drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2010 Broadcom Corporation
   4  */
   5
   6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/vmalloc.h>
  12 #include <net/cfg80211.h>
  13 #include <net/netlink.h>
  14 #include <uapi/linux/if_arp.h>
  15
  16 #include <brcmu_utils.h>
  17 #include <defs.h>
  18 #include <brcmu_wifi.h>
  19 #include "core.h"
  20 #include "debug.h"
  21 #include "tracepoint.h"
  22 #include "fwil_types.h"
  23 #include "p2p.h"
  24 #include "btcoex.h"
  25 #include "pno.h"
  26 #include "fwsignal.h"
  27 #include "cfg80211.h"
  28 #include "feature.h"
  29 #include "fwil.h"
  30 #include "proto.h"
  31 #include "vendor.h"
  32 #include "bus.h"
  33 #include "common.h"
  34
  35 #define BRCMF_SCAN_IE_LEN_MAX           2048
  36
  37 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  38 #define WPA_OUI_TYPE                    1
  39 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  40 #define WME_OUI_TYPE                    2
  41 #define WPS_OUI_TYPE                    4
  42
  43 #define VS_IE_FIXED_HDR_LEN             6
  44 #define WPA_IE_VERSION_LEN              2
  45 #define WPA_IE_MIN_OUI_LEN              4
  46 #define WPA_IE_SUITE_COUNT_LEN          2
  47
  48 #define WPA_CIPHER_NONE                 0       /* None */
  49 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  50 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  51 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  52 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  53
  54 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  55 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  56 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  57 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  58 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  59 #define RSN_AKM_SAE                     8       /* SAE */
  60 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  61 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  62 #define RSN_CAP_MFPR_MASK               BIT(6)
  63 #define RSN_CAP_MFPC_MASK               BIT(7)
  64 #define RSN_PMKID_COUNT_LEN             2
  65
  66 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  67                                                  * string :"add", "del" (+ NUL)
  68                                                  */
  69 #define VNDR_IE_COUNT_OFFSET            4
  70 #define VNDR_IE_PKTFLAG_OFFSET          8
  71 #define VNDR_IE_VSIE_OFFSET             12
  72 #define VNDR_IE_HDR_SIZE                12
  73 #define VNDR_IE_PARSE_LIMIT             5
  74
  75 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  76 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  77
  78 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  79 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  80 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  81
  82 #define BRCMF_SCAN_CHANNEL_TIME         40
  83 #define BRCMF_SCAN_UNASSOC_TIME         40
  84 #define BRCMF_SCAN_PASSIVE_TIME         120
  85
  86 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  87
  88 #define BRCMF_PS_MAX_TIMEOUT_MS         2000
  89
  90 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  91         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  92
  93 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
  94 {
  95         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
  96                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
  97                           vif->sme_state);
  98                 return false;
  99         }
 100         return true;
 101 }
 102
 103 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 104 #define RATETAB_ENT(_rateid, _flags) \
 105         {                                                               \
 106                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 107                 .hw_value       = (_rateid),                            \
 108                 .flags          = (_flags),                             \
 109         }
 110
 111 static struct ieee80211_rate __wl_rates[] = {
 112         RATETAB_ENT(BRCM_RATE_1M, 0),
 113         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 114         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 115         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 116         RATETAB_ENT(BRCM_RATE_6M, 0),
 117         RATETAB_ENT(BRCM_RATE_9M, 0),
 118         RATETAB_ENT(BRCM_RATE_12M, 0),
 119         RATETAB_ENT(BRCM_RATE_18M, 0),
 120         RATETAB_ENT(BRCM_RATE_24M, 0),
 121         RATETAB_ENT(BRCM_RATE_36M, 0),
 122         RATETAB_ENT(BRCM_RATE_48M, 0),
 123         RATETAB_ENT(BRCM_RATE_54M, 0),
 124 };
 125
 126 #define wl_g_rates              (__wl_rates + 0)
 127 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 128 #define wl_a_rates              (__wl_rates + 4)
 129 #define wl_a_rates_size         (wl_g_rates_size - 4)
 130
 131 #define CHAN2G(_channel, _freq) {                               \
 132         .band                   = NL80211_BAND_2GHZ,            \
 133         .center_freq            = (_freq),                      \
 134         .hw_value               = (_channel),                   \
 135         .max_antenna_gain       = 0,                            \
 136         .max_power              = 30,                           \
 137 }
 138
 139 #define CHAN5G(_channel) {                                      \
 140         .band                   = NL80211_BAND_5GHZ,            \
 141         .center_freq            = 5000 + (5 * (_channel)),      \
 142         .hw_value               = (_channel),                   \
 143         .max_antenna_gain       = 0,                            \
 144         .max_power              = 30,                           \
 145 }
 146
 147 static struct ieee80211_channel __wl_2ghz_channels[] = {
 148         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 149         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 150         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 151         CHAN2G(13, 2472), CHAN2G(14, 2484)
 152 };
 153
 154 static struct ieee80211_channel __wl_5ghz_channels[] = {
 155         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 156         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 157         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 158         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 159         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 160         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 161 };
 162
 163 /* Band templates duplicated per wiphy. The channel info
 164  * above is added to the band during setup.
 165  */
 166 static const struct ieee80211_supported_band __wl_band_2ghz = {
 167         .band = NL80211_BAND_2GHZ,
 168         .bitrates = wl_g_rates,
 169         .n_bitrates = wl_g_rates_size,
 170 };
 171
 172 static const struct ieee80211_supported_band __wl_band_5ghz = {
 173         .band = NL80211_BAND_5GHZ,
 174         .bitrates = wl_a_rates,
 175         .n_bitrates = wl_a_rates_size,
 176 };
 177
 178 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 179  * By default world regulatory domain defined in reg.c puts the flags
 180  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 181  * With respect to these flags, wpa_supplicant doesn't * start p2p
 182  * operations on 5GHz channels. All the changes in world regulatory
 183  * domain are to be done here.
 184  */
 185 static const struct ieee80211_regdomain brcmf_regdom = {
 186         .n_reg_rules = 4,
 187         .alpha2 =  "99",
 188         .reg_rules = {
 189                 /* IEEE 802.11b/g, channels 1..11 */
 190                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 191                 /* If any */
 192                 /* IEEE 802.11 channel 14 - Only JP enables
 193                  * this and for 802.11b only
 194                  */
 195                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 196                 /* IEEE 802.11a, channel 36..64 */
 197                 REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
 198                 /* IEEE 802.11a, channel 100..165 */
 199                 REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
 200 };
 201
 202 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 203  * are supported. A pointer to this array and the number of entries is passed
 204  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 205  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 206  * device does not support MFP then the number of suites will be decreased by 1
 207  */
 208 static const u32 brcmf_cipher_suites[] = {
 209         WLAN_CIPHER_SUITE_WEP40,
 210         WLAN_CIPHER_SUITE_WEP104,
 211         WLAN_CIPHER_SUITE_TKIP,
 212         WLAN_CIPHER_SUITE_CCMP,
 213         /* Keep as last entry: */
 214         WLAN_CIPHER_SUITE_AES_CMAC
 215 };
 216
 217 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 218 struct brcmf_vs_tlv {
 219         u8 id;
 220         u8 len;
 221         u8 oui[3];
 222         u8 oui_type;
 223 };
 224
 225 struct parsed_vndr_ie_info {
 226         u8 *ie_ptr;
 227         u32 ie_len;     /* total length including id & length field */
 228         struct brcmf_vs_tlv vndrie;
 229 };
 230
 231 struct parsed_vndr_ies {
 232         u32 count;
 233         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 234 };
 235
 236 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 237 {
 238         switch (band) {
 239         case NL80211_BAND_2GHZ:
 240                 return WLC_BAND_2G;
 241         case NL80211_BAND_5GHZ:
 242                 return WLC_BAND_5G;
 243         default:
 244                 WARN_ON(1);
 245                 break;
 246         }
 247         return 0;
 248 }
 249
 250 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 251                                struct cfg80211_chan_def *ch)
 252 {
 253         struct brcmu_chan ch_inf;
 254         s32 primary_offset;
 255
 256         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 257                   ch->chan->center_freq, ch->center_freq1, ch->width);
 258         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 259         primary_offset = ch->chan->center_freq - ch->center_freq1;
 260         switch (ch->width) {
 261         case NL80211_CHAN_WIDTH_20:
 262         case NL80211_CHAN_WIDTH_20_NOHT:
 263                 ch_inf.bw = BRCMU_CHAN_BW_20;
 264                 WARN_ON(primary_offset != 0);
 265                 break;
 266         case NL80211_CHAN_WIDTH_40:
 267                 ch_inf.bw = BRCMU_CHAN_BW_40;
 268                 if (primary_offset > 0)
 269                         ch_inf.sb = BRCMU_CHAN_SB_U;
 270                 else
 271                         ch_inf.sb = BRCMU_CHAN_SB_L;
 272                 break;
 273         case NL80211_CHAN_WIDTH_80:
 274                 ch_inf.bw = BRCMU_CHAN_BW_80;
 275                 if (primary_offset == -30)
 276                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 277                 else if (primary_offset == -10)
 278                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 279                 else if (primary_offset == 10)
 280                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 281                 else
 282                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 283                 break;
 284         case NL80211_CHAN_WIDTH_160:
 285                 ch_inf.bw = BRCMU_CHAN_BW_160;
 286                 if (primary_offset == -70)
 287                         ch_inf.sb = BRCMU_CHAN_SB_LLL;
 288                 else if (primary_offset == -50)
 289                         ch_inf.sb = BRCMU_CHAN_SB_LLU;
 290                 else if (primary_offset == -30)
 291                         ch_inf.sb = BRCMU_CHAN_SB_LUL;
 292                 else if (primary_offset == -10)
 293                         ch_inf.sb = BRCMU_CHAN_SB_LUU;
 294                 else if (primary_offset == 10)
 295                         ch_inf.sb = BRCMU_CHAN_SB_ULL;
 296                 else if (primary_offset == 30)
 297                         ch_inf.sb = BRCMU_CHAN_SB_ULU;
 298                 else if (primary_offset == 50)
 299                         ch_inf.sb = BRCMU_CHAN_SB_UUL;
 300                 else
 301                         ch_inf.sb = BRCMU_CHAN_SB_UUU;
 302                 break;
 303         case NL80211_CHAN_WIDTH_80P80:
 304         case NL80211_CHAN_WIDTH_5:
 305         case NL80211_CHAN_WIDTH_10:
 306         default:
 307                 WARN_ON_ONCE(1);
 308         }
 309         switch (ch->chan->band) {
 310         case NL80211_BAND_2GHZ:
 311                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 312                 break;
 313         case NL80211_BAND_5GHZ:
 314                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 315                 break;
 316         case NL80211_BAND_60GHZ:
 317         default:
 318                 WARN_ON_ONCE(1);
 319         }
 320         d11inf->encchspec(&ch_inf);
 321
 322         brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
 323         return ch_inf.chspec;
 324 }
 325
 326 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 327                         struct ieee80211_channel *ch)
 328 {
 329         struct brcmu_chan ch_inf;
 330
 331         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 332         ch_inf.bw = BRCMU_CHAN_BW_20;
 333         d11inf->encchspec(&ch_inf);
 334
 335         return ch_inf.chspec;
 336 }
 337
 338 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 339  * triples, returning a pointer to the substring whose first element
 340  * matches tag
 341  */
 342 static const struct brcmf_tlv *
 343 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 344 {
 345         const struct brcmf_tlv *elt = buf;
 346         int totlen = buflen;
 347
 348         /* find tagged parameter */
 349         while (totlen >= TLV_HDR_LEN) {
 350                 int len = elt->len;
 351
 352                 /* validate remaining totlen */
 353                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 354                         return elt;
 355
 356                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 357                 totlen -= (len + TLV_HDR_LEN);
 358         }
 359
 360         return NULL;
 361 }
 362
 363 /* Is any of the tlvs the expected entry? If
 364  * not update the tlvs buffer pointer/length.
 365  */
 366 static bool
 367 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 368                  const u8 *oui, u32 oui_len, u8 type)
 369 {
 370         /* If the contents match the OUI and the type */
 371         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 372             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 373             type == ie[TLV_BODY_OFF + oui_len]) {
 374                 return true;
 375         }
 376
 377         if (tlvs == NULL)
 378                 return false;
 379         /* point to the next ie */
 380         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 381         /* calculate the length of the rest of the buffer */
 382         *tlvs_len -= (int)(ie - *tlvs);
 383         /* update the pointer to the start of the buffer */
 384         *tlvs = ie;
 385
 386         return false;
 387 }
 388
 389 static struct brcmf_vs_tlv *
 390 brcmf_find_wpaie(const u8 *parse, u32 len)
 391 {
 392         const struct brcmf_tlv *ie;
 393
 394         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 395                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 396                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 397                         return (struct brcmf_vs_tlv *)ie;
 398         }
 399         return NULL;
 400 }
 401
 402 static struct brcmf_vs_tlv *
 403 brcmf_find_wpsie(const u8 *parse, u32 len)
 404 {
 405         const struct brcmf_tlv *ie;
 406
 407         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 408                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 409                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 410                         return (struct brcmf_vs_tlv *)ie;
 411         }
 412         return NULL;
 413 }
 414
 415 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 416                                      struct brcmf_cfg80211_vif *vif,
 417                                      enum nl80211_iftype new_type)
 418 {
 419         struct brcmf_cfg80211_vif *pos;
 420         bool check_combos = false;
 421         int ret = 0;
 422         struct iface_combination_params params = {
 423                 .num_different_channels = 1,
 424         };
 425
 426         list_for_each_entry(pos, &cfg->vif_list, list)
 427                 if (pos == vif) {
 428                         params.iftype_num[new_type]++;
 429                 } else {
 430                         /* concurrent interfaces so need check combinations */
 431                         check_combos = true;
 432                         params.iftype_num[pos->wdev.iftype]++;
 433                 }
 434
 435         if (check_combos)
 436                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 437
 438         return ret;
 439 }
 440
 441 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 442                                   enum nl80211_iftype new_type)
 443 {
 444         struct brcmf_cfg80211_vif *pos;
 445         struct iface_combination_params params = {
 446                 .num_different_channels = 1,
 447         };
 448
 449         list_for_each_entry(pos, &cfg->vif_list, list)
 450                 params.iftype_num[pos->wdev.iftype]++;
 451
 452         params.iftype_num[new_type]++;
 453         return cfg80211_check_combinations(cfg->wiphy, &params);
 454 }
 455
 456 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 457                                  struct brcmf_wsec_key_le *key_le)
 458 {
 459         key_le->index = cpu_to_le32(key->index);
 460         key_le->len = cpu_to_le32(key->len);
 461         key_le->algo = cpu_to_le32(key->algo);
 462         key_le->flags = cpu_to_le32(key->flags);
 463         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 464         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 465         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 466         memcpy(key_le->data, key->data, sizeof(key->data));
 467         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 468 }
 469
 470 static int
 471 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 472 {
 473         struct brcmf_pub *drvr = ifp->drvr;
 474         int err;
 475         struct brcmf_wsec_key_le key_le;
 476
 477         convert_key_from_CPU(key, &key_le);
 478
 479         brcmf_netdev_wait_pend8021x(ifp);
 480
 481         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 482                                         sizeof(key_le));
 483
 484         if (err)
 485                 bphy_err(drvr, "wsec_key error (%d)\n", err);
 486         return err;
 487 }
 488
 489 static void
 490 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 491 {
 492         struct brcmf_cfg80211_vif *vif;
 493         struct brcmf_if *ifp;
 494
 495         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 496         ifp = vif->ifp;
 497
 498         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 499             (wdev->iftype == NL80211_IFTYPE_AP) ||
 500             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 501                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 502                                                 ADDR_DIRECT);
 503         else
 504                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 505                                                 ADDR_INDIRECT);
 506 }
 507
 508 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 509 {
 510         int bsscfgidx;
 511
 512         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 513                 /* bsscfgidx 1 is reserved for legacy P2P */
 514                 if (bsscfgidx == 1)
 515                         continue;
 516                 if (!drvr->iflist[bsscfgidx])
 517                         return bsscfgidx;
 518         }
 519
 520         return -ENOMEM;
 521 }
 522
 523 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 524 {
 525         struct brcmf_pub *drvr = ifp->drvr;
 526         struct brcmf_mbss_ssid_le mbss_ssid_le;
 527         int bsscfgidx;
 528         int err;
 529
 530         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 531         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 532         if (bsscfgidx < 0)
 533                 return bsscfgidx;
 534
 535         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 536         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 537         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 538
 539         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 540                                         sizeof(mbss_ssid_le));
 541         if (err < 0)
 542                 bphy_err(drvr, "setting ssid failed %d\n", err);
 543
 544         return err;
 545 }
 546
 547 /**
 548  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 549  *
 550  * @wiphy: wiphy device of new interface.
 551  * @name: name of the new interface.
 552  * @params: contains mac address for AP device.
 553  */
 554 static
 555 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 556                                       struct vif_params *params)
 557 {
 558         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 559         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 560         struct brcmf_pub *drvr = cfg->pub;
 561         struct brcmf_cfg80211_vif *vif;
 562         int err;
 563
 564         if (brcmf_cfg80211_vif_event_armed(cfg))
 565                 return ERR_PTR(-EBUSY);
 566
 567         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 568
 569         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 570         if (IS_ERR(vif))
 571                 return (struct wireless_dev *)vif;
 572
 573         brcmf_cfg80211_arm_vif_event(cfg, vif);
 574
 575         err = brcmf_cfg80211_request_ap_if(ifp);
 576         if (err) {
 577                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 578                 goto fail;
 579         }
 580
 581         /* wait for firmware event */
 582         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 583                                             BRCMF_VIF_EVENT_TIMEOUT);
 584         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 585         if (!err) {
 586                 bphy_err(drvr, "timeout occurred\n");
 587                 err = -EIO;
 588                 goto fail;
 589         }
 590
 591         /* interface created in firmware */
 592         ifp = vif->ifp;
 593         if (!ifp) {
 594                 bphy_err(drvr, "no if pointer provided\n");
 595                 err = -ENOENT;
 596                 goto fail;
 597         }
 598
 599         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 600         err = brcmf_net_attach(ifp, true);
 601         if (err) {
 602                 bphy_err(drvr, "Registering netdevice failed\n");
 603                 free_netdev(ifp->ndev);
 604                 goto fail;
 605         }
 606
 607         return &ifp->vif->wdev;
 608
 609 fail:
 610         brcmf_free_vif(vif);
 611         return ERR_PTR(err);
 612 }
 613
 614 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 615 {
 616         enum nl80211_iftype iftype;
 617
 618         iftype = vif->wdev.iftype;
 619         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 620 }
 621
 622 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 623 {
 624         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 625 }
 626
 627 /**
 628  * brcmf_mon_add_vif() - create monitor mode virtual interface
 629  *
 630  * @wiphy: wiphy device of new interface.
 631  * @name: name of the new interface.
 632  */
 633 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
 634                                               const char *name)
 635 {
 636         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 637         struct brcmf_cfg80211_vif *vif;
 638         struct net_device *ndev;
 639         struct brcmf_if *ifp;
 640         int err;
 641
 642         if (cfg->pub->mon_if) {
 643                 err = -EEXIST;
 644                 goto err_out;
 645         }
 646
 647         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
 648         if (IS_ERR(vif)) {
 649                 err = PTR_ERR(vif);
 650                 goto err_out;
 651         }
 652
 653         ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
 654         if (!ndev) {
 655                 err = -ENOMEM;
 656                 goto err_free_vif;
 657         }
 658         ndev->type = ARPHRD_IEEE80211_RADIOTAP;
 659         ndev->ieee80211_ptr = &vif->wdev;
 660         ndev->needs_free_netdev = true;
 661         ndev->priv_destructor = brcmf_cfg80211_free_netdev;
 662         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
 663
 664         ifp = netdev_priv(ndev);
 665         ifp->vif = vif;
 666         ifp->ndev = ndev;
 667         ifp->drvr = cfg->pub;
 668
 669         vif->ifp = ifp;
 670         vif->wdev.netdev = ndev;
 671
 672         err = brcmf_net_mon_attach(ifp);
 673         if (err) {
 674                 brcmf_err("Failed to attach %s device\n", ndev->name);
 675                 free_netdev(ndev);
 676                 goto err_free_vif;
 677         }
 678
 679         cfg->pub->mon_if = ifp;
 680
 681         return &vif->wdev;
 682
 683 err_free_vif:
 684         brcmf_free_vif(vif);
 685 err_out:
 686         return ERR_PTR(err);
 687 }
 688
 689 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 690 {
 691         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 692         struct net_device *ndev = wdev->netdev;
 693
 694         ndev->netdev_ops->ndo_stop(ndev);
 695
 696         brcmf_net_detach(ndev, true);
 697
 698         cfg->pub->mon_if = NULL;
 699
 700         return 0;
 701 }
 702
 703 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 704                                                      const char *name,
 705                                                      unsigned char name_assign_type,
 706                                                      enum nl80211_iftype type,
 707                                                      struct vif_params *params)
 708 {
 709         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 710         struct brcmf_pub *drvr = cfg->pub;
 711         struct wireless_dev *wdev;
 712         int err;
 713
 714         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 715         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 716         if (err) {
 717                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 718                 return ERR_PTR(err);
 719         }
 720         switch (type) {
 721         case NL80211_IFTYPE_ADHOC:
 722         case NL80211_IFTYPE_STATION:
 723         case NL80211_IFTYPE_AP_VLAN:
 724         case NL80211_IFTYPE_WDS:
 725         case NL80211_IFTYPE_MESH_POINT:
 726                 return ERR_PTR(-EOPNOTSUPP);
 727         case NL80211_IFTYPE_MONITOR:
 728                 return brcmf_mon_add_vif(wiphy, name);
 729         case NL80211_IFTYPE_AP:
 730                 wdev = brcmf_ap_add_vif(wiphy, name, params);
 731                 break;
 732         case NL80211_IFTYPE_P2P_CLIENT:
 733         case NL80211_IFTYPE_P2P_GO:
 734         case NL80211_IFTYPE_P2P_DEVICE:
 735                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
 736                 break;
 737         case NL80211_IFTYPE_UNSPECIFIED:
 738         default:
 739                 return ERR_PTR(-EINVAL);
 740         }
 741
 742         if (IS_ERR(wdev))
 743                 bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
 744                          type, (int)PTR_ERR(wdev));
 745         else
 746                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 747
 748         return wdev;
 749 }
 750
 751 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 752 {
 753         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 754                 brcmf_set_mpc(ifp, mpc);
 755 }
 756
 757 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 758 {
 759         struct brcmf_pub *drvr = ifp->drvr;
 760         s32 err = 0;
 761
 762         if (check_vif_up(ifp->vif)) {
 763                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 764                 if (err) {
 765                         bphy_err(drvr, "fail to set mpc\n");
 766                         return;
 767                 }
 768                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 769         }
 770 }
 771
 772 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 773                                 struct brcmf_if *ifp, bool aborted,
 774                                 bool fw_abort)
 775 {
 776         struct brcmf_pub *drvr = cfg->pub;
 777         struct brcmf_scan_params_le params_le;
 778         struct cfg80211_scan_request *scan_request;
 779         u64 reqid;
 780         u32 bucket;
 781         s32 err = 0;
 782
 783         brcmf_dbg(SCAN, "Enter\n");
 784
 785         /* clear scan request, because the FW abort can cause a second call */
 786         /* to this functon and might cause a double cfg80211_scan_done      */
 787         scan_request = cfg->scan_request;
 788         cfg->scan_request = NULL;
 789
 790         if (timer_pending(&cfg->escan_timeout))
 791                 del_timer_sync(&cfg->escan_timeout);
 792
 793         if (fw_abort) {
 794                 /* Do a scan abort to stop the driver's scan engine */
 795                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 796                 memset(&params_le, 0, sizeof(params_le));
 797                 eth_broadcast_addr(params_le.bssid);
 798                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 799                 params_le.scan_type = 0;
 800                 params_le.channel_num = cpu_to_le32(1);
 801                 params_le.nprobes = cpu_to_le32(1);
 802                 params_le.active_time = cpu_to_le32(-1);
 803                 params_le.passive_time = cpu_to_le32(-1);
 804                 params_le.home_time = cpu_to_le32(-1);
 805                 /* Scan is aborted by setting channel_list[0] to -1 */
 806                 params_le.channel_list[0] = cpu_to_le16(-1);
 807                 /* E-Scan (or anyother type) can be aborted by SCAN */
 808                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 809                                              &params_le, sizeof(params_le));
 810                 if (err)
 811                         bphy_err(drvr, "Scan abort failed\n");
 812         }
 813
 814         brcmf_scan_config_mpc(ifp, 1);
 815
 816         /*
 817          * e-scan can be initiated internally
 818          * which takes precedence.
 819          */
 820         if (cfg->int_escan_map) {
 821                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
 822                           cfg->int_escan_map);
 823                 while (cfg->int_escan_map) {
 824                         bucket = __ffs(cfg->int_escan_map);
 825                         cfg->int_escan_map &= ~BIT(bucket);
 826                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
 827                                                                bucket);
 828                         if (!aborted) {
 829                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
 830                                           reqid);
 831                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
 832                                                             reqid);
 833                         }
 834                 }
 835         } else if (scan_request) {
 836                 struct cfg80211_scan_info info = {
 837                         .aborted = aborted,
 838                 };
 839
 840                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 841                           aborted ? "Aborted" : "Done");
 842                 cfg80211_scan_done(scan_request, &info);
 843         }
 844         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 845                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 846
 847         return err;
 848 }
 849
 850 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 851                                        struct wireless_dev *wdev)
 852 {
 853         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 854         struct net_device *ndev = wdev->netdev;
 855         struct brcmf_if *ifp = netdev_priv(ndev);
 856         struct brcmf_pub *drvr = cfg->pub;
 857         int ret;
 858         int err;
 859
 860         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 861
 862         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 863         if (err) {
 864                 bphy_err(drvr, "interface_remove failed %d\n", err);
 865                 goto err_unarm;
 866         }
 867
 868         /* wait for firmware event */
 869         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 870                                             BRCMF_VIF_EVENT_TIMEOUT);
 871         if (!ret) {
 872                 bphy_err(drvr, "timeout occurred\n");
 873                 err = -EIO;
 874                 goto err_unarm;
 875         }
 876
 877         brcmf_remove_interface(ifp, true);
 878
 879 err_unarm:
 880         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 881         return err;
 882 }
 883
 884 static
 885 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 886 {
 887         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 888         struct net_device *ndev = wdev->netdev;
 889
 890         if (ndev && ndev == cfg_to_ndev(cfg))
 891                 return -ENOTSUPP;
 892
 893         /* vif event pending in firmware */
 894         if (brcmf_cfg80211_vif_event_armed(cfg))
 895                 return -EBUSY;
 896
 897         if (ndev) {
 898                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 899                     cfg->escan_info.ifp == netdev_priv(ndev))
 900                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 901                                                     true, true);
 902
 903                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 904         }
 905
 906         switch (wdev->iftype) {
 907         case NL80211_IFTYPE_ADHOC:
 908         case NL80211_IFTYPE_STATION:
 909         case NL80211_IFTYPE_AP_VLAN:
 910         case NL80211_IFTYPE_WDS:
 911         case NL80211_IFTYPE_MESH_POINT:
 912                 return -EOPNOTSUPP;
 913         case NL80211_IFTYPE_MONITOR:
 914                 return brcmf_mon_del_vif(wiphy, wdev);
 915         case NL80211_IFTYPE_AP:
 916                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 917         case NL80211_IFTYPE_P2P_CLIENT:
 918         case NL80211_IFTYPE_P2P_GO:
 919         case NL80211_IFTYPE_P2P_DEVICE:
 920                 return brcmf_p2p_del_vif(wiphy, wdev);
 921         case NL80211_IFTYPE_UNSPECIFIED:
 922         default:
 923                 return -EINVAL;
 924         }
 925         return -EOPNOTSUPP;
 926 }
 927
 928 static s32
 929 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 930                          enum nl80211_iftype type,
 931                          struct vif_params *params)
 932 {
 933         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 934         struct brcmf_if *ifp = netdev_priv(ndev);
 935         struct brcmf_cfg80211_vif *vif = ifp->vif;
 936         struct brcmf_pub *drvr = cfg->pub;
 937         s32 infra = 0;
 938         s32 ap = 0;
 939         s32 err = 0;
 940
 941         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 942                   type);
 943
 944         /* WAR: There are a number of p2p interface related problems which
 945          * need to be handled initially (before doing the validate).
