drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2010 Broadcom Corporation
   4  */
   5
   6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/vmalloc.h>
  12 #include <linux/ctype.h>
  13 #include <net/cfg80211.h>
  14 #include <net/netlink.h>
  15 #include <uapi/linux/if_arp.h>
  16
  17 #include <brcmu_utils.h>
  18 #include <defs.h>
  19 #include <brcmu_wifi.h>
  20 #include <brcm_hw_ids.h>
  21 #include "core.h"
  22 #include "debug.h"
  23 #include "tracepoint.h"
  24 #include "fwil_types.h"
  25 #include "p2p.h"
  26 #include "btcoex.h"
  27 #include "pno.h"
  28 #include "fwsignal.h"
  29 #include "cfg80211.h"
  30 #include "feature.h"
  31 #include "fwil.h"
  32 #include "proto.h"
  33 #include "vendor.h"
  34 #include "bus.h"
  35 #include "common.h"
  36
  37 #define BRCMF_SCAN_IE_LEN_MAX           2048
  38
  39 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  40 #define WPA_OUI_TYPE                    1
  41 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  42 #define WME_OUI_TYPE                    2
  43 #define WPS_OUI_TYPE                    4
  44
  45 #define VS_IE_FIXED_HDR_LEN             6
  46 #define WPA_IE_VERSION_LEN              2
  47 #define WPA_IE_MIN_OUI_LEN              4
  48 #define WPA_IE_SUITE_COUNT_LEN          2
  49
  50 #define WPA_CIPHER_NONE                 0       /* None */
  51 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  52 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  53 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  54 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  55
  56 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  57 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  58 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  59 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  60 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  61 #define RSN_AKM_SAE                     8       /* SAE */
  62 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  63 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  64 #define RSN_CAP_MFPR_MASK               BIT(6)
  65 #define RSN_CAP_MFPC_MASK               BIT(7)
  66 #define RSN_PMKID_COUNT_LEN             2
  67
  68 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  69                                                  * string :"add", "del" (+ NUL)
  70                                                  */
  71 #define VNDR_IE_COUNT_OFFSET            4
  72 #define VNDR_IE_PKTFLAG_OFFSET          8
  73 #define VNDR_IE_VSIE_OFFSET             12
  74 #define VNDR_IE_HDR_SIZE                12
  75 #define VNDR_IE_PARSE_LIMIT             5
  76
  77 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  78 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  79
  80 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  81 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  82 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  83
  84 #define BRCMF_SCAN_CHANNEL_TIME         40
  85 #define BRCMF_SCAN_UNASSOC_TIME         40
  86 #define BRCMF_SCAN_PASSIVE_TIME         120
  87
  88 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  89
  90 #define BRCMF_PS_MAX_TIMEOUT_MS         2000
  91
  92 #define MGMT_AUTH_FRAME_DWELL_TIME      4000
  93 #define MGMT_AUTH_FRAME_WAIT_TIME       (MGMT_AUTH_FRAME_DWELL_TIME + 100)
  94
  95 /* Dump obss definitions */
  96 #define ACS_MSRMNT_DELAY                80
  97 #define CHAN_NOISE_DUMMY                (-80)
  98 #define OBSS_TOKEN_IDX                  15
  99 #define IBSS_TOKEN_IDX                  15
 100 #define TX_TOKEN_IDX                    14
 101 #define CTG_TOKEN_IDX                   13
 102 #define PKT_TOKEN_IDX                   15
 103 #define IDLE_TOKEN_IDX                  12
 104
 105 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 106         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 107
 108 #define BRCMF_MAX_CHANSPEC_LIST \
 109         (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
 110
 111 struct brcmf_dump_survey {
 112         u32 obss;
 113         u32 ibss;
 114         u32 no_ctg;
 115         u32 no_pckt;
 116         u32 tx;
 117         u32 idle;
 118 };
 119
 120 struct cca_stats_n_flags {
 121         u32 msrmnt_time; /* Time for Measurement (msec) */
 122         u32 msrmnt_done; /* flag set when measurement complete */
 123         char buf[1];
 124 };
 125
 126 struct cca_msrmnt_query {
 127         u32 msrmnt_query;
 128         u32 time_req;
 129 };
 130
 131 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 132 {
 133         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 134                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 135                           vif->sme_state);
 136                 return false;
 137         }
 138         return true;
 139 }
 140
 141 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 142 #define RATETAB_ENT(_rateid, _flags) \
 143         {                                                               \
 144                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 145                 .hw_value       = (_rateid),                            \
 146                 .flags          = (_flags),                             \
 147         }
 148
 149 static struct ieee80211_rate __wl_rates[] = {
 150         RATETAB_ENT(BRCM_RATE_1M, 0),
 151         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 152         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 153         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 154         RATETAB_ENT(BRCM_RATE_6M, 0),
 155         RATETAB_ENT(BRCM_RATE_9M, 0),
 156         RATETAB_ENT(BRCM_RATE_12M, 0),
 157         RATETAB_ENT(BRCM_RATE_18M, 0),
 158         RATETAB_ENT(BRCM_RATE_24M, 0),
 159         RATETAB_ENT(BRCM_RATE_36M, 0),
 160         RATETAB_ENT(BRCM_RATE_48M, 0),
 161         RATETAB_ENT(BRCM_RATE_54M, 0),
 162 };
 163
 164 #define wl_g_rates              (__wl_rates + 0)
 165 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 166 #define wl_a_rates              (__wl_rates + 4)
 167 #define wl_a_rates_size         (wl_g_rates_size - 4)
 168
 169 #define CHAN2G(_channel, _freq) {                               \
 170         .band                   = NL80211_BAND_2GHZ,            \
 171         .center_freq            = (_freq),                      \
 172         .hw_value               = (_channel),                   \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176
 177 #define CHAN5G(_channel) {                                      \
 178         .band                   = NL80211_BAND_5GHZ,            \
 179         .center_freq            = 5000 + (5 * (_channel)),      \
 180         .hw_value               = (_channel),                   \
 181         .max_antenna_gain       = 0,                            \
 182         .max_power              = 30,                           \
 183 }
 184
 185 static struct ieee80211_channel __wl_2ghz_channels[] = {
 186         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 187         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 188         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 189         CHAN2G(13, 2472), CHAN2G(14, 2484)
 190 };
 191
 192 static struct ieee80211_channel __wl_5ghz_channels[] = {
 193         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 194         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 195         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 196         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 197         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 198         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 199 };
 200
 201 /* Band templates duplicated per wiphy. The channel info
 202  * above is added to the band during setup.
 203  */
 204 static const struct ieee80211_supported_band __wl_band_2ghz = {
 205         .band = NL80211_BAND_2GHZ,
 206         .bitrates = wl_g_rates,
 207         .n_bitrates = wl_g_rates_size,
 208 };
 209
 210 static const struct ieee80211_supported_band __wl_band_5ghz = {
 211         .band = NL80211_BAND_5GHZ,
 212         .bitrates = wl_a_rates,
 213         .n_bitrates = wl_a_rates_size,
 214 };
 215
 216 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 217  * By default world regulatory domain defined in reg.c puts the flags
 218  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 219  * With respect to these flags, wpa_supplicant doesn't * start p2p
 220  * operations on 5GHz channels. All the changes in world regulatory
 221  * domain are to be done here.
 222  */
 223 static const struct ieee80211_regdomain brcmf_regdom = {
 224         .n_reg_rules = 4,
 225         .alpha2 =  "99",
 226         .reg_rules = {
 227                 /* IEEE 802.11b/g, channels 1..11 */
 228                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 229                 /* If any */
 230                 /* IEEE 802.11 channel 14 - Only JP enables
 231                  * this and for 802.11b only
 232                  */
 233                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 234                 /* IEEE 802.11a, channel 36..64 */
 235                 REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
 236                 /* IEEE 802.11a, channel 100..165 */
 237                 REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
 238 };
 239
 240 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 241  * are supported. A pointer to this array and the number of entries is passed
 242  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 243  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 244  * device does not support MFP then the number of suites will be decreased by 1
 245  */
 246 static const u32 brcmf_cipher_suites[] = {
 247         WLAN_CIPHER_SUITE_WEP40,
 248         WLAN_CIPHER_SUITE_WEP104,
 249         WLAN_CIPHER_SUITE_TKIP,
 250         WLAN_CIPHER_SUITE_CCMP,
 251         /* Keep as last entry: */
 252         WLAN_CIPHER_SUITE_AES_CMAC
 253 };
 254
 255 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 256 struct brcmf_vs_tlv {
 257         u8 id;
 258         u8 len;
 259         u8 oui[3];
 260         u8 oui_type;
 261 };
 262
 263 struct parsed_vndr_ie_info {
 264         u8 *ie_ptr;
 265         u32 ie_len;     /* total length including id & length field */
 266         struct brcmf_vs_tlv vndrie;
 267 };
 268
 269 struct parsed_vndr_ies {
 270         u32 count;
 271         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 272 };
 273
 274 #define WL_INTERFACE_CREATE_VER_1               1
 275 #define WL_INTERFACE_CREATE_VER_2               2
 276 #define WL_INTERFACE_CREATE_VER_3               3
 277 #define WL_INTERFACE_CREATE_VER_MAX             WL_INTERFACE_CREATE_VER_3
 278
 279 #define WL_INTERFACE_MAC_DONT_USE       0x0
 280 #define WL_INTERFACE_MAC_USE            0x2
 281
 282 #define WL_INTERFACE_CREATE_STA         0x0
 283 #define WL_INTERFACE_CREATE_AP          0x1
 284
 285 struct wl_interface_create_v1 {
 286         u16     ver;                    /* structure version */
 287         u32     flags;                  /* flags for operation */
 288         u8      mac_addr[ETH_ALEN];     /* MAC address */
 289         u32     wlc_index;              /* optional for wlc index */
 290 };
 291
 292 struct wl_interface_create_v2 {
 293         u16     ver;                    /* structure version */
 294         u8      pad1[2];
 295         u32     flags;                  /* flags for operation */
 296         u8      mac_addr[ETH_ALEN];     /* MAC address */
 297         u8      iftype;                 /* type of interface created */
 298         u8      pad2;
 299         u32     wlc_index;              /* optional for wlc index */
 300 };
 301
 302 struct wl_interface_create_v3 {
 303         u16 ver;                        /* structure version */
 304         u16 len;                        /* length of structure + data */
 305         u16 fixed_len;                  /* length of structure */
 306         u8 iftype;                      /* type of interface created */
 307         u8 wlc_index;                   /* optional for wlc index */
 308         u32 flags;                      /* flags for operation */
 309         u8 mac_addr[ETH_ALEN];          /* MAC address */
 310         u8 bssid[ETH_ALEN];             /* optional for BSSID */
 311         u8 if_index;                    /* interface index request */
 312         u8 pad[3];
 313         u8 data[];                      /* Optional for specific data */
 314 };
 315
 316 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 317 {
 318         switch (band) {
 319         case NL80211_BAND_2GHZ:
 320                 return WLC_BAND_2G;
 321         case NL80211_BAND_5GHZ:
 322                 return WLC_BAND_5G;
 323         default:
 324                 WARN_ON(1);
 325                 break;
 326         }
 327         return 0;
 328 }
 329
 330 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 331                                struct cfg80211_chan_def *ch)
 332 {
 333         struct brcmu_chan ch_inf;
 334         s32 primary_offset;
 335
 336         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 337                   ch->chan->center_freq, ch->center_freq1, ch->width);
 338         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 339         primary_offset = ch->chan->center_freq - ch->center_freq1;
 340         switch (ch->width) {
 341         case NL80211_CHAN_WIDTH_20:
 342         case NL80211_CHAN_WIDTH_20_NOHT:
 343                 ch_inf.bw = BRCMU_CHAN_BW_20;
 344                 WARN_ON(primary_offset != 0);
 345                 break;
 346         case NL80211_CHAN_WIDTH_40:
 347                 ch_inf.bw = BRCMU_CHAN_BW_40;
