {
8389                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
8390                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
8391                 } else {
8392                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
8393                                             brcmf_notify_tdls_peer_event);
8394                 }
8395         }
8396
8397         /* (re-) activate FWEH event handling */
8398         err = brcmf_fweh_activate_events(ifp);
8399         if (err) {
8400                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8401                 goto detach;
8402         }
8403
8404         /* Fill in some of the advertised nl80211 supported features */
8405         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
8406                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
8407 #ifdef CONFIG_PM
8408                 if (wiphy->wowlan &&
8409                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
8410                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8411 #endif
8412         }
8413
8414         return cfg;
8415
8416 detach:
8417         brcmf_pno_detach(cfg);
8418         brcmf_btcoex_detach(cfg);
8419         brcmf_p2p_detach(&cfg->p2p);
8420 wiphy_unreg_out:
8421         wiphy_unregister(cfg->wiphy);
8422 priv_out:
8423         wl_deinit_priv(cfg);
8424         brcmf_free_vif(vif);
8425         ifp->vif = NULL;
8426 wiphy_out:
8427         brcmf_free_wiphy(wiphy);
8428         kfree(cfg);
8429         return NULL;
8430 }
8431
8432 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
8433 {
8434         if (!cfg)
8435                 return;
8436
8437         brcmf_pno_detach(cfg);
8438         brcmf_btcoex_detach(cfg);
8439         wiphy_unregister(cfg->wiphy);
8440         wl_deinit_priv(cfg);
8441         brcmf_free_wiphy(cfg->wiphy);
8442         kfree(cfg);
8443 }