 946          * wpa_supplicant tends to do iface changes on p2p device/client/go
 947          * which are not always possible/allowed. However we need to return
 948          * OK otherwise the wpa_supplicant wont start. The situation differs
 949          * on configuration and setup (p2pon=1 module param). The first check
 950          * is to see if the request is a change to station for p2p iface.
 951          */
 952         if ((type == NL80211_IFTYPE_STATION) &&
 953             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 954              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 955              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 956                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 957                 /* Now depending on whether module param p2pon=1 was used the
 958                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 959                  * that if p2pon=1 is used, but a newer supplicant is used then
 960                  * we should return an error, as this combination wont work.
 961                  * In other situations 0 is returned and supplicant will start
 962                  * normally. It will give a trace in cfg80211, but it is the
 963                  * only way to get it working. Unfortunately this will result
 964                  * in situation where we wont support new supplicant in
 965                  * combination with module param p2pon=1, but that is the way
 966                  * it is. If the user tries this then unloading of driver might
 967                  * fail/lock.
 968                  */
 969                 if (cfg->p2p.p2pdev_dynamically)
 970                         return -EOPNOTSUPP;
 971                 else
 972                         return 0;
 973         }
 974         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 975         if (err) {
 976                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 977                 return err;
 978         }
 979         switch (type) {
 980         case NL80211_IFTYPE_MONITOR:
 981         case NL80211_IFTYPE_WDS:
 982                 bphy_err(drvr, "type (%d) : currently we do not support this type\n",
 983                          type);
 984                 return -EOPNOTSUPP;
 985         case NL80211_IFTYPE_ADHOC:
 986                 infra = 0;
 987                 break;
 988         case NL80211_IFTYPE_STATION:
 989                 infra = 1;
 990                 break;
 991         case NL80211_IFTYPE_AP:
 992         case NL80211_IFTYPE_P2P_GO:
 993                 ap = 1;
 994                 break;
 995         default:
 996                 err = -EINVAL;
 997                 goto done;
 998         }
 999
1000         if (ap) {
1001                 if (type == NL80211_IFTYPE_P2P_GO) {
1002                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
1003                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1004                 }
1005                 if (!err) {
1006                         brcmf_dbg(INFO, "IF Type = AP\n");
1007                 }
1008         } else {
1009                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1010                 if (err) {
1011                         bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1012                         err = -EAGAIN;
1013                         goto done;
1014                 }
1015                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1016                           "Adhoc" : "Infra");
1017         }
1018         ndev->ieee80211_ptr->iftype = type;
1019
1020         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1021
1022 done:
1023         brcmf_dbg(TRACE, "Exit\n");
1024
1025         return err;
1026 }
1027
1028 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1029                              struct brcmf_scan_params_le *params_le,
1030                              struct cfg80211_scan_request *request)
1031 {
1032         u32 n_ssids;
1033         u32 n_channels;
1034         s32 i;
1035         s32 offset;
1036         u16 chanspec;
1037         char *ptr;
1038         struct brcmf_ssid_le ssid_le;
1039
1040         eth_broadcast_addr(params_le->bssid);
1041         params_le->bss_type = DOT11_BSSTYPE_ANY;
1042         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
1043         params_le->channel_num = 0;
1044         params_le->nprobes = cpu_to_le32(-1);
1045         params_le->active_time = cpu_to_le32(-1);
1046         params_le->passive_time = cpu_to_le32(-1);
1047         params_le->home_time = cpu_to_le32(-1);
1048         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1049
1050         n_ssids = request->n_ssids;
1051         n_channels = request->n_channels;
1052
1053         /* Copy channel array if applicable */
1054         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1055                   n_channels);
1056         if (n_channels > 0) {
1057                 for (i = 0; i < n_channels; i++) {
1058                         chanspec = channel_to_chanspec(&cfg->d11inf,
1059                                                        request->channels[i]);
1060                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1061                                   request->channels[i]->hw_value, chanspec);
1062                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1063                 }
1064         } else {
1065                 brcmf_dbg(SCAN, "Scanning all channels\n");
1066         }
1067         /* Copy ssid array if applicable */
1068         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1069         if (n_ssids > 0) {
1070                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1071                                 n_channels * sizeof(u16);
1072                 offset = roundup(offset, sizeof(u32));
1073                 ptr = (char *)params_le + offset;
1074                 for (i = 0; i < n_ssids; i++) {
1075                         memset(&ssid_le, 0, sizeof(ssid_le));
1076                         ssid_le.SSID_len =
1077                                         cpu_to_le32(request->ssids[i].ssid_len);
1078                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1079                                request->ssids[i].ssid_len);
1080                         if (!ssid_le.SSID_len)
1081                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1082                         else
1083                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1084                                           i, ssid_le.SSID, ssid_le.SSID_len);
1085                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1086                         ptr += sizeof(ssid_le);
1087                 }
1088         } else {
1089                 brcmf_dbg(SCAN, "Performing passive scan\n");
1090                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
1091         }
1092         /* Adding mask to channel numbers */
1093         params_le->channel_num =
1094                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1095                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1096 }
1097
1098 static s32
1099 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1100                 struct cfg80211_scan_request *request)
1101 {
1102         struct brcmf_pub *drvr = cfg->pub;
1103         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1104                           offsetof(struct brcmf_escan_params_le, params_le);
1105         struct brcmf_escan_params_le *params;
1106         s32 err = 0;
1107
1108         brcmf_dbg(SCAN, "E-SCAN START\n");
1109
1110         if (request != NULL) {
1111                 /* Allocate space for populating ssids in struct */
1112                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1113
1114                 /* Allocate space for populating ssids in struct */
1115                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1116         }
1117
1118         params = kzalloc(params_size, GFP_KERNEL);
1119         if (!params) {
1120                 err = -ENOMEM;
1121                 goto exit;
1122         }
1123         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1124         brcmf_escan_prep(cfg, &params->params_le, request);
1125         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1126         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1127         params->sync_id = cpu_to_le16(0x1234);
1128
1129         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1130         if (err) {
1131                 if (err == -EBUSY)
1132                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1133                 else
1134                         bphy_err(drvr, "error (%d)\n", err);
1135         }
1136
1137         kfree(params);
1138 exit:
1139         return err;
1140 }
1141
1142 static s32
1143 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1144 {
1145         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1146         s32 err;
1147         struct brcmf_scan_results *results;
1148         struct escan_info *escan = &cfg->escan_info;
1149
1150         brcmf_dbg(SCAN, "Enter\n");
1151         escan->ifp = ifp;
1152         escan->wiphy = cfg->wiphy;
1153         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1154
1155         brcmf_scan_config_mpc(ifp, 0);
1156         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1157         results->version = 0;
1158         results->count = 0;
1159         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1160
1161         err = escan->run(cfg, ifp, request);
1162         if (err)
1163                 brcmf_scan_config_mpc(ifp, 1);
1164         return err;
1165 }
1166
1167 static s32
1168 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1169 {
1170         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1171         struct brcmf_pub *drvr = cfg->pub;
1172         struct brcmf_cfg80211_vif *vif;
1173         s32 err = 0;
1174
1175         brcmf_dbg(TRACE, "Enter\n");
1176         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1177         if (!check_vif_up(vif))
1178                 return -EIO;
1179
1180         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1181                 bphy_err(drvr, "Scanning already: status (%lu)\n",
1182                          cfg->scan_status);
1183                 return -EAGAIN;
1184         }
1185         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1186                 bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1187                          cfg->scan_status);
1188                 return -EAGAIN;
1189         }
1190         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1191                 bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1192                          cfg->scan_status);
1193                 return -EAGAIN;
1194         }
1195         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1196                 bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1197                 return -EAGAIN;
1198         }
1199
1200         /* If scan req comes for p2p0, send it over primary I/F */
1201         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1202                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1203
1204         brcmf_dbg(SCAN, "START ESCAN\n");
1205
1206         cfg->scan_request = request;
1207         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1208
1209         cfg->escan_info.run = brcmf_run_escan;
1210         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1211         if (err)
1212                 goto scan_out;
1213
1214         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1215                                     request->ie, request->ie_len);
1216         if (err)
1217                 goto scan_out;
1218
1219         err = brcmf_do_escan(vif->ifp, request);
1220         if (err)
1221                 goto scan_out;
1222
1223         /* Arm scan timeout timer */
1224         mod_timer(&cfg->escan_timeout,
1225                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1226
1227         return 0;
1228
1229 scan_out:
1230         bphy_err(drvr, "scan error (%d)\n", err);
1231         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1232         cfg->scan_request = NULL;
1233         return err;
1234 }
1235
1236 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1237 {
1238         struct brcmf_if *ifp = netdev_priv(ndev);
1239         struct brcmf_pub *drvr = ifp->drvr;
1240         s32 err = 0;
1241
1242         err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1243         if (err)
1244                 bphy_err(drvr, "Error (%d)\n", err);
1245
1246         return err;
1247 }
1248
1249 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1250 {
1251         struct brcmf_if *ifp = netdev_priv(ndev);
1252         struct brcmf_pub *drvr = ifp->drvr;
1253         s32 err = 0;
1254
1255         err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1256                                       frag_threshold);
1257         if (err)
1258                 bphy_err(drvr, "Error (%d)\n", err);
1259
1260         return err;
1261 }
1262
1263 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1264 {
1265         struct brcmf_if *ifp = netdev_priv(ndev);
1266         struct brcmf_pub *drvr = ifp->drvr;
1267         s32 err = 0;
1268         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1269
1270         err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1271         if (err) {
1272                 bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1273                 return err;
1274         }
1275         return err;
1276 }
1277
1278 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1279 {
1280         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1281         struct net_device *ndev = cfg_to_ndev(cfg);
1282         struct brcmf_if *ifp = netdev_priv(ndev);
1283         s32 err = 0;
1284
1285         brcmf_dbg(TRACE, "Enter\n");
1286         if (!check_vif_up(ifp->vif))
1287                 return -EIO;
1288
1289         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1290             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1291                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1292                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1293                 if (!err)
1294                         goto done;
1295         }
1296         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1297             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1298                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1299                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1300                 if (!err)
1301                         goto done;
1302         }
1303         if (changed & WIPHY_PARAM_RETRY_LONG
1304             && (cfg->conf->retry_long != wiphy->retry_long)) {
1305                 cfg->conf->retry_long = wiphy->retry_long;
1306                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1307                 if (!err)
1308                         goto done;
1309         }
1310         if (changed & WIPHY_PARAM_RETRY_SHORT
1311             && (cfg->conf->retry_short != wiphy->retry_short)) {
1312                 cfg->conf->retry_short = wiphy->retry_short;
1313                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1314                 if (!err)
1315                         goto done;
1316         }
1317
1318 done:
1319         brcmf_dbg(TRACE, "Exit\n");
1320         return err;
1321 }
1322
1323 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1324 {
1325         memset(prof, 0, sizeof(*prof));
1326 }
1327
1328 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1329 {
1330         u16 reason;
1331
1332         switch (e->event_code) {
1333         case BRCMF_E_DEAUTH:
1334         case BRCMF_E_DEAUTH_IND:
1335         case BRCMF_E_DISASSOC_IND:
1336                 reason = e->reason;
1337                 break;
1338         case BRCMF_E_LINK:
1339         default:
1340                 reason = 0;
1341                 break;
1342         }
1343         return reason;
1344 }
1345
1346 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1347 {
1348         struct brcmf_pub *drvr = ifp->drvr;
1349         struct brcmf_wsec_pmk_le pmk;
1350         int i, err;
1351
1352         /* convert to firmware key format */
1353         pmk.key_len = cpu_to_le16(pmk_len << 1);
1354         pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1355         for (i = 0; i < pmk_len; i++)
1356                 snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
1357
1358         /* store psk in firmware */
1359         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1360                                      &pmk, sizeof(pmk));
1361         if (err < 0)
1362                 bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1363                          pmk_len);
1364
1365         return err;
1366 }
1367
1368 static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
1369                                   u16 pwd_len)
1370 {
1371         struct brcmf_pub *drvr = ifp->drvr;
1372         struct brcmf_wsec_sae_pwd_le sae_pwd;
1373         int err;
1374
1375         if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
1376                 bphy_err(drvr, "sae_password must be less than %d\n",
1377                          BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
1378                 return -EINVAL;
1379         }
1380
1381         sae_pwd.key_len = cpu_to_le16(pwd_len);
1382         memcpy(sae_pwd.key, pwd_data, pwd_len);
1383
1384         err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
1385                                        sizeof(sae_pwd));
1386         if (err < 0)
1387                 bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
1388                          pwd_len);
1389
1390         return err;
1391 }
1392
1393 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1394                             bool locally_generated)
1395 {
1396         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1397         struct brcmf_pub *drvr = cfg->pub;
1398         bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1399         s32 err = 0;
1400
1401         brcmf_dbg(TRACE, "Enter\n");
1402
1403         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1404                 if (bus_up) {
1405                         brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1406                         err = brcmf_fil_cmd_data_set(vif->ifp,
1407                                                      BRCMF_C_DISASSOC, NULL, 0);
1408                         if (err)
1409                                 bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1410                                          err);
1411                 }
1412
1413                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1414                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1415                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1416                                               locally_generated, GFP_KERNEL);
1417         }
1418         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1419         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1420         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1421         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1422                 if (bus_up)
1423                         brcmf_set_pmk(vif->ifp, NULL, 0);
1424                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1425         }
1426         brcmf_dbg(TRACE, "Exit\n");
1427 }
1428
1429 static s32
1430 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1431                       struct cfg80211_ibss_params *params)
1432 {
1433         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1434         struct brcmf_if *ifp = netdev_priv(ndev);
1435         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1436         struct brcmf_pub *drvr = cfg->pub;
1437         struct brcmf_join_params join_params;
1438         size_t join_params_size = 0;
1439         s32 err = 0;
1440         s32 wsec = 0;
1441         s32 bcnprd;
1442         u16 chanspec;
1443         u32 ssid_len;
1444
1445         brcmf_dbg(TRACE, "Enter\n");
1446         if (!check_vif_up(ifp->vif))
1447                 return -EIO;
1448
1449         if (params->ssid)
1450                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1451         else {
1452                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1453                 return -EOPNOTSUPP;
1454         }
1455
1456         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1457
1458         if (params->bssid)
1459                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1460         else
1461                 brcmf_dbg(CONN, "No BSSID specified\n");
1462
1463         if (params->chandef.chan)
1464                 brcmf_dbg(CONN, "channel: %d\n",
1465                           params->chandef.chan->center_freq);
1466         else
1467                 brcmf_dbg(CONN, "no channel specified\n");
1468
1469         if (params->channel_fixed)
1470                 brcmf_dbg(CONN, "fixed channel required\n");
1471         else
1472                 brcmf_dbg(CONN, "no fixed channel required\n");
1473
1474         if (params->ie && params->ie_len)
1475                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1476         else
1477                 brcmf_dbg(CONN, "no ie specified\n");
1478
1479         if (params->beacon_interval)
1480                 brcmf_dbg(CONN, "beacon interval: %d\n",
1481                           params->beacon_interval);
1482         else
1483                 brcmf_dbg(CONN, "no beacon interval specified\n");
1484
1485         if (params->basic_rates)
1486                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1487         else
1488                 brcmf_dbg(CONN, "no basic rates specified\n");
1489
1490         if (params->privacy)
1491                 brcmf_dbg(CONN, "privacy required\n");
1492         else
1493                 brcmf_dbg(CONN, "no privacy required\n");
1494
1495         /* Configure Privacy for starter */
1496         if (params->privacy)
1497                 wsec |= WEP_ENABLED;
1498
1499         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1500         if (err) {
1501                 bphy_err(drvr, "wsec failed (%d)\n", err);
1502                 goto done;
1503         }
1504
1505         /* Configure Beacon Interval for starter */
1506         if (params->beacon_interval)
1507                 bcnprd = params->beacon_interval;
1508         else
1509                 bcnprd = 100;
1510
1511         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1512         if (err) {
1513                 bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1514                 goto done;
1515         }
1516
1517         /* Configure required join parameter */
1518         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1519
1520         /* SSID */
1521         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1522         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1523         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1524         join_params_size = sizeof(join_params.ssid_le);
1525
1526         /* BSSID */
1527         if (params->bssid) {
1528                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1529                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1530                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1531         } else {
1532                 eth_broadcast_addr(join_params.params_le.bssid);
1533                 eth_zero_addr(profile->bssid);
1534         }
1535
1536         /* Channel */
1537         if (params->chandef.chan) {
1538                 u32 target_channel;
1539
1540                 cfg->channel =
1541                         ieee80211_frequency_to_channel(
1542                                 params->chandef.chan->center_freq);
1543                 if (params->channel_fixed) {
1544                         /* adding chanspec */
1545                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1546                                                        &params->chandef);
1547                         join_params.params_le.chanspec_list[0] =
1548                                 cpu_to_le16(chanspec);
1549                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1550                         join_params_size += sizeof(join_params.params_le);
1551                 }
1552
1553                 /* set channel for starter */
1554                 target_channel = cfg->channel;
1555                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1556                                             target_channel);
1557                 if (err) {
1558                         bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1559                         goto done;
1560                 }
1561         } else
1562                 cfg->channel = 0;
1563
1564         cfg->ibss_starter = false;
1565
1566
1567         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1568                                      &join_params, join_params_size);
1569         if (err) {
1570                 bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1571                 goto done;
1572         }
1573
1574 done:
1575         if (err)
1576                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1577         brcmf_dbg(TRACE, "Exit\n");
1578         return err;
1579 }
1580
1581 static s32
1582 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1583 {
1584         struct brcmf_if *ifp = netdev_priv(ndev);
1585
1586         brcmf_dbg(TRACE, "Enter\n");
1587         if (!check_vif_up(ifp->vif)) {
1588                 /* When driver is being unloaded, it can end up here. If an
1589                  * error is returned then later on a debug trace in the wireless
1590                  * core module will be printed. To avoid this 0 is returned.
1591                  */
1592                 return 0;
1593         }
1594
1595         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1596         brcmf_net_setcarrier(ifp, false);
1597
1598         brcmf_dbg(TRACE, "Exit\n");
1599
1600         return 0;
1601 }
1602
1603 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1604                                  struct cfg80211_connect_params *sme)
1605 {
1606         struct brcmf_if *ifp = netdev_priv(ndev);
1607         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1608         struct brcmf_pub *drvr = ifp->drvr;
1609         struct brcmf_cfg80211_security *sec;
1610         s32 val = 0;
1611         s32 err = 0;
1612
1613         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1614                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1615         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1616                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1617         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
1618                 val = WPA3_AUTH_SAE_PSK;
1619         else
1620                 val = WPA_AUTH_DISABLED;
1621         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1622         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1623         if (err) {
1624                 bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1625                 return err;
1626         }
1627         sec = &profile->sec;
1628         sec->wpa_versions = sme->crypto.wpa_versions;
1629         return err;
1630 }
1631
1632 static s32 brcmf_set_auth_type(struct net_device *ndev,
1633                                struct cfg80211_connect_params *sme)
1634 {
1635         struct brcmf_if *ifp = netdev_priv(ndev);
1636         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1637         struct brcmf_pub *drvr = ifp->drvr;
1638         struct brcmf_cfg80211_security *sec;
1639         s32 val = 0;
1640         s32 err = 0;
1641
1642         switch (sme->auth_type) {
1643         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1644                 val = 0;
1645                 brcmf_dbg(CONN, "open system\n");
1646                 break;
1647         case NL80211_AUTHTYPE_SHARED_KEY:
1648                 val = 1;
1649                 brcmf_dbg(CONN, "shared key\n");
1650                 break;
1651         case NL80211_AUTHTYPE_SAE:
1652                 val = 3;
1653                 brcmf_dbg(CONN, "SAE authentication\n");
1654                 break;
1655         default:
1656                 val = 2;
1657                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1658                 break;
1659         }
1660
1661         err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
1662         if (err) {
1663                 bphy_err(drvr, "set auth failed (%d)\n", err);
1664                 return err;
1665         }
1666         sec = &profile->sec;
1667         sec->auth_type = sme->auth_type;
1668         return err;
1669 }
1670
1671 static s32
1672 brcmf_set_wsec_mode(struct net_device *ndev,
1673                     struct cfg80211_connect_params *sme)
1674 {
1675         struct brcmf_if *ifp = netdev_priv(ndev);
1676         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1677         struct brcmf_pub *drvr = ifp->drvr;
1678         struct brcmf_cfg80211_security *sec;
1679         s32 pval = 0;
1680         s32 gval = 0;
1681         s32 wsec;
1682         s32 err = 0;
1683
1684         if (sme->crypto.n_ciphers_pairwise) {
1685                 switch (sme->crypto.ciphers_pairwise[0]) {
1686                 case WLAN_CIPHER_SUITE_WEP40:
1687                 case WLAN_CIPHER_SUITE_WEP104:
1688                         pval = WEP_ENABLED;
1689                         break;
1690                 case WLAN_CIPHER_SUITE_TKIP:
1691                         pval = TKIP_ENABLED;
1692                         break;
1693                 case WLAN_CIPHER_SUITE_CCMP:
1694                         pval = AES_ENABLED;
1695                         break;
1696                 case WLAN_CIPHER_SUITE_AES_CMAC:
1697                         pval = AES_ENABLED;
1698                         break;
1699                 default:
1700                         bphy_err(drvr, "invalid cipher pairwise (%d)\n",
1701                                  sme->crypto.ciphers_pairwise[0]);
1702                         return -EINVAL;
1703                 }
1704         }
1705         if (sme->crypto.cipher_group) {
1706                 switch (sme->crypto.cipher_group) {
1707                 case WLAN_CIPHER_SUITE_WEP40:
1708                 case WLAN_CIPHER_SUITE_WEP104:
1709                         gval = WEP_ENABLED;
1710                         break;
1711                 case WLAN_CIPHER_SUITE_TKIP:
1712                         gval = TKIP_ENABLED;
1713                         break;
1714                 case WLAN_CIPHER_SUITE_CCMP:
1715                         gval = AES_ENABLED;
1716                         break;
1717                 case WLAN_CIPHER_SUITE_AES_CMAC:
1718                         gval = AES_ENABLED;
1719                         break;
1720                 default:
1721                         bphy_err(drvr, "invalid cipher group (%d)\n",
1722                                  sme->crypto.cipher_group);
1723                         return -EINVAL;
1724                 }
1725         }
1726
1727         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1728         /* In case of privacy, but no security and WPS then simulate */
1729         /* setting AES. WPS-2.0 allows no security                   */
1730         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1731             sme->privacy)
1732                 pval = AES_ENABLED;
1733
1734         wsec = pval | gval;
1735         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
1736         if (err) {
1737                 bphy_err(drvr, "error (%d)\n", err);
1738                 return err;
1739         }
1740
1741         sec = &profile->sec;
1742         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1743         sec->cipher_group = sme->crypto.cipher_group;
1744
1745         return err;
1746 }
1747
1748 static s32
1749 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1750 {
1751         struct brcmf_if *ifp = netdev_priv(ndev);
1752         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1753         struct brcmf_pub *drvr = ifp->drvr;
1754         s32 val;
1755         s32 err;
1756         const struct brcmf_tlv *rsn_ie;
1757         const u8 *ie;
1758         u32 ie_len;
1759         u32 offset;
1760         u16 rsn_cap;
1761         u32 mfp;
1762         u16 count;
1763
1764         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1765         profile->is_ft = false;
1766
1767         if (!sme->crypto.n_akm_suites)
1768                 return 0;
1769
1770         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1771         if (err) {
1772                 bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
1773                 return err;
1774         }
1775         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1776                 switch (sme->crypto.akm_suites[0]) {
1777                 case WLAN_AKM_SUITE_8021X:
1778                         val = WPA_AUTH_UNSPECIFIED;
1779                         if (sme->want_1x)
1780                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1781                         break;
1782                 case WLAN_AKM_SUITE_PSK:
1783                         val = WPA_AUTH_PSK;
1784                         break;
1785                 default:
1786                         bphy_err(drvr, "invalid cipher group (%d)\n",
1787                                  sme->crypto.cipher_group);
1788                         return -EINVAL;
1789                 }
1790         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1791                 switch (sme->crypto.akm_suites[0]) {
1792                 case WLAN_AKM_SUITE_8021X:
1793                         val = WPA2_AUTH_UNSPECIFIED;
1794                         if (sme->want_1x)
1795                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1796                         break;
1797                 case WLAN_AKM_SUITE_8021X_SHA256:
1798                         val = WPA2_AUTH_1X_SHA256;
1799                         if (sme->want_1x)
1800                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1801                         break;
1802                 case WLAN_AKM_SUITE_PSK_SHA256:
1803                         val = WPA2_AUTH_PSK_SHA256;
1804                         break;
1805                 case WLAN_AKM_SUITE_PSK:
1806                         val = WPA2_AUTH_PSK;
1807                         break;
1808                 case WLAN_AKM_SUITE_FT_8021X:
1809                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
1810                         profile->is_ft = true;
1811                         if (sme->want_1x)
1812                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1813                         break;
1814                 case WLAN_AKM_SUITE_FT_PSK:
1815                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
1816                         profile->is_ft = true;
1817                         break;
1818                 default:
1819                         bphy_err(drvr, "invalid cipher group (%d)\n",
1820                                  sme->crypto.cipher_group);
1821                         return -EINVAL;
1822                 }
1823         } else if (val & WPA3_AUTH_SAE_PSK) {
1824                 switch (sme->crypto.akm_suites[0]) {
1825                 case WLAN_AKM_SUITE_SAE:
1826                         val = WPA3_AUTH_SAE_PSK;
1827                         if (sme->crypto.sae_pwd) {
1828                                 brcmf_dbg(INFO, "using SAE offload\n");
1829                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
1830                         }
1831                         break;
1832                 case WLAN_AKM_SUITE_FT_OVER_SAE:
1833                         val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
1834                         profile->is_ft = true;
1835                         if (sme->crypto.sae_pwd) {
1836                                 brcmf_dbg(INFO, "using SAE offload\n");
1837                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
1838                         }
1839                         break;
1840                 default:
1841                         bphy_err(drvr, "invalid cipher group (%d)\n",
1842                                  sme->crypto.cipher_group);
1843                         return -EINVAL;
1844                 }
1845         }
1846
1847         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
1848                 brcmf_dbg(INFO, "using 1X offload\n");
1849
1850         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1851                 goto skip_mfp_config;
1852         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1853          * IE will not be verified, just a quick search for MFP config
1854          */
1855         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1856                                   WLAN_EID_RSN);
1857         if (!rsn_ie)
1858                 goto skip_mfp_config;
1859         ie = (const u8 *)rsn_ie;
1860         ie_len = rsn_ie->len + TLV_HDR_LEN;
1861         /* Skip unicast suite */
1862         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1863         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1864                 goto skip_mfp_config;
1865         /* Skip multicast suite */
1866         count = ie[offset] + (ie[offset + 1] << 8);
1867         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1868         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1869                 goto skip_mfp_config;
1870         /* Skip auth key management suite(s) */
1871         count = ie[offset] + (ie[offset + 1] << 8);
1872         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1873         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1874                 goto skip_mfp_config;
1875         /* Ready to read capabilities */
1876         mfp = BRCMF_MFP_NONE;
1877         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1878         if (rsn_cap & RSN_CAP_MFPR_MASK)
1879                 mfp = BRCMF_MFP_REQUIRED;
1880         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1881                 mfp = BRCMF_MFP_CAPABLE;
1882         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1883
1884 skip_mfp_config:
1885         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1886         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1887         if (err) {
1888                 bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
1889                 return err;
1890         }
1891
1892         return err;
1893 }
1894
1895 static s32
1896 brcmf_set_sharedkey(struct net_device *ndev,
1897                     struct cfg80211_connect_params *sme)
1898 {
1899         struct brcmf_if *ifp = netdev_priv(ndev);
1900         struct brcmf_pub *drvr = ifp->drvr;
1901         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1902         struct brcmf_cfg80211_security *sec;
1903         struct brcmf_wsec_key key;
1904         s32 val;
1905         s32 err = 0;
1906
1907         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1908
1909         if (sme->key_len == 0)
1910                 return 0;
1911
1912         sec = &profile->sec;
1913         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1914                   sec->wpa_versions, sec->cipher_pairwise);
1915
1916         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
1917                                  NL80211_WPA_VERSION_3))
1918                 return 0;
1919
1920         if (!(sec->cipher_pairwise &
1921             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1922                 return 0;
1923
1924         memset(&key, 0, sizeof(key));
1925         key.len = (u32) sme->key_len;
1926         key.index = (u32) sme->key_idx;
1927         if (key.len > sizeof(key.data)) {
1928                 bphy_err(drvr, "Too long key length (%u)\n", key.len);
1929                 return -EINVAL;
1930         }
1931         memcpy(key.data, sme->key, key.len);
1932         key.flags = BRCMF_PRIMARY_KEY;
1933         switch (sec->cipher_pairwise) {
1934         case WLAN_CIPHER_SUITE_WEP40:
1935                 key.algo = CRYPTO_ALGO_WEP1;
1936                 break;
1937         case WLAN_CIPHER_SUITE_WEP104:
1938                 key.algo = CRYPTO_ALGO_WEP128;
1939                 break;
1940         default:
1941                 bphy_err(drvr, "Invalid algorithm (%d)\n",
1942                          sme->crypto.ciphers_pairwise[0]);
1943                 return -EINVAL;
1944         }
1945         /* Set the new key/index */
1946         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1947                   key.len, key.index, key.algo);
1948         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1949         err = send_key_to_dongle(ifp, &key);
1950         if (err)
1951                 return err;
1952
1953         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1954                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1955                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1956                 err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
1957                 if (err)
1958                         bphy_err(drvr, "set auth failed (%d)\n", err);
1959         }
1960         return err;
1961 }
1962
1963 static
1964 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1965                                            enum nl80211_auth_type type)
1966 {
1967         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1968             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1969                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1970                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1971         }
1972         return type;
1973 }
1974
1975 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1976                                 struct cfg80211_bss_selection *bss_select)
1977 {
1978         struct brcmf_pub *drvr = ifp->drvr;
1979         struct brcmf_join_pref_params join_pref_params[2];
1980         enum nl80211_band band;
1981         int err, i = 0;
1982
1983         join_pref_params[i].len = 2;
1984         join_pref_params[i].rssi_gain = 0;
1985
1986         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1987                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1988
1989         switch (bss_select->behaviour) {
1990         case __NL80211_BSS_SELECT_ATTR_INVALID:
1991                 brcmf_c_set_joinpref_default(ifp);
1992                 return;
1993         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1994                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1995                 band = bss_select->param.band_pref;
1996                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1997                 i++;
1998                 break;
1999         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2000                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2001                 band = bss_select->param.adjust.band;
2002                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2003                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2004                 i++;
2005                 break;
2006         case NL80211_BSS_SELECT_ATTR_RSSI:
2007         default:
2008                 break;
2009         }
2010         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2011         join_pref_params[i].len = 2;
2012         join_pref_params[i].rssi_gain = 0;
2013         join_pref_params[i].band = 0;
2014         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2015                                        sizeof(join_pref_params));
2016         if (err)
2017                 bphy_err(drvr, "Set join_pref error (%d)\n", err);
2018 }
2019
2020 static s32
2021 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2022                        struct cfg80211_connect_params *sme)
2023 {
2024         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2025         struct brcmf_if *ifp = netdev_priv(ndev);
2026         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2027         struct ieee80211_channel *chan = sme->channel;
2028         struct brcmf_pub *drvr = ifp->drvr;
2029         struct brcmf_join_params join_params;
2030         size_t join_params_size;
2031         const struct brcmf_tlv *rsn_ie;
2032         const struct brcmf_vs_tlv *wpa_ie;
2033         const void *ie;
2034         u32 ie_len;
2035         struct brcmf_ext_join_params_le *ext_join_params;
2036         u16 chanspec;
2037         s32 err = 0;
2038         u32 ssid_len;
2039
2040         brcmf_dbg(TRACE, "Enter\n");
2041         if (!check_vif_up(ifp->vif))
2042                 return -EIO;
2043
2044         if (!sme->ssid) {
2045                 bphy_err(drvr, "Invalid ssid\n");
2046                 return -EOPNOTSUPP;
2047         }
2048
2049         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2050                 /* A normal (non P2P) connection request setup. */
2051                 ie = NULL;
2052                 ie_len = 0;
2053                 /* find the WPA_IE */
2054                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2055                 if (wpa_ie) {
2056                         ie = wpa_ie;
2057                         ie_len = wpa_ie->len + TLV_HDR_LEN;
2058                 } else {
2059                         /* find the RSN_IE */
2060                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2061                                                   sme->ie_len,
2062                                                   WLAN_EID_RSN);
2063                         if (rsn_ie) {
2064                                 ie = rsn_ie;
2065                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
2066                         }
2067                 }
2068                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2069         }
2070
2071         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2072                                     sme->ie, sme->ie_len);
2073         if (err)
2074                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2075         else
2076                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2077
2078         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2079
2080         if (chan) {
2081                 cfg->channel =
2082                         ieee80211_frequency_to_channel(chan->center_freq);
2083                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2084                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2085                           cfg->channel, chan->center_freq, chanspec);
2086         } else {
2087                 cfg->channel = 0;
2088                 chanspec = 0;
2089         }
2090
2091         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2092
2093         err = brcmf_set_wpa_version(ndev, sme);
2094         if (err) {
2095                 bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2096                 goto done;
2097         }
2098
2099         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2100         err = brcmf_set_auth_type(ndev, sme);
2101         if (err) {
2102                 bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2103                 goto done;
2104         }
2105
2106         err = brcmf_set_wsec_mode(ndev, sme);
2107         if (err) {
2108                 bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2109                 goto done;
2110         }
2111
2112         err = brcmf_set_key_mgmt(ndev, sme);
2113         if (err) {
2114                 bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2115                 goto done;
2116         }
2117
2118         err = brcmf_set_sharedkey(ndev, sme);
2119         if (err) {
2120                 bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2121                 goto done;
2122         }
2123
2124         if (sme->crypto.psk &&
2125             profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2126                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2127                         err = -EINVAL;
2128                         goto done;
2129                 }
2130                 brcmf_dbg(INFO, "using PSK offload\n");
2131                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2132         }
2133
2134         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2135                 /* enable firmware supplicant for this interface */
2136                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2137                 if (err < 0) {
2138                         bphy_err(drvr, "failed to enable fw supplicant\n");
2139                         goto done;
2140                 }
2141         }
2142
2143         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2144                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2145                                     BRCMF_WSEC_MAX_PSK_LEN);
2146         else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2147                 /* clean up user-space RSNE */
2148                 err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
2149                 if (err) {
2150                         bphy_err(drvr, "failed to clean up user-space RSNE\n");
2151                         goto done;
2152                 }
2153                 err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
2154                                              sme->crypto.sae_pwd_len);
2155                 if (!err && sme->crypto.psk)
2156                         err = brcmf_set_pmk(ifp, sme->crypto.psk,
2157                                             BRCMF_WSEC_MAX_PSK_LEN);
2158         }
2159         if (err)
2160                 goto done;
2161
2162         /* Join with specific BSSID and cached SSID
2163          * If SSID is zero join based on BSSID only
2164          */
2165         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2166                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2167         if (cfg->channel)
2168                 join_params_size += sizeof(u16);
2169         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2170         if (ext_join_params == NULL) {
2171                 err = -ENOMEM;
2172                 goto done;
2173         }
2174         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2175         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2176         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2177         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2178                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2179                           ext_join_params->ssid_le.SSID, ssid_len);
2180
2181         /* Set up join scan parameters */
2182         ext_join_params->scan_le.scan_type = -1;
2183         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2184
2185         if (sme->bssid)
2186                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2187         else
2188                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2189
2190         if (cfg->channel) {
2191                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2192
2193                 ext_join_params->assoc_le.chanspec_list[0] =
2194                         cpu_to_le16(chanspec);
2195                 /* Increase dwell time to receive probe response or detect
2196                  * beacon from target AP at a noisy air only during connect
2197                  * command.