 348                 if (primary_offset > 0)
 349                         ch_inf.sb = BRCMU_CHAN_SB_U;
 350                 else
 351                         ch_inf.sb = BRCMU_CHAN_SB_L;
 352                 break;
 353         case NL80211_CHAN_WIDTH_80:
 354                 ch_inf.bw = BRCMU_CHAN_BW_80;
 355                 if (primary_offset == -30)
 356                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 357                 else if (primary_offset == -10)
 358                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 359                 else if (primary_offset == 10)
 360                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 361                 else
 362                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 363                 break;
 364         case NL80211_CHAN_WIDTH_160:
 365                 ch_inf.bw = BRCMU_CHAN_BW_160;
 366                 if (primary_offset == -70)
 367                         ch_inf.sb = BRCMU_CHAN_SB_LLL;
 368                 else if (primary_offset == -50)
 369                         ch_inf.sb = BRCMU_CHAN_SB_LLU;
 370                 else if (primary_offset == -30)
 371                         ch_inf.sb = BRCMU_CHAN_SB_LUL;
 372                 else if (primary_offset == -10)
 373                         ch_inf.sb = BRCMU_CHAN_SB_LUU;
 374                 else if (primary_offset == 10)
 375                         ch_inf.sb = BRCMU_CHAN_SB_ULL;
 376                 else if (primary_offset == 30)
 377                         ch_inf.sb = BRCMU_CHAN_SB_ULU;
 378                 else if (primary_offset == 50)
 379                         ch_inf.sb = BRCMU_CHAN_SB_UUL;
 380                 else
 381                         ch_inf.sb = BRCMU_CHAN_SB_UUU;
 382                 break;
 383         case NL80211_CHAN_WIDTH_80P80:
 384         case NL80211_CHAN_WIDTH_5:
 385         case NL80211_CHAN_WIDTH_10:
 386         default:
 387                 WARN_ON_ONCE(1);
 388         }
 389         switch (ch->chan->band) {
 390         case NL80211_BAND_2GHZ:
 391                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 392                 break;
 393         case NL80211_BAND_5GHZ:
 394                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 395                 break;
 396         case NL80211_BAND_60GHZ:
 397         default:
 398                 WARN_ON_ONCE(1);
 399         }
 400         d11inf->encchspec(&ch_inf);
 401
 402         brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
 403         return ch_inf.chspec;
 404 }
 405
 406 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 407                         struct ieee80211_channel *ch)
 408 {
 409         struct brcmu_chan ch_inf;
 410
 411         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 412         ch_inf.bw = BRCMU_CHAN_BW_20;
 413         d11inf->encchspec(&ch_inf);
 414
 415         return ch_inf.chspec;
 416 }
 417
 418 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 419  * triples, returning a pointer to the substring whose first element
 420  * matches tag
 421  */
 422 static const struct brcmf_tlv *
 423 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 424 {
 425         const struct brcmf_tlv *elt = buf;
 426         int totlen = buflen;
 427
 428         /* find tagged parameter */
 429         while (totlen >= TLV_HDR_LEN) {
 430                 int len = elt->len;
 431
 432                 /* validate remaining totlen */
 433                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 434                         return elt;
 435
 436                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 437                 totlen -= (len + TLV_HDR_LEN);
 438         }
 439
 440         return NULL;
 441 }
 442
 443 /* Is any of the tlvs the expected entry? If
 444  * not update the tlvs buffer pointer/length.
 445  */
 446 static bool
 447 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 448                  const u8 *oui, u32 oui_len, u8 type)
 449 {
 450         /* If the contents match the OUI and the type */
 451         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 452             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 453             type == ie[TLV_BODY_OFF + oui_len]) {
 454                 return true;
 455         }
 456
 457         if (tlvs == NULL)
 458                 return false;
 459         /* point to the next ie */
 460         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 461         /* calculate the length of the rest of the buffer */
 462         *tlvs_len -= (int)(ie - *tlvs);
 463         /* update the pointer to the start of the buffer */
 464         *tlvs = ie;
 465
 466         return false;
 467 }
 468
 469 static struct brcmf_vs_tlv *
 470 brcmf_find_wpaie(const u8 *parse, u32 len)
 471 {
 472         const struct brcmf_tlv *ie;
 473
 474         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 475                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 476                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 477                         return (struct brcmf_vs_tlv *)ie;
 478         }
 479         return NULL;
 480 }
 481
 482 static struct brcmf_vs_tlv *
 483 brcmf_find_wpsie(const u8 *parse, u32 len)
 484 {
 485         const struct brcmf_tlv *ie;
 486
 487         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 488                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 489                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 490                         return (struct brcmf_vs_tlv *)ie;
 491         }
 492         return NULL;
 493 }
 494
 495 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 496                                      struct brcmf_cfg80211_vif *vif,
 497                                      enum nl80211_iftype new_type)
 498 {
 499         struct brcmf_cfg80211_vif *pos;
 500         bool check_combos = false;
 501         int ret = 0;
 502         struct iface_combination_params params = {
 503                 .num_different_channels = 1,
 504         };
 505
 506         list_for_each_entry(pos, &cfg->vif_list, list)
 507                 if (pos == vif) {
 508                         params.iftype_num[new_type]++;
 509                 } else {
 510                         /* concurrent interfaces so need check combinations */
 511                         check_combos = true;
 512                         params.iftype_num[pos->wdev.iftype]++;
 513                 }
 514
 515         if (check_combos)
 516                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 517
 518         return ret;
 519 }
 520
 521 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 522                                   enum nl80211_iftype new_type)
 523 {
 524         struct brcmf_cfg80211_vif *pos;
 525         struct iface_combination_params params = {
 526                 .num_different_channels = 1,
 527         };
 528
 529         list_for_each_entry(pos, &cfg->vif_list, list)
 530                 params.iftype_num[pos->wdev.iftype]++;
 531
 532         params.iftype_num[new_type]++;
 533         return cfg80211_check_combinations(cfg->wiphy, &params);
 534 }
 535
 536 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 537                                  struct brcmf_wsec_key_le *key_le)
 538 {
 539         key_le->index = cpu_to_le32(key->index);
 540         key_le->len = cpu_to_le32(key->len);
 541         key_le->algo = cpu_to_le32(key->algo);
 542         key_le->flags = cpu_to_le32(key->flags);
 543         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 544         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 545         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 546         memcpy(key_le->data, key->data, sizeof(key->data));
 547         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 548 }
 549
 550 static int
 551 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 552 {
 553         struct brcmf_pub *drvr = ifp->drvr;
 554         int err;
 555         struct brcmf_wsec_key_le key_le;
 556
 557         convert_key_from_CPU(key, &key_le);
 558
 559         brcmf_netdev_wait_pend8021x(ifp);
 560
 561         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 562                                         sizeof(key_le));
 563
 564         if (err)
 565                 bphy_err(drvr, "wsec_key error (%d)\n", err);
 566         return err;
 567 }
 568
 569 static void
 570 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 571 {
 572         struct brcmf_cfg80211_vif *vif;
 573         struct brcmf_if *ifp;
 574
 575         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 576         ifp = vif->ifp;
 577
 578         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 579             (wdev->iftype == NL80211_IFTYPE_AP) ||
 580             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 581                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 582                                                 ADDR_DIRECT);
 583         else
 584                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 585                                                 ADDR_INDIRECT);
 586 }
 587
 588 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 589 {
 590         int bsscfgidx;
 591
 592         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 593                 /* bsscfgidx 1 is reserved for legacy P2P */
 594                 if (bsscfgidx == 1)
 595                         continue;
 596                 if (!drvr->iflist[bsscfgidx])
 597                         return bsscfgidx;
 598         }
 599
 600         return -ENOMEM;
 601 }
 602
 603 static void brcmf_set_vif_sta_macaddr(struct brcmf_if *ifp, u8 *mac_addr)
 604 {
 605         u8 mac_idx = ifp->drvr->sta_mac_idx;
 606
 607         /* set difference MAC address with locally administered bit */
 608         memcpy(mac_addr, ifp->mac_addr, ETH_ALEN);
 609         mac_addr[0] |= 0x02;
 610         mac_addr[3] ^= mac_idx ? 0xC0 : 0xA0;
 611         mac_idx++;
 612         mac_idx = mac_idx % 2;
 613         ifp->drvr->sta_mac_idx = mac_idx;
 614 }
 615
 616 static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
 617 {
 618         struct wl_interface_create_v1 iface_v1;
 619         struct wl_interface_create_v2 iface_v2;
 620         struct wl_interface_create_v3 iface_v3;
 621         u32 iface_create_ver;
 622         int err;
 623
 624         /* interface_create version 1 */
 625         memset(&iface_v1, 0, sizeof(iface_v1));
 626         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 627         iface_v1.flags = WL_INTERFACE_CREATE_STA |
 628                          WL_INTERFACE_MAC_USE;
 629         if (!is_zero_ether_addr(macaddr))
 630                 memcpy(iface_v1.mac_addr, macaddr, ETH_ALEN);
 631         else
 632                 brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 633
 634         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 635                                        &iface_v1,
 636                                        sizeof(iface_v1));
 637         if (err) {
 638                 brcmf_info("failed to create interface(v1), err=%d\n",
 639                            err);
 640         } else {
 641                 brcmf_dbg(INFO, "interface created(v1)\n");
 642                 return 0;
 643         }
 644
 645         /* interface_create version 2 */
 646         memset(&iface_v2, 0, sizeof(iface_v2));
 647         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 648         iface_v2.flags = WL_INTERFACE_MAC_USE;
 649         iface_v2.iftype = WL_INTERFACE_CREATE_STA;
 650         if (!is_zero_ether_addr(macaddr))
 651                 memcpy(iface_v2.mac_addr, macaddr, ETH_ALEN);
 652         else
 653                 brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 654
 655         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 656                                        &iface_v2,
 657                                        sizeof(iface_v2));
 658         if (err) {
 659                 brcmf_info("failed to create interface(v2), err=%d\n",
 660                            err);
 661         } else {
 662                 brcmf_dbg(INFO, "interface created(v2)\n");
 663                 return 0;
 664         }
 665
 666         /* interface_create version 3+ */
 667         /* get supported version from firmware side */
 668         iface_create_ver = 0;
 669         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 670                                        &iface_create_ver);
 671         if (err) {
 672                 brcmf_err("fail to get supported version, err=%d\n", err);
 673                 return -EOPNOTSUPP;
 674         }
 675
 676         switch (iface_create_ver) {
 677         case WL_INTERFACE_CREATE_VER_3:
 678                 memset(&iface_v3, 0, sizeof(iface_v3));
 679                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 680                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 681                 iface_v3.iftype = WL_INTERFACE_CREATE_STA;
 682                 if (!is_zero_ether_addr(macaddr))
 683                         memcpy(iface_v3.mac_addr, macaddr, ETH_ALEN);
 684                 else
 685                         brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 686
 687                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 688                                                &iface_v3,
 689                                                sizeof(iface_v3));
 690
 691                 if (!err)
 692                         brcmf_dbg(INFO, "interface created(v3)\n");
 693                 break;
 694         default:
 695                 brcmf_err("not support interface create(v%d)\n",
 696                           iface_create_ver);
 697                 err = -EOPNOTSUPP;
 698                 break;
 699         }
 700
 701         if (err) {
 702                 brcmf_info("station interface creation failed (%d)\n",
 703                            err);
 704                 return -EIO;
 705         }
 706
 707         return 0;
 708 }
 709
 710 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 711 {
 712         struct wl_interface_create_v1 iface_v1;
 713         struct wl_interface_create_v2 iface_v2;
 714         struct wl_interface_create_v3 iface_v3;
 715         u32 iface_create_ver;
 716         struct brcmf_pub *drvr = ifp->drvr;
 717         struct brcmf_mbss_ssid_le mbss_ssid_le;
 718         int bsscfgidx;
 719         int err;
 720
 721         /* interface_create version 1 */
 722         memset(&iface_v1, 0, sizeof(iface_v1));
 723         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 724         iface_v1.flags = WL_INTERFACE_CREATE_AP |
 725                          WL_INTERFACE_MAC_USE;
 726
 727         brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 728
 729         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 730                                        &iface_v1,
 731                                        sizeof(iface_v1));
 732         if (err) {
 733                 brcmf_info("failed to create interface(v1), err=%d\n",
 734                            err);
 735         } else {
 736                 brcmf_dbg(INFO, "interface created(v1)\n");
 737                 return 0;
 738         }
 739
 740         /* interface_create version 2 */
 741         memset(&iface_v2, 0, sizeof(iface_v2));
 742         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 743         iface_v2.flags = WL_INTERFACE_MAC_USE;
 744         iface_v2.iftype = WL_INTERFACE_CREATE_AP;
 745
 746         brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 747
 748         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 749                                        &iface_v2,
 750                                        sizeof(iface_v2));
 751         if (err) {
 752                 brcmf_info("failed to create interface(v2), err=%d\n",
 753                            err);
 754         } else {
 755                 brcmf_dbg(INFO, "interface created(v2)\n");
 756                 return 0;
 757         }
 758
 759         /* interface_create version 3+ */
 760         /* get supported version from firmware side */
 761         iface_create_ver = 0;
 762         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 763                                        &iface_create_ver);
 764         if (err) {
 765                 brcmf_err("fail to get supported version, err=%d\n", err);
 766                 return -EOPNOTSUPP;
 767         }
 768
 769         switch (iface_create_ver) {
 770         case WL_INTERFACE_CREATE_VER_3:
 771                 memset(&iface_v3, 0, sizeof(iface_v3));
 772                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 773                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 774                 iface_v3.iftype = WL_INTERFACE_CREATE_AP;
 775                 brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 776
 777                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 778                                                &iface_v3,
 779                                                sizeof(iface_v3));
 780
 781                 if (!err)
 782                         brcmf_dbg(INFO, "interface created(v3)\n");
 783                 break;
 784         default:
 785                 brcmf_err("not support interface create(v%d)\n",
 786                           iface_create_ver);
 787                 err = -EOPNOTSUPP;
 788                 break;
 789         }
 790
 791         if (err) {
 792                 brcmf_info("Does not support interface_create (%d)\n",
 793                            err);
 794                 memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 795                 bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 796                 if (bsscfgidx < 0)
 797                         return bsscfgidx;
 798
 799                 mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 800                 mbss_ssid_le.SSID_len = cpu_to_le32(5);
 801                 sprintf(mbss_ssid_le.SSID, "ssid%d", bsscfgidx);
 802
 803                 err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 804                                                 sizeof(mbss_ssid_le));
 805
 806                 if (err < 0)
 807                         bphy_err(drvr, "setting ssid failed %d\n", err);
 808         }
 809
 810         return err;
 811 }
 812
 813 /**
 814  * brcmf_apsta_add_vif() - create a new AP or STA virtual interface
 815  *
 816  * @wiphy: wiphy device of new interface.
 817  * @name: name of the new interface.
 818  * @params: contains mac address for AP or STA device.
 819  * @type: interface type.
 820  */
 821 static
 822 struct wireless_dev *brcmf_apsta_add_vif(struct wiphy *wiphy, const char *name,
 823                                          struct vif_params *params,
 824                                          enum nl80211_iftype type)
 825 {
 826         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 827         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 828         struct brcmf_pub *drvr = cfg->pub;
 829         struct brcmf_cfg80211_vif *vif;
 830         int err;
 831
 832         if (type != NL80211_IFTYPE_STATION && type != NL80211_IFTYPE_AP)
 833                 return ERR_PTR(-EINVAL);
 834
 835         if (brcmf_cfg80211_vif_event_armed(cfg))
 836                 return ERR_PTR(-EBUSY);
 837
 838         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 839
 840         vif = brcmf_alloc_vif(cfg, type);
 841         if (IS_ERR(vif))
 842                 return (struct wireless_dev *)vif;
 843
 844         brcmf_cfg80211_arm_vif_event(cfg, vif);
 845
 846         if (type == NL80211_IFTYPE_STATION)
 847                 err = brcmf_cfg80211_request_sta_if(ifp, params->macaddr);
 848         else
 849                 err = brcmf_cfg80211_request_ap_if(ifp);
 850         if (err) {
 851                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 852                 goto fail;
 853         }
 854
 855         /* wait for firmware event */
 856         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 857                                             BRCMF_VIF_EVENT_TIMEOUT);
 858         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 859         if (!err) {
 860                 bphy_err(drvr, "timeout occurred\n");
 861                 err = -EIO;
 862                 goto fail;
 863         }
 864
 865         /* interface created in firmware */
 866         ifp = vif->ifp;
 867         if (!ifp) {
 868                 bphy_err(drvr, "no if pointer provided\n");
 869                 err = -ENOENT;
 870                 goto fail;
 871         }
 872
 873         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 874         err = brcmf_net_attach(ifp, true);
 875         if (err) {
 876                 bphy_err(drvr, "Registering netdevice failed\n");
 877                 free_netdev(ifp->ndev);
 878                 goto fail;
 879         }
 880
 881         return &ifp->vif->wdev;
 882
 883 fail:
 884         brcmf_free_vif(vif);
 885         return ERR_PTR(err);
 886 }
 887
 888 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 889 {
 890         enum nl80211_iftype iftype;
 891
 892         iftype = vif->wdev.iftype;
 893         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 894 }
 895
 896 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 897 {
 898         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 899 }
 900
 901 /**
 902  * brcmf_mon_add_vif() - create monitor mode virtual interface
 903  *
 904  * @wiphy: wiphy device of new interface.
 905  * @name: name of the new interface.
 906  */
 907 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
 908                                               const char *name)
 909 {
 910         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 911         struct brcmf_cfg80211_vif *vif;
 912         struct net_device *ndev;
 913         struct brcmf_if *ifp;
 914         int err;
 915
 916         if (cfg->pub->mon_if) {
 917                 err = -EEXIST;
 918                 goto err_out;
 919         }
 920
 921         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
 922         if (IS_ERR(vif)) {
 923                 err = PTR_ERR(vif);
 924                 goto err_out;
 925         }
 926
 927         ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
 928         if (!ndev) {
 929                 err = -ENOMEM;
 930                 goto err_free_vif;
 931         }
 932         ndev->type = ARPHRD_IEEE80211_RADIOTAP;
 933         ndev->ieee80211_ptr = &vif->wdev;
 934         ndev->needs_free_netdev = true;
 935         ndev->priv_destructor = brcmf_cfg80211_free_netdev;
 936         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
 937
 938         ifp = netdev_priv(ndev);
 939         ifp->vif = vif;
 940         ifp->ndev = ndev;
 941         ifp->drvr = cfg->pub;
 942
 943         vif->ifp = ifp;
 944         vif->wdev.netdev = ndev;
 945
 946         err = brcmf_net_mon_attach(ifp);
 947         if (err) {
 948                 brcmf_err("Failed to attach %s device\n", ndev->name);
 949                 free_netdev(ndev);
 950                 goto err_free_vif;
 951         }
 952
 953         cfg->pub->mon_if = ifp;
 954
 955         return &vif->wdev;
 956
 957 err_free_vif:
 958         brcmf_free_vif(vif);
 959 err_out:
 960         return ERR_PTR(err);
 961 }
 962
 963 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 964 {
 965         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 966         struct net_device *ndev = wdev->netdev;
 967
 968         ndev->netdev_ops->ndo_stop(ndev);
 969
 970         brcmf_net_detach(ndev, true);
 971
 972         cfg->pub->mon_if = NULL;
 973
 974         return 0;
 975 }
 976
 977 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 978                                                      const char *name,
 979                                                      unsigned char name_assign_type,
 980                                                      enum nl80211_iftype type,
 981                                                      struct vif_params *params)
 982 {
 983         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 984         struct brcmf_pub *drvr = cfg->pub;
 985         struct wireless_dev *wdev;
 986         int err;
 987
 988         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 989         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 990         if (err) {
 991                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 992                 return ERR_PTR(err);
 993         }
 994         switch (type) {
 995         case NL80211_IFTYPE_ADHOC:
 996         case NL80211_IFTYPE_AP_VLAN:
 997         case NL80211_IFTYPE_WDS:
 998         case NL80211_IFTYPE_MESH_POINT:
 999                 return ERR_PTR(-EOPNOTSUPP);
1000         case NL80211_IFTYPE_MONITOR:
1001                 return brcmf_mon_add_vif(wiphy, name);
1002         case NL80211_IFTYPE_STATION:
1003         case NL80211_IFTYPE_AP:
1004                 wdev = brcmf_apsta_add_vif(wiphy, name, params, type);
1005                 break;
1006         case NL80211_IFTYPE_P2P_CLIENT:
1007         case NL80211_IFTYPE_P2P_GO:
1008         case NL80211_IFTYPE_P2P_DEVICE:
1009                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
1010                 break;
1011         case NL80211_IFTYPE_UNSPECIFIED:
1012         default:
1013                 return ERR_PTR(-EINVAL);
1014         }
1015
1016         if (IS_ERR(wdev))
1017                 bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
1018                          type, (int)PTR_ERR(wdev));
1019         else
1020                 brcmf_cfg80211_update_proto_addr_mode(wdev);
1021
1022         return wdev;
1023 }
1024
1025 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
1026 {
1027         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
1028                 brcmf_set_mpc(ifp, mpc);
1029 }
1030
1031 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
1032 {
1033         struct brcmf_pub *drvr = ifp->drvr;
1034         s32 err = 0;
1035
1036         if (check_vif_up(ifp->vif)) {
1037                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
1038                 if (err) {
1039                         bphy_err(drvr, "fail to set mpc\n");
1040                         return;
1041                 }
1042                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
1043         }
1044 }
1045
1046 static void brcmf_scan_params_v2_to_v1(struct brcmf_scan_params_v2_le *params_v2_le,
1047                                        struct brcmf_scan_params_le *params_le)
1048 {
1049         size_t params_size;
1050         u32 ch;
1051         int n_channels, n_ssids;
1052
1053         memcpy(&params_le->ssid_le, &params_v2_le->ssid_le,
1054                sizeof(params_le->ssid_le));
1055         memcpy(&params_le->bssid, &params_v2_le->bssid,
1056                sizeof(params_le->bssid));
1057
1058         params_le->bss_type = params_v2_le->bss_type;
1059         params_le->scan_type = le32_to_cpu(params_v2_le->scan_type);
1060         params_le->nprobes = params_v2_le->nprobes;
1061         params_le->active_time = params_v2_le->active_time;
1062         params_le->passive_time = params_v2_le->passive_time;