2198                  */
2199                 ext_join_params->scan_le.active_time =
2200                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2201                 ext_join_params->scan_le.passive_time =
2202                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2203                 /* To sync with presence period of VSDB GO send probe request
2204                  * more frequently. Probe request will be stopped when it gets
2205                  * probe response from target AP/GO.
2206                  */
2207                 ext_join_params->scan_le.nprobes =
2208                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2209                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2210         } else {
2211                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2212                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2213                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2214         }
2215
2216         brcmf_set_join_pref(ifp, &sme->bss_select);
2217
2218         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2219                                          join_params_size);
2220         kfree(ext_join_params);
2221         if (!err)
2222                 /* This is it. join command worked, we are done */
2223                 goto done;
2224
2225         /* join command failed, fallback to set ssid */
2226         memset(&join_params, 0, sizeof(join_params));
2227         join_params_size = sizeof(join_params.ssid_le);
2228
2229         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2230         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2231
2232         if (sme->bssid)
2233                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2234         else
2235                 eth_broadcast_addr(join_params.params_le.bssid);
2236
2237         if (cfg->channel) {
2238                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2239                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2240                 join_params_size += sizeof(join_params.params_le);
2241         }
2242         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2243                                      &join_params, join_params_size);
2244         if (err)
2245                 bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2246
2247 done:
2248         if (err)
2249                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2250         brcmf_dbg(TRACE, "Exit\n");
2251         return err;
2252 }
2253
2254 static s32
2255 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2256                        u16 reason_code)
2257 {
2258         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2259         struct brcmf_if *ifp = netdev_priv(ndev);
2260         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2261         struct brcmf_pub *drvr = cfg->pub;
2262         struct brcmf_scb_val_le scbval;
2263         s32 err = 0;
2264
2265         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2266         if (!check_vif_up(ifp->vif))
2267                 return -EIO;
2268
2269         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2270         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2271         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2272
2273         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2274         scbval.val = cpu_to_le32(reason_code);
2275         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2276                                      &scbval, sizeof(scbval));
2277         if (err)
2278                 bphy_err(drvr, "error (%d)\n", err);
2279
2280         brcmf_dbg(TRACE, "Exit\n");
2281         return err;
2282 }
2283
2284 static s32
2285 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2286                             enum nl80211_tx_power_setting type, s32 mbm)
2287 {
2288         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2289         struct net_device *ndev = cfg_to_ndev(cfg);
2290         struct brcmf_if *ifp = netdev_priv(ndev);
2291         struct brcmf_pub *drvr = cfg->pub;
2292         s32 err;
2293         s32 disable;
2294         u32 qdbm = 127;
2295
2296         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2297         if (!check_vif_up(ifp->vif))
2298                 return -EIO;
2299
2300         switch (type) {
2301         case NL80211_TX_POWER_AUTOMATIC:
2302                 break;
2303         case NL80211_TX_POWER_LIMITED:
2304         case NL80211_TX_POWER_FIXED:
2305                 if (mbm < 0) {
2306                         bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2307                         err = -EINVAL;
2308                         goto done;
2309                 }
2310                 qdbm =  MBM_TO_DBM(4 * mbm);
2311                 if (qdbm > 127)
2312                         qdbm = 127;
2313                 qdbm |= WL_TXPWR_OVERRIDE;
2314                 break;
2315         default:
2316                 bphy_err(drvr, "Unsupported type %d\n", type);
2317                 err = -EINVAL;
2318                 goto done;
2319         }
2320         /* Make sure radio is off or on as far as software is concerned */
2321         disable = WL_RADIO_SW_DISABLE << 16;
2322         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2323         if (err)
2324                 bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2325
2326         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2327         if (err)
2328                 bphy_err(drvr, "qtxpower error (%d)\n", err);
2329
2330 done:
2331         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2332         return err;
2333 }
2334
2335 static s32
2336 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2337                             s32 *dbm)
2338 {
2339         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2340         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2341         struct brcmf_pub *drvr = cfg->pub;
2342         s32 qdbm = 0;
2343         s32 err;
2344
2345         brcmf_dbg(TRACE, "Enter\n");
2346         if (!check_vif_up(vif))
2347                 return -EIO;
2348
2349         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2350         if (err) {
2351                 bphy_err(drvr, "error (%d)\n", err);
2352                 goto done;
2353         }
2354         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2355
2356 done:
2357         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2358         return err;
2359 }
2360
2361 static s32
2362 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2363                                   u8 key_idx, bool unicast, bool multicast)
2364 {
2365         struct brcmf_if *ifp = netdev_priv(ndev);
2366         struct brcmf_pub *drvr = ifp->drvr;
2367         u32 index;
2368         u32 wsec;
2369         s32 err = 0;
2370
2371         brcmf_dbg(TRACE, "Enter\n");
2372         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2373         if (!check_vif_up(ifp->vif))
2374                 return -EIO;
2375
2376         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2377         if (err) {
2378                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2379                 goto done;
2380         }
2381
2382         if (wsec & WEP_ENABLED) {
2383                 /* Just select a new current key */
2384                 index = key_idx;
2385                 err = brcmf_fil_cmd_int_set(ifp,
2386                                             BRCMF_C_SET_KEY_PRIMARY, index);
2387                 if (err)
2388                         bphy_err(drvr, "error (%d)\n", err);
2389         }
2390 done:
2391         brcmf_dbg(TRACE, "Exit\n");
2392         return err;
2393 }
2394
2395 static s32
2396 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2397                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2398 {
2399         struct brcmf_if *ifp = netdev_priv(ndev);
2400         struct brcmf_wsec_key *key;
2401         s32 err;
2402
2403         brcmf_dbg(TRACE, "Enter\n");
2404         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2405
2406         if (!check_vif_up(ifp->vif))
2407                 return -EIO;
2408
2409         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2410                 /* we ignore this key index in this case */
2411                 return -EINVAL;
2412         }
2413
2414         key = &ifp->vif->profile.key[key_idx];
2415
2416         if (key->algo == CRYPTO_ALGO_OFF) {
2417                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2418                 return -EINVAL;
2419         }
2420
2421         memset(key, 0, sizeof(*key));
2422         key->index = (u32)key_idx;
2423         key->flags = BRCMF_PRIMARY_KEY;
2424
2425         /* Clear the key/index */
2426         err = send_key_to_dongle(ifp, key);
2427
2428         brcmf_dbg(TRACE, "Exit\n");
2429         return err;
2430 }
2431
2432 static s32
2433 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2434                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2435                        struct key_params *params)
2436 {
2437         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2438         struct brcmf_if *ifp = netdev_priv(ndev);
2439         struct brcmf_pub *drvr = cfg->pub;
2440         struct brcmf_wsec_key *key;
2441         s32 val;
2442         s32 wsec;
2443         s32 err;
2444         u8 keybuf[8];
2445         bool ext_key;
2446
2447         brcmf_dbg(TRACE, "Enter\n");
2448         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2449         if (!check_vif_up(ifp->vif))
2450                 return -EIO;
2451
2452         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2453                 /* we ignore this key index in this case */
2454                 bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2455                 return -EINVAL;
2456         }
2457
2458         if (params->key_len == 0)
2459                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2460                                               mac_addr);
2461
2462         if (params->key_len > sizeof(key->data)) {
2463                 bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2464                 return -EINVAL;
2465         }
2466
2467         ext_key = false;
2468         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2469             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2470                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2471                 ext_key = true;
2472         }
2473
2474         key = &ifp->vif->profile.key[key_idx];
2475         memset(key, 0, sizeof(*key));
2476         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2477                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2478         key->len = params->key_len;
2479         key->index = key_idx;
2480         memcpy(key->data, params->key, key->len);
2481         if (!ext_key)
2482                 key->flags = BRCMF_PRIMARY_KEY;
2483
2484         if (params->seq && params->seq_len == 6) {
2485                 /* rx iv */
2486                 u8 *ivptr;
2487
2488                 ivptr = (u8 *)params->seq;
2489                 key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2490                         (ivptr[3] << 8) | ivptr[2];
2491                 key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2492                 key->iv_initialized = true;
2493         }
2494
2495         switch (params->cipher) {
2496         case WLAN_CIPHER_SUITE_WEP40:
2497                 key->algo = CRYPTO_ALGO_WEP1;
2498                 val = WEP_ENABLED;
2499                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2500                 break;
2501         case WLAN_CIPHER_SUITE_WEP104:
2502                 key->algo = CRYPTO_ALGO_WEP128;
2503                 val = WEP_ENABLED;
2504                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2505                 break;
2506         case WLAN_CIPHER_SUITE_TKIP:
2507                 if (!brcmf_is_apmode(ifp->vif)) {
2508                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2509                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2510                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2511                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2512                 }
2513                 key->algo = CRYPTO_ALGO_TKIP;
2514                 val = TKIP_ENABLED;
2515                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2516                 break;
2517         case WLAN_CIPHER_SUITE_AES_CMAC:
2518                 key->algo = CRYPTO_ALGO_AES_CCM;
2519                 val = AES_ENABLED;
2520                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2521                 break;
2522         case WLAN_CIPHER_SUITE_CCMP:
2523                 key->algo = CRYPTO_ALGO_AES_CCM;
2524                 val = AES_ENABLED;
2525                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2526                 break;
2527         default:
2528                 bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2529                 err = -EINVAL;
2530                 goto done;
2531         }
2532
2533         err = send_key_to_dongle(ifp, key);
2534         if (ext_key || err)
2535                 goto done;
2536
2537         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2538         if (err) {
2539                 bphy_err(drvr, "get wsec error (%d)\n", err);
2540                 goto done;
2541         }
2542         wsec |= val;
2543         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2544         if (err) {
2545                 bphy_err(drvr, "set wsec error (%d)\n", err);
2546                 goto done;
2547         }
2548
2549 done:
2550         brcmf_dbg(TRACE, "Exit\n");
2551         return err;
2552 }
2553
2554 static s32
2555 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2556                        bool pairwise, const u8 *mac_addr, void *cookie,
2557                        void (*callback)(void *cookie,
2558                                         struct key_params *params))
2559 {
2560         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2561         struct key_params params;
2562         struct brcmf_if *ifp = netdev_priv(ndev);
2563         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2564         struct brcmf_pub *drvr = cfg->pub;
2565         struct brcmf_cfg80211_security *sec;
2566         s32 wsec;
2567         s32 err = 0;
2568
2569         brcmf_dbg(TRACE, "Enter\n");
2570         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2571         if (!check_vif_up(ifp->vif))
2572                 return -EIO;
2573
2574         memset(&params, 0, sizeof(params));
2575
2576         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2577         if (err) {
2578                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2579                 /* Ignore this error, may happen during DISASSOC */
2580                 err = -EAGAIN;
2581                 goto done;
2582         }
2583         if (wsec & WEP_ENABLED) {
2584                 sec = &profile->sec;
2585                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2586                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2587                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2588                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2589                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2590                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2591                 }
2592         } else if (wsec & TKIP_ENABLED) {
2593                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2594                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2595         } else if (wsec & AES_ENABLED) {
2596                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2597                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2598         } else  {
2599                 bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2600                 err = -EINVAL;
2601                 goto done;
2602         }
2603         callback(cookie, &params);
2604
2605 done:
2606         brcmf_dbg(TRACE, "Exit\n");
2607         return err;
2608 }
2609
2610 static s32
2611 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2612                                        struct net_device *ndev, u8 key_idx)
2613 {
2614         struct brcmf_if *ifp = netdev_priv(ndev);
2615
2616         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2617
2618         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2619                 return 0;
2620
2621         brcmf_dbg(INFO, "Not supported\n");
2622
2623         return -EOPNOTSUPP;
2624 }
2625
2626 static void
2627 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2628 {
2629         struct brcmf_pub *drvr = ifp->drvr;
2630         s32 err;
2631         u8 key_idx;
2632         struct brcmf_wsec_key *key;
2633         s32 wsec;
2634
2635         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2636                 key = &ifp->vif->profile.key[key_idx];
2637                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2638                     (key->algo == CRYPTO_ALGO_WEP128))
2639                         break;
2640         }
2641         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2642                 return;
2643
2644         err = send_key_to_dongle(ifp, key);
2645         if (err) {
2646                 bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
2647                 return;
2648         }
2649         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2650         if (err) {
2651                 bphy_err(drvr, "get wsec error (%d)\n", err);
2652                 return;
2653         }
2654         wsec |= WEP_ENABLED;
2655         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2656         if (err)
2657                 bphy_err(drvr, "set wsec error (%d)\n", err);
2658 }
2659
2660 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2661 {
2662         struct nl80211_sta_flag_update *sfu;
2663
2664         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2665         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
2666         sfu = &si->sta_flags;
2667         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2668                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2669                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2670                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2671         if (fw_sta_flags & BRCMF_STA_WME)
2672                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2673         if (fw_sta_flags & BRCMF_STA_AUTHE)
2674                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2675         if (fw_sta_flags & BRCMF_STA_ASSOC)
2676                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2677         if (fw_sta_flags & BRCMF_STA_AUTHO)
2678                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2679 }
2680
2681 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2682 {
2683         struct brcmf_pub *drvr = ifp->drvr;
2684         struct {
2685                 __le32 len;
2686                 struct brcmf_bss_info_le bss_le;
2687         } *buf;
2688         u16 capability;
2689         int err;
2690
2691         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2692         if (!buf)
2693                 return;
2694
2695         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2696         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2697                                      WL_BSS_INFO_MAX);
2698         if (err) {
2699                 bphy_err(drvr, "Failed to get bss info (%d)\n", err);
2700                 goto out_kfree;
2701         }
2702         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
2703         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2704         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2705         capability = le16_to_cpu(buf->bss_le.capability);
2706         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2707                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2708         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2709                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2710         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2711                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2712
2713 out_kfree:
2714         kfree(buf);
2715 }
2716
2717 static s32
2718 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2719                                 struct station_info *sinfo)
2720 {
2721         struct brcmf_pub *drvr = ifp->drvr;
2722         struct brcmf_scb_val_le scbval;
2723         struct brcmf_pktcnt_le pktcnt;
2724         s32 err;
2725         u32 rate;
2726         u32 rssi;
2727
2728         /* Get the current tx rate */
2729         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2730         if (err < 0) {
2731                 bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
2732                 return err;
2733         }
2734         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
2735         sinfo->txrate.legacy = rate * 5;
2736
2737         memset(&scbval, 0, sizeof(scbval));
2738         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2739                                      sizeof(scbval));
2740         if (err) {
2741                 bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
2742                 return err;
2743         }
2744         rssi = le32_to_cpu(scbval.val);
2745         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2746         sinfo->signal = rssi;
2747
2748         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2749                                      sizeof(pktcnt));
2750         if (err) {
2751                 bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2752                 return err;
2753         }
2754         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
2755                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
2756                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
2757                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
2758         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2759         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2760         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2761         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2762
2763         return 0;
2764 }
2765
2766 static s32
2767 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2768                            const u8 *mac, struct station_info *sinfo)
2769 {
2770         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2771         struct brcmf_if *ifp = netdev_priv(ndev);
2772         struct brcmf_pub *drvr = cfg->pub;
2773         struct brcmf_scb_val_le scb_val;
2774         s32 err = 0;
2775         struct brcmf_sta_info_le sta_info_le;
2776         u32 sta_flags;
2777         u32 is_tdls_peer;
2778         s32 total_rssi_avg = 0;
2779         s32 total_rssi = 0;
2780         s32 count_rssi = 0;
2781         int rssi;
2782         u32 i;
2783
2784         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2785         if (!check_vif_up(ifp->vif))
2786                 return -EIO;
2787
2788         if (brcmf_is_ibssmode(ifp->vif))
2789                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2790
2791         memset(&sta_info_le, 0, sizeof(sta_info_le));
2792         memcpy(&sta_info_le, mac, ETH_ALEN);
2793         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2794                                        &sta_info_le,
2795                                        sizeof(sta_info_le));
2796         is_tdls_peer = !err;
2797         if (err) {
2798                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2799                                                &sta_info_le,
2800                                                sizeof(sta_info_le));
2801                 if (err < 0) {
2802                         bphy_err(drvr, "GET STA INFO failed, %d\n", err);
2803                         goto done;
2804                 }
2805         }
2806         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2807         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
2808         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2809         sta_flags = le32_to_cpu(sta_info_le.flags);
2810         brcmf_convert_sta_flags(sta_flags, sinfo);
2811         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2812         if (is_tdls_peer)
2813                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2814         else
2815                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2816         if (sta_flags & BRCMF_STA_ASSOC) {
2817                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
2818                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2819                 brcmf_fill_bss_param(ifp, sinfo);
2820         }
2821         if (sta_flags & BRCMF_STA_SCBSTATS) {
2822                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
2823                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2824                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
2825                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2826                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2827                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
2828                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2829                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2830                 if (sinfo->tx_packets) {
2831                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
2832                         sinfo->txrate.legacy =
2833                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2834                 }
2835                 if (sinfo->rx_packets) {
2836                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
2837                         sinfo->rxrate.legacy =
2838                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2839                 }
2840                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2841                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
2842                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2843                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
2844                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2845                 }
2846                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2847                         if (sta_info_le.rssi[i] == 0 ||
2848                             sta_info_le.rx_lastpkt_rssi[i] == 0)
2849                                 continue;
2850                         sinfo->chains |= BIT(count_rssi);
2851                         sinfo->chain_signal[count_rssi] =
2852                                 sta_info_le.rx_lastpkt_rssi[i];
2853                         sinfo->chain_signal_avg[count_rssi] =
2854                                 sta_info_le.rssi[i];
2855                         total_rssi += sta_info_le.rx_lastpkt_rssi[i];
2856                         total_rssi_avg += sta_info_le.rssi[i];
2857                         count_rssi++;
2858                 }
2859                 if (count_rssi) {
2860                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2861                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
2862                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
2863                         sinfo->filled |=
2864                                 BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
2865                         sinfo->signal = total_rssi / count_rssi;
2866                         sinfo->signal_avg = total_rssi_avg / count_rssi;
2867                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2868                         &ifp->vif->sme_state)) {
2869                         memset(&scb_val, 0, sizeof(scb_val));
2870                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2871                                                      &scb_val, sizeof(scb_val));
2872                         if (err) {
2873                                 bphy_err(drvr, "Could not get rssi (%d)\n",
2874                                          err);
2875                                 goto done;
2876                         } else {
2877                                 rssi = le32_to_cpu(scb_val.val);
2878                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2879                                 sinfo->signal = rssi;
2880                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2881                         }
2882                 }
2883         }
2884 done:
2885         brcmf_dbg(TRACE, "Exit\n");
2886         return err;
2887 }
2888
2889 static int
2890 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2891                             int idx, u8 *mac, struct station_info *sinfo)
2892 {
2893         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2894         struct brcmf_if *ifp = netdev_priv(ndev);
2895         struct brcmf_pub *drvr = cfg->pub;
2896         s32 err;
2897
2898         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2899
2900         if (idx == 0) {
2901                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2902                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2903                                              &cfg->assoclist,
2904                                              sizeof(cfg->assoclist));
2905                 if (err) {
2906                         /* GET_ASSOCLIST unsupported by firmware of older chips */
2907                         if (err == -EBADE)
2908                                 bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
2909                         else
2910                                 bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
2911                                          err);
2912
2913                         cfg->assoclist.count = 0;
2914                         return -EOPNOTSUPP;
2915                 }
2916         }
2917         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2918                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2919                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2920         }
2921         return -ENOENT;
2922 }
2923
2924 static s32
2925 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2926                            bool enabled, s32 timeout)
2927 {
2928         s32 pm;
2929         s32 err = 0;
2930         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2931         struct brcmf_if *ifp = netdev_priv(ndev);
2932         struct brcmf_pub *drvr = cfg->pub;
2933
2934         brcmf_dbg(TRACE, "Enter\n");
2935
2936         /*
2937          * Powersave enable/disable request is coming from the
2938          * cfg80211 even before the interface is up. In that
2939          * scenario, driver will be storing the power save
2940          * preference in cfg struct to apply this to
2941          * FW later while initializing the dongle
2942          */
2943         cfg->pwr_save = enabled;
2944         if (!check_vif_up(ifp->vif)) {
2945
2946                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2947                 goto done;
2948         }
2949
2950         pm = enabled ? PM_FAST : PM_OFF;
2951         /* Do not enable the power save after assoc if it is a p2p interface */
2952         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2953                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2954                 pm = PM_OFF;
2955         }
2956         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2957
2958         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2959         if (err) {
2960                 if (err == -ENODEV)
2961                         bphy_err(drvr, "net_device is not ready yet\n");
2962                 else
2963                         bphy_err(drvr, "error (%d)\n", err);
2964         }
2965
2966         err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
2967                                 min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
2968         if (err)
2969                 bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
2970
2971 done:
2972         brcmf_dbg(TRACE, "Exit\n");
2973         return err;
2974 }
2975
2976 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2977                                    struct brcmf_bss_info_le *bi)
2978 {
2979         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2980         struct brcmf_pub *drvr = cfg->pub;
2981         struct cfg80211_bss *bss;
2982         enum nl80211_band band;
2983         struct brcmu_chan ch;
2984         u16 channel;
2985         u32 freq;
2986         u16 notify_capability;
2987         u16 notify_interval;
2988         u8 *notify_ie;
2989         size_t notify_ielen;
2990         struct cfg80211_inform_bss bss_data = {};
2991
2992         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2993                 bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
2994                 return -EINVAL;
2995         }
2996
2997         if (!bi->ctl_ch) {
2998                 ch.chspec = le16_to_cpu(bi->chanspec);
2999                 cfg->d11inf.decchspec(&ch);
3000                 bi->ctl_ch = ch.control_ch_num;
3001         }
3002         channel = bi->ctl_ch;
3003
3004         if (channel <= CH_MAX_2G_CHANNEL)
3005                 band = NL80211_BAND_2GHZ;
3006         else
3007                 band = NL80211_BAND_5GHZ;
3008
3009         freq = ieee80211_channel_to_frequency(channel, band);
3010         bss_data.chan = ieee80211_get_channel(wiphy, freq);
3011         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3012         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3013
3014         notify_capability = le16_to_cpu(bi->capability);
3015         notify_interval = le16_to_cpu(bi->beacon_period);
3016         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3017         notify_ielen = le32_to_cpu(bi->ie_length);
3018         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3019
3020         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3021         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3022         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3023         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3024         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3025
3026         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3027                                        CFG80211_BSS_FTYPE_UNKNOWN,
3028                                        (const u8 *)bi->BSSID,
3029                                        0, notify_capability,
3030                                        notify_interval, notify_ie,
3031                                        notify_ielen, GFP_KERNEL);
3032
3033         if (!bss)
3034                 return -ENOMEM;
3035
3036         cfg80211_put_bss(wiphy, bss);
3037
3038         return 0;
3039 }
3040
3041 static struct brcmf_bss_info_le *
3042 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3043 {
3044         if (bss == NULL)
3045                 return list->bss_info_le;
3046         return (struct brcmf_bss_info_le *)((unsigned long)bss +
3047                                             le32_to_cpu(bss->length));
3048 }
3049
3050 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3051 {
3052         struct brcmf_pub *drvr = cfg->pub;
3053         struct brcmf_scan_results *bss_list;
3054         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
3055         s32 err = 0;
3056         int i;
3057
3058         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3059         if (bss_list->count != 0 &&
3060             bss_list->version != BRCMF_BSS_INFO_VERSION) {
3061                 bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3062                          bss_list->version);
3063                 return -EOPNOTSUPP;
3064         }
3065         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3066         for (i = 0; i < bss_list->count; i++) {
3067                 bi = next_bss_le(bss_list, bi);
3068                 err = brcmf_inform_single_bss(cfg, bi);
3069                 if (err)
3070                         break;
3071         }
3072         return err;
3073 }
3074
3075 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3076                              struct net_device *ndev, const u8 *bssid)
3077 {
3078         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3079         struct brcmf_pub *drvr = cfg->pub;
3080         struct ieee80211_channel *notify_channel;
3081         struct brcmf_bss_info_le *bi = NULL;
3082         struct ieee80211_supported_band *band;
3083         struct cfg80211_bss *bss;
3084         struct brcmu_chan ch;
3085         u8 *buf = NULL;
3086         s32 err = 0;
3087         u32 freq;
3088         u16 notify_capability;
3089         u16 notify_interval;
3090         u8 *notify_ie;
3091         size_t notify_ielen;
3092         s32 notify_signal;
3093
3094         brcmf_dbg(TRACE, "Enter\n");
3095
3096         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3097         if (buf == NULL) {
3098                 err = -ENOMEM;
3099                 goto CleanUp;
3100         }
3101
3102         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3103
3104         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3105                                      buf, WL_BSS_INFO_MAX);
3106         if (err) {
3107                 bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3108                 goto CleanUp;
3109         }
3110
3111         bi = (struct brcmf_bss_info_le *)(buf + 4);
3112
3113         ch.chspec = le16_to_cpu(bi->chanspec);
3114         cfg->d11inf.decchspec(&ch);
3115
3116         if (ch.band == BRCMU_CHAN_BAND_2G)
3117                 band = wiphy->bands[NL80211_BAND_2GHZ];
3118         else
3119                 band = wiphy->bands[NL80211_BAND_5GHZ];
3120
3121         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3122         cfg->channel = freq;
3123         notify_channel = ieee80211_get_channel(wiphy, freq);
3124
3125         notify_capability = le16_to_cpu(bi->capability);
3126         notify_interval = le16_to_cpu(bi->beacon_period);
3127         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3128         notify_ielen = le32_to_cpu(bi->ie_length);
3129         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3130
3131         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3132         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3133         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3134         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3135
3136         bss = cfg80211_inform_bss(wiphy, notify_channel,
3137                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3138                                   notify_capability, notify_interval,
3139                                   notify_ie, notify_ielen, notify_signal,
3140                                   GFP_KERNEL);
3141
3142         if (!bss) {
3143                 err = -ENOMEM;
3144                 goto CleanUp;
3145         }
3146
3147         cfg80211_put_bss(wiphy, bss);
3148
3149 CleanUp:
3150
3151         kfree(buf);
3152
3153         brcmf_dbg(TRACE, "Exit\n");
3154
3155         return err;
3156 }
3157
3158 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3159                                  struct brcmf_if *ifp)
3160 {
3161         struct brcmf_pub *drvr = cfg->pub;
3162         struct brcmf_bss_info_le *bi;
3163         const struct brcmf_tlv *tim;
3164         size_t ie_len;
3165         u8 *ie;
3166         s32 err = 0;
3167
3168         brcmf_dbg(TRACE, "Enter\n");
3169         if (brcmf_is_ibssmode(ifp->vif))
3170                 return err;
3171
3172         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3173         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3174                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3175         if (err) {
3176                 bphy_err(drvr, "Could not get bss info %d\n", err);
3177                 goto update_bss_info_out;
3178         }
3179
3180         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3181         err = brcmf_inform_single_bss(cfg, bi);
3182         if (err)
3183                 goto update_bss_info_out;
3184
3185         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
3186         ie_len = le32_to_cpu(bi->ie_length);
3187
3188         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
3189         if (!tim) {
3190                 /*
3191                 * active scan was done so we could not get dtim
3192                 * information out of probe response.