1063         params_le->home_time = params_v2_le->home_time;
1064         params_le->channel_num = params_v2_le->channel_num;
1065
1066         ch = le32_to_cpu(params_v2_le->channel_num);
1067         n_channels = ch & BRCMF_SCAN_PARAMS_COUNT_MASK;
1068         n_ssids = ch >> BRCMF_SCAN_PARAMS_NSSID_SHIFT;
1069
1070         params_size = sizeof(u16) * n_channels;
1071         if (n_ssids > 0) {
1072                 params_size = roundup(params_size, sizeof(u32));
1073                 params_size += sizeof(struct brcmf_ssid_le) * n_ssids;
1074         }
1075
1076         memcpy(&params_le->channel_list[0],
1077                &params_v2_le->channel_list[0], params_size);
1078 }
1079
1080 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1081                              struct brcmf_scan_params_v2_le *params_le,
1082                              struct cfg80211_scan_request *request)
1083 {
1084         u32 n_ssids;
1085         u32 n_channels;
1086         s32 i;
1087         s32 offset;
1088         u16 chanspec;
1089         char *ptr;
1090         int length;
1091         struct brcmf_ssid_le ssid_le;
1092
1093         eth_broadcast_addr(params_le->bssid);
1094
1095         length = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1096
1097         params_le->version = cpu_to_le16(BRCMF_SCAN_PARAMS_VERSION_V2);
1098         params_le->bss_type = DOT11_BSSTYPE_ANY;
1099         params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_ACTIVE);
1100         params_le->channel_num = 0;
1101         params_le->nprobes = cpu_to_le32(-1);
1102         params_le->active_time = cpu_to_le32(-1);
1103         params_le->passive_time = cpu_to_le32(-1);
1104         params_le->home_time = cpu_to_le32(-1);
1105         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1106
1107         /* Scan abort */
1108         if (!request) {
1109                 length += sizeof(u16);
1110                 params_le->channel_num = cpu_to_le32(1);
1111                 params_le->channel_list[0] = cpu_to_le16(-1);
1112                 params_le->length = cpu_to_le16(length);
1113                 return;
1114         }
1115
1116         n_ssids = request->n_ssids;
1117         n_channels = request->n_channels;
1118
1119         /* Copy channel array if applicable */
1120         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1121                   n_channels);
1122         if (n_channels > 0) {
1123                 length += roundup(sizeof(u16) * n_channels, sizeof(u32));
1124                 for (i = 0; i < n_channels; i++) {
1125                         chanspec = channel_to_chanspec(&cfg->d11inf,
1126                                                        request->channels[i]);
1127                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1128                                   request->channels[i]->hw_value, chanspec);
1129                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1130                 }
1131         } else {
1132                 brcmf_dbg(SCAN, "Scanning all channels\n");
1133         }
1134
1135         /* Copy ssid array if applicable */
1136         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1137         if (n_ssids > 0) {
1138                 offset = offsetof(struct brcmf_scan_params_v2_le, channel_list) +
1139                                 n_channels * sizeof(u16);
1140                 offset = roundup(offset, sizeof(u32));
1141                 length += sizeof(ssid_le) * n_ssids,
1142                 ptr = (char *)params_le + offset;
1143                 for (i = 0; i < n_ssids; i++) {
1144                         memset(&ssid_le, 0, sizeof(ssid_le));
1145                         ssid_le.SSID_len =
1146                                         cpu_to_le32(request->ssids[i].ssid_len);
1147                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1148                                request->ssids[i].ssid_len);
1149                         if (!ssid_le.SSID_len)
1150                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1151                         else
1152                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1153                                           i, ssid_le.SSID, ssid_le.SSID_len);
1154                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1155                         ptr += sizeof(ssid_le);
1156                 }
1157         } else {
1158                 brcmf_dbg(SCAN, "Performing passive scan\n");
1159                 params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_PASSIVE);
1160         }
1161         params_le->length = cpu_to_le16(length);
1162         /* Adding mask to channel numbers */
1163         params_le->channel_num =
1164                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1165                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1166 }
1167
1168 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
1169                                 struct brcmf_if *ifp, bool aborted,
1170                                 bool fw_abort)
1171 {
1172         struct brcmf_pub *drvr = cfg->pub;
1173         struct brcmf_scan_params_v2_le params_v2_le;
1174         struct cfg80211_scan_request *scan_request;
1175         u64 reqid;
1176         u32 bucket;
1177         s32 err = 0;
1178
1179         brcmf_dbg(SCAN, "Enter\n");
1180
1181         /* clear scan request, because the FW abort can cause a second call */
1182         /* to this functon and might cause a double cfg80211_scan_done      */
1183         scan_request = cfg->scan_request;
1184         cfg->scan_request = NULL;
1185
1186         if (timer_pending(&cfg->escan_timeout))
1187                 del_timer_sync(&cfg->escan_timeout);
1188
1189         if (fw_abort) {
1190                 /* Do a scan abort to stop the driver's scan engine */
1191                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
1192
1193                 brcmf_escan_prep(cfg, &params_v2_le, NULL);
1194
1195                 /* E-Scan (or anyother type) can be aborted by SCAN */
1196                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1197                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1198                                                      &params_v2_le,
1199                                                      sizeof(params_v2_le));
1200                 } else {
1201                         struct brcmf_scan_params_le params_le;
1202
1203                         brcmf_scan_params_v2_to_v1(&params_v2_le, &params_le);
1204                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1205                                                      &params_le,
1206                                                      sizeof(params_le));
1207                 }
1208
1209                 if (err)
1210                         bphy_err(drvr, "Scan abort failed\n");
1211         }
1212
1213         brcmf_scan_config_mpc(ifp, 1);
1214
1215         /*
1216          * e-scan can be initiated internally
1217          * which takes precedence.
1218          */
1219         if (cfg->int_escan_map) {
1220                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
1221                           cfg->int_escan_map);
1222                 while (cfg->int_escan_map) {
1223                         bucket = __ffs(cfg->int_escan_map);
1224                         cfg->int_escan_map &= ~BIT(bucket);
1225                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
1226                                                                bucket);
1227                         if (!aborted) {
1228                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
1229                                           reqid);
1230                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
1231                                                             reqid);
1232                         }
1233                 }
1234         } else if (scan_request) {
1235                 struct cfg80211_scan_info info = {
1236                         .aborted = aborted,
1237                 };
1238
1239                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
1240                           aborted ? "Aborted" : "Done");
1241                 cfg80211_scan_done(scan_request, &info);
1242         }
1243         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
1244                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
1245
1246         return err;
1247 }
1248
1249 static int brcmf_cfg80211_del_apsta_iface(struct wiphy *wiphy,
1250                                           struct wireless_dev *wdev)
1251 {
1252         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1253         struct net_device *ndev = wdev->netdev;
1254         struct brcmf_if *ifp = netdev_priv(ndev);
1255         struct brcmf_pub *drvr = cfg->pub;
1256         int ret;
1257         int err;
1258
1259         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
1260
1261         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
1262         if (err) {
1263                 bphy_err(drvr, "interface_remove failed %d\n", err);
1264                 goto err_unarm;
1265         }
1266
1267         /* wait for firmware event */
1268         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
1269                                             BRCMF_VIF_EVENT_TIMEOUT);
1270         if (!ret) {
1271                 bphy_err(drvr, "timeout occurred\n");
1272                 err = -EIO;
1273                 goto err_unarm;
1274         }
1275
1276         brcmf_remove_interface(ifp, true);
1277
1278 err_unarm:
1279         brcmf_cfg80211_arm_vif_event(cfg, NULL);
1280         return err;
1281 }
1282
1283 static
1284 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
1285 {
1286         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1287         struct net_device *ndev = wdev->netdev;
1288
1289         if (ndev && ndev == cfg_to_ndev(cfg))
1290                 return -ENOTSUPP;
1291
1292         /* vif event pending in firmware */
1293         if (brcmf_cfg80211_vif_event_armed(cfg))
1294                 return -EBUSY;
1295
1296         if (ndev) {
1297                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
1298                     cfg->escan_info.ifp == netdev_priv(ndev))
1299                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
1300                                                     true, true);
1301
1302                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
1303         }
1304
1305         switch (wdev->iftype) {
1306         case NL80211_IFTYPE_ADHOC:
1307         case NL80211_IFTYPE_AP_VLAN:
1308         case NL80211_IFTYPE_WDS:
1309         case NL80211_IFTYPE_MESH_POINT:
1310                 return -EOPNOTSUPP;
1311         case NL80211_IFTYPE_MONITOR:
1312                 return brcmf_mon_del_vif(wiphy, wdev);
1313         case NL80211_IFTYPE_STATION:
1314         case NL80211_IFTYPE_AP:
1315                 return brcmf_cfg80211_del_apsta_iface(wiphy, wdev);
1316         case NL80211_IFTYPE_P2P_CLIENT:
1317         case NL80211_IFTYPE_P2P_GO:
1318         case NL80211_IFTYPE_P2P_DEVICE:
1319                 return brcmf_p2p_del_vif(wiphy, wdev);
1320         case NL80211_IFTYPE_UNSPECIFIED:
1321         default:
1322                 return -EINVAL;
1323         }
1324         return -EOPNOTSUPP;
1325 }
1326
1327 static s32
1328 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
1329                          enum nl80211_iftype type,
1330                          struct vif_params *params)
1331 {
1332         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1333         struct brcmf_if *ifp = netdev_priv(ndev);
1334         struct brcmf_cfg80211_vif *vif = ifp->vif;
1335         struct brcmf_pub *drvr = cfg->pub;
1336         s32 infra = 0;
1337         s32 ap = 0;
1338         s32 err = 0;
1339
1340         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
1341                   type);
1342
1343         /* WAR: There are a number of p2p interface related problems which
1344          * need to be handled initially (before doing the validate).
1345          * wpa_supplicant tends to do iface changes on p2p device/client/go
1346          * which are not always possible/allowed. However we need to return
1347          * OK otherwise the wpa_supplicant wont start. The situation differs
1348          * on configuration and setup (p2pon=1 module param). The first check
1349          * is to see if the request is a change to station for p2p iface.
1350          */
1351         if ((type == NL80211_IFTYPE_STATION) &&
1352             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
1353              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
1354              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
1355                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
1356                 /* Now depending on whether module param p2pon=1 was used the
1357                  * response needs to be either 0 or EOPNOTSUPP. The reason is
1358                  * that if p2pon=1 is used, but a newer supplicant is used then
1359                  * we should return an error, as this combination wont work.
1360                  * In other situations 0 is returned and supplicant will start
1361                  * normally. It will give a trace in cfg80211, but it is the
1362                  * only way to get it working. Unfortunately this will result
1363                  * in situation where we wont support new supplicant in
1364                  * combination with module param p2pon=1, but that is the way
1365                  * it is. If the user tries this then unloading of driver might
1366                  * fail/lock.
1367                  */
1368                 if (cfg->p2p.p2pdev_dynamically)
1369                         return -EOPNOTSUPP;
1370                 else
1371                         return 0;
1372         }
1373         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
1374         if (err) {
1375                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
1376                 return err;
1377         }
1378         switch (type) {
1379         case NL80211_IFTYPE_MONITOR:
1380         case NL80211_IFTYPE_WDS:
1381                 bphy_err(drvr, "type (%d) : currently we do not support this type\n",
1382                          type);
1383                 return -EOPNOTSUPP;
1384         case NL80211_IFTYPE_ADHOC:
1385                 infra = 0;
1386                 break;
1387         case NL80211_IFTYPE_STATION:
1388                 infra = 1;
1389                 break;
1390         case NL80211_IFTYPE_AP:
1391         case NL80211_IFTYPE_P2P_GO:
1392                 ap = 1;
1393                 break;
1394         default:
1395                 err = -EINVAL;
1396                 goto done;
1397         }
1398
1399         if (ap) {
1400                 if (type == NL80211_IFTYPE_P2P_GO) {
1401                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
1402                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1403                 }
1404                 if (!err) {
1405                         brcmf_dbg(INFO, "IF Type = AP\n");
1406                 }
1407         } else {
1408                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1409                 if (err) {
1410                         bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1411                         err = -EAGAIN;
1412                         goto done;
1413                 }
1414                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1415                           "Adhoc" : "Infra");
1416         }
1417         ndev->ieee80211_ptr->iftype = type;
1418
1419         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1420
1421 done:
1422         brcmf_dbg(TRACE, "Exit\n");
1423
1424         return err;
1425 }
1426
1427 static s32
1428 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1429                 struct cfg80211_scan_request *request)
1430 {
1431         struct brcmf_pub *drvr = cfg->pub;
1432         s32 params_size = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE +
1433                           offsetof(struct brcmf_escan_params_le, params_v2_le);
1434         struct brcmf_escan_params_le *params;
1435         s32 err = 0;
1436
1437         brcmf_dbg(SCAN, "E-SCAN START\n");
1438
1439         if (request != NULL) {
1440                 /* Allocate space for populating ssids in struct */
1441                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1442
1443                 /* Allocate space for populating ssids in struct */
1444                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1445         }
1446
1447         params = kzalloc(params_size, GFP_KERNEL);
1448         if (!params) {
1449                 err = -ENOMEM;
1450                 goto exit;
1451         }
1452         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1453         brcmf_escan_prep(cfg, &params->params_v2_le, request);
1454
1455         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
1456
1457         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1458                 struct brcmf_escan_params_le *params_v1;
1459
1460                 params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1461                 params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
1462                 params_v1 = kzalloc(params_size, GFP_KERNEL);
1463                 if (!params_v1) {
1464                         err = -ENOMEM;
1465                         goto exit_params;
1466                 }
1467                 params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1468                 brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
1469                 kfree(params);
1470                 params = params_v1;
1471         }
1472
1473         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1474         params->sync_id = cpu_to_le16(0x1234);
1475
1476         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1477         if (err) {
1478                 if (err == -EBUSY)
1479                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1480                 else
1481                         bphy_err(drvr, "error (%d)\n", err);
1482         }
1483
1484 exit_params:
1485         kfree(params);
1486 exit:
1487         return err;
1488 }
1489
1490 static s32
1491 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1492 {
1493         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1494         s32 err;
1495         struct brcmf_scan_results *results;
1496         struct escan_info *escan = &cfg->escan_info;
1497
1498         brcmf_dbg(SCAN, "Enter\n");
1499         escan->ifp = ifp;
1500         escan->wiphy = cfg->wiphy;
1501         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1502
1503         brcmf_scan_config_mpc(ifp, 0);
1504         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1505         results->version = 0;
1506         results->count = 0;
1507         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1508
1509         err = escan->run(cfg, ifp, request);
1510         if (err)
1511                 brcmf_scan_config_mpc(ifp, 1);
1512         return err;
1513 }
1514
1515 static s32
1516 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1517 {
1518         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1519         struct brcmf_pub *drvr = cfg->pub;
1520         struct brcmf_cfg80211_vif *vif;
1521         s32 err = 0;
1522
1523         brcmf_dbg(TRACE, "Enter\n");
1524         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1525         if (!check_vif_up(vif))
1526                 return -EIO;
1527
1528         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1529                 bphy_err(drvr, "Scanning already: status (%lu)\n",
1530                          cfg->scan_status);
1531                 return -EAGAIN;
1532         }
1533         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1534                 bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1535                          cfg->scan_status);
1536                 return -EAGAIN;
1537         }
1538         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1539                 bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1540                          cfg->scan_status);
1541                 return -EAGAIN;
1542         }
1543         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1544                 bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1545                 return -EAGAIN;
1546         }
1547
1548         /* If scan req comes for p2p0, send it over primary I/F */
1549         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1550                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1551
1552         brcmf_dbg(SCAN, "START ESCAN\n");
1553
1554         cfg->scan_request = request;
1555         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1556
1557         cfg->escan_info.run = brcmf_run_escan;
1558         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1559         if (err)
1560                 goto scan_out;
1561
1562         err = brcmf_do_escan(vif->ifp, request);
1563         if (err)
1564                 goto scan_out;
1565
1566         /* Arm scan timeout timer */
1567         mod_timer(&cfg->escan_timeout,
1568                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1569
1570         return 0;
1571
1572 scan_out:
1573         bphy_err(drvr, "scan error (%d)\n", err);
1574         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1575         cfg->scan_request = NULL;
1576         return err;
1577 }
1578
1579 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1580 {
1581         struct brcmf_if *ifp = netdev_priv(ndev);
1582         struct brcmf_pub *drvr = ifp->drvr;
1583         s32 err = 0;
1584
1585         err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1586         if (err)
1587                 bphy_err(drvr, "Error (%d)\n", err);
1588
1589         return err;
1590 }
1591
1592 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1593 {
1594         struct brcmf_if *ifp = netdev_priv(ndev);
1595         struct brcmf_pub *drvr = ifp->drvr;
1596         s32 err = 0;
1597
1598         err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1599                                       frag_threshold);
1600         if (err)
1601                 bphy_err(drvr, "Error (%d)\n", err);
1602
1603         return err;
1604 }
1605
1606 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1607 {
1608         struct brcmf_if *ifp = netdev_priv(ndev);
1609         struct brcmf_pub *drvr = ifp->drvr;
1610         s32 err = 0;
1611         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1612
1613         err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1614         if (err) {
1615                 bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1616                 return err;
1617         }
1618         return err;
1619 }
1620
1621 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1622 {
1623         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1624         struct net_device *ndev = cfg_to_ndev(cfg);
1625         struct brcmf_if *ifp = netdev_priv(ndev);
1626         s32 err = 0;
1627
1628         brcmf_dbg(TRACE, "Enter\n");
1629         if (!check_vif_up(ifp->vif))
1630                 return -EIO;
1631
1632         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1633             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1634                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1635                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1636                 if (!err)
1637                         goto done;
1638         }
1639         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1640             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1641                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1642                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1643                 if (!err)
1644                         goto done;
1645         }
1646         if (changed & WIPHY_PARAM_RETRY_LONG
1647             && (cfg->conf->retry_long != wiphy->retry_long)) {
1648                 cfg->conf->retry_long = wiphy->retry_long;
1649                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1650                 if (!err)
1651                         goto done;
1652         }
1653         if (changed & WIPHY_PARAM_RETRY_SHORT
1654             && (cfg->conf->retry_short != wiphy->retry_short)) {
1655                 cfg->conf->retry_short = wiphy->retry_short;
1656                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1657                 if (!err)
1658                         goto done;
1659         }
1660
1661 done:
1662         brcmf_dbg(TRACE, "Exit\n");
1663         return err;
1664 }
1665
1666 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1667 {
1668         memset(prof, 0, sizeof(*prof));
1669 }
1670
1671 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1672 {
1673         u16 reason;
1674
1675         switch (e->event_code) {
1676         case BRCMF_E_DEAUTH:
1677         case BRCMF_E_DEAUTH_IND:
1678         case BRCMF_E_DISASSOC_IND:
1679                 reason = e->reason;
1680                 break;
1681         case BRCMF_E_LINK:
1682         default:
1683                 reason = 0;
1684                 break;
1685         }
1686         return reason;
1687 }
1688
1689 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1690 {
1691         struct brcmf_pub *drvr = ifp->drvr;
1692         struct brcmf_wsec_pmk_le pmk;
1693         int err;
1694
1695         memset(&pmk, 0, sizeof(pmk));
1696
1697         /* pass pmk directly */
1698         pmk.key_len = cpu_to_le16(pmk_len);
1699         pmk.flags = cpu_to_le16(0);
1700         memcpy(pmk.key, pmk_data, pmk_len);
1701
1702         /* store psk in firmware */
1703         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1704                                      &pmk, sizeof(pmk));
1705         if (err < 0)
1706                 bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1707                          pmk_len);
1708
1709         return err;
1710 }
1711
1712 static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
1713                                   u16 pwd_len)
1714 {
1715         struct brcmf_pub *drvr = ifp->drvr;
1716         struct brcmf_wsec_sae_pwd_le sae_pwd;
1717         int err;
1718
1719         if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
1720                 bphy_err(drvr, "sae_password must be less than %d\n",
1721                          BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
1722                 return -EINVAL;
1723         }
1724
1725         sae_pwd.key_len = cpu_to_le16(pwd_len);
1726         memcpy(sae_pwd.key, pwd_data, pwd_len);
1727
1728         err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
1729                                        sizeof(sae_pwd));
1730         if (err < 0)
1731                 bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
1732                          pwd_len);
1733
1734         return err;
1735 }
1736
1737 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1738                             bool locally_generated)
1739 {
1740         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1741         struct brcmf_pub *drvr = cfg->pub;
1742         bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1743         s32 err = 0;
1744
1745         brcmf_dbg(TRACE, "Enter\n");
1746
1747         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1748                 if (bus_up) {
1749                         brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1750                         err = brcmf_fil_cmd_data_set(vif->ifp,
1751                                                      BRCMF_C_DISASSOC, NULL, 0);
1752                         if (err)
1753                                 bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1754                                          err);
1755                 }
1756
1757                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1758                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1759                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1760                                               locally_generated, GFP_KERNEL);
1761         }
1762         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1763         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
1764         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
1765         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1766         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1767         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1768                 if (bus_up)
1769                         brcmf_set_pmk(vif->ifp, NULL, 0);
1770                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1771         }
1772         brcmf_dbg(TRACE, "Exit\n");
1773 }
1774
1775 static s32
1776 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1777                       struct cfg80211_ibss_params *params)
1778 {
1779         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1780         struct brcmf_if *ifp = netdev_priv(ndev);
1781         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1782         struct brcmf_pub *drvr = cfg->pub;
1783         struct brcmf_join_params join_params;
1784         size_t join_params_size = 0;
1785         s32 err = 0;
1786         s32 wsec = 0;
1787         s32 bcnprd;
1788         u16 chanspec;
1789         u32 ssid_len;
1790
1791         brcmf_dbg(TRACE, "Enter\n");
1792         if (!check_vif_up(ifp->vif))
1793                 return -EIO;
1794
1795         if (params->ssid)
1796                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1797         else {
1798                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1799                 return -EOPNOTSUPP;
1800         }
1801
1802         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1803
1804         if (params->bssid)
1805                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1806         else
1807                 brcmf_dbg(CONN, "No BSSID specified\n");
1808
1809         if (params->chandef.chan)
1810                 brcmf_dbg(CONN, "channel: %d\n",
1811                           params->chandef.chan->center_freq);
1812         else
1813                 brcmf_dbg(CONN, "no channel specified\n");
1814
1815         if (params->channel_fixed)
1816                 brcmf_dbg(CONN, "fixed channel required\n");
1817         else
1818                 brcmf_dbg(CONN, "no fixed channel required\n");
1819
1820         if (params->ie && params->ie_len)
1821                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1822         else
1823                 brcmf_dbg(CONN, "no ie specified\n");
1824
1825         if (params->beacon_interval)
1826                 brcmf_dbg(CONN, "beacon interval: %d\n",
1827                           params->beacon_interval);
1828         else
1829                 brcmf_dbg(CONN, "no beacon interval specified\n");
1830
1831         if (params->basic_rates)
1832                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1833         else
1834                 brcmf_dbg(CONN, "no basic rates specified\n");
1835
1836         if (params->privacy)
1837                 brcmf_dbg(CONN, "privacy required\n");
1838         else
1839                 brcmf_dbg(CONN, "no privacy required\n");
1840
1841         /* Configure Privacy for starter */
1842         if (params->privacy)
1843                 wsec |= WEP_ENABLED;
1844
1845         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1846         if (err) {
1847                 bphy_err(drvr, "wsec failed (%d)\n", err);
1848                 goto done;
1849         }
1850
1851         /* Configure Beacon Interval for starter */
1852         if (params->beacon_interval)
1853                 bcnprd = params->beacon_interval;
1854         else
1855                 bcnprd = 100;
1856
1857         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1858         if (err) {
1859                 bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1860                 goto done;
1861         }
1862
1863         /* Configure required join parameter */
1864         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1865
1866         /* SSID */
1867         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1868         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1869         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1870         join_params_size = sizeof(join_params.ssid_le);
1871
1872         /* BSSID */
1873         if (params->bssid) {
1874                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1875                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1876                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1877         } else {
1878                 eth_broadcast_addr(join_params.params_le.bssid);
1879                 eth_zero_addr(profile->bssid);
1880         }
1881
1882         /* Channel */
1883         if (params->chandef.chan) {
1884                 u32 target_channel;
1885
1886                 cfg->channel =
1887                         ieee80211_frequency_to_channel(
1888                                 params->chandef.chan->center_freq);
1889                 if (params->channel_fixed) {
1890                         /* adding chanspec */
1891                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1892                                                        &params->chandef);
1893                         join_params.params_le.chanspec_list[0] =
1894                                 cpu_to_le16(chanspec);
1895                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1896                         join_params_size += sizeof(join_params.params_le);
1897                 }
1898
1899                 /* set channel for starter */
1900                 target_channel = cfg->channel;
1901                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1902                                             target_channel);
1903                 if (err) {
1904                         bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1905                         goto done;
1906                 }
1907         } else
1908                 cfg->channel = 0;
1909
1910         cfg->ibss_starter = false;
1911
1912
1913         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1914                                      &join_params, join_params_size);
1915         if (err) {
1916                 bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1917                 goto done;
1918         }
1919
1920 done:
1921         if (err)
1922                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1923         brcmf_dbg(TRACE, "Exit\n");
1924         return err;
1925 }
1926
1927 static s32
1928 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1929 {
1930         struct brcmf_if *ifp = netdev_priv(ndev);
1931
1932         brcmf_dbg(TRACE, "Enter\n");
1933         if (!check_vif_up(ifp->vif)) {
1934                 /* When driver is being unloaded, it can end up here. If an
1935                  * error is returned then later on a debug trace in the wireless
1936                  * core module will be printed. To avoid this 0 is returned.