3193                 * so we speficially query dtim information to dongle.
3194                 */
3195                 u32 var;
3196                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3197                 if (err) {
3198                         bphy_err(drvr, "wl dtim_assoc failed (%d)\n", err);
3199                         goto update_bss_info_out;
3200                 }
3201         }
3202
3203 update_bss_info_out:
3204         brcmf_dbg(TRACE, "Exit");
3205         return err;
3206 }
3207
3208 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3209 {
3210         struct escan_info *escan = &cfg->escan_info;
3211
3212         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3213         if (cfg->int_escan_map || cfg->scan_request) {
3214                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3215                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3216         }
3217         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3218         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3219 }
3220
3221 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3222 {
3223         struct brcmf_cfg80211_info *cfg =
3224                         container_of(work, struct brcmf_cfg80211_info,
3225                                      escan_timeout_work);
3226
3227         brcmf_inform_bss(cfg);
3228         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3229 }
3230
3231 static void brcmf_escan_timeout(struct timer_list *t)
3232 {
3233         struct brcmf_cfg80211_info *cfg =
3234                         from_timer(cfg, t, escan_timeout);
3235         struct brcmf_pub *drvr = cfg->pub;
3236
3237         if (cfg->int_escan_map || cfg->scan_request) {
3238                 bphy_err(drvr, "timer expired\n");
3239                 schedule_work(&cfg->escan_timeout_work);
3240         }
3241 }
3242
3243 static s32
3244 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3245                               struct brcmf_bss_info_le *bss,
3246                               struct brcmf_bss_info_le *bss_info_le)
3247 {
3248         struct brcmu_chan ch_bss, ch_bss_info_le;
3249
3250         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3251         cfg->d11inf.decchspec(&ch_bss);
3252         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3253         cfg->d11inf.decchspec(&ch_bss_info_le);
3254
3255         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3256                 ch_bss.band == ch_bss_info_le.band &&
3257                 bss_info_le->SSID_len == bss->SSID_len &&
3258                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3259                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3260                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3261                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3262                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3263
3264                         /* preserve max RSSI if the measurements are
3265                         * both on-channel or both off-channel
3266                         */
3267                         if (bss_info_rssi > bss_rssi)
3268                                 bss->RSSI = bss_info_le->RSSI;
3269                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3270                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3271                         /* preserve the on-channel rssi measurement
3272                         * if the new measurement is off channel
3273                         */
3274                         bss->RSSI = bss_info_le->RSSI;
3275                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3276                 }
3277                 return 1;
3278         }
3279         return 0;
3280 }
3281
3282 static s32
3283 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3284                              const struct brcmf_event_msg *e, void *data)
3285 {
3286         struct brcmf_pub *drvr = ifp->drvr;
3287         struct brcmf_cfg80211_info *cfg = drvr->config;
3288         s32 status;
3289         struct brcmf_escan_result_le *escan_result_le;
3290         u32 escan_buflen;
3291         struct brcmf_bss_info_le *bss_info_le;
3292         struct brcmf_bss_info_le *bss = NULL;
3293         u32 bi_length;
3294         struct brcmf_scan_results *list;
3295         u32 i;
3296         bool aborted;
3297
3298         status = e->status;
3299
3300         if (status == BRCMF_E_STATUS_ABORT)
3301                 goto exit;
3302
3303         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3304                 bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3305                          ifp->bsscfgidx);
3306                 return -EPERM;
3307         }
3308
3309         if (status == BRCMF_E_STATUS_PARTIAL) {
3310                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3311                 if (e->datalen < sizeof(*escan_result_le)) {
3312                         bphy_err(drvr, "invalid event data length\n");
3313                         goto exit;
3314                 }
3315                 escan_result_le = (struct brcmf_escan_result_le *) data;
3316                 if (!escan_result_le) {
3317                         bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3318                         goto exit;
3319                 }
3320                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3321                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3322                     escan_buflen > e->datalen ||
3323                     escan_buflen < sizeof(*escan_result_le)) {
3324                         bphy_err(drvr, "Invalid escan buffer length: %d\n",
3325                                  escan_buflen);
3326                         goto exit;
3327                 }
3328                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3329                         bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3330                                  escan_result_le->bss_count);
3331                         goto exit;
3332                 }
3333                 bss_info_le = &escan_result_le->bss_info_le;
3334
3335                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3336                         goto exit;
3337
3338                 if (!cfg->int_escan_map && !cfg->scan_request) {
3339                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3340                         goto exit;
3341                 }
3342
3343                 bi_length = le32_to_cpu(bss_info_le->length);
3344                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3345                         bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3346                                  bi_length);
3347                         goto exit;
3348                 }
3349
3350                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3351                                         BIT(NL80211_IFTYPE_ADHOC))) {
3352                         if (le16_to_cpu(bss_info_le->capability) &
3353                                                 WLAN_CAPABILITY_IBSS) {
3354                                 bphy_err(drvr, "Ignoring IBSS result\n");
3355                                 goto exit;
3356                         }
3357                 }
3358
3359                 list = (struct brcmf_scan_results *)
3360                                 cfg->escan_info.escan_buf;
3361                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3362                         bphy_err(drvr, "Buffer is too small: ignoring\n");
3363                         goto exit;
3364                 }
3365
3366                 for (i = 0; i < list->count; i++) {
3367                         bss = bss ? (struct brcmf_bss_info_le *)
3368                                 ((unsigned char *)bss +
3369                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3370                         if (brcmf_compare_update_same_bss(cfg, bss,
3371                                                           bss_info_le))
3372                                 goto exit;
3373                 }
3374                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3375                        bi_length);
3376                 list->version = le32_to_cpu(bss_info_le->version);
3377                 list->buflen += bi_length;
3378                 list->count++;
3379         } else {
3380                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3381                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3382                         goto exit;
3383                 if (cfg->int_escan_map || cfg->scan_request) {
3384                         brcmf_inform_bss(cfg);
3385                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3386                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3387                 } else
3388                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3389                                   status);
3390         }
3391 exit:
3392         return 0;
3393 }
3394
3395 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3396 {
3397         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3398                             brcmf_cfg80211_escan_handler);
3399         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3400         /* Init scan_timeout timer */
3401         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3402         INIT_WORK(&cfg->escan_timeout_work,
3403                   brcmf_cfg80211_escan_timeout_worker);
3404 }
3405
3406 static struct cfg80211_scan_request *
3407 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3408         struct cfg80211_scan_request *req;
3409         size_t req_size;
3410
3411         req_size = sizeof(*req) +
3412                    n_netinfo * sizeof(req->channels[0]) +
3413                    n_netinfo * sizeof(*req->ssids);
3414
3415         req = kzalloc(req_size, GFP_KERNEL);
3416         if (req) {
3417                 req->wiphy = wiphy;
3418                 req->ssids = (void *)(&req->channels[0]) +
3419                              n_netinfo * sizeof(req->channels[0]);
3420         }
3421         return req;
3422 }
3423
3424 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3425                                          u8 *ssid, u8 ssid_len, u8 channel)
3426 {
3427         struct ieee80211_channel *chan;
3428         enum nl80211_band band;
3429         int freq, i;
3430
3431         if (channel <= CH_MAX_2G_CHANNEL)
3432                 band = NL80211_BAND_2GHZ;
3433         else
3434                 band = NL80211_BAND_5GHZ;
3435
3436         freq = ieee80211_channel_to_frequency(channel, band);
3437         if (!freq)
3438                 return -EINVAL;
3439
3440         chan = ieee80211_get_channel(req->wiphy, freq);
3441         if (!chan)
3442                 return -EINVAL;
3443
3444         for (i = 0; i < req->n_channels; i++) {
3445                 if (req->channels[i] == chan)
3446                         break;
3447         }
3448         if (i == req->n_channels)
3449                 req->channels[req->n_channels++] = chan;
3450
3451         for (i = 0; i < req->n_ssids; i++) {
3452                 if (req->ssids[i].ssid_len == ssid_len &&
3453                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3454                         break;
3455         }
3456         if (i == req->n_ssids) {
3457                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3458                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3459         }
3460         return 0;
3461 }
3462
3463 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3464                                       struct cfg80211_scan_request *request)
3465 {
3466         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3467         int err;
3468
3469         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3470                 if (cfg->int_escan_map)
3471                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3472                                   cfg->int_escan_map);
3473                 /* Abort any on-going scan */
3474                 brcmf_abort_scanning(cfg);
3475         }
3476
3477         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3478         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3479         cfg->escan_info.run = brcmf_run_escan;
3480         err = brcmf_do_escan(ifp, request);
3481         if (err) {
3482                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3483                 return err;
3484         }
3485         cfg->int_escan_map = fwmap;
3486         return 0;
3487 }
3488
3489 static struct brcmf_pno_net_info_le *
3490 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3491 {
3492         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3493         struct brcmf_pno_net_info_le *netinfo;
3494
3495         switch (pfn_v1->version) {
3496         default:
3497                 WARN_ON(1);
3498                 fallthrough;
3499         case cpu_to_le32(1):
3500                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3501                 break;
3502         case cpu_to_le32(2):
3503                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3504                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3505                 break;
3506         }
3507
3508         return netinfo;
3509 }
3510
3511 /* PFN result doesn't have all the info which are required by the supplicant
3512  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3513  * via wl_inform_single_bss in the required format. Escan does require the
3514  * scan request in the form of cfg80211_scan_request. For timebeing, create
3515  * cfg80211_scan_request one out of the received PNO event.
3516  */
3517 static s32
3518 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3519                                 const struct brcmf_event_msg *e, void *data)
3520 {
3521         struct brcmf_pub *drvr = ifp->drvr;
3522         struct brcmf_cfg80211_info *cfg = drvr->config;
3523         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3524         struct cfg80211_scan_request *request = NULL;
3525         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3526         int i, err = 0;
3527         struct brcmf_pno_scanresults_le *pfn_result;
3528         u32 bucket_map;
3529         u32 result_count;
3530         u32 status;
3531         u32 datalen;
3532
3533         brcmf_dbg(SCAN, "Enter\n");
3534
3535         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3536                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3537                 return 0;
3538         }
3539
3540         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3541                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3542                 return 0;
3543         }
3544
3545         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3546         result_count = le32_to_cpu(pfn_result->count);
3547         status = le32_to_cpu(pfn_result->status);
3548
3549         /* PFN event is limited to fit 512 bytes so we may get
3550          * multiple NET_FOUND events. For now place a warning here.
3551          */
3552         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3553         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3554         if (!result_count) {
3555                 bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3556                 goto out_err;
3557         }
3558
3559         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3560         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3561         if (datalen < result_count * sizeof(*netinfo)) {
3562                 bphy_err(drvr, "insufficient event data\n");
3563                 goto out_err;
3564         }
3565
3566         request = brcmf_alloc_internal_escan_request(wiphy,
3567                                                      result_count);
3568         if (!request) {
3569                 err = -ENOMEM;
3570                 goto out_err;
3571         }
3572
3573         bucket_map = 0;
3574         for (i = 0; i < result_count; i++) {
3575                 netinfo = &netinfo_start[i];
3576
3577                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3578                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3579                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3580                           netinfo->SSID, netinfo->channel);
3581                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3582                 err = brcmf_internal_escan_add_info(request,
3583                                                     netinfo->SSID,
3584                                                     netinfo->SSID_len,
3585                                                     netinfo->channel);
3586                 if (err)
3587                         goto out_err;
3588         }
3589
3590         if (!bucket_map)
3591                 goto free_req;
3592
3593         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3594         if (!err)
3595                 goto free_req;
3596
3597 out_err:
3598         cfg80211_sched_scan_stopped(wiphy, 0);
3599 free_req:
3600         kfree(request);
3601         return err;
3602 }
3603
3604 static int
3605 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3606                                 struct net_device *ndev,
3607                                 struct cfg80211_sched_scan_request *req)
3608 {
3609         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3610         struct brcmf_if *ifp = netdev_priv(ndev);
3611         struct brcmf_pub *drvr = cfg->pub;
3612
3613         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3614                   req->n_match_sets, req->n_ssids);
3615
3616         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3617                 bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3618                          cfg->scan_status);
3619                 return -EAGAIN;
3620         }
3621
3622         if (req->n_match_sets <= 0) {
3623                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3624                           req->n_match_sets);
3625                 return -EINVAL;
3626         }
3627
3628         return brcmf_pno_start_sched_scan(ifp, req);
3629 }
3630
3631 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3632                                           struct net_device *ndev, u64 reqid)
3633 {
3634         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3635         struct brcmf_if *ifp = netdev_priv(ndev);
3636
3637         brcmf_dbg(SCAN, "enter\n");
3638         brcmf_pno_stop_sched_scan(ifp, reqid);
3639         if (cfg->int_escan_map)
3640                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3641         return 0;
3642 }
3643
3644 static __always_inline void brcmf_delay(u32 ms)
3645 {
3646         if (ms < 1000 / HZ) {
3647                 cond_resched();
3648                 mdelay(ms);
3649         } else {
3650                 msleep(ms);
3651         }
3652 }
3653
3654 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3655                                      u8 *pattern, u32 patternsize, u8 *mask,
3656                                      u32 packet_offset)
3657 {
3658         struct brcmf_fil_wowl_pattern_le *filter;
3659         u32 masksize;
3660         u32 patternoffset;
3661         u8 *buf;
3662         u32 bufsize;
3663         s32 ret;
3664
3665         masksize = (patternsize + 7) / 8;
3666         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3667
3668         bufsize = sizeof(*filter) + patternsize + masksize;
3669         buf = kzalloc(bufsize, GFP_KERNEL);
3670         if (!buf)
3671                 return -ENOMEM;
3672         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3673
3674         memcpy(filter->cmd, cmd, 4);
3675         filter->masksize = cpu_to_le32(masksize);
3676         filter->offset = cpu_to_le32(packet_offset);
3677         filter->patternoffset = cpu_to_le32(patternoffset);
3678         filter->patternsize = cpu_to_le32(patternsize);
3679         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3680
3681         if ((mask) && (masksize))
3682                 memcpy(buf + sizeof(*filter), mask, masksize);
3683         if ((pattern) && (patternsize))
3684                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3685
3686         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3687
3688         kfree(buf);
3689         return ret;
3690 }
3691
3692 static s32
3693 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3694                       void *data)
3695 {
3696         struct brcmf_pub *drvr = ifp->drvr;
3697         struct brcmf_cfg80211_info *cfg = drvr->config;
3698         struct brcmf_pno_scanresults_le *pfn_result;
3699         struct brcmf_pno_net_info_le *netinfo;
3700
3701         brcmf_dbg(SCAN, "Enter\n");
3702
3703         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3704                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3705                 return 0;
3706         }
3707
3708         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3709
3710         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3711                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3712                 return 0;
3713         }
3714
3715         if (le32_to_cpu(pfn_result->count) < 1) {
3716                 bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
3717                          le32_to_cpu(pfn_result->count));
3718                 return -EINVAL;
3719         }
3720
3721         netinfo = brcmf_get_netinfo_array(pfn_result);
3722         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3723                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3724         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3725         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3726         cfg->wowl.nd->n_channels = 1;
3727         cfg->wowl.nd->channels[0] =
3728                 ieee80211_channel_to_frequency(netinfo->channel,
3729                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3730                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3731         cfg->wowl.nd_info->n_matches = 1;
3732         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3733
3734         /* Inform (the resume task) that the net detect information was recvd */
3735         cfg->wowl.nd_data_completed = true;
3736         wake_up(&cfg->wowl.nd_data_wait);
3737
3738         return 0;
3739 }
3740
3741 #ifdef CONFIG_PM
3742
3743 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3744 {
3745         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3746         struct brcmf_pub *drvr = cfg->pub;
3747         struct brcmf_wowl_wakeind_le wake_ind_le;
3748         struct cfg80211_wowlan_wakeup wakeup_data;
3749         struct cfg80211_wowlan_wakeup *wakeup;
3750         u32 wakeind;
3751         s32 err;
3752         int timeout;
3753
3754         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3755                                        sizeof(wake_ind_le));
3756         if (err) {
3757                 bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
3758                 return;
3759         }
3760
3761         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3762         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3763                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3764                        BRCMF_WOWL_PFN_FOUND)) {
3765                 wakeup = &wakeup_data;
3766                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3767                 wakeup_data.pattern_idx = -1;
3768
3769                 if (wakeind & BRCMF_WOWL_MAGIC) {
3770                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3771                         wakeup_data.magic_pkt = true;
3772                 }
3773                 if (wakeind & BRCMF_WOWL_DIS) {
3774                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3775                         wakeup_data.disconnect = true;
3776                 }
3777                 if (wakeind & BRCMF_WOWL_BCN) {
3778                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3779                         wakeup_data.disconnect = true;
3780                 }
3781                 if (wakeind & BRCMF_WOWL_RETR) {
3782                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3783                         wakeup_data.disconnect = true;
3784                 }
3785                 if (wakeind & BRCMF_WOWL_NET) {
3786                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3787                         /* For now always map to pattern 0, no API to get
3788                          * correct information available at the moment.
3789                          */
3790                         wakeup_data.pattern_idx = 0;
3791                 }
3792                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3793                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3794                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3795                                 cfg->wowl.nd_data_completed,
3796                                 BRCMF_ND_INFO_TIMEOUT);
3797                         if (!timeout)
3798                                 bphy_err(drvr, "No result for wowl net detect\n");
3799                         else
3800                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3801                 }
3802                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3803                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3804                         wakeup_data.gtk_rekey_failure = true;
3805                 }
3806         } else {
3807                 wakeup = NULL;
3808         }
3809         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3810 }
3811
3812 #else
3813
3814 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3815 {
3816 }
3817
3818 #endif /* CONFIG_PM */
3819
3820 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3821 {
3822         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3823         struct net_device *ndev = cfg_to_ndev(cfg);
3824         struct brcmf_if *ifp = netdev_priv(ndev);
3825
3826         brcmf_dbg(TRACE, "Enter\n");
3827
3828         if (cfg->wowl.active) {
3829                 brcmf_report_wowl_wakeind(wiphy, ifp);
3830                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3831                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3832                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3833                         brcmf_configure_arp_nd_offload(ifp, true);
3834                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3835                                       cfg->wowl.pre_pmmode);
3836                 cfg->wowl.active = false;
3837                 if (cfg->wowl.nd_enabled) {
3838                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
3839                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3840                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3841                                             brcmf_notify_sched_scan_results);
3842                         cfg->wowl.nd_enabled = false;
3843                 }
3844         }
3845         return 0;
3846 }
3847
3848 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3849                                  struct brcmf_if *ifp,
3850                                  struct cfg80211_wowlan *wowl)
3851 {
3852         u32 wowl_config;
3853         struct brcmf_wowl_wakeind_le wowl_wakeind;
3854         u32 i;
3855
3856         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3857
3858         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3859                 brcmf_configure_arp_nd_offload(ifp, false);
3860         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3861         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3862
3863         wowl_config = 0;
3864         if (wowl->disconnect)
3865                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3866         if (wowl->magic_pkt)
3867                 wowl_config |= BRCMF_WOWL_MAGIC;
3868         if ((wowl->patterns) && (wowl->n_patterns)) {
3869                 wowl_config |= BRCMF_WOWL_NET;
3870                 for (i = 0; i < wowl->n_patterns; i++) {
3871                         brcmf_config_wowl_pattern(ifp, "add",
3872                                 (u8 *)wowl->patterns[i].pattern,
3873                                 wowl->patterns[i].pattern_len,
3874                                 (u8 *)wowl->patterns[i].mask,
3875                                 wowl->patterns[i].pkt_offset);
3876                 }
3877         }
3878         if (wowl->nd_config) {
3879                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3880                                                 wowl->nd_config);
3881                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3882
3883                 cfg->wowl.nd_data_completed = false;
3884                 cfg->wowl.nd_enabled = true;
3885                 /* Now reroute the event for PFN to the wowl function. */
3886                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3887                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3888                                     brcmf_wowl_nd_results);
3889         }
3890         if (wowl->gtk_rekey_failure)
3891                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3892         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3893                 wowl_config |= BRCMF_WOWL_UNASSOC;
3894
3895         memcpy(&wowl_wakeind, "clear", 6);
3896         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3897                                  sizeof(wowl_wakeind));
3898         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3899         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3900         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3901         cfg->wowl.active = true;
3902 }
3903
3904 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3905                                   struct cfg80211_wowlan *wowl)
3906 {
3907         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3908         struct net_device *ndev = cfg_to_ndev(cfg);
3909         struct brcmf_if *ifp = netdev_priv(ndev);
3910         struct brcmf_cfg80211_vif *vif;
3911
3912         brcmf_dbg(TRACE, "Enter\n");
3913
3914         /* if the primary net_device is not READY there is nothing
3915          * we can do but pray resume goes smoothly.