1937                  */
1938                 return 0;
1939         }
1940
1941         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1942         brcmf_net_setcarrier(ifp, false);
1943
1944         brcmf_dbg(TRACE, "Exit\n");
1945
1946         return 0;
1947 }
1948
1949 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1950                                  struct cfg80211_connect_params *sme)
1951 {
1952         struct brcmf_if *ifp = netdev_priv(ndev);
1953         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1954         struct brcmf_pub *drvr = ifp->drvr;
1955         struct brcmf_cfg80211_security *sec;
1956         s32 val = 0;
1957         s32 err = 0;
1958
1959         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1) {
1960                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1961         } else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2) {
1962                 if (sme->crypto.akm_suites[0] == WLAN_AKM_SUITE_SAE)
1963                         val = WPA3_AUTH_SAE_PSK;
1964                 else
1965                         val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1966         } else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3) {
1967                 val = WPA3_AUTH_SAE_PSK;
1968         } else {
1969                 val = WPA_AUTH_DISABLED;
1970         }
1971         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1972         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1973         if (err) {
1974                 bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1975                 return err;
1976         }
1977         sec = &profile->sec;
1978         sec->wpa_versions = sme->crypto.wpa_versions;
1979         return err;
1980 }
1981
1982 static s32 brcmf_set_auth_type(struct net_device *ndev,
1983                                struct cfg80211_connect_params *sme)
1984 {
1985         struct brcmf_if *ifp = netdev_priv(ndev);
1986         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1987         struct brcmf_pub *drvr = ifp->drvr;
1988         struct brcmf_cfg80211_security *sec;
1989         s32 val = 0;
1990         s32 err = 0;
1991
1992         switch (sme->auth_type) {
1993         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1994                 val = 0;
1995                 brcmf_dbg(CONN, "open system\n");
1996                 break;
1997         case NL80211_AUTHTYPE_SHARED_KEY:
1998                 val = 1;
1999                 brcmf_dbg(CONN, "shared key\n");
2000                 break;
2001         case NL80211_AUTHTYPE_SAE:
2002                 val = 3;
2003                 brcmf_dbg(CONN, "SAE authentication\n");
2004                 break;
2005         default:
2006                 val = 2;
2007                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
2008                 break;
2009         }
2010
2011         err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2012         if (err) {
2013                 bphy_err(drvr, "set auth failed (%d)\n", err);
2014                 return err;
2015         }
2016         sec = &profile->sec;
2017         sec->auth_type = sme->auth_type;
2018         return err;
2019 }
2020
2021 static s32
2022 brcmf_set_wsec_mode(struct net_device *ndev,
2023                     struct cfg80211_connect_params *sme)
2024 {
2025         struct brcmf_if *ifp = netdev_priv(ndev);
2026         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2027         struct brcmf_pub *drvr = ifp->drvr;
2028         struct brcmf_cfg80211_security *sec;
2029         s32 pval = 0;
2030         s32 gval = 0;
2031         s32 wsec;
2032         s32 err = 0;
2033
2034         if (sme->crypto.n_ciphers_pairwise) {
2035                 switch (sme->crypto.ciphers_pairwise[0]) {
2036                 case WLAN_CIPHER_SUITE_WEP40:
2037                 case WLAN_CIPHER_SUITE_WEP104:
2038                         pval = WEP_ENABLED;
2039                         break;
2040                 case WLAN_CIPHER_SUITE_TKIP:
2041                         pval = TKIP_ENABLED;
2042                         break;
2043                 case WLAN_CIPHER_SUITE_CCMP:
2044                         pval = AES_ENABLED;
2045                         break;
2046                 case WLAN_CIPHER_SUITE_AES_CMAC:
2047                         pval = AES_ENABLED;
2048                         break;
2049                 default:
2050                         bphy_err(drvr, "invalid cipher pairwise (%d)\n",
2051                                  sme->crypto.ciphers_pairwise[0]);
2052                         return -EINVAL;
2053                 }
2054         }
2055         if (sme->crypto.cipher_group) {
2056                 switch (sme->crypto.cipher_group) {
2057                 case WLAN_CIPHER_SUITE_WEP40:
2058                 case WLAN_CIPHER_SUITE_WEP104:
2059                         gval = WEP_ENABLED;
2060                         break;
2061                 case WLAN_CIPHER_SUITE_TKIP:
2062                         gval = TKIP_ENABLED;
2063                         break;
2064                 case WLAN_CIPHER_SUITE_CCMP:
2065                         gval = AES_ENABLED;
2066                         break;
2067                 case WLAN_CIPHER_SUITE_AES_CMAC:
2068                         gval = AES_ENABLED;
2069                         break;
2070                 default:
2071                         bphy_err(drvr, "invalid cipher group (%d)\n",
2072                                  sme->crypto.cipher_group);
2073                         return -EINVAL;
2074                 }
2075         }
2076
2077         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
2078         /* In case of privacy, but no security and WPS then simulate */
2079         /* setting AES. WPS-2.0 allows no security                   */
2080         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
2081             sme->privacy)
2082                 pval = AES_ENABLED;
2083
2084         wsec = pval | gval;
2085         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2086         if (err) {
2087                 bphy_err(drvr, "error (%d)\n", err);
2088                 return err;
2089         }
2090
2091         sec = &profile->sec;
2092         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
2093         sec->cipher_group = sme->crypto.cipher_group;
2094
2095         return err;
2096 }
2097
2098 static s32
2099 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
2100 {
2101         struct brcmf_if *ifp = netdev_priv(ndev);
2102         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2103         struct brcmf_pub *drvr = ifp->drvr;
2104         s32 val;
2105         s32 err;
2106         const struct brcmf_tlv *rsn_ie;
2107         const u8 *ie;
2108         u32 ie_len;
2109         u32 offset;
2110         u16 rsn_cap;
2111         u32 mfp;
2112         u16 count;
2113
2114         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2115         profile->is_ft = false;
2116
2117         if (!sme->crypto.n_akm_suites)
2118                 return 0;
2119
2120         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
2121         if (err) {
2122                 bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
2123                 return err;
2124         }
2125         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
2126                 switch (sme->crypto.akm_suites[0]) {
2127                 case WLAN_AKM_SUITE_8021X:
2128                         val = WPA_AUTH_UNSPECIFIED;
2129                         if (sme->want_1x)
2130                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2131                         break;
2132                 case WLAN_AKM_SUITE_PSK:
2133                         val = WPA_AUTH_PSK;
2134                         break;
2135                 default:
2136                         bphy_err(drvr, "invalid akm suite (%d)\n",
2137                                  sme->crypto.akm_suites[0]);
2138                         return -EINVAL;
2139                 }
2140         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
2141                 switch (sme->crypto.akm_suites[0]) {
2142                 case WLAN_AKM_SUITE_8021X:
2143                         val = WPA2_AUTH_UNSPECIFIED;
2144                         if (sme->want_1x)
2145                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2146                         break;
2147                 case WLAN_AKM_SUITE_8021X_SHA256:
2148                         val = WPA2_AUTH_1X_SHA256;
2149                         if (sme->want_1x)
2150                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2151                         break;
2152                 case WLAN_AKM_SUITE_PSK_SHA256:
2153                         val = WPA2_AUTH_PSK_SHA256;
2154                         break;
2155                 case WLAN_AKM_SUITE_PSK:
2156                         val = WPA2_AUTH_PSK;
2157                         break;
2158                 case WLAN_AKM_SUITE_FT_8021X:
2159                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
2160                         profile->is_ft = true;
2161                         if (sme->want_1x)
2162                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2163                         break;
2164                 case WLAN_AKM_SUITE_FT_PSK:
2165                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
2166                         profile->is_ft = true;
2167                         break;
2168                 default:
2169                         bphy_err(drvr, "invalid akm suite (%d)\n",
2170                                  sme->crypto.akm_suites[0]);
2171                         return -EINVAL;
2172                 }
2173         } else if (val & WPA3_AUTH_SAE_PSK) {
2174                 switch (sme->crypto.akm_suites[0]) {
2175                 case WLAN_AKM_SUITE_SAE:
2176                         val = WPA3_AUTH_SAE_PSK;
2177                         if (sme->crypto.sae_pwd) {
2178                                 brcmf_dbg(INFO, "using SAE offload\n");
2179                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2180                         }
2181                         break;
2182                 case WLAN_AKM_SUITE_FT_OVER_SAE:
2183                         val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
2184                         profile->is_ft = true;
2185                         if (sme->crypto.sae_pwd) {
2186                                 brcmf_dbg(INFO, "using SAE offload\n");
2187                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2188                         }
2189                         break;
2190                 default:
2191                         bphy_err(drvr, "invalid akm suite (%d)\n",
2192                                  sme->crypto.akm_suites[0]);
2193                         return -EINVAL;
2194                 }
2195         }
2196
2197         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
2198                 brcmf_dbg(INFO, "using 1X offload\n");
2199
2200         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2201                 goto skip_mfp_config;
2202         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
2203          * IE will not be verified, just a quick search for MFP config
2204          */
2205         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
2206                                   WLAN_EID_RSN);
2207         if (!rsn_ie)
2208                 goto skip_mfp_config;
2209         ie = (const u8 *)rsn_ie;
2210         ie_len = rsn_ie->len + TLV_HDR_LEN;
2211         /* Skip unicast suite */
2212         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
2213         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2214                 goto skip_mfp_config;
2215         /* Skip multicast suite */
2216         count = ie[offset] + (ie[offset + 1] << 8);
2217         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2218         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2219                 goto skip_mfp_config;
2220         /* Skip auth key management suite(s) */
2221         count = ie[offset] + (ie[offset + 1] << 8);
2222         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2223         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
2224                 goto skip_mfp_config;
2225         /* Ready to read capabilities */
2226         mfp = BRCMF_MFP_NONE;
2227         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
2228         if (rsn_cap & RSN_CAP_MFPR_MASK)
2229                 mfp = BRCMF_MFP_REQUIRED;
2230         else if (rsn_cap & RSN_CAP_MFPC_MASK)
2231                 mfp = BRCMF_MFP_CAPABLE;
2232         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
2233
2234 skip_mfp_config:
2235         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
2236         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
2237         if (err) {
2238                 bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
2239                 return err;
2240         }
2241
2242         return err;
2243 }
2244
2245 static s32
2246 brcmf_set_sharedkey(struct net_device *ndev,
2247                     struct cfg80211_connect_params *sme)
2248 {
2249         struct brcmf_if *ifp = netdev_priv(ndev);
2250         struct brcmf_pub *drvr = ifp->drvr;
2251         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2252         struct brcmf_cfg80211_security *sec;
2253         struct brcmf_wsec_key key;
2254         s32 val;
2255         s32 err = 0;
2256
2257         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
2258
2259         if (sme->key_len == 0)
2260                 return 0;
2261
2262         sec = &profile->sec;