3916          */
3917         if (!check_vif_up(ifp->vif))
3918                 goto exit;
3919
3920         /* Stop scheduled scan */
3921         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3922                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
3923
3924         /* end any scanning */
3925         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3926                 brcmf_abort_scanning(cfg);
3927
3928         if (wowl == NULL) {
3929                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3930                 list_for_each_entry(vif, &cfg->vif_list, list) {
3931                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3932                                 continue;
3933                         /* While going to suspend if associated with AP
3934                          * disassociate from AP to save power while system is
3935                          * in suspended state
3936                          */
3937                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
3938                         /* Make sure WPA_Supplicant receives all the event
3939                          * generated due to DISASSOC call to the fw to keep
3940                          * the state fw and WPA_Supplicant state consistent
3941                          */
3942                         brcmf_delay(500);
3943                 }
3944                 /* Configure MPC */
3945                 brcmf_set_mpc(ifp, 1);
3946
3947         } else {
3948                 /* Configure WOWL paramaters */
3949                 brcmf_configure_wowl(cfg, ifp, wowl);
3950         }
3951
3952 exit:
3953         brcmf_dbg(TRACE, "Exit\n");
3954         /* clear any scanning activity */
3955         cfg->scan_status = 0;
3956         return 0;
3957 }
3958
3959 static __used s32
3960 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3961 {
3962         struct brcmf_pmk_list_le *pmk_list;
3963         int i;
3964         u32 npmk;
3965         s32 err;
3966
3967         pmk_list = &cfg->pmk_list;
3968         npmk = le32_to_cpu(pmk_list->npmk);
3969
3970         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3971         for (i = 0; i < npmk; i++)
3972                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3973
3974         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3975                                        sizeof(*pmk_list));
3976
3977         return err;
3978 }
3979
3980 static s32
3981 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3982                          struct cfg80211_pmksa *pmksa)
3983 {
3984         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3985         struct brcmf_if *ifp = netdev_priv(ndev);
3986         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3987         struct brcmf_pub *drvr = cfg->pub;
3988         s32 err;
3989         u32 npmk, i;
3990
3991         brcmf_dbg(TRACE, "Enter\n");
3992         if (!check_vif_up(ifp->vif))
3993                 return -EIO;
3994
3995         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3996         for (i = 0; i < npmk; i++)
3997                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3998                         break;
3999         if (i < BRCMF_MAXPMKID) {
4000                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4001                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4002                 if (i == npmk) {
4003                         npmk++;
4004                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
4005                 }
4006         } else {
4007                 bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4008                 return -EINVAL;
4009         }
4010
4011         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
4012         brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmk[npmk].pmkid);
4013
4014         err = brcmf_update_pmklist(cfg, ifp);
4015
4016         brcmf_dbg(TRACE, "Exit\n");
4017         return err;
4018 }
4019
4020 static s32
4021 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4022                          struct cfg80211_pmksa *pmksa)
4023 {
4024         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4025         struct brcmf_if *ifp = netdev_priv(ndev);
4026         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4027         struct brcmf_pub *drvr = cfg->pub;
4028         s32 err;
4029         u32 npmk, i;
4030
4031         brcmf_dbg(TRACE, "Enter\n");
4032         if (!check_vif_up(ifp->vif))
4033                 return -EIO;
4034
4035         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4036
4037         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4038         for (i = 0; i < npmk; i++)
4039                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4040                         break;
4041
4042         if ((npmk > 0) && (i < npmk)) {
4043                 for (; i < (npmk - 1); i++) {
4044                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4045                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4046                                WLAN_PMKID_LEN);
4047                 }
4048                 memset(&pmk[i], 0, sizeof(*pmk));
4049                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4050         } else {
4051                 bphy_err(drvr, "Cache entry not found\n");
4052                 return -EINVAL;
4053         }
4054
4055         err = brcmf_update_pmklist(cfg, ifp);
4056
4057         brcmf_dbg(TRACE, "Exit\n");
4058         return err;
4059
4060 }
4061
4062 static s32
4063 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4064 {
4065         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4066         struct brcmf_if *ifp = netdev_priv(ndev);
4067         s32 err;
4068
4069         brcmf_dbg(TRACE, "Enter\n");
4070         if (!check_vif_up(ifp->vif))
4071                 return -EIO;
4072
4073         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4074         err = brcmf_update_pmklist(cfg, ifp);
4075
4076         brcmf_dbg(TRACE, "Exit\n");
4077         return err;
4078
4079 }
4080
4081 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4082 {
4083         struct brcmf_pub *drvr = ifp->drvr;
4084         s32 err;
4085         s32 wpa_val;
4086
4087         /* set auth */
4088         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4089         if (err < 0) {
4090                 bphy_err(drvr, "auth error %d\n", err);
4091                 return err;
4092         }
4093         /* set wsec */
4094         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4095         if (err < 0) {
4096                 bphy_err(drvr, "wsec error %d\n", err);
4097                 return err;
4098         }
4099         /* set upper-layer auth */
4100         if (brcmf_is_ibssmode(ifp->vif))
4101                 wpa_val = WPA_AUTH_NONE;
4102         else
4103                 wpa_val = WPA_AUTH_DISABLED;
4104         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4105         if (err < 0) {
4106                 bphy_err(drvr, "wpa_auth error %d\n", err);
4107                 return err;
4108         }
4109
4110         return 0;
4111 }
4112
4113 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4114 {
4115         if (is_rsn_ie)
4116                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4117
4118         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4119 }
4120
4121 static s32
4122 brcmf_configure_wpaie(struct brcmf_if *ifp,
4123                       const struct brcmf_vs_tlv *wpa_ie,
4124                       bool is_rsn_ie)
4125 {
4126         struct brcmf_pub *drvr = ifp->drvr;
4127         u32 auth = 0; /* d11 open authentication */
4128         u16 count;
4129         s32 err = 0;
4130         s32 len;
4131         u32 i;
4132         u32 wsec;
4133         u32 pval = 0;
4134         u32 gval = 0;
4135         u32 wpa_auth = 0;
4136         u32 offset;
4137         u8 *data;
4138         u16 rsn_cap;
4139         u32 wme_bss_disable;
4140         u32 mfp;
4141
4142         brcmf_dbg(TRACE, "Enter\n");
4143         if (wpa_ie == NULL)
4144                 goto exit;
4145
4146         len = wpa_ie->len + TLV_HDR_LEN;
4147         data = (u8 *)wpa_ie;
4148         offset = TLV_HDR_LEN;
4149         if (!is_rsn_ie)
4150                 offset += VS_IE_FIXED_HDR_LEN;
4151         else
4152                 offset += WPA_IE_VERSION_LEN;
4153
4154         /* check for multicast cipher suite */
4155         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4156                 err = -EINVAL;
4157                 bphy_err(drvr, "no multicast cipher suite\n");
4158                 goto exit;
4159         }
4160
4161         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4162                 err = -EINVAL;
4163                 bphy_err(drvr, "ivalid OUI\n");
4164                 goto exit;
4165         }
4166         offset += TLV_OUI_LEN;
4167
4168         /* pick up multicast cipher */
4169         switch (data[offset]) {
4170         case WPA_CIPHER_NONE:
4171                 gval = 0;
4172                 break;
4173         case WPA_CIPHER_WEP_40:
4174         case WPA_CIPHER_WEP_104:
4175                 gval = WEP_ENABLED;
4176                 break;
4177         case WPA_CIPHER_TKIP:
4178                 gval = TKIP_ENABLED;
4179                 break;
4180         case WPA_CIPHER_AES_CCM:
4181                 gval = AES_ENABLED;
4182                 break;
4183         default:
4184                 err = -EINVAL;
4185                 bphy_err(drvr, "Invalid multi cast cipher info\n");
4186                 goto exit;
4187         }
4188
4189         offset++;
4190         /* walk thru unicast cipher list and pick up what we recognize */
4191         count = data[offset] + (data[offset + 1] << 8);
4192         offset += WPA_IE_SUITE_COUNT_LEN;
4193         /* Check for unicast suite(s) */
4194         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4195                 err = -EINVAL;
4196                 bphy_err(drvr, "no unicast cipher suite\n");
4197                 goto exit;
4198         }
4199         for (i = 0; i < count; i++) {
4200                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4201                         err = -EINVAL;
4202                         bphy_err(drvr, "ivalid OUI\n");
4203                         goto exit;
4204                 }
4205                 offset += TLV_OUI_LEN;
4206                 switch (data[offset]) {
4207                 case WPA_CIPHER_NONE:
4208                         break;
4209                 case WPA_CIPHER_WEP_40:
4210                 case WPA_CIPHER_WEP_104:
4211                         pval |= WEP_ENABLED;
4212                         break;
4213                 case WPA_CIPHER_TKIP:
4214                         pval |= TKIP_ENABLED;
4215                         break;
4216                 case WPA_CIPHER_AES_CCM:
4217                         pval |= AES_ENABLED;
4218                         break;
4219                 default:
4220                         bphy_err(drvr, "Invalid unicast security info\n");
4221                 }
4222                 offset++;
4223         }
4224         /* walk thru auth management suite list and pick up what we recognize */
4225         count = data[offset] + (data[offset + 1] << 8);
4226         offset += WPA_IE_SUITE_COUNT_LEN;
4227         /* Check for auth key management suite(s) */
4228         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4229                 err = -EINVAL;
4230                 bphy_err(drvr, "no auth key mgmt suite\n");
4231                 goto exit;
4232         }
4233         for (i = 0; i < count; i++) {
4234                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4235                         err = -EINVAL;
4236                         bphy_err(drvr, "ivalid OUI\n");
4237                         goto exit;
4238                 }
4239                 offset += TLV_OUI_LEN;
4240                 switch (data[offset]) {
4241                 case RSN_AKM_NONE:
4242                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4243                         wpa_auth |= WPA_AUTH_NONE;
4244                         break;
4245                 case RSN_AKM_UNSPECIFIED:
4246                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4247                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4248                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4249                         break;
4250                 case RSN_AKM_PSK:
4251                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4252                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4253                                     (wpa_auth |= WPA_AUTH_PSK);
4254                         break;
4255                 case RSN_AKM_SHA256_PSK:
4256                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4257                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4258                         break;
4259                 case RSN_AKM_SHA256_1X:
4260                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4261                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4262                         break;
4263                 case RSN_AKM_SAE:
4264                         brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4265                         wpa_auth |= WPA3_AUTH_SAE_PSK;
4266                         break;
4267                 default:
4268                         bphy_err(drvr, "Invalid key mgmt info\n");
4269                 }
4270                 offset++;
4271         }
4272
4273         mfp = BRCMF_MFP_NONE;
4274         if (is_rsn_ie) {
4275                 wme_bss_disable = 1;
4276                 if ((offset + RSN_CAP_LEN) <= len) {
4277                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4278                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4279                                 wme_bss_disable = 0;
4280                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4281                                 brcmf_dbg(TRACE, "MFP Required\n");
4282                                 mfp = BRCMF_MFP_REQUIRED;
4283                                 /* Firmware only supports mfp required in
4284                                  * combination with WPA2_AUTH_PSK_SHA256,
4285                                  * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4286                                  */
4287                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4288                                                   WPA2_AUTH_1X_SHA256 |
4289                                                   WPA3_AUTH_SAE_PSK))) {
4290                                         err = -EINVAL;
4291                                         goto exit;
4292                                 }
4293                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4294                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4295                                  * is to be included in the rsn ie.
4296                                  */
4297                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4298                                         wpa_auth |= WPA2_AUTH_PSK;
4299                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4300                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4301                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4302                                 brcmf_dbg(TRACE, "MFP Capable\n");
4303                                 mfp = BRCMF_MFP_CAPABLE;
4304                         }
4305                 }
4306                 offset += RSN_CAP_LEN;
4307                 /* set wme_bss_disable to sync RSN Capabilities */
4308                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4309                                                wme_bss_disable);
4310                 if (err < 0) {
4311                         bphy_err(drvr, "wme_bss_disable error %d\n", err);
4312                         goto exit;
4313                 }
4314
4315                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4316                 offset += RSN_PMKID_COUNT_LEN;
4317
4318                 /* See if there is BIP wpa suite left for MFP */
4319                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4320                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4321                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4322                                                         &data[offset],
4323                                                         WPA_IE_MIN_OUI_LEN);
4324                         if (err < 0) {
4325                                 bphy_err(drvr, "bip error %d\n", err);
4326                                 goto exit;
4327                         }
4328                 }
4329         }
4330         /* FOR WPS , set SES_OW_ENABLED */
4331         wsec = (pval | gval | SES_OW_ENABLED);
4332
4333         /* set auth */
4334         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4335         if (err < 0) {
4336                 bphy_err(drvr, "auth error %d\n", err);
4337                 goto exit;
4338         }
4339         /* set wsec */
4340         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4341         if (err < 0) {
4342                 bphy_err(drvr, "wsec error %d\n", err);
4343                 goto exit;
4344         }
4345         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4346          * will overwrite the values set by MFP
4347          */
4348         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4349                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4350                 if (err < 0) {
4351                         bphy_err(drvr, "mfp error %d\n", err);
4352                         goto exit;
4353                 }
4354         }
4355         /* set upper-layer auth */
4356         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4357         if (err < 0) {
4358                 bphy_err(drvr, "wpa_auth error %d\n", err);
4359                 goto exit;
4360         }
4361
4362 exit:
4363         return err;
4364 }
4365
4366 static s32
4367 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4368                      struct parsed_vndr_ies *vndr_ies)
4369 {
4370         struct brcmf_vs_tlv *vndrie;
4371         struct brcmf_tlv *ie;
4372         struct parsed_vndr_ie_info *parsed_info;
4373         s32 remaining_len;
4374
4375         remaining_len = (s32)vndr_ie_len;
4376         memset(vndr_ies, 0, sizeof(*vndr_ies));
4377
4378         ie = (struct brcmf_tlv *)vndr_ie_buf;
4379         while (ie) {
4380                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4381                         goto next;
4382                 vndrie = (struct brcmf_vs_tlv *)ie;
4383                 /* len should be bigger than OUI length + one */
4384                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4385                         brcmf_err("invalid vndr ie. length is too small %d\n",
4386                                   vndrie->len);
4387                         goto next;
4388                 }
4389                 /* if wpa or wme ie, do not add ie */
4390                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4391                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4392                     (vndrie->oui_type == WME_OUI_TYPE))) {
4393                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4394                         goto next;
4395                 }
4396
4397                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4398
4399                 /* save vndr ie information */
4400                 parsed_info->ie_ptr = (char *)vndrie;
4401                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4402                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4403
4404                 vndr_ies->count++;
4405
4406                 brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4407                           parsed_info->vndrie.oui,
4408                           parsed_info->vndrie.oui_type);
4409
4410                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4411                         break;
4412 next:
4413                 remaining_len -= (ie->len + TLV_HDR_LEN);
4414                 if (remaining_len <= TLV_HDR_LEN)
4415                         ie = NULL;
4416                 else
4417                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4418                                 TLV_HDR_LEN);
4419         }
4420         return 0;
4421 }
4422
4423 static u32
4424 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4425 {
4426         strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4427
4428         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4429
4430         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4431
4432         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4433
4434         return ie_len + VNDR_IE_HDR_SIZE;
4435 }
4436
4437 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4438                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4439 {
4440         struct brcmf_pub *drvr;
4441         struct brcmf_if *ifp;
4442         struct vif_saved_ie *saved_ie;
4443         s32 err = 0;
4444         u8  *iovar_ie_buf;
4445         u8  *curr_ie_buf;
4446         u8  *mgmt_ie_buf = NULL;
4447         int mgmt_ie_buf_len;
4448         u32 *mgmt_ie_len;
4449         u32 del_add_ie_buf_len = 0;
4450         u32 total_ie_buf_len = 0;
4451         u32 parsed_ie_buf_len = 0;
4452         struct parsed_vndr_ies old_vndr_ies;
4453         struct parsed_vndr_ies new_vndr_ies;
4454         struct parsed_vndr_ie_info *vndrie_info;
4455         s32 i;
4456         u8 *ptr;
4457         int remained_buf_len;
4458
4459         if (!vif)
4460                 return -ENODEV;
4461         ifp = vif->ifp;
4462         drvr = ifp->drvr;
4463         saved_ie = &vif->saved_ie;
4464
4465         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4466                   pktflag);
4467         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4468         if (!iovar_ie_buf)
4469                 return -ENOMEM;
4470         curr_ie_buf = iovar_ie_buf;
4471         switch (pktflag) {
4472         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4473                 mgmt_ie_buf = saved_ie->probe_req_ie;
4474                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4475                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4476                 break;
4477         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4478                 mgmt_ie_buf = saved_ie->probe_res_ie;
4479                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4480                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4481                 break;
4482         case BRCMF_VNDR_IE_BEACON_FLAG:
4483                 mgmt_ie_buf = saved_ie->beacon_ie;
4484                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4485                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4486                 break;
4487         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4488                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4489                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4490                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4491                 break;
4492         case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4493                 mgmt_ie_buf = saved_ie->assoc_res_ie;
4494                 mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4495                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4496                 break;
4497         default:
4498                 err = -EPERM;
4499                 bphy_err(drvr, "not suitable type\n");
4500                 goto exit;
4501         }
4502
4503         if (vndr_ie_len > mgmt_ie_buf_len) {
4504                 err = -ENOMEM;
4505                 bphy_err(drvr, "extra IE size too big\n");
4506                 goto exit;
4507         }
4508
4509         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4510         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4511                 ptr = curr_ie_buf;
4512                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4513                 for (i = 0; i < new_vndr_ies.count; i++) {
4514                         vndrie_info = &new_vndr_ies.ie_info[i];
4515                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4516                                vndrie_info->ie_len);
4517                         parsed_ie_buf_len += vndrie_info->ie_len;
4518                 }
4519         }
4520
4521         if (mgmt_ie_buf && *mgmt_ie_len) {
4522                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4523                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4524                             parsed_ie_buf_len) == 0)) {
4525                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4526                         goto exit;
4527                 }
4528
4529                 /* parse old vndr_ie */
4530                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4531
4532                 /* make a command to delete old ie */
4533                 for (i = 0; i < old_vndr_ies.count; i++) {
4534                         vndrie_info = &old_vndr_ies.ie_info[i];
4535
4536                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4537                                   vndrie_info->vndrie.id,
4538                                   vndrie_info->vndrie.len,
4539                                   vndrie_info->vndrie.oui);
4540
4541                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4542                                                            vndrie_info->ie_ptr,
4543                                                            vndrie_info->ie_len,
4544                                                            "del");
4545                         curr_ie_buf += del_add_ie_buf_len;
4546                         total_ie_buf_len += del_add_ie_buf_len;
4547                 }
4548         }
4549
4550         *mgmt_ie_len = 0;
4551         /* Add if there is any extra IE */
4552         if (mgmt_ie_buf && parsed_ie_buf_len) {
4553                 ptr = mgmt_ie_buf;
4554
4555                 remained_buf_len = mgmt_ie_buf_len;
4556
4557                 /* make a command to add new ie */
4558                 for (i = 0; i < new_vndr_ies.count; i++) {
4559                         vndrie_info = &new_vndr_ies.ie_info[i];
4560
4561                         /* verify remained buf size before copy data */
4562                         if (remained_buf_len < (vndrie_info->vndrie.len +
4563                                                         VNDR_IE_VSIE_OFFSET)) {
4564                                 bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4565                                          remained_buf_len);
4566                                 break;
4567                         }
4568                         remained_buf_len -= (vndrie_info->ie_len +
4569                                              VNDR_IE_VSIE_OFFSET);
4570
4571                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4572                                   vndrie_info->vndrie.id,
4573                                   vndrie_info->vndrie.len,
4574                                   vndrie_info->vndrie.oui);
4575
4576                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4577                                                            vndrie_info->ie_ptr,
4578                                                            vndrie_info->ie_len,
4579                                                            "add");
4580
4581                         /* save the parsed IE in wl struct */
4582                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4583                                vndrie_info->ie_len);
4584                         *mgmt_ie_len += vndrie_info->ie_len;
4585
4586                         curr_ie_buf += del_add_ie_buf_len;
4587                         total_ie_buf_len += del_add_ie_buf_len;
4588                 }
4589         }
4590         if (total_ie_buf_len) {
4591                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4592                                                  total_ie_buf_len);
4593                 if (err)
4594                         bphy_err(drvr, "vndr ie set error : %d\n", err);
4595         }
4596
4597 exit:
4598         kfree(iovar_ie_buf);
4599         return err;
4600 }
4601
4602 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4603 {
4604         s32 pktflags[] = {
4605                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4606                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4607                 BRCMF_VNDR_IE_BEACON_FLAG
4608         };
4609         int i;
4610
4611         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4612                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4613
4614         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4615         return 0;
4616 }
4617
4618 static s32
4619 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4620                         struct cfg80211_beacon_data *beacon)
4621 {
4622         struct brcmf_pub *drvr = vif->ifp->drvr;
4623         s32 err;
4624
4625         /* Set Beacon IEs to FW */
4626         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4627                                     beacon->tail, beacon->tail_len);
4628         if (err) {
4629                 bphy_err(drvr, "Set Beacon IE Failed\n");
4630                 return err;
4631         }
4632         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4633
4634         /* Set Probe Response IEs to FW */
4635         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4636                                     beacon->proberesp_ies,
4637                                     beacon->proberesp_ies_len);
4638         if (err)
4639                 bphy_err(drvr, "Set Probe Resp IE Failed\n");
4640         else
4641                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4642
4643         /* Set Assoc Response IEs to FW */
4644         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
4645                                     beacon->assocresp_ies,
4646                                     beacon->assocresp_ies_len);
4647         if (err)
4648                 brcmf_err("Set Assoc Resp IE Failed\n");
4649         else
4650                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
4651
4652         return err;
4653 }
4654
4655 static s32
4656 brcmf_parse_configure_security(struct brcmf_if *ifp,
4657                                struct cfg80211_ap_settings *settings,
4658                                enum nl80211_iftype dev_role)
4659 {
4660         const struct brcmf_tlv *rsn_ie;
4661         const struct brcmf_vs_tlv *wpa_ie;
4662         s32 err = 0;
4663
4664         /* find the RSN_IE */
4665         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4666                                   settings->beacon.tail_len, WLAN_EID_RSN);
4667
4668         /* find the WPA_IE */
4669         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4670                                   settings->beacon.tail_len);
4671
4672         if (wpa_ie || rsn_ie) {
4673                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4674                 if (wpa_ie) {
4675                         /* WPA IE */
4676                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4677                         if (err < 0)
4678                                 return err;
4679                 } else {
4680                         struct brcmf_vs_tlv *tmp_ie;
4681
4682                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4683
4684                         /* RSN IE */
4685                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4686                         if (err < 0)
4687                                 return err;
4688                 }
4689         } else {
4690                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4691                 brcmf_configure_opensecurity(ifp);
4692         }
4693
4694         return err;
4695 }
4696
4697 static s32
4698 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4699                         struct cfg80211_ap_settings *settings)
4700 {
4701         s32 ie_offset;
4702         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4703         struct brcmf_if *ifp = netdev_priv(ndev);
4704         struct brcmf_pub *drvr = cfg->pub;
4705         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4706         struct cfg80211_crypto_settings *crypto = &settings->crypto;
4707         const struct brcmf_tlv *ssid_ie;
4708         const struct brcmf_tlv *country_ie;
4709         struct brcmf_ssid_le ssid_le;
4710         s32 err = -EPERM;
4711         struct brcmf_join_params join_params;
4712         enum nl80211_iftype dev_role;
4713         struct brcmf_fil_bss_enable_le bss_enable;
4714         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4715         bool mbss;
4716         int is_11d;
4717         bool supports_11d;
4718
4719         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4720                   settings->chandef.chan->hw_value,
4721                   settings->chandef.center_freq1, settings->chandef.width,
4722                   settings->beacon_interval, settings->dtim_period);
4723         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4724                   settings->ssid, settings->ssid_len, settings->auth_type,
4725                   settings->inactivity_timeout);
4726         dev_role = ifp->vif->wdev.iftype;
4727         mbss = ifp->vif->mbss;
4728
4729         /* store current 11d setting */
4730         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4731                                   &ifp->vif->is_11d)) {
4732                 is_11d = supports_11d = false;
4733         } else {
4734                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4735                                               settings->beacon.tail_len,
4736                                               WLAN_EID_COUNTRY);
4737                 is_11d = country_ie ? 1 : 0;
4738                 supports_11d = true;
4739         }
4740
4741         memset(&ssid_le, 0, sizeof(ssid_le));
4742         if (settings->ssid == NULL || settings->ssid_len == 0) {
4743                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4744                 ssid_ie = brcmf_parse_tlvs(
4745                                 (u8 *)&settings->beacon.head[ie_offset],
4746                                 settings->beacon.head_len - ie_offset,
4747                                 WLAN_EID_SSID);
4748                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4749                         return -EINVAL;
4750
4751                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4752                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4753                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4754         } else {
4755                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4756                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4757         }
4758
4759         if (!mbss) {
4760                 brcmf_set_mpc(ifp, 0);
4761                 brcmf_configure_arp_nd_offload(ifp, false);
4762         }
4763
4764         /* Parameters shared by all radio interfaces */
4765         if (!mbss) {
4766                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4767                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4768                                                     is_11d);
4769                         if (err < 0) {
4770                                 bphy_err(drvr, "Regulatory Set Error, %d\n",
4771                                          err);
4772                                 goto exit;
4773                         }
4774                 }
4775                 if (settings->beacon_interval) {
4776                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4777                                                     settings->beacon_interval);
4778                         if (err < 0) {
4779                                 bphy_err(drvr, "Beacon Interval Set Error, %d\n",
4780                                          err);
4781                                 goto exit;
4782                         }
4783                 }
4784                 if (settings->dtim_period) {
4785                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4786                                                     settings->dtim_period);
4787                         if (err < 0) {
4788                                 bphy_err(drvr, "DTIM Interval Set Error, %d\n",
4789                                          err);
4790                                 goto exit;
4791                         }
4792                 }
4793
4794                 if ((dev_role == NL80211_IFTYPE_AP) &&
4795                     ((ifp->ifidx == 0) ||
4796                      (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
4797                       !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
4798                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4799                         if (err < 0) {
4800                                 bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
4801                                          err);
4802                                 goto exit;
4803                         }
4804                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4805                 }
4806
4807                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4808                 if (err < 0) {
4809                         bphy_err(drvr, "SET INFRA error %d\n", err);
4810                         goto exit;
4811                 }
4812         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4813                 /* Multiple-BSS should use same 11d configuration */
4814                 err = -EINVAL;
4815                 goto exit;
4816         }
4817
4818         /* Interface specific setup */
4819         if (dev_role == NL80211_IFTYPE_AP) {
4820                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4821                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4822
4823                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4824                 if (err < 0) {
4825                         bphy_err(drvr, "setting AP mode failed %d\n",
4826                                  err);
4827                         goto exit;
4828                 }
4829                 if (!mbss) {
4830                         /* Firmware 10.x requires setting channel after enabling
4831                          * AP and before bringing interface up.
4832                          */
4833                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4834                         if (err < 0) {
4835                                 bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
4836                                          chanspec, err);
4837                                 goto exit;
4838                         }
4839                 }
4840                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4841                 if (err < 0) {
4842                         bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
4843                         goto exit;
4844                 }
4845
4846                 if (crypto->psk) {
4847                         brcmf_dbg(INFO, "using PSK offload\n");
4848                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
4849                         err = brcmf_set_pmk(ifp, crypto->psk,
4850                                             BRCMF_WSEC_MAX_PSK_LEN);
4851                         if (err < 0)
4852                                 goto exit;
4853                 }
4854                 if (crypto->sae_pwd) {
4855                         brcmf_dbg(INFO, "using SAE offload\n");
4856                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
4857                         err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
4858                                                      crypto->sae_pwd_len);
4859                         if (err < 0)
4860                                 goto exit;
4861                 }
4862                 if (profile->use_fwauth == 0)
4863                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
4864
4865                 err = brcmf_parse_configure_security(ifp, settings,
4866                                                      NL80211_IFTYPE_AP);
4867                 if (err < 0) {
4868                         bphy_err(drvr, "brcmf_parse_configure_security error\n");
4869                         goto exit;
4870                 }
4871
4872                 /* On DOWN the firmware removes the WEP keys, reconfigure
4873                  * them if they were set.
4874                  */
4875                 brcmf_cfg80211_reconfigure_wep(ifp);
4876
4877                 memset(&join_params, 0, sizeof(join_params));
4878                 /* join parameters starts with ssid */
4879                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4880                 /* create softap */
4881                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4882                                              &join_params, sizeof(join_params));
4883                 if (err < 0) {
4884                         bphy_err(drvr, "SET SSID error (%d)\n", err);
4885                         goto exit;
4886                 }
4887
4888                 err = brcmf_fil_iovar_int_set(ifp, "closednet",
4889                                               settings->hidden_ssid);
4890                 if (err) {
4891                         bphy_err(drvr, "%s closednet error (%d)\n",
4892                                  settings->hidden_ssid ?
4893                                  "enabled" : "disabled",
4894                                  err);
4895                         goto exit;
4896                 }
4897
4898                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4899         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4900                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4901                 if (err < 0) {
4902                         bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
4903                                  chanspec, err);
4904                         goto exit;
4905                 }
4906
4907                 err = brcmf_parse_configure_security(ifp, settings,
4908                                                      NL80211_IFTYPE_P2P_GO);
4909                 if (err < 0) {
4910                         brcmf_err("brcmf_parse_configure_security error\n");
4911                         goto exit;
4912                 }
4913
4914                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4915                                                 sizeof(ssid_le));
4916                 if (err < 0) {
4917                         bphy_err(drvr, "setting ssid failed %d\n", err);
4918                         goto exit;
4919                 }
4920                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4921                 bss_enable.enable = cpu_to_le32(1);
4922                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4923                                                sizeof(bss_enable));
4924                 if (err < 0) {
4925                         bphy_err(drvr, "bss_enable config failed %d\n", err);
4926                         goto exit;
4927                 }
4928
4929                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4930         } else {
4931                 WARN_ON(1);
4932         }
4933
4934         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4935         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4936         brcmf_net_setcarrier(ifp, true);
4937
4938 exit:
4939         if ((err) && (!mbss)) {
4940                 brcmf_set_mpc(ifp, 1);
4941                 brcmf_configure_arp_nd_offload(ifp, true);
4942         }
4943         return err;
4944 }
4945
4946 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4947 {
4948         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4949         struct brcmf_if *ifp = netdev_priv(ndev);
4950         struct brcmf_pub *drvr = cfg->pub;
4951         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4952         s32 err;
4953         struct brcmf_fil_bss_enable_le bss_enable;
4954         struct brcmf_join_params join_params;
4955
4956         brcmf_dbg(TRACE, "Enter\n");
4957
4958         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4959                 /* Due to most likely deauths outstanding we sleep */
4960                 /* first to make sure they get processed by fw. */
4961                 msleep(400);
4962
4963                 if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
4964                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
4965                                 brcmf_set_pmk(ifp, NULL, 0);
4966                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
4967                                 brcmf_set_sae_password(ifp, NULL, 0);
4968                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
4969                 }
4970
4971                 if (ifp->vif->mbss) {
4972                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4973                         return err;
4974                 }
4975
4976                 /* First BSS doesn't get a full reset */
4977                 if (ifp->bsscfgidx == 0)
4978                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4979
4980                 memset(&join_params, 0, sizeof(join_params));
4981                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4982                                              &join_params, sizeof(join_params));
4983                 if (err < 0)
4984                         bphy_err(drvr, "SET SSID error (%d)\n", err);
4985                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4986                 if (err < 0)
4987                         bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
4988                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4989                 if (err < 0)
4990                         bphy_err(drvr, "setting AP mode failed %d\n", err);
4991                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4992                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4993                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4994                                       ifp->vif->is_11d);
4995                 /* Bring device back up so it can be used again */
4996                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4997                 if (err < 0)
4998                         bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
4999
5000                 brcmf_vif_clear_mgmt_ies(ifp->vif);
5001         } else {
5002                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5003                 bss_enable.enable = cpu_to_le32(0);
5004                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5005                                                sizeof(bss_enable));
5006                 if (err < 0)
5007                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5008         }
5009         brcmf_set_mpc(ifp, 1);
5010         brcmf_configure_arp_nd_offload(ifp, true);
5011         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5012         brcmf_net_setcarrier(ifp, false);
5013
5014         return err;
5015 }
5016
5017 static s32
5018 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5019                              struct cfg80211_beacon_data *info)
5020 {
5021         struct brcmf_if *ifp = netdev_priv(ndev);
5022         s32 err;
5023
5024         brcmf_dbg(TRACE, "Enter\n");
5025
5026         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
5027
5028         return err;
5029 }
5030
5031 static int
5032 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5033                            struct station_del_parameters *params)
5034 {
5035         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5036         struct brcmf_pub *drvr = cfg->pub;
5037         struct brcmf_scb_val_le scbval;
5038         struct brcmf_if *ifp = netdev_priv(ndev);
5039         s32 err;
5040
5041         if (!params->mac)
5042                 return -EFAULT;
5043
5044         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5045
5046         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5047                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5048         if (!check_vif_up(ifp->vif))
5049                 return -EIO;
5050
5051         memcpy(&scbval.ea, params->mac, ETH_ALEN);
5052         scbval.val = cpu_to_le32(params->reason_code);
5053         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5054                                      &scbval, sizeof(scbval));
5055         if (err)
5056                 bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5057                          err);
5058
5059         brcmf_dbg(TRACE, "Exit\n");
5060         return err;
5061 }
5062
5063 static int
5064 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5065                               const u8 *mac, struct station_parameters *params)
5066 {
5067         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5068         struct brcmf_pub *drvr = cfg->pub;
5069         struct brcmf_if *ifp = netdev_priv(ndev);
5070         s32 err;
5071
5072         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5073                   params->sta_flags_mask, params->sta_flags_set);
5074
5075         /* Ignore all 00 MAC */
5076         if (is_zero_ether_addr(mac))
5077                 return 0;
5078
5079         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5080                 return 0;
5081
5082         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5083                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5084                                              (void *)mac, ETH_ALEN);
5085         else
5086                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5087                                              (void *)mac, ETH_ALEN);
5088         if (err < 0)
5089                 bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5090
5091         return err;
5092 }
5093
5094 static void
5095 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5096                                                struct wireless_dev *wdev,
5097                                                struct mgmt_frame_regs *upd)
5098 {
5099         struct brcmf_cfg80211_vif *vif;
5100
5101         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5102
5103         vif->mgmt_rx_reg = upd->interface_stypes;
5104 }
5105
5106
5107 static int
5108 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5109                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5110 {
5111         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5112         struct ieee80211_channel *chan = params->chan;
5113         struct brcmf_pub *drvr = cfg->pub;
5114         const u8 *buf = params->buf;
5115         size_t len = params->len;
5116         const struct ieee80211_mgmt *mgmt;
5117         struct brcmf_cfg80211_vif *vif;
5118         s32 err = 0;
5119         s32 ie_offset;
5120         s32 ie_len;
5121         struct brcmf_fil_action_frame_le *action_frame;
5122         struct brcmf_fil_af_params_le *af_params;
5123         bool ack;
5124         s32 chan_nr;
5125         u32 freq;
5126
5127         brcmf_dbg(TRACE, "Enter\n");
5128
5129         *cookie = 0;
5130
5131         mgmt = (const struct ieee80211_mgmt *)buf;
5132
5133         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5134                 bphy_err(drvr, "Driver only allows MGMT packet type\n");
5135                 return -EPERM;
5136         }
5137
5138         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5139
5140         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5141                 /* Right now the only reason to get a probe response */
5142                 /* is for p2p listen response or for p2p GO from     */
5143                 /* wpa_supplicant. Unfortunately the probe is send   */
5144                 /* on primary ndev, while dongle wants it on the p2p */
5145                 /* vif. Since this is only reason for a probe        */
5146                 /* response to be sent, the vif is taken from cfg.   */
5147                 /* If ever desired to send proberesp for non p2p     */
5148                 /* response then data should be checked for          */
5149                 /* "DIRECT-". Note in future supplicant will take    */
5150                 /* dedicated p2p wdev to do this and then this 'hack'*/
5151                 /* is not needed anymore.                            */
5152                 ie_offset =  DOT11_MGMT_HDR_LEN +
5153                              DOT11_BCN_PRB_FIXED_LEN;
5154                 ie_len = len - ie_offset;
5155                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5156                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5157                 err = brcmf_vif_set_mgmt_ie(vif,
5158                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
5159                                             &buf[ie_offset],
5160                                             ie_len);
5161                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5162                                         GFP_KERNEL);
5163         } else if (ieee80211_is_action(mgmt->frame_control)) {
5164                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5165                         bphy_err(drvr, "invalid action frame length\n");
5166                         err = -EINVAL;
5167                         goto exit;
5168                 }
5169                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5170                 if (af_params == NULL) {
5171                         bphy_err(drvr, "unable to allocate frame\n");
5172                         err = -ENOMEM;
5173                         goto exit;
5174                 }
5175                 action_frame = &af_params->action_frame;
5176                 /* Add the packet Id */
5177                 action_frame->packet_id = cpu_to_le32(*cookie);
5178                 /* Add BSSID */
5179                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5180                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5181                 /* Add the length exepted for 802.11 header  */
5182                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5183                 /* Add the channel. Use the one specified as parameter if any or
5184                  * the current one (got from the firmware) otherwise
5185                  */
5186                 if (chan)
5187                         freq = chan->center_freq;
5188                 else
5189                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5190                                               &freq);
5191                 chan_nr = ieee80211_frequency_to_channel(freq);
5192                 af_params->channel = cpu_to_le32(chan_nr);
5193                 af_params->dwell_time = cpu_to_le32(params->wait);
5194                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5195                        le16_to_cpu(action_frame->len));
5196
5197                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5198                           *cookie, le16_to_cpu(action_frame->len), freq);
5199
5200                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5201                                                   af_params);
5202
5203                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5204                                         GFP_KERNEL);
5205                 kfree(af_params);
5206         } else {
5207                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5208                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5209         }
5210
5211 exit:
5212         return err;
5213 }
5214
5215 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5216                                                     struct net_device *ndev,
5217                                                     s32 rssi_low, s32 rssi_high)
5218 {
5219         struct brcmf_cfg80211_vif *vif;
5220         struct brcmf_if *ifp;
5221         int err = 0;
5222
5223         brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5224
5225         ifp = netdev_priv(ndev);
5226         vif = ifp->vif;
5227
5228         if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5229                 /* The firmware will send an event when the RSSI is less than or
5230                  * equal to a configured level and the previous RSSI event was
5231                  * less than or equal to a different level. Set a third level
5232                  * so that we also detect the transition from rssi <= rssi_high
5233                  * to rssi > rssi_high.
5234                  */
5235                 struct brcmf_rssi_event_le config = {
5236                         .rate_limit_msec = cpu_to_le32(0),
5237                         .rssi_level_num = 3,
5238                         .rssi_levels = {
5239                                 clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5240                                 clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5241                                 S8_MAX,
5242                         },
5243                 };
5244
5245                 err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5246                                                sizeof(config));
5247                 if (err) {
5248                         err = -EINVAL;
5249                 } else {
5250                         vif->cqm_rssi_low = rssi_low;
5251                         vif->cqm_rssi_high = rssi_high;
5252                 }
5253         }
5254
5255         return err;
5256 }
5257
5258 static int
5259 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5260                                         struct wireless_dev *wdev,
5261                                         u64 cookie)
5262 {
5263         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5264         struct brcmf_pub *drvr = cfg->pub;
5265         struct brcmf_cfg80211_vif *vif;
5266         int err = 0;
5267
5268         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5269
5270         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5271         if (vif == NULL) {
5272                 bphy_err(drvr, "No p2p device available for probe response\n");
5273                 err = -ENODEV;
5274                 goto exit;
5275         }
5276         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5277 exit:
5278         return err;
5279 }
5280
5281 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5282                                       struct wireless_dev *wdev,
5283                                       struct cfg80211_chan_def *chandef)
5284 {
5285         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5286         struct net_device *ndev = wdev->netdev;
5287         struct brcmf_pub *drvr = cfg->pub;
5288         struct brcmu_chan ch;
5289         enum nl80211_band band = 0;
5290         enum nl80211_chan_width width = 0;
5291         u32 chanspec;
5292         int freq, err;
5293
5294         if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5295                 return -ENODEV;
5296
5297         err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5298         if (err) {
5299                 bphy_err(drvr, "chanspec failed (%d)\n", err);
5300                 return err;
5301         }
5302
5303         ch.chspec = chanspec;
5304         cfg->d11inf.decchspec(&ch);
5305
5306         switch (ch.band) {
5307         case BRCMU_CHAN_BAND_2G:
5308                 band = NL80211_BAND_2GHZ;
5309                 break;
5310         case BRCMU_CHAN_BAND_5G:
5311                 band = NL80211_BAND_5GHZ;
5312                 break;
5313         }
5314
5315         switch (ch.bw) {
5316         case BRCMU_CHAN_BW_80:
5317                 width = NL80211_CHAN_WIDTH_80;
5318                 break;
5319         case BRCMU_CHAN_BW_40:
5320                 width = NL80211_CHAN_WIDTH_40;
5321                 break;
5322         case BRCMU_CHAN_BW_20:
5323                 width = NL80211_CHAN_WIDTH_20;
5324                 break;
5325         case BRCMU_CHAN_BW_80P80:
5326                 width = NL80211_CHAN_WIDTH_80P80;
5327                 break;
5328         case BRCMU_CHAN_BW_160:
5329                 width = NL80211_CHAN_WIDTH_160;
5330                 break;
5331         }
5332
5333         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5334         chandef->chan = ieee80211_get_channel(wiphy, freq);
5335         chandef->width = width;
5336         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5337         chandef->center_freq2 = 0;
5338
5339         return 0;
5340 }
5341
5342 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5343                                            struct wireless_dev *wdev,
5344                                            enum nl80211_crit_proto_id proto,
5345                                            u16 duration)
5346 {
5347         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5348         struct brcmf_cfg80211_vif *vif;
5349
5350         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5351
5352         /* only DHCP support for now */
5353         if (proto != NL80211_CRIT_PROTO_DHCP)
5354                 return -EINVAL;
5355
5356         /* suppress and abort scanning */
5357         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5358         brcmf_abort_scanning(cfg);
5359
5360         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5361 }
5362
5363 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5364                                            struct wireless_dev *wdev)
5365 {
5366         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5367         struct brcmf_cfg80211_vif *vif;
5368
5369         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5370
5371         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5372         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5373 }
5374
5375 static s32
5376 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5377                              const struct brcmf_event_msg *e, void *data)
5378 {
5379         switch (e->reason) {
5380         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5381                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5382                 break;
5383         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5384                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5385                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5386                 break;
5387         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5388                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5389                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5390                 break;
5391         }
5392
5393         return 0;
5394 }
5395
5396 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5397 {
5398         int ret;
5399
5400         switch (oper) {
5401         case NL80211_TDLS_DISCOVERY_REQ:
5402                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5403                 break;
5404         case NL80211_TDLS_SETUP:
5405                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5406                 break;
5407         case NL80211_TDLS_TEARDOWN:
5408                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5409                 break;
5410         default:
5411                 brcmf_err("unsupported operation: %d\n", oper);
5412                 ret = -EOPNOTSUPP;
5413         }
5414         return ret;
5415 }
5416
5417 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5418                                     struct net_device *ndev, const u8 *peer,
5419                                     enum nl80211_tdls_operation oper)
5420 {
5421         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5422         struct brcmf_pub *drvr = cfg->pub;
5423         struct brcmf_if *ifp;
5424         struct brcmf_tdls_iovar_le info;
5425         int ret = 0;
5426
5427         ret = brcmf_convert_nl80211_tdls_oper(oper);
5428         if (ret < 0)
5429                 return ret;
5430
5431         ifp = netdev_priv(ndev);
5432         memset(&info, 0, sizeof(info));
5433         info.mode = (u8)ret;
5434         if (peer)
5435                 memcpy(info.ea, peer, ETH_ALEN);
5436
5437         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5438                                        &info, sizeof(info));
5439         if (ret < 0)
5440                 bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5441
5442         return ret;
5443 }
5444
5445 static int
5446 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5447                                   struct net_device *ndev,
5448                                   struct cfg80211_connect_params *sme,
5449                                   u32 changed)
5450 {
5451         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5452         struct brcmf_pub *drvr = cfg->pub;
5453         struct brcmf_if *ifp;
5454         int err;
5455
5456         if (!(changed & UPDATE_ASSOC_IES))
5457                 return 0;
5458
5459         ifp = netdev_priv(ndev);
5460         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5461                                     sme->ie, sme->ie_len);
5462         if (err)
5463                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5464         else
5465                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5466
5467         return err;
5468 }
5469
5470 #ifdef CONFIG_PM
5471 static int
5472 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5473                               struct cfg80211_gtk_rekey_data *gtk)
5474 {
5475         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5476         struct brcmf_pub *drvr = cfg->pub;
5477         struct brcmf_if *ifp = netdev_priv(ndev);
5478         struct brcmf_gtk_keyinfo_le gtk_le;
5479         int ret;
5480
5481         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5482
5483         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5484         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5485         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5486                sizeof(gtk_le.replay_counter));
5487
5488         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5489                                        sizeof(gtk_le));
5490         if (ret < 0)
5491                 bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5492
5493         return ret;
5494 }
5495 #endif
5496
5497 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5498                                   const struct cfg80211_pmk_conf *conf)
5499 {
5500         struct brcmf_if *ifp;
5501
5502         brcmf_dbg(TRACE, "enter\n");
5503
5504         /* expect using firmware supplicant for 1X */
5505         ifp = netdev_priv(dev);
5506         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5507                 return -EINVAL;
5508
5509         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5510                 return -ERANGE;
5511
5512         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5513 }
5514
5515 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5516                                   const u8 *aa)
5517 {
5518         struct brcmf_if *ifp;
5519
5520         brcmf_dbg(TRACE, "enter\n");
5521         ifp = netdev_priv(dev);
5522         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5523                 return -EINVAL;
5524
5525         return brcmf_set_pmk(ifp, NULL, 0);
5526 }
5527
5528 static struct cfg80211_ops brcmf_cfg80211_ops = {
5529         .add_virtual_intf = brcmf_cfg80211_add_iface,
5530         .del_virtual_intf = brcmf_cfg80211_del_iface,
5531         .change_virtual_intf = brcmf_cfg80211_change_iface,
5532         .scan = brcmf_cfg80211_scan,
5533         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5534         .join_ibss = brcmf_cfg80211_join_ibss,
5535         .leave_ibss = brcmf_cfg80211_leave_ibss,
5536         .get_station = brcmf_cfg80211_get_station,
5537         .dump_station = brcmf_cfg80211_dump_station,
5538         .set_tx_power = brcmf_cfg80211_set_tx_power,
5539         .get_tx_power = brcmf_cfg80211_get_tx_power,
5540         .add_key = brcmf_cfg80211_add_key,
5541         .del_key = brcmf_cfg80211_del_key,
5542         .get_key = brcmf_cfg80211_get_key,
5543         .set_default_key = brcmf_cfg80211_config_default_key,
5544         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5545         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5546         .connect = brcmf_cfg80211_connect,
5547         .disconnect = brcmf_cfg80211_disconnect,
5548         .suspend = brcmf_cfg80211_suspend,
5549         .resume = brcmf_cfg80211_resume,
5550         .set_pmksa = brcmf_cfg80211_set_pmksa,
5551         .del_pmksa = brcmf_cfg80211_del_pmksa,
5552         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5553         .start_ap = brcmf_cfg80211_start_ap,
5554         .stop_ap = brcmf_cfg80211_stop_ap,
5555         .change_beacon = brcmf_cfg80211_change_beacon,
5556         .del_station = brcmf_cfg80211_del_station,
5557         .change_station = brcmf_cfg80211_change_station,
5558         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5559         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5560         .update_mgmt_frame_registrations =
5561                 brcmf_cfg80211_update_mgmt_frame_registrations,
5562         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5563         .set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
5564         .remain_on_channel = brcmf_p2p_remain_on_channel,
5565         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5566         .get_channel = brcmf_cfg80211_get_channel,
5567         .start_p2p_device = brcmf_p2p_start_device,
5568         .stop_p2p_device = brcmf_p2p_stop_device,
5569         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5570         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5571         .tdls_oper = brcmf_cfg80211_tdls_oper,
5572         .update_connect_params = brcmf_cfg80211_update_conn_params,
5573         .set_pmk = brcmf_cfg80211_set_pmk,
5574         .del_pmk = brcmf_cfg80211_del_pmk,
5575 };
5576
5577 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
5578 {
5579         struct cfg80211_ops *ops;
5580
5581         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5582                        GFP_KERNEL);
5583
5584         if (ops && settings->roamoff)
5585                 ops->update_connect_params = NULL;
5586
5587         return ops;
5588 }
5589
5590 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5591                                            enum nl80211_iftype type)
5592 {
5593         struct brcmf_cfg80211_vif *vif_walk;
5594         struct brcmf_cfg80211_vif *vif;
5595         bool mbss;
5596         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
5597
5598         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5599                   sizeof(*vif));
5600         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5601         if (!vif)
5602                 return ERR_PTR(-ENOMEM);
5603
5604         vif->wdev.wiphy = cfg->wiphy;
5605         vif->wdev.iftype = type;
5606
5607         brcmf_init_prof(&vif->profile);
5608
5609         if (type == NL80211_IFTYPE_AP &&
5610             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
5611                 mbss = false;
5612                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5613                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5614                                 mbss = true;
5615                                 break;
5616                         }
5617                 }
5618                 vif->mbss = mbss;
5619         }
5620
5621         list_add_tail(&vif->list, &cfg->vif_list);
5622         return vif;
5623 }
5624
5625 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5626 {
5627         list_del(&vif->list);
5628         kfree(vif);
5629 }
5630
5631 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5632 {
5633         struct brcmf_cfg80211_vif *vif;
5634         struct brcmf_if *ifp;
5635
5636         ifp = netdev_priv(ndev);
5637         vif = ifp->vif;
5638
5639         if (vif)
5640                 brcmf_free_vif(vif);
5641 }
5642
5643 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
5644                             const struct brcmf_event_msg *e)
5645 {
5646         u32 event = e->event_code;
5647         u32 status = e->status;
5648
5649         if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
5650              vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
5651             event == BRCMF_E_PSK_SUP &&
5652             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
5653                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5654         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5655                 brcmf_dbg(CONN, "Processing set ssid\n");
5656                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
5657                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
5658                     vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
5659                         return true;
5660
5661                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5662         }
5663
5664         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
5665             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
5666                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5667                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5668                 return true;
5669         }
5670         return false;
5671 }
5672
5673 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
5674                             const struct brcmf_event_msg *e)
5675 {
5676         u32 event = e->event_code;
5677         u16 flags = e->flags;
5678
5679         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5680             (event == BRCMF_E_DISASSOC_IND) ||
5681             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5682                 brcmf_dbg(CONN, "Processing link down\n");
5683                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5684                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5685                 return true;
5686         }
5687         return false;
5688 }
5689
5690 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5691                                const struct brcmf_event_msg *e)
5692 {
5693         u32 event = e->event_code;
5694         u32 status = e->status;
5695
5696         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5697                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5698                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5699                 return true;
5700         }
5701
5702         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5703                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5704                 return true;
5705         }
5706
5707         if (event == BRCMF_E_PSK_SUP &&
5708             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
5709                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
5710                           status);
5711                 return true;
5712         }
5713
5714         return false;
5715 }
5716
5717 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5718 {
5719         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5720
5721         kfree(conn_info->req_ie);
5722         conn_info->req_ie = NULL;
5723         conn_info->req_ie_len = 0;
5724         kfree(conn_info->resp_ie);
5725         conn_info->resp_ie = NULL;
5726         conn_info->resp_ie_len = 0;
5727 }
5728
5729 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
5730 {
5731         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
5732
5733         if (!cfg)
5734                 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
5735                        (prio ^ 2) : prio;
5736
5737         /* For those AC(s) with ACM flag set to 1, convert its 4-level priority
5738          * to an 8-level precedence which is the same as BE's
5739          */
5740         if (prio > PRIO_8021D_EE &&
5741             cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
5742                 return cfg->ac_priority[prio] * 2;
5743
5744         /* Conversion of 4-level priority to 8-level precedence */
5745         if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
5746             prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
5747                 return cfg->ac_priority[prio] * 2;
5748         else
5749                 return cfg->ac_priority[prio] * 2 + 1;
5750 }
5751
5752 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
5753 {
5754         /* Prio here refers to the 802.1d priority in range of 0 to 7.
5755          * ACI here refers to the WLAN AC Index in range of 0 to 3.
5756          * This function will return ACI corresponding to input prio.
5757          */
5758         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
5759
5760         if (cfg)
5761                 return cfg->ac_priority[prio];
5762
5763         return prio;
5764 }
5765
5766 static void brcmf_init_wmm_prio(u8 *priority)
5767 {
5768         /* Initialize AC priority array to default
5769          * 802.1d priority as per following table:
5770          * 802.1d prio 0,3 maps to BE
5771          * 802.1d prio 1,2 maps to BK
5772          * 802.1d prio 4,5 maps to VI
5773          * 802.1d prio 6,7 maps to VO
5774          */
5775         priority[0] = BRCMF_FWS_FIFO_AC_BE;
5776         priority[3] = BRCMF_FWS_FIFO_AC_BE;
5777         priority[1] = BRCMF_FWS_FIFO_AC_BK;
5778         priority[2] = BRCMF_FWS_FIFO_AC_BK;
5779         priority[4] = BRCMF_FWS_FIFO_AC_VI;
5780         priority[5] = BRCMF_FWS_FIFO_AC_VI;
5781         priority[6] = BRCMF_FWS_FIFO_AC_VO;
5782         priority[7] = BRCMF_FWS_FIFO_AC_VO;
5783 }
5784
5785 static void brcmf_wifi_prioritize_acparams(const
5786         struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
5787 {
5788         u8 aci;
5789         u8 aifsn;
5790         u8 ecwmin;
5791         u8 ecwmax;
5792         u8 acm;
5793         u8 ranking_basis[EDCF_AC_COUNT];
5794         u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
5795         u8 index;
5796
5797         for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
5798                 aifsn  = acp->ACI & EDCF_AIFSN_MASK;
5799                 acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
5800                 ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
5801                 ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
5802                 brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
5803                           aci, aifsn, acm, ecwmin, ecwmax);
5804                 /* Default AC_VO will be the lowest ranking value */
5805                 ranking_basis[aci] = aifsn + ecwmin + ecwmax;
5806                 /* Initialise priority starting at 0 (AC_BE) */
5807                 aci_prio[aci] = 0;
5808
5809                 /* If ACM is set, STA can't use this AC as per 802.11.
5810                  * Change the ranking to BE
5811                  */
5812                 if (aci != AC_BE && aci != AC_BK && acm == 1)
5813                         ranking_basis[aci] = ranking_basis[AC_BE];
5814         }
5815
5816         /* Ranking method which works for AC priority
5817          * swapping when values for cwmin, cwmax and aifsn are varied
5818          * Compare each aci_prio against each other aci_prio
5819          */
5820         for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
5821                 for (index = 0; index < EDCF_AC_COUNT; index++) {
5822                         if (index != aci) {
5823                                 /* Smaller ranking value has higher priority,
5824                                  * so increment priority for each ACI which has
5825                                  * a higher ranking value
5826                                  */
5827                                 if (ranking_basis[aci] < ranking_basis[index])
5828                                         aci_prio[aci]++;
5829                         }
5830                 }
5831         }
5832
5833         /* By now, aci_prio[] will be in range of 0 to 3.
5834          * Use ACI prio to get the new priority value for
5835          * each 802.1d traffic type, in this range.