2263         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
2264                   sec->wpa_versions, sec->cipher_pairwise);
2265
2266         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
2267                                  NL80211_WPA_VERSION_3))
2268                 return 0;
2269
2270         if (!(sec->cipher_pairwise &
2271             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
2272                 return 0;
2273
2274         memset(&key, 0, sizeof(key));
2275         key.len = (u32) sme->key_len;
2276         key.index = (u32) sme->key_idx;
2277         if (key.len > sizeof(key.data)) {
2278                 bphy_err(drvr, "Too long key length (%u)\n", key.len);
2279                 return -EINVAL;
2280         }
2281         memcpy(key.data, sme->key, key.len);
2282         key.flags = BRCMF_PRIMARY_KEY;
2283         switch (sec->cipher_pairwise) {
2284         case WLAN_CIPHER_SUITE_WEP40:
2285                 key.algo = CRYPTO_ALGO_WEP1;
2286                 break;
2287         case WLAN_CIPHER_SUITE_WEP104:
2288                 key.algo = CRYPTO_ALGO_WEP128;
2289                 break;
2290         default:
2291                 bphy_err(drvr, "Invalid algorithm (%d)\n",
2292                          sme->crypto.ciphers_pairwise[0]);
2293                 return -EINVAL;
2294         }
2295         /* Set the new key/index */
2296         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
2297                   key.len, key.index, key.algo);
2298         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
2299         err = send_key_to_dongle(ifp, &key);
2300         if (err)
2301                 return err;
2302
2303         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
2304                 brcmf_dbg(CONN, "set auth_type to shared key\n");
2305                 val = WL_AUTH_SHARED_KEY;       /* shared key */
2306                 err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2307                 if (err)
2308                         bphy_err(drvr, "set auth failed (%d)\n", err);
2309         }
2310         return err;
2311 }
2312
2313 static
2314 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
2315                                            enum nl80211_auth_type type)
2316 {
2317         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
2318             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
2319                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
2320                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2321         }
2322         return type;
2323 }
2324
2325 static void brcmf_set_join_pref(struct brcmf_if *ifp,
2326                                 struct cfg80211_bss_selection *bss_select)
2327 {
2328         struct brcmf_pub *drvr = ifp->drvr;
2329         struct brcmf_join_pref_params join_pref_params[2];
2330         enum nl80211_band band;
2331         int err, i = 0;
2332
2333         join_pref_params[i].len = 2;
2334         join_pref_params[i].rssi_gain = 0;
2335
2336         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
2337                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
2338
2339         switch (bss_select->behaviour) {
2340         case __NL80211_BSS_SELECT_ATTR_INVALID:
2341                 brcmf_c_set_joinpref_default(ifp);
2342                 return;
2343         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
2344                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
2345                 band = bss_select->param.band_pref;
2346                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2347                 i++;
2348                 break;
2349         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2350                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2351                 band = bss_select->param.adjust.band;
2352                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2353                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2354                 i++;
2355                 break;
2356         case NL80211_BSS_SELECT_ATTR_RSSI:
2357         default:
2358                 break;
2359         }
2360         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2361         join_pref_params[i].len = 2;
2362         join_pref_params[i].rssi_gain = 0;
2363         join_pref_params[i].band = 0;
2364         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2365                                        sizeof(join_pref_params));
2366         if (err)
2367                 bphy_err(drvr, "Set join_pref error (%d)\n", err);
2368 }
2369
2370 static s32
2371 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2372                        struct cfg80211_connect_params *sme)
2373 {
2374         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2375         struct brcmf_if *ifp = netdev_priv(ndev);
2376         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2377         struct ieee80211_channel *chan = sme->channel;
2378         struct brcmf_pub *drvr = ifp->drvr;
2379         struct brcmf_join_params join_params;
2380         size_t join_params_size;
2381         const struct brcmf_tlv *rsn_ie;
2382         const struct brcmf_vs_tlv *wpa_ie;
2383         const void *ie;
2384         u32 ie_len;
2385         struct brcmf_ext_join_params_le *ext_join_params;
2386         u16 chanspec;
2387         s32 err = 0;
2388         u32 ssid_len;
2389
2390         brcmf_dbg(TRACE, "Enter\n");
2391         if (!check_vif_up(ifp->vif))
2392                 return -EIO;
2393
2394         if (!sme->ssid) {
2395                 bphy_err(drvr, "Invalid ssid\n");
2396                 return -EOPNOTSUPP;
2397         }
2398
2399         if (sme->channel_hint)
2400                 chan = sme->channel_hint;
2401
2402         if (sme->bssid_hint)
2403                 sme->bssid = sme->bssid_hint;
2404
2405         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2406                 /* A normal (non P2P) connection request setup. */
2407                 ie = NULL;
2408                 ie_len = 0;
2409                 /* find the WPA_IE */
2410                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2411                 if (wpa_ie) {
2412                         ie = wpa_ie;
2413                         ie_len = wpa_ie->len + TLV_HDR_LEN;
2414                 } else {
2415                         /* find the RSN_IE */
2416                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2417                                                   sme->ie_len,
2418                                                   WLAN_EID_RSN);
2419                         if (rsn_ie) {
2420                                 ie = rsn_ie;
2421                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
2422                         }
2423                 }
2424                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2425         }
2426
2427         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2428                                     sme->ie, sme->ie_len);
2429         if (err)
2430                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2431         else
2432                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2433
2434         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2435
2436         if (chan) {
2437                 cfg->channel =
2438                         ieee80211_frequency_to_channel(chan->center_freq);
2439                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2440                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2441                           cfg->channel, chan->center_freq, chanspec);
2442         } else {
2443                 cfg->channel = 0;
2444                 chanspec = 0;
2445         }
2446
2447         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2448
2449         err = brcmf_set_wpa_version(ndev, sme);
2450         if (err) {
2451                 bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2452                 goto done;
2453         }
2454
2455         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2456         err = brcmf_set_auth_type(ndev, sme);
2457         if (err) {
2458                 bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2459                 goto done;
2460         }
2461
2462         err = brcmf_set_wsec_mode(ndev, sme);
2463         if (err) {
2464                 bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2465                 goto done;
2466         }
2467
2468         err = brcmf_set_key_mgmt(ndev, sme);
2469         if (err) {
2470                 bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2471                 goto done;
2472         }
2473
2474         err = brcmf_set_sharedkey(ndev, sme);
2475         if (err) {
2476                 bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2477                 goto done;
2478         }
2479
2480         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
2481                 if (sme->crypto.psk) {
2482                         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2483                                 if (WARN_ON(profile->use_fwsup !=
2484                                         BRCMF_PROFILE_FWSUP_NONE)) {
2485                                         err = -EINVAL;
2486                                         goto done;
2487                                 }
2488                                 brcmf_dbg(INFO, "using PSK offload\n");
2489                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2490                         }
2491                 } else {
2492                         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2493                 }
2494
2495                 if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2496                         /* enable firmware supplicant for this interface */
2497                         err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2498                         if (err < 0) {
2499                                 bphy_err(drvr, "failed to enable fw supplicant\n");
2500                                 goto done;
2501                         }
2502                 } else {
2503                         err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
2504                 }
2505
2506                 if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2507                         err = brcmf_set_pmk(ifp, sme->crypto.psk,
2508                                             BRCMF_WSEC_MAX_PSK_LEN);
2509                 else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2510                         /* clean up user-space RSNE */
2511                         if (brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0)) {
2512                                 bphy_err(drvr, "failed to clean up user-space RSNE\n");
2513                                 goto done;
2514                         }
2515                         err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
2516                                                      sme->crypto.sae_pwd_len);
2517                         if (!err && sme->crypto.psk)
2518                                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2519                                                     BRCMF_WSEC_MAX_PSK_LEN);
2520                 }
2521                 if (err)
2522                         goto done;
2523         }
2524         /* Join with specific BSSID and cached SSID
2525          * If SSID is zero join based on BSSID only
2526          */
2527         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2528                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2529         if (cfg->channel)
2530                 join_params_size += sizeof(u16);
2531         ext_join_params = kzalloc(sizeof(*ext_join_params), GFP_KERNEL);
2532         if (ext_join_params == NULL) {
2533                 err = -ENOMEM;
2534                 goto done;
2535         }
2536         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2537         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2538         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2539         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2540                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2541                           ext_join_params->ssid_le.SSID, ssid_len);
2542
2543         /* Set up join scan parameters */
2544         ext_join_params->scan_le.scan_type = -1;
2545         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2546
2547         if (sme->bssid)
2548                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2549         else
2550                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2551
2552         if (cfg->channel) {
2553                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2554
2555                 ext_join_params->assoc_le.chanspec_list[0] =
2556                         cpu_to_le16(chanspec);
2557                 /* Increase dwell time to receive probe response or detect
2558                  * beacon from target AP at a noisy air only during connect
2559                  * command.
2560                  */
2561                 ext_join_params->scan_le.active_time =
2562                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2563                 ext_join_params->scan_le.passive_time =
2564                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2565                 /* To sync with presence period of VSDB GO send probe request
2566                  * more frequently. Probe request will be stopped when it gets
2567                  * probe response from target AP/GO.