5836          */
5837         if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
5838               aci_prio[AC_BK] == aci_prio[AC_VI] &&
5839               aci_prio[AC_VI] == aci_prio[AC_VO])) {
5840                 /* 802.1d 0,3 maps to BE */
5841                 priority[0] = aci_prio[AC_BE];
5842                 priority[3] = aci_prio[AC_BE];
5843
5844                 /* 802.1d 1,2 maps to BK */
5845                 priority[1] = aci_prio[AC_BK];
5846                 priority[2] = aci_prio[AC_BK];
5847
5848                 /* 802.1d 4,5 maps to VO */
5849                 priority[4] = aci_prio[AC_VI];
5850                 priority[5] = aci_prio[AC_VI];
5851
5852                 /* 802.1d 6,7 maps to VO */
5853                 priority[6] = aci_prio[AC_VO];
5854                 priority[7] = aci_prio[AC_VO];
5855         } else {
5856                 /* Initialize to default priority */
5857                 brcmf_init_wmm_prio(priority);
5858         }
5859
5860         brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
5861                   priority[0], priority[1], priority[2], priority[3]);
5862
5863         brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
5864                   priority[4], priority[5], priority[6], priority[7]);
5865 }
5866
5867 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5868                                struct brcmf_if *ifp)
5869 {
5870         struct brcmf_pub *drvr = cfg->pub;
5871         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5872         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5873         struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
5874         u32 req_len;
5875         u32 resp_len;
5876         s32 err = 0;
5877
5878         brcmf_clear_assoc_ies(cfg);
5879
5880         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5881                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5882         if (err) {
5883                 bphy_err(drvr, "could not get assoc info (%d)\n", err);
5884                 return err;
5885         }
5886         assoc_info =
5887                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5888         req_len = le32_to_cpu(assoc_info->req_len);
5889         resp_len = le32_to_cpu(assoc_info->resp_len);
5890         if (req_len) {
5891                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5892                                                cfg->extra_buf,
5893                                                WL_ASSOC_INFO_MAX);
5894                 if (err) {
5895                         bphy_err(drvr, "could not get assoc req (%d)\n", err);
5896                         return err;
5897                 }
5898                 conn_info->req_ie_len = req_len;
5899                 conn_info->req_ie =
5900                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5901                             GFP_KERNEL);
5902                 if (!conn_info->req_ie)
5903                         conn_info->req_ie_len = 0;
5904         } else {
5905                 conn_info->req_ie_len = 0;
5906                 conn_info->req_ie = NULL;
5907         }
5908         if (resp_len) {
5909                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5910                                                cfg->extra_buf,
5911                                                WL_ASSOC_INFO_MAX);
5912                 if (err) {
5913                         bphy_err(drvr, "could not get assoc resp (%d)\n", err);
5914                         return err;
5915                 }
5916                 conn_info->resp_ie_len = resp_len;
5917                 conn_info->resp_ie =
5918                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5919                             GFP_KERNEL);
5920                 if (!conn_info->resp_ie)
5921                         conn_info->resp_ie_len = 0;
5922
5923                 err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
5924                                                edcf_acparam_info,
5925                                                sizeof(edcf_acparam_info));
5926                 if (err) {
5927                         brcmf_err("could not get wme_ac_sta (%d)\n", err);
5928                         return err;
5929                 }
5930
5931                 brcmf_wifi_prioritize_acparams(edcf_acparam_info,
5932                                                cfg->ac_priority);
5933         } else {
5934                 conn_info->resp_ie_len = 0;
5935                 conn_info->resp_ie = NULL;
5936         }
5937         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5938                   conn_info->req_ie_len, conn_info->resp_ie_len);
5939
5940         return err;
5941 }
5942
5943 static s32
5944 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5945                        struct net_device *ndev,
5946                        const struct brcmf_event_msg *e)
5947 {
5948         struct brcmf_if *ifp = netdev_priv(ndev);
5949         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5950         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5951         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5952         struct ieee80211_channel *notify_channel = NULL;
5953         struct ieee80211_supported_band *band;
5954         struct brcmf_bss_info_le *bi;
5955         struct brcmu_chan ch;
5956         struct cfg80211_roam_info roam_info = {};
5957         u32 freq;
5958         s32 err = 0;
5959         u8 *buf;
5960
5961         brcmf_dbg(TRACE, "Enter\n");
5962
5963         brcmf_get_assoc_ies(cfg, ifp);
5964         memcpy(profile->bssid, e->addr, ETH_ALEN);
5965         brcmf_update_bss_info(cfg, ifp);
5966
5967         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5968         if (buf == NULL) {
5969                 err = -ENOMEM;
5970                 goto done;
5971         }
5972
5973         /* data sent to dongle has to be little endian */
5974         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5975         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5976                                      buf, WL_BSS_INFO_MAX);
5977
5978         if (err)
5979                 goto done;
5980
5981         bi = (struct brcmf_bss_info_le *)(buf + 4);
5982         ch.chspec = le16_to_cpu(bi->chanspec);
5983         cfg->d11inf.decchspec(&ch);
5984
5985         if (ch.band == BRCMU_CHAN_BAND_2G)
5986                 band = wiphy->bands[NL80211_BAND_2GHZ];
5987         else
5988                 band = wiphy->bands[NL80211_BAND_5GHZ];
5989
5990         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5991         notify_channel = ieee80211_get_channel(wiphy, freq);
5992
5993 done:
5994         kfree(buf);
5995
5996         roam_info.channel = notify_channel;
5997         roam_info.bssid = profile->bssid;
5998         roam_info.req_ie = conn_info->req_ie;
5999         roam_info.req_ie_len = conn_info->req_ie_len;
6000         roam_info.resp_ie = conn_info->resp_ie;
6001         roam_info.resp_ie_len = conn_info->resp_ie_len;
6002
6003         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6004         brcmf_dbg(CONN, "Report roaming result\n");
6005
6006         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6007                 cfg80211_port_authorized(ndev, profile->bssid, GFP_KERNEL);
6008                 brcmf_dbg(CONN, "Report port authorized\n");
6009         }
6010
6011         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6012         brcmf_dbg(TRACE, "Exit\n");
6013         return err;
6014 }
6015
6016 static s32
6017 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6018                        struct net_device *ndev, const struct brcmf_event_msg *e,
6019                        bool completed)
6020 {
6021         struct brcmf_if *ifp = netdev_priv(ndev);
6022         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6023         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6024         struct cfg80211_connect_resp_params conn_params;
6025
6026         brcmf_dbg(TRACE, "Enter\n");
6027
6028         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6029                                &ifp->vif->sme_state)) {
6030                 memset(&conn_params, 0, sizeof(conn_params));
6031                 if (completed) {
6032                         brcmf_get_assoc_ies(cfg, ifp);
6033                         brcmf_update_bss_info(cfg, ifp);
6034                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6035                                 &ifp->vif->sme_state);
6036                         conn_params.status = WLAN_STATUS_SUCCESS;
6037                 } else {
6038                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6039                 }
6040                 conn_params.bssid = profile->bssid;
6041                 conn_params.req_ie = conn_info->req_ie;
6042                 conn_params.req_ie_len = conn_info->req_ie_len;
6043                 conn_params.resp_ie = conn_info->resp_ie;
6044                 conn_params.resp_ie_len = conn_info->resp_ie_len;
6045                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6046                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
6047                           completed ? "succeeded" : "failed");
6048         }
6049         brcmf_dbg(TRACE, "Exit\n");
6050         return 0;
6051 }
6052
6053 static s32
6054 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6055                                struct net_device *ndev,
6056                                const struct brcmf_event_msg *e, void *data)
6057 {
6058         struct brcmf_pub *drvr = cfg->pub;
6059         static int generation;
6060         u32 event = e->event_code;
6061         u32 reason = e->reason;
6062         struct station_info *sinfo;
6063
6064         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6065                   brcmf_fweh_event_name(event), event, reason);
6066         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6067             ndev != cfg_to_ndev(cfg)) {
6068                 brcmf_dbg(CONN, "AP mode link down\n");
6069                 complete(&cfg->vif_disabled);
6070                 return 0;
6071         }
6072
6073         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6074             (reason == BRCMF_E_STATUS_SUCCESS)) {
6075                 if (!data) {
6076                         bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6077                         return -EINVAL;
6078                 }
6079
6080                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6081                 if (!sinfo)
6082                         return -ENOMEM;
6083
6084                 sinfo->assoc_req_ies = data;
6085                 sinfo->assoc_req_ies_len = e->datalen;
6086                 generation++;
6087                 sinfo->generation = generation;
6088                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6089
6090                 kfree(sinfo);
6091         } else if ((event == BRCMF_E_DISASSOC_IND) ||
6092                    (event == BRCMF_E_DEAUTH_IND) ||
6093                    (event == BRCMF_E_DEAUTH)) {
6094                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6095         }
6096         return 0;
6097 }
6098
6099 static s32
6100 brcmf_notify_connect_status(struct brcmf_if *ifp,
6101                             const struct brcmf_event_msg *e, void *data)
6102 {
6103         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6104         struct net_device *ndev = ifp->ndev;
6105         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6106         struct ieee80211_channel *chan;
6107         s32 err = 0;
6108
6109         if ((e->event_code == BRCMF_E_DEAUTH) ||
6110             (e->event_code == BRCMF_E_DEAUTH_IND) ||
6111             (e->event_code == BRCMF_E_DISASSOC_IND) ||
6112             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6113                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6114         }
6115
6116         if (brcmf_is_apmode(ifp->vif)) {
6117                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6118         } else if (brcmf_is_linkup(ifp->vif, e)) {
6119                 brcmf_dbg(CONN, "Linkup\n");
6120                 if (brcmf_is_ibssmode(ifp->vif)) {
6121                         brcmf_inform_ibss(cfg, ndev, e->addr);
6122                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6123                         memcpy(profile->bssid, e->addr, ETH_ALEN);
6124                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6125                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6126                                   &ifp->vif->sme_state);
6127                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6128                                 &ifp->vif->sme_state);
6129                 } else
6130                         brcmf_bss_connect_done(cfg, ndev, e, true);
6131                 brcmf_net_setcarrier(ifp, true);
6132         } else if (brcmf_is_linkdown(ifp->vif, e)) {
6133                 brcmf_dbg(CONN, "Linkdown\n");
6134                 if (!brcmf_is_ibssmode(ifp->vif) &&
6135                     test_bit(BRCMF_VIF_STATUS_CONNECTED,
6136                              &ifp->vif->sme_state)) {
6137                         if (memcmp(profile->bssid, e->addr, ETH_ALEN))
6138                                 return err;
6139
6140                         brcmf_bss_connect_done(cfg, ndev, e, false);
6141                         brcmf_link_down(ifp->vif,
6142                                         brcmf_map_fw_linkdown_reason(e),
6143                                         e->event_code &
6144                                         (BRCMF_E_DEAUTH_IND |
6145                                         BRCMF_E_DISASSOC_IND)
6146                                         ? false : true);
6147                         brcmf_init_prof(ndev_to_prof(ndev));
6148                         if (ndev != cfg_to_ndev(cfg))
6149                                 complete(&cfg->vif_disabled);
6150                         brcmf_net_setcarrier(ifp, false);
6151                 }
6152         } else if (brcmf_is_nonetwork(cfg, e)) {
6153                 if (brcmf_is_ibssmode(ifp->vif))
6154                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6155                                   &ifp->vif->sme_state);
6156                 else
6157                         brcmf_bss_connect_done(cfg, ndev, e, false);
6158         }
6159
6160         return err;
6161 }
6162
6163 static s32
6164 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6165                             const struct brcmf_event_msg *e, void *data)
6166 {
6167         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6168         u32 event = e->event_code;
6169         u32 status = e->status;
6170
6171         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6172                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6173                              &ifp->vif->sme_state)) {
6174                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6175                 } else {
6176                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6177                         brcmf_net_setcarrier(ifp, true);
6178                 }
6179         }
6180
6181         return 0;
6182 }
6183
6184 static s32
6185 brcmf_notify_mic_status(struct brcmf_if *ifp,
6186                         const struct brcmf_event_msg *e, void *data)
6187 {
6188         u16 flags = e->flags;
6189         enum nl80211_key_type key_type;
6190
6191         if (flags & BRCMF_EVENT_MSG_GROUP)
6192                 key_type = NL80211_KEYTYPE_GROUP;
6193         else
6194                 key_type = NL80211_KEYTYPE_PAIRWISE;
6195
6196         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6197                                      NULL, GFP_KERNEL);
6198
6199         return 0;
6200 }
6201
6202 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6203                              const struct brcmf_event_msg *e, void *data)
6204 {
6205         struct brcmf_cfg80211_vif *vif = ifp->vif;
6206         struct brcmf_rssi_be *info = data;
6207         s32 rssi, snr, noise;
6208         s32 low, high, last;
6209
6210         if (e->datalen < sizeof(*info)) {
6211                 brcmf_err("insufficient RSSI event data\n");
6212                 return 0;
6213         }
6214
6215         rssi = be32_to_cpu(info->rssi);
6216         snr = be32_to_cpu(info->snr);
6217         noise = be32_to_cpu(info->noise);
6218
6219         low = vif->cqm_rssi_low;
6220         high = vif->cqm_rssi_high;
6221         last = vif->cqm_rssi_last;
6222
6223         brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6224                   rssi, snr, noise, low, high, last);
6225
6226         vif->cqm_rssi_last = rssi;
6227
6228         if (rssi <= low || rssi == 0) {
6229                 brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6230                 cfg80211_cqm_rssi_notify(ifp->ndev,
6231                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6232                                          rssi, GFP_KERNEL);
6233         } else if (rssi > high) {
6234                 brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6235                 cfg80211_cqm_rssi_notify(ifp->ndev,
6236                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6237                                          rssi, GFP_KERNEL);
6238         }
6239
6240         return 0;
6241 }
6242
6243 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6244                                   const struct brcmf_event_msg *e, void *data)
6245 {
6246         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6247         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6248         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6249         struct brcmf_cfg80211_vif *vif;
6250
6251         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6252                   ifevent->action, ifevent->flags, ifevent->ifidx,
6253                   ifevent->bsscfgidx);
6254
6255         spin_lock(&event->vif_event_lock);
6256         event->action = ifevent->action;
6257         vif = event->vif;
6258
6259         switch (ifevent->action) {
6260         case BRCMF_E_IF_ADD:
6261                 /* waiting process may have timed out */
6262                 if (!cfg->vif_event.vif) {
6263                         spin_unlock(&event->vif_event_lock);
6264                         return -EBADF;
6265                 }
6266
6267                 ifp->vif = vif;
6268                 vif->ifp = ifp;
6269                 if (ifp->ndev) {
6270                         vif->wdev.netdev = ifp->ndev;
6271                         ifp->ndev->ieee80211_ptr = &vif->wdev;
6272                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6273                 }
6274                 spin_unlock(&event->vif_event_lock);
6275                 wake_up(&event->vif_wq);
6276                 return 0;
6277
6278         case BRCMF_E_IF_DEL:
6279                 spin_unlock(&event->vif_event_lock);
6280                 /* event may not be upon user request */
6281                 if (brcmf_cfg80211_vif_event_armed(cfg))
6282                         wake_up(&event->vif_wq);
6283                 return 0;
6284
6285         case BRCMF_E_IF_CHANGE:
6286                 spin_unlock(&event->vif_event_lock);
6287                 wake_up(&event->vif_wq);
6288                 return 0;
6289
6290         default:
6291                 spin_unlock(&event->vif_event_lock);
6292                 break;
6293         }
6294         return -EINVAL;
6295 }
6296
6297 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6298 {
6299         conf->frag_threshold = (u32)-1;
6300         conf->rts_threshold = (u32)-1;
6301         conf->retry_short = (u32)-1;
6302         conf->retry_long = (u32)-1;
6303 }
6304
6305 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6306 {
6307         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6308                             brcmf_notify_connect_status);
6309         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6310                             brcmf_notify_connect_status);
6311         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6312                             brcmf_notify_connect_status);
6313         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6314                             brcmf_notify_connect_status);
6315         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6316                             brcmf_notify_connect_status);
6317         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6318                             brcmf_notify_connect_status);
6319         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6320                             brcmf_notify_roaming_status);
6321         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6322                             brcmf_notify_mic_status);
6323         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6324                             brcmf_notify_connect_status);
6325         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6326                             brcmf_notify_sched_scan_results);
6327         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6328                             brcmf_notify_vif_event);
6329         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6330                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6331         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6332                             brcmf_p2p_notify_listen_complete);
6333         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6334                             brcmf_p2p_notify_action_frame_rx);
6335         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6336                             brcmf_p2p_notify_action_tx_complete);
6337         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6338                             brcmf_p2p_notify_action_tx_complete);
6339         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6340                             brcmf_notify_connect_status);
6341         brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
6342 }
6343
6344 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6345 {
6346         kfree(cfg->conf);
6347         cfg->conf = NULL;
6348         kfree(cfg->extra_buf);
6349         cfg->extra_buf = NULL;
6350         kfree(cfg->wowl.nd);
6351         cfg->wowl.nd = NULL;
6352         kfree(cfg->wowl.nd_info);
6353         cfg->wowl.nd_info = NULL;
6354         kfree(cfg->escan_info.escan_buf);
6355         cfg->escan_info.escan_buf = NULL;
6356 }
6357
6358 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
6359 {
6360         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
6361         if (!cfg->conf)
6362                 goto init_priv_mem_out;
6363         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
6364         if (!cfg->extra_buf)
6365                 goto init_priv_mem_out;
6366         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
6367         if (!cfg->wowl.nd)
6368                 goto init_priv_mem_out;
6369         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
6370                                     sizeof(struct cfg80211_wowlan_nd_match *),
6371                                     GFP_KERNEL);
6372         if (!cfg->wowl.nd_info)
6373                 goto init_priv_mem_out;
6374         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
6375         if (!cfg->escan_info.escan_buf)
6376                 goto init_priv_mem_out;
6377
6378         return 0;
6379
6380 init_priv_mem_out:
6381         brcmf_deinit_priv_mem(cfg);
6382
6383         return -ENOMEM;
6384 }
6385
6386 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
6387 {
6388         s32 err = 0;
6389
6390         cfg->scan_request = NULL;
6391         cfg->pwr_save = true;
6392         cfg->dongle_up = false;         /* dongle is not up yet */
6393         err = brcmf_init_priv_mem(cfg);
6394         if (err)
6395                 return err;
6396         brcmf_register_event_handlers(cfg);
6397         mutex_init(&cfg->usr_sync);
6398         brcmf_init_escan(cfg);
6399         brcmf_init_conf(cfg->conf);
6400         brcmf_init_wmm_prio(cfg->ac_priority);
6401         init_completion(&cfg->vif_disabled);
6402         return err;
6403 }
6404
6405 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
6406 {
6407         cfg->dongle_up = false; /* dongle down */
6408         brcmf_abort_scanning(cfg);
6409         brcmf_deinit_priv_mem(cfg);
6410 }
6411
6412 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
6413 {
6414         init_waitqueue_head(&event->vif_wq);
6415         spin_lock_init(&event->vif_event_lock);
6416 }
6417
6418 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
6419 {
6420         struct brcmf_pub *drvr = ifp->drvr;
6421         s32 err;
6422         u32 bcn_timeout;
6423         __le32 roamtrigger[2];
6424         __le32 roam_delta[2];
6425
6426         /* Configure beacon timeout value based upon roaming setting */
6427         if (ifp->drvr->settings->roamoff)
6428                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
6429         else
6430                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
6431         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
6432         if (err) {
6433                 bphy_err(drvr, "bcn_timeout error (%d)\n", err);
6434                 goto roam_setup_done;
6435         }
6436
6437         /* Enable/Disable built-in roaming to allow supplicant to take care of
6438          * roaming.
6439          */
6440         brcmf_dbg(INFO, "Internal Roaming = %s\n",
6441                   ifp->drvr->settings->roamoff ? "Off" : "On");
6442         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
6443                                       ifp->drvr->settings->roamoff);
6444         if (err) {
6445                 bphy_err(drvr, "roam_off error (%d)\n", err);
6446                 goto roam_setup_done;
6447         }
6448
6449         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
6450         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
6451         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
6452                                      (void *)roamtrigger, sizeof(roamtrigger));
6453         if (err)
6454                 bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
6455
6456         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
6457         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
6458         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
6459                                      (void *)roam_delta, sizeof(roam_delta));
6460         if (err)
6461                 bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
6462
6463         return 0;
6464
6465 roam_setup_done:
6466         return err;
6467 }
6468
6469 static s32
6470 brcmf_dongle_scantime(struct brcmf_if *ifp)
6471 {
6472         struct brcmf_pub *drvr = ifp->drvr;
6473         s32 err = 0;
6474
6475         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
6476                                     BRCMF_SCAN_CHANNEL_TIME);
6477         if (err) {
6478                 bphy_err(drvr, "Scan assoc time error (%d)\n", err);
6479                 goto dongle_scantime_out;
6480         }
6481         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
6482                                     BRCMF_SCAN_UNASSOC_TIME);
6483         if (err) {
6484                 bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
6485                 goto dongle_scantime_out;
6486         }
6487
6488         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
6489                                     BRCMF_SCAN_PASSIVE_TIME);
6490         if (err) {
6491                 bphy_err(drvr, "Scan passive time error (%d)\n", err);
6492                 goto dongle_scantime_out;
6493         }
6494
6495 dongle_scantime_out:
6496         return err;
6497 }
6498
6499 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6500                                            struct brcmu_chan *ch)
6501 {
6502         u32 ht40_flag;
6503
6504         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6505         if (ch->sb == BRCMU_CHAN_SB_U) {
6506                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6507                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6508                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6509         } else {
6510                 /* It should be one of
6511                  * IEEE80211_CHAN_NO_HT40 or
6512                  * IEEE80211_CHAN_NO_HT40PLUS
6513                  */
6514                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6515                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6516                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6517         }
6518 }
6519
6520 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6521                                     u32 bw_cap[])
6522 {
6523         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6524         struct brcmf_pub *drvr = cfg->pub;
6525         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6526         struct ieee80211_supported_band *band;
6527         struct ieee80211_channel *channel;
6528         struct brcmf_chanspec_list *list;
6529         struct brcmu_chan ch;
6530         int err;
6531         u8 *pbuf;
6532         u32 i, j;
6533         u32 total;
6534         u32 chaninfo;
6535
6536         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6537
6538         if (pbuf == NULL)
6539                 return -ENOMEM;
6540
6541         list = (struct brcmf_chanspec_list *)pbuf;
6542
6543         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6544                                        BRCMF_DCMD_MEDLEN);
6545         if (err) {
6546                 bphy_err(drvr, "get chanspecs error (%d)\n", err);
6547                 goto fail_pbuf;
6548         }
6549
6550         band = wiphy->bands[NL80211_BAND_2GHZ];
6551         if (band)
6552                 for (i = 0; i < band->n_channels; i++)
6553                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6554         band = wiphy->bands[NL80211_BAND_5GHZ];
6555         if (band)
6556                 for (i = 0; i < band->n_channels; i++)
6557                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6558
6559         total = le32_to_cpu(list->count);
6560         for (i = 0; i < total; i++) {
6561                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6562                 cfg->d11inf.decchspec(&ch);
6563
6564                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6565                         band = wiphy->bands[NL80211_BAND_2GHZ];
6566                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6567                         band = wiphy->bands[NL80211_BAND_5GHZ];
6568                 } else {
6569                         bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
6570                                  ch.chspec);
6571                         continue;
6572                 }
6573                 if (!band)
6574                         continue;
6575                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6576                     ch.bw == BRCMU_CHAN_BW_40)
6577                         continue;
6578                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
6579                     ch.bw == BRCMU_CHAN_BW_80)
6580                         continue;
6581
6582                 channel = NULL;
6583                 for (j = 0; j < band->n_channels; j++) {
6584                         if (band->channels[j].hw_value == ch.control_ch_num) {
6585                                 channel = &band->channels[j];
6586                                 break;
6587                         }
6588                 }
6589                 if (!channel) {
6590                         /* It seems firmware supports some channel we never
6591                          * considered. Something new in IEEE standard?
6592                          */
6593                         bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
6594                                  ch.control_ch_num);
6595                         continue;
6596                 }
6597
6598                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
6599                         continue;
6600
6601                 /* assuming the chanspecs order is HT20,
6602                  * HT40 upper, HT40 lower, and VHT80.
6603                  */
6604                 switch (ch.bw) {
6605                 case BRCMU_CHAN_BW_160:
6606                         channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
6607                         break;
6608                 case BRCMU_CHAN_BW_80:
6609                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
6610                         break;
6611                 case BRCMU_CHAN_BW_40:
6612                         brcmf_update_bw40_channel_flag(channel, &ch);
6613                         break;
6614                 default:
6615                         wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
6616                                    ch.bw);
6617                         fallthrough;
6618                 case BRCMU_CHAN_BW_20:
6619                         /* enable the channel and disable other bandwidths
6620                          * for now as mentioned order assure they are enabled
6621                          * for subsequent chanspecs.
6622                          */
6623                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6624                                          IEEE80211_CHAN_NO_80MHZ |
6625                                          IEEE80211_CHAN_NO_160MHZ;
6626                         ch.bw = BRCMU_CHAN_BW_20;
6627                         cfg->d11inf.encchspec(&ch);
6628                         chaninfo = ch.chspec;
6629                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6630                                                        &chaninfo);
6631                         if (!err) {
6632                                 if (chaninfo & WL_CHAN_RADAR)
6633                                         channel->flags |=
6634                                                 (IEEE80211_CHAN_RADAR |
6635                                                  IEEE80211_CHAN_NO_IR);
6636                                 if (chaninfo & WL_CHAN_PASSIVE)
6637                                         channel->flags |=
6638                                                 IEEE80211_CHAN_NO_IR;
6639                         }
6640                 }
6641         }
6642
6643 fail_pbuf:
6644         kfree(pbuf);
6645         return err;
6646 }
6647
6648 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6649 {
6650         struct brcmf_pub *drvr = cfg->pub;
6651         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6652         struct ieee80211_supported_band *band;
6653         struct brcmf_fil_bwcap_le band_bwcap;
6654         struct brcmf_chanspec_list *list;
6655         u8 *pbuf;
6656         u32 val;
6657         int err;
6658         struct brcmu_chan ch;
6659         u32 num_chan;
6660         int i, j;
6661
6662         /* verify support for bw_cap command */
6663         val = WLC_BAND_5G;
6664         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6665
6666         if (!err) {
6667                 /* only set 2G bandwidth using bw_cap command */
6668                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6669                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6670                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6671                                                sizeof(band_bwcap));
6672         } else {
6673                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6674                 val = WLC_N_BW_40ALL;
6675                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6676         }
6677
6678         if (!err) {
6679                 /* update channel info in 2G band */
6680                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6681
6682                 if (pbuf == NULL)
6683                         return -ENOMEM;
6684
6685                 ch.band = BRCMU_CHAN_BAND_2G;
6686                 ch.bw = BRCMU_CHAN_BW_40;
6687                 ch.sb = BRCMU_CHAN_SB_NONE;
6688                 ch.chnum = 0;
6689                 cfg->d11inf.encchspec(&ch);
6690
6691                 /* pass encoded chanspec in query */
6692                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6693
6694                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6695                                                BRCMF_DCMD_MEDLEN);
6696                 if (err) {
6697                         bphy_err(drvr, "get chanspecs error (%d)\n", err);
6698                         kfree(pbuf);
6699                         return err;
6700                 }
6701
6702                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6703                 list = (struct brcmf_chanspec_list *)pbuf;
6704                 num_chan = le32_to_cpu(list->count);
6705                 for (i = 0; i < num_chan; i++) {
6706                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6707                         cfg->d11inf.decchspec(&ch);
6708                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6709                                 continue;
6710                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6711                                 continue;
6712                         for (j = 0; j < band->n_channels; j++) {
6713                                 if (band->channels[j].hw_value == ch.control_ch_num)
6714                                         break;
6715                         }
6716                         if (WARN_ON(j == band->n_channels))
6717                                 continue;
6718
6719                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6720                 }
6721                 kfree(pbuf);
6722         }
6723         return err;
6724 }
6725
6726 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6727 {
6728         struct brcmf_pub *drvr = ifp->drvr;
6729         u32 band, mimo_bwcap;
6730         int err;
6731
6732         band = WLC_BAND_2G;
6733         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6734         if (!err) {
6735                 bw_cap[NL80211_BAND_2GHZ] = band;
6736                 band = WLC_BAND_5G;
6737                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6738                 if (!err) {
6739                         bw_cap[NL80211_BAND_5GHZ] = band;
6740                         return;
6741                 }
6742                 WARN_ON(1);
6743                 return;
6744         }
6745         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6746         mimo_bwcap = 0;
6747         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6748         if (err)
6749                 /* assume 20MHz if firmware does not give a clue */
6750                 mimo_bwcap = WLC_N_BW_20ALL;
6751
6752         switch (mimo_bwcap) {
6753         case WLC_N_BW_40ALL:
6754                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6755                 fallthrough;
6756         case WLC_N_BW_20IN2G_40IN5G:
6757                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6758                 fallthrough;
6759         case WLC_N_BW_20ALL:
6760                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6761                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6762                 break;
6763         default:
6764                 bphy_err(drvr, "invalid mimo_bw_cap value\n");
6765         }
6766 }
6767
6768 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6769                                 u32 bw_cap[2], u32 nchain)
6770 {
6771         band->ht_cap.ht_supported = true;
6772         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6773                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6774                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6775         }
6776         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6777         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6778         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6779         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6780         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6781         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6782 }
6783
6784 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6785 {
6786         u16 mcs_map;
6787         int i;
6788
6789         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6790                 mcs_map = (mcs_map << 2) | supp;
6791
6792         return cpu_to_le16(mcs_map);
6793 }
6794
6795 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6796                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6797                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6798 {
6799         __le16 mcs_map;
6800
6801         /* not allowed in 2.4G band */
6802         if (band->band == NL80211_BAND_2GHZ)
6803                 return;
6804
6805         band->vht_cap.vht_supported = true;
6806         /* 80MHz is mandatory */
6807         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6808         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6809                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6810                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6811         }
6812         /* all support 256-QAM */
6813         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6814         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6815         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6816
6817         /* Beamforming support information */
6818         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6819                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6820         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6821                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6822         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6823                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6824         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6825                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6826
6827         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6828                 band->vht_cap.cap |=
6829                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6830                 band->vht_cap.cap |= ((txstreams - 1) <<
6831                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6832                 band->vht_cap.cap |=
6833                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6834         }
6835 }
6836
6837 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
6838 {
6839         struct brcmf_pub *drvr = cfg->pub;
6840         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6841         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6842         u32 nmode = 0;
6843         u32 vhtmode = 0;
6844         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6845         u32 rxchain;
6846         u32 nchain;
6847         int err;
6848         s32 i;
6849         struct ieee80211_supported_band *band;
6850         u32 txstreams = 0;
6851         u32 txbf_bfe_cap = 0;
6852         u32 txbf_bfr_cap = 0;
6853
6854         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6855         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6856         if (err) {
6857                 bphy_err(drvr, "nmode error (%d)\n", err);
6858         } else {
6859                 brcmf_get_bwcap(ifp, bw_cap);
6860         }
6861         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6862                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6863                   bw_cap[NL80211_BAND_5GHZ]);
6864
6865         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6866         if (err) {
6867                 /* rxchain unsupported by firmware of older chips */
6868                 if (err == -EBADE)
6869                         bphy_info_once(drvr, "rxchain unsupported\n");
6870                 else
6871                         bphy_err(drvr, "rxchain error (%d)\n", err);
6872
6873                 nchain = 1;
6874         } else {
6875                 for (nchain = 0; rxchain; nchain++)
6876                         rxchain = rxchain & (rxchain - 1);
6877         }
6878         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6879
6880         err = brcmf_construct_chaninfo(cfg, bw_cap);
6881         if (err) {
6882                 bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
6883                 return err;
6884         }
6885
6886         if (vhtmode) {
6887                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6888                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6889                                               &txbf_bfe_cap);
6890                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6891                                               &txbf_bfr_cap);
6892         }
6893
6894         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6895                 band = wiphy->bands[i];
6896                 if (band == NULL)
6897                         continue;
6898
6899                 if (nmode)
6900                         brcmf_update_ht_cap(band, bw_cap, nchain);
6901                 if (vhtmode)
6902                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6903                                              txbf_bfe_cap, txbf_bfr_cap);
6904         }
6905
6906         return 0;
6907 }
6908
6909 static const struct ieee80211_txrx_stypes
6910 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6911         [NL80211_IFTYPE_STATION] = {
6912                 .tx = 0xffff,
6913                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6914                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6915         },
6916         [NL80211_IFTYPE_P2P_CLIENT] = {
6917                 .tx = 0xffff,
6918                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6919                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6920         },
6921         [NL80211_IFTYPE_P2P_GO] = {
6922                 .tx = 0xffff,
6923                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6924                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6925                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6926                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6927                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6928                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6929                       BIT(IEEE80211_STYPE_ACTION >> 4)
6930         },
6931         [NL80211_IFTYPE_P2P_DEVICE] = {
6932                 .tx = 0xffff,
6933                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6934                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6935         },
6936         [NL80211_IFTYPE_AP] = {
6937                 .tx = 0xffff,
6938                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6939                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6940                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6941                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6942                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6943                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6944                       BIT(IEEE80211_STYPE_ACTION >> 4)
6945         }
6946 };
6947
6948 /**
6949  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6950  *
6951  * @wiphy: wiphy object.
6952  * @ifp: interface object needed for feat module api.
6953  *
6954  * The interface modes and combinations are determined dynamically here
6955  * based on firmware functionality.
6956  *
6957  * no p2p and no mbss:
6958  *
6959  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6960  *
6961  * no p2p and mbss:
6962  *
6963  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6964  *      #AP <= 4, matching BI, channels = 1, 4 total
6965  *
6966  * no p2p and rsdb:
6967  *      #STA <= 1, #AP <= 2, channels = 2, 4 total
6968  *
6969  * p2p, no mchan, and mbss:
6970  *
6971  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6972  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6973  *      #AP <= 4, matching BI, channels = 1, 4 total
6974  *
6975  * p2p, mchan, and mbss:
6976  *
6977  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6978  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6979  *      #AP <= 4, matching BI, channels = 1, 4 total
6980  *
6981  * p2p, rsdb, and no mbss:
6982  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
6983  *       channels = 2, 4 total
6984  */
6985 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6986 {
6987         struct ieee80211_iface_combination *combo = NULL;
6988         struct ieee80211_iface_limit *c0_limits = NULL;
6989         struct ieee80211_iface_limit *p2p_limits = NULL;
6990         struct ieee80211_iface_limit *mbss_limits = NULL;
6991         bool mon_flag, mbss, p2p, rsdb, mchan;
6992         int i, c, n_combos, n_limits;
6993
6994         mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
6995         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6996         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6997         rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
6998         mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
6999
7000         n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7001         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7002         if (!combo)
7003                 goto err;
7004
7005         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7006                                  BIT(NL80211_IFTYPE_ADHOC) |
7007                                  BIT(NL80211_IFTYPE_AP);
7008         if (mon_flag)
7009                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7010         if (p2p)
7011                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7012                                           BIT(NL80211_IFTYPE_P2P_GO) |
7013                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
7014
7015         c = 0;
7016         i = 0;
7017         n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7018         c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7019         if (!c0_limits)
7020                 goto err;
7021
7022         combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7023         c0_limits[i].max = 1;
7024         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7025         if (mon_flag) {
7026                 c0_limits[i].max = 1;
7027                 c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7028         }
7029         if (p2p) {
7030                 c0_limits[i].max = 1;
7031                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7032                 c0_limits[i].max = 1 + rsdb;
7033                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7034                                        BIT(NL80211_IFTYPE_P2P_GO);
7035         }
7036         if (p2p && rsdb) {
7037                 c0_limits[i].max = 2;
7038                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7039                 combo[c].max_interfaces = 4;
7040         } else if (p2p) {
7041                 combo[c].max_interfaces = i;
7042         } else if (rsdb) {
7043                 c0_limits[i].max = 2;
7044                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7045                 combo[c].max_interfaces = 3;
7046         } else {
7047                 c0_limits[i].max = 1;
7048                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7049                 combo[c].max_interfaces = i;
7050         }
7051         combo[c].n_limits = i;
7052         combo[c].limits = c0_limits;
7053
7054         if (p2p && !rsdb) {
7055                 c++;
7056                 i = 0;
7057                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7058                 if (!p2p_limits)
7059                         goto err;
7060                 p2p_limits[i].max = 1;
7061                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7062                 p2p_limits[i].max = 1;
7063                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7064                 p2p_limits[i].max = 1;
7065                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7066                 p2p_limits[i].max = 1;
7067                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7068                 combo[c].num_different_channels = 1;
7069                 combo[c].max_interfaces = i;
7070                 combo[c].n_limits = i;
7071                 combo[c].limits = p2p_limits;
7072         }
7073
7074         if (mbss) {
7075                 c++;
7076                 i = 0;
7077                 n_limits = 1 + mon_flag;
7078                 mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7079                                       GFP_KERNEL);
7080                 if (!mbss_limits)
7081                         goto err;
7082                 mbss_limits[i].max = 4;
7083                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7084                 if (mon_flag) {
7085                         mbss_limits[i].max = 1;
7086                         mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7087                 }
7088                 combo[c].beacon_int_infra_match = true;
7089                 combo[c].num_different_channels = 1;
7090                 combo[c].max_interfaces = 4 + mon_flag;
7091                 combo[c].n_limits = i;
7092                 combo[c].limits = mbss_limits;
7093         }
7094
7095         wiphy->n_iface_combinations = n_combos;
7096         wiphy->iface_combinations = combo;
7097         return 0;
7098
7099 err:
7100         kfree(c0_limits);
7101         kfree(p2p_limits);
7102         kfree(mbss_limits);
7103         kfree(combo);
7104         return -ENOMEM;
7105 }
7106
7107 #ifdef CONFIG_PM
7108 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7109         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7110         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
7111         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7112         .pattern_min_len = 1,
7113         .max_pkt_offset = 1500,
7114 };
7115 #endif
7116
7117 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7118 {
7119 #ifdef CONFIG_PM
7120         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7121         struct brcmf_pub *drvr = cfg->pub;
7122         struct wiphy_wowlan_support *wowl;
7123
7124         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7125                        GFP_KERNEL);
7126         if (!wowl) {
7127                 bphy_err(drvr, "only support basic wowlan features\n");
7128                 wiphy->wowlan = &brcmf_wowlan_support;
7129                 return;
7130         }
7131
7132         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7133                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7134                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7135                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7136                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
7137                 }
7138         }
7139         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7140                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7141                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7142         }
7143
7144         wiphy->wowlan = wowl;
7145 #endif
7146 }
7147
7148 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7149 {
7150         struct brcmf_pub *drvr = ifp->drvr;
7151         const struct ieee80211_iface_combination *combo;
7152         struct ieee80211_supported_band *band;
7153         u16 max_interfaces = 0;
7154         bool gscan;
7155         __le32 bandlist[3];
7156         u32 n_bands;
7157         int err, i;
7158
7159         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7160         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7161         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7162
7163         err = brcmf_setup_ifmodes(wiphy, ifp);
7164         if (err)
7165                 return err;
7166
7167         for (i = 0, combo = wiphy->iface_combinations;
7168              i < wiphy->n_iface_combinations; i++, combo++) {
7169                 max_interfaces = max(max_interfaces, combo->max_interfaces);
7170         }
7171
7172         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7173              i++) {
7174                 u8 *addr = drvr->addresses[i].addr;
7175
7176                 memcpy(addr, drvr->mac, ETH_ALEN);
7177                 if (i) {
7178                         addr[0] |= BIT(1);
7179                         addr[ETH_ALEN - 1] ^= i;
7180                 }
7181         }
7182         wiphy->addresses = drvr->addresses;
7183         wiphy->n_addresses = i;
7184
7185         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7186         wiphy->cipher_suites = brcmf_cipher_suites;
7187         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7188         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7189                 wiphy->n_cipher_suites--;
7190         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7191                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7192                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7193
7194         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7195                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
7196                         WIPHY_FLAG_HAVE_AP_SME |
7197                         WIPHY_FLAG_OFFCHAN_TX |
7198                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7199         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7200                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7201         if (!ifp->drvr->settings->roamoff)
7202                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7203         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7204                 wiphy_ext_feature_set(wiphy,
7205                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7206                 wiphy_ext_feature_set(wiphy,
7207                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7208                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7209                         wiphy_ext_feature_set(wiphy,
7210                                               NL80211_EXT_FEATURE_SAE_OFFLOAD);
7211         }
7212         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7213                 wiphy_ext_feature_set(wiphy,
7214                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7215                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7216                         wiphy_ext_feature_set(wiphy,
7217                                               NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7218         }
7219         wiphy->mgmt_stypes = brcmf_txrx_stypes;
7220         wiphy->max_remain_on_channel_duration = 5000;
7221         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7222                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7223                 brcmf_pno_wiphy_params(wiphy, gscan);
7224         }
7225         /* vendor commands/events support */
7226         wiphy->vendor_commands = brcmf_vendor_cmds;
7227         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7228
7229         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7230                 brcmf_wiphy_wowl_params(wiphy, ifp);
7231         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7232                                      sizeof(bandlist));
7233         if (err) {
7234                 bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7235                 return err;
7236         }
7237         /* first entry in bandlist is number of bands */
7238         n_bands = le32_to_cpu(bandlist[0]);
7239         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7240                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7241                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7242                                        GFP_KERNEL);
7243                         if (!band)
7244                                 return -ENOMEM;
7245
7246                         band->channels = kmemdup(&__wl_2ghz_channels,
7247                                                  sizeof(__wl_2ghz_channels),
7248                                                  GFP_KERNEL);
7249                         if (!band->channels) {
7250                                 kfree(band);
7251                                 return -ENOMEM;
7252                         }
7253
7254                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7255                         wiphy->bands[NL80211_BAND_2GHZ] = band;
7256                 }
7257                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7258                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7259                                        GFP_KERNEL);
7260                         if (!band)
7261                                 return -ENOMEM;
7262
7263                         band->channels = kmemdup(&__wl_5ghz_channels,
7264                                                  sizeof(__wl_5ghz_channels),
7265                                                  GFP_KERNEL);
7266                         if (!band->channels) {
7267                                 kfree(band);
7268                                 return -ENOMEM;
7269                         }
7270
7271                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7272                         wiphy->bands[NL80211_BAND_5GHZ] = band;
7273                 }
7274         }
7275
7276         if (wiphy->bands[NL80211_BAND_5GHZ] &&
7277             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7278                 wiphy_ext_feature_set(wiphy,
7279                                       NL80211_EXT_FEATURE_DFS_OFFLOAD);
7280
7281         wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7282
7283         wiphy_read_of_freq_limits(wiphy);
7284
7285         return 0;
7286 }
7287
7288 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7289 {
7290         struct brcmf_pub *drvr = cfg->pub;
7291         struct net_device *ndev;
7292         struct wireless_dev *wdev;
7293         struct brcmf_if *ifp;
7294         s32 power_mode;
7295         s32 err = 0;
7296
7297         if (cfg->dongle_up)
7298                 return err;
7299
7300         ndev = cfg_to_ndev(cfg);
7301         wdev = ndev->ieee80211_ptr;
7302         ifp = netdev_priv(ndev);
7303
7304         /* make sure RF is ready for work */
7305         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7306
7307         brcmf_dongle_scantime(ifp);
7308
7309         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7310         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7311         if (err)
7312                 goto default_conf_out;
7313         brcmf_dbg(INFO, "power save set to %s\n",
7314                   (power_mode ? "enabled" : "disabled"));
7315
7316         err = brcmf_dongle_roam(ifp);
7317         if (err)
7318                 goto default_conf_out;
7319         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7320                                           NULL);
7321         if (err)
7322                 goto default_conf_out;
7323
7324         brcmf_configure_arp_nd_offload(ifp, true);
7325
7326         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7327         if (err) {
7328                 bphy_err(drvr, "failed to set frameburst mode\n");
7329                 goto default_conf_out;
7330         }
7331
7332         cfg->dongle_up = true;
7333 default_conf_out:
7334
7335         return err;
7336
7337 }
7338
7339 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
7340 {
7341         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7342
7343         return brcmf_config_dongle(ifp->drvr->config);
7344 }
7345
7346 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
7347 {
7348         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7349
7350         /*
7351          * While going down, if associated with AP disassociate
7352          * from AP to save power
7353          */
7354         if (check_vif_up(ifp->vif)) {
7355                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
7356
7357                 /* Make sure WPA_Supplicant receives all the event
7358                    generated due to DISASSOC call to the fw to keep
7359                    the state fw and WPA_Supplicant state consistent
7360                  */
7361                 brcmf_delay(500);
7362         }
7363
7364         brcmf_abort_scanning(cfg);
7365         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7366
7367         return 0;
7368 }
7369
7370 s32 brcmf_cfg80211_up(struct net_device *ndev)
7371 {
7372         struct brcmf_if *ifp = netdev_priv(ndev);
7373         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7374         s32 err = 0;
7375
7376         mutex_lock(&cfg->usr_sync);
7377         err = __brcmf_cfg80211_up(ifp);
7378         mutex_unlock(&cfg->usr_sync);
7379
7380         return err;
7381 }
7382
7383 s32 brcmf_cfg80211_down(struct net_device *ndev)
7384 {
7385         struct brcmf_if *ifp = netdev_priv(ndev);
7386         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7387         s32 err = 0;
7388
7389         mutex_lock(&cfg->usr_sync);
7390         err = __brcmf_cfg80211_down(ifp);
7391         mutex_unlock(&cfg->usr_sync);
7392
7393         return err;
7394 }
7395
7396 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
7397 {
7398         struct wireless_dev *wdev = &ifp->vif->wdev;
7399
7400         return wdev->iftype;
7401 }
7402
7403 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
7404                              unsigned long state)
7405 {
7406         struct brcmf_cfg80211_vif *vif;
7407
7408         list_for_each_entry(vif, &cfg->vif_list, list) {
7409                 if (test_bit(state, &vif->sme_state))
7410                         return true;
7411         }
7412         return false;
7413 }
7414
7415 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
7416                                     u8 action)
7417 {
7418         u8 evt_action;
7419
7420         spin_lock(&event->vif_event_lock);
7421         evt_action = event->action;
7422         spin_unlock(&event->vif_event_lock);
7423         return evt_action == action;
7424 }
7425
7426 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
7427                                   struct brcmf_cfg80211_vif *vif)
7428 {
7429         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7430
7431         spin_lock(&event->vif_event_lock);
7432         event->vif = vif;
7433         event->action = 0;
7434         spin_unlock(&event->vif_event_lock);
7435 }
7436
7437 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
7438 {
7439         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7440         bool armed;
7441
7442         spin_lock(&event->vif_event_lock);
7443         armed = event->vif != NULL;
7444         spin_unlock(&event->vif_event_lock);
7445
7446         return armed;
7447 }
7448
7449 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
7450                                   u8 action, ulong timeout)
7451 {
7452         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7453
7454         return wait_event_timeout(event->vif_wq,
7455                                   vif_event_equals(event, action), timeout);
7456 }
7457
7458 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
7459                                         struct brcmf_fil_country_le *ccreq)
7460 {
7461         struct brcmfmac_pd_cc *country_codes;
7462         struct brcmfmac_pd_cc_entry *cc;
7463         s32 found_index;
7464         int i;
7465
7466         country_codes = drvr->settings->country_codes;
7467         if (!country_codes) {
7468                 brcmf_dbg(TRACE, "No country codes configured for device\n");
7469                 return -EINVAL;
7470         }
7471
7472         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
7473             (alpha2[1] == ccreq->country_abbrev[1])) {
7474                 brcmf_dbg(TRACE, "Country code already set\n");
7475                 return -EAGAIN;
7476         }
7477
7478         found_index = -1;
7479         for (i = 0; i < country_codes->table_size; i++) {
7480                 cc = &country_codes->table[i];
7481                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
7482                         found_index = i;
7483                 if ((cc->iso3166[0] == alpha2[0]) &&
7484                     (cc->iso3166[1] == alpha2[1])) {
7485                         found_index = i;
7486                         break;
7487                 }
7488         }
7489         if (found_index == -1) {
7490                 brcmf_dbg(TRACE, "No country code match found\n");
7491                 return -EINVAL;
7492         }
7493         memset(ccreq, 0, sizeof(*ccreq));
7494         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
7495         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
7496                BRCMF_COUNTRY_BUF_SZ);
7497         ccreq->country_abbrev[0] = alpha2[0];
7498         ccreq->country_abbrev[1] = alpha2[1];
7499         ccreq->country_abbrev[2] = 0;
7500
7501         return 0;
7502 }
7503
7504 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
7505                                         struct regulatory_request *req)
7506 {
7507         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7508         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
7509         struct brcmf_pub *drvr = cfg->pub;
7510         struct brcmf_fil_country_le ccreq;
7511         s32 err;
7512         int i;
7513
7514         /* The country code gets set to "00" by default at boot, ignore */
7515         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
7516                 return;
7517
7518         /* ignore non-ISO3166 country codes */
7519         for (i = 0; i < 2; i++)
7520                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
7521                         bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
7522                                  req->alpha2[0], req->alpha2[1]);
7523                         return;
7524                 }
7525
7526         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
7527                   req->alpha2[0], req->alpha2[1]);
7528
7529         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
7530         if (err) {
7531                 bphy_err(drvr, "Country code iovar returned err = %d\n", err);
7532                 return;
7533         }
7534
7535         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
7536         if (err)
7537                 return;
7538
7539         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
7540         if (err) {
7541                 bphy_err(drvr, "Firmware rejected country setting\n");
7542                 return;
7543         }
7544         brcmf_setup_wiphybands(cfg);
7545 }
7546
7547 static void brcmf_free_wiphy(struct wiphy *wiphy)
7548 {
7549         int i;
7550
7551         if (!wiphy)
7552                 return;
7553
7554         if (wiphy->iface_combinations) {
7555                 for (i = 0; i < wiphy->n_iface_combinations; i++)
7556                         kfree(wiphy->iface_combinations[i].limits);
7557         }
7558         kfree(wiphy->iface_combinations);
7559         if (wiphy->bands[NL80211_BAND_2GHZ]) {
7560                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
7561                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
7562         }
7563         if (wiphy->bands[NL80211_BAND_5GHZ]) {
7564                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
7565                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
7566         }
7567 #if IS_ENABLED(CONFIG_PM)
7568         if (wiphy->wowlan != &brcmf_wowlan_support)
7569                 kfree(wiphy->wowlan);
7570 #endif
7571 }
7572
7573 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
7574                                                   struct cfg80211_ops *ops,
7575                                                   bool p2pdev_forced)
7576 {
7577         struct wiphy *wiphy = drvr->wiphy;
7578         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
7579         struct brcmf_cfg80211_info *cfg;
7580         struct brcmf_cfg80211_vif *vif;
7581         struct brcmf_if *ifp;
7582         s32 err = 0;
7583         s32 io_type;
7584         u16 *cap = NULL;
7585
7586         if (!ndev) {
7587                 bphy_err(drvr, "ndev is invalid\n");
7588                 return NULL;
7589         }
7590
7591         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
7592         if (!cfg) {
7593                 bphy_err(drvr, "Could not allocate wiphy device\n");
7594                 return NULL;
7595         }
7596
7597         cfg->wiphy = wiphy;
7598         cfg->pub = drvr;
7599         init_vif_event(&cfg->vif_event);
7600         INIT_LIST_HEAD(&cfg->vif_list);
7601
7602         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
7603         if (IS_ERR(vif))
7604                 goto wiphy_out;
7605
7606         ifp = netdev_priv(ndev);
7607         vif->ifp = ifp;
7608         vif->wdev.netdev = ndev;
7609         ndev->ieee80211_ptr = &vif->wdev;
7610         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
7611
7612         err = wl_init_priv(cfg);
7613         if (err) {
7614                 bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
7615                 brcmf_free_vif(vif);
7616                 goto wiphy_out;
7617         }
7618         ifp->vif = vif;
7619
7620         /* determine d11 io type before wiphy setup */
7621         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
7622         if (err) {
7623                 bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
7624                 goto priv_out;
7625         }
7626         cfg->d11inf.io_type = (u8)io_type;
7627         brcmu_d11_attach(&cfg->d11inf);
7628
7629         /* regulatory notifer below needs access to cfg so
7630          * assign it now.
7631          */
7632         drvr->config = cfg;
7633
7634         err = brcmf_setup_wiphy(wiphy, ifp);
7635         if (err < 0)
7636                 goto priv_out;
7637
7638         brcmf_dbg(INFO, "Registering custom regulatory\n");
7639         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
7640         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
7641         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
7642
7643         /* firmware defaults to 40MHz disabled in 2G band. We signal
7644          * cfg80211 here that we do and have it decide we can enable
7645          * it. But first check if device does support 2G operation.
7646          */
7647         if (wiphy->bands[NL80211_BAND_2GHZ]) {
7648                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
7649                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7650         }
7651 #ifdef CONFIG_PM
7652         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
7653                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
7654 #endif
7655         err = wiphy_register(wiphy);
7656         if (err < 0) {
7657                 bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
7658                 goto priv_out;
7659         }
7660
7661         err = brcmf_setup_wiphybands(cfg);
7662         if (err) {
7663                 bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
7664                 goto wiphy_unreg_out;
7665         }
7666
7667         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
7668          * setup 40MHz in 2GHz band and enable OBSS scanning.
7669          */
7670         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
7671                 err = brcmf_enable_bw40_2g(cfg);
7672                 if (!err)
7673                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
7674                                                       BRCMF_OBSS_COEX_AUTO);
7675                 else
7676                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7677         }
7678
7679         err = brcmf_fweh_activate_events(ifp);
7680         if (err) {
7681                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
7682                 goto wiphy_unreg_out;
7683         }
7684
7685         err = brcmf_p2p_attach(cfg, p2pdev_forced);
7686         if (err) {
7687                 bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
7688                 goto wiphy_unreg_out;
7689         }
7690         err = brcmf_btcoex_attach(cfg);
7691         if (err) {
7692                 bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
7693                 brcmf_p2p_detach(&cfg->p2p);
7694                 goto wiphy_unreg_out;
7695         }
7696         err = brcmf_pno_attach(cfg);
7697         if (err) {
7698                 bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
7699                 brcmf_btcoex_detach(cfg);
7700                 brcmf_p2p_detach(&cfg->p2p);
7701                 goto wiphy_unreg_out;
7702         }
7703
7704         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
7705                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
7706                 if (err) {
7707                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
7708                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
7709                 } else {
7710                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
7711                                             brcmf_notify_tdls_peer_event);
7712                 }
7713         }
7714
7715         /* (re-) activate FWEH event handling */
7716         err = brcmf_fweh_activate_events(ifp);
7717         if (err) {
7718                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
7719                 goto detach;
7720         }
7721
7722         /* Fill in some of the advertised nl80211 supported features */
7723         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
7724                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7725 #ifdef CONFIG_PM
7726                 if (wiphy->wowlan &&
7727                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
7728                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7729 #endif
7730         }
7731
7732         return cfg;
7733
7734 detach:
7735         brcmf_pno_detach(cfg);
7736         brcmf_btcoex_detach(cfg);
7737         brcmf_p2p_detach(&cfg->p2p);
7738 wiphy_unreg_out:
7739         wiphy_unregister(cfg->wiphy);
7740 priv_out:
7741         wl_deinit_priv(cfg);
7742         brcmf_free_vif(vif);
7743         ifp->vif = NULL;
7744 wiphy_out:
7745         brcmf_free_wiphy(wiphy);
7746         kfree(cfg);
7747         return NULL;
7748 }
7749
7750 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7751 {
7752         if (!cfg)
7753                 return;
7754
7755         brcmf_pno_detach(cfg);
7756         brcmf_btcoex_detach(cfg);
7757         wiphy_unregister(cfg->wiphy);
7758         wl_deinit_priv(cfg);
7759         brcmf_free_wiphy(cfg->wiphy);
7760         kfree(cfg);
7761 }