2568                  */
2569                 ext_join_params->scan_le.nprobes =
2570                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2571                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2572         } else {
2573                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2574                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2575                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2576         }
2577
2578         brcmf_set_join_pref(ifp, &sme->bss_select);
2579
2580         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2581                                          join_params_size);
2582         kfree(ext_join_params);
2583         if (!err)
2584                 /* This is it. join command worked, we are done */
2585                 goto done;
2586
2587         /* join command failed, fallback to set ssid */
2588         memset(&join_params, 0, sizeof(join_params));
2589         join_params_size = sizeof(join_params.ssid_le);
2590
2591         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2592         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2593
2594         if (sme->bssid)
2595                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2596         else
2597                 eth_broadcast_addr(join_params.params_le.bssid);
2598
2599         if (cfg->channel) {
2600                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2601                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2602                 join_params_size += sizeof(join_params.params_le);
2603         }
2604         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2605                                      &join_params, join_params_size);
2606         if (err)
2607                 bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2608
2609 done:
2610         if (err)
2611                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2612         brcmf_dbg(TRACE, "Exit\n");
2613         return err;
2614 }
2615
2616 static s32
2617 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2618                        u16 reason_code)
2619 {
2620         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2621         struct brcmf_if *ifp = netdev_priv(ndev);
2622         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2623         struct brcmf_pub *drvr = cfg->pub;
2624         struct brcmf_scb_val_le scbval;
2625         s32 err = 0;
2626
2627         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2628         if (!check_vif_up(ifp->vif))
2629                 return -EIO;
2630
2631         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2632         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2633         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &ifp->vif->sme_state);
2634         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &ifp->vif->sme_state);
2635         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2636
2637         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2638         scbval.val = cpu_to_le32(reason_code);
2639         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2640                                      &scbval, sizeof(scbval));
2641         if (err)
2642                 bphy_err(drvr, "error (%d)\n", err);
2643
2644         brcmf_dbg(TRACE, "Exit\n");
2645         return err;
2646 }
2647
2648 static s32
2649 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2650                             enum nl80211_tx_power_setting type, s32 mbm)
2651 {
2652         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2653         struct net_device *ndev = cfg_to_ndev(cfg);
2654         struct brcmf_if *ifp = netdev_priv(ndev);
2655         struct brcmf_pub *drvr = cfg->pub;
2656         s32 err;
2657         s32 disable;
2658         u32 qdbm = 127;
2659
2660         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2661         if (!check_vif_up(ifp->vif))
2662                 return -EIO;
2663
2664         switch (type) {
2665         case NL80211_TX_POWER_AUTOMATIC:
2666                 break;
2667         case NL80211_TX_POWER_LIMITED:
2668         case NL80211_TX_POWER_FIXED:
2669                 if (mbm < 0) {
2670                         bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2671                         err = -EINVAL;
2672                         goto done;
2673                 }
2674                 qdbm =  MBM_TO_DBM(4 * mbm);
2675                 if (qdbm > 127)
2676                         qdbm = 127;
2677                 qdbm |= WL_TXPWR_OVERRIDE;
2678                 break;
2679         default:
2680                 bphy_err(drvr, "Unsupported type %d\n", type);
2681                 err = -EINVAL;
2682                 goto done;
2683         }
2684         /* Make sure radio is off or on as far as software is concerned */
2685         disable = WL_RADIO_SW_DISABLE << 16;
2686         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2687         if (err)
2688                 bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2689
2690         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2691         if (err)
2692                 bphy_err(drvr, "qtxpower error (%d)\n", err);
2693
2694 done:
2695         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2696         return err;
2697 }
2698
2699 static s32
2700 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2701                             s32 *dbm)
2702 {
2703         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2704         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2705         struct brcmf_pub *drvr = cfg->pub;
2706         s32 qdbm = 0;
2707         s32 err;
2708
2709         brcmf_dbg(TRACE, "Enter\n");
2710         if (!check_vif_up(vif))
2711                 return -EIO;
2712
2713         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2714         if (err) {
2715                 bphy_err(drvr, "error (%d)\n", err);
2716                 goto done;
2717         }
2718         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2719
2720 done:
2721         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2722         return err;
2723 }
2724
2725 static s32
2726 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2727                                   int link_id, u8 key_idx, bool unicast,
2728                                   bool multicast)
2729 {
2730         struct brcmf_if *ifp = netdev_priv(ndev);
2731         struct brcmf_pub *drvr = ifp->drvr;
2732         u32 index;
2733         u32 wsec;
2734         s32 err = 0;
2735
2736         brcmf_dbg(TRACE, "Enter\n");
2737         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2738         if (!check_vif_up(ifp->vif))
2739                 return -EIO;
2740
2741         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2742         if (err) {
2743                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2744                 goto done;
2745         }
2746
2747         if (wsec & WEP_ENABLED) {
2748                 /* Just select a new current key */
2749                 index = key_idx;
2750                 err = brcmf_fil_cmd_int_set(ifp,
2751                                             BRCMF_C_SET_KEY_PRIMARY, index);
2752                 if (err)
2753                         bphy_err(drvr, "error (%d)\n", err);
2754         }
2755 done:
2756         brcmf_dbg(TRACE, "Exit\n");
2757         return err;
2758 }
2759
2760 static s32
2761 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2762                        int link_id, u8 key_idx, bool pairwise,
2763                        const u8 *mac_addr)
2764 {
2765         struct brcmf_if *ifp = netdev_priv(ndev);
2766         struct brcmf_wsec_key *key;
2767         s32 err;
2768
2769         brcmf_dbg(TRACE, "Enter\n");
2770         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2771
2772         if (!check_vif_up(ifp->vif))
2773                 return -EIO;
2774
2775         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2776                 /* we ignore this key index in this case */
2777                 return -EINVAL;
2778         }
2779
2780         key = &ifp->vif->profile.key[key_idx];
2781
2782         if (key->algo == CRYPTO_ALGO_OFF) {
2783                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2784                 return -EINVAL;
2785         }
2786
2787         memset(key, 0, sizeof(*key));
2788         key->index = (u32)key_idx;
2789         key->flags = BRCMF_PRIMARY_KEY;
2790
2791         /* Clear the key/index */
2792         err = send_key_to_dongle(ifp, key);
2793
2794         brcmf_dbg(TRACE, "Exit\n");
2795         return err;
2796 }
2797
2798 static s32
2799 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2800                        int link_id, u8 key_idx, bool pairwise,
2801                        const u8 *mac_addr, struct key_params *params)
2802 {
2803         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2804         struct brcmf_if *ifp = netdev_priv(ndev);
2805         struct brcmf_pub *drvr = cfg->pub;
2806         struct brcmf_wsec_key *key;
2807         s32 val;
2808         s32 wsec;
2809         s32 err;
2810         u8 keybuf[8];
2811         bool ext_key;
2812
2813         brcmf_dbg(TRACE, "Enter\n");
2814         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2815         if (!check_vif_up(ifp->vif))
2816                 return -EIO;
2817
2818         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2819                 /* we ignore this key index in this case */
2820                 bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2821                 return -EINVAL;
2822         }
2823
2824         if (params->key_len == 0)
2825                 return brcmf_cfg80211_del_key(wiphy, ndev, -1, key_idx,
2826                                               pairwise, mac_addr);
2827
2828         if (params->key_len > sizeof(key->data)) {
2829                 bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2830                 return -EINVAL;
2831         }
2832
2833         ext_key = false;
2834         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2835             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2836                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2837                 ext_key = true;
2838         }
2839
2840         key = &ifp->vif->profile.key[key_idx];
2841         memset(key, 0, sizeof(*key));
2842         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2843                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2844         key->len = params->key_len;
2845         key->index = key_idx;
2846         memcpy(key->data, params->key, key->len);
2847         if (!ext_key)
2848                 key->flags = BRCMF_PRIMARY_KEY;
2849
2850         if (params->seq && params->seq_len == 6) {
2851                 /* rx iv */
2852                 u8 *ivptr;
2853
2854                 ivptr = (u8 *)params->seq;
2855                 key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2856                         (ivptr[3] << 8) | ivptr[2];
2857                 key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2858                 key->iv_initialized = true;
2859         }
2860
2861         switch (params->cipher) {
2862         case WLAN_CIPHER_SUITE_WEP40:
2863                 key->algo = CRYPTO_ALGO_WEP1;
2864                 val = WEP_ENABLED;
2865                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2866                 break;
2867         case WLAN_CIPHER_SUITE_WEP104:
2868                 key->algo = CRYPTO_ALGO_WEP128;
2869                 val = WEP_ENABLED;
2870                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2871                 break;
2872         case WLAN_CIPHER_SUITE_TKIP:
2873                 if (!brcmf_is_apmode(ifp->vif)) {
2874                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2875                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2876                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2877                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2878                 }
2879                 key->algo = CRYPTO_ALGO_TKIP;
2880                 val = TKIP_ENABLED;
2881                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2882                 break;
2883         case WLAN_CIPHER_SUITE_AES_CMAC:
2884                 key->algo = CRYPTO_ALGO_AES_CCM;
2885                 val = AES_ENABLED;
2886                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2887                 break;
2888         case WLAN_CIPHER_SUITE_CCMP:
2889                 key->algo = CRYPTO_ALGO_AES_CCM;
2890                 val = AES_ENABLED;
2891                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2892                 break;
2893         default:
2894                 bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2895                 err = -EINVAL;
2896                 goto done;
2897         }
2898
2899         err = send_key_to_dongle(ifp, key);
2900         if (ext_key || err)
2901                 goto done;
2902
2903         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2904         if (err) {
2905                 bphy_err(drvr, "get wsec error (%d)\n", err);
2906                 goto done;
2907         }
2908         wsec |= val;
2909         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2910         if (err) {
2911                 bphy_err(drvr, "set wsec error (%d)\n", err);
2912                 goto done;
2913         }
2914
2915 done:
2916         brcmf_dbg(TRACE, "Exit\n");
2917         return err;
2918 }
2919
2920 static s32
2921 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2922                        int link_id, u8 key_idx, bool pairwise,
2923                        const u8 *mac_addr, void *cookie,
2924                        void (*callback)(void *cookie,
2925                                         struct key_params *params))
2926 {
2927         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2928         struct key_params params;
2929         struct brcmf_if *ifp = netdev_priv(ndev);
2930         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2931         struct brcmf_pub *drvr = cfg->pub;
2932         struct brcmf_cfg80211_security *sec;
2933         s32 wsec;
2934         s32 err = 0;
2935
2936         brcmf_dbg(TRACE, "Enter\n");
2937         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2938         if (!check_vif_up(ifp->vif))
2939                 return -EIO;
2940
2941         memset(&params, 0, sizeof(params));
2942
2943         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2944         if (err) {
2945                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2946                 /* Ignore this error, may happen during DISASSOC */
2947                 err = -EAGAIN;
2948                 goto done;
2949         }
2950         if (wsec & WEP_ENABLED) {
2951                 sec = &profile->sec;
2952                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2953                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2954                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2955                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2956                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2957                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2958                 }
2959         } else if (wsec & TKIP_ENABLED) {
2960                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2961                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2962         } else if (wsec & AES_ENABLED) {
2963                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2964                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2965         } else  {
2966                 bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2967                 err = -EINVAL;
2968                 goto done;
2969         }
2970         callback(cookie, &params);
2971
2972 done:
2973         brcmf_dbg(TRACE, "Exit\n");
2974         return err;
2975 }
2976
2977 static s32
2978 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2979                                        struct net_device *ndev, int link_id,
2980                                        u8 key_idx)
2981 {
2982         struct brcmf_if *ifp = netdev_priv(ndev);
2983
2984         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2985
2986         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2987                 return 0;
2988
2989         brcmf_dbg(INFO, "Not supported\n");
2990
2991         return -EOPNOTSUPP;
2992 }
2993
2994 static void
2995 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2996 {
2997         struct brcmf_pub *drvr = ifp->drvr;
2998         s32 err;
2999         u8 key_idx;
3000         struct brcmf_wsec_key *key;
3001         s32 wsec;
3002
3003         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
3004                 key = &ifp->vif->profile.key[key_idx];
3005                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
3006                     (key->algo == CRYPTO_ALGO_WEP128))
3007                         break;
3008         }
3009         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
3010                 return;
3011
3012         err = send_key_to_dongle(ifp, key);
3013         if (err) {
3014                 bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
3015                 return;
3016         }
3017         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
3018         if (err) {
3019                 bphy_err(drvr, "get wsec error (%d)\n", err);
3020                 return;
3021         }
3022         wsec |= WEP_ENABLED;
3023         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3024         if (err)
3025                 bphy_err(drvr, "set wsec error (%d)\n", err);
3026 }
3027
3028 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
3029 {
3030         struct nl80211_sta_flag_update *sfu;
3031
3032         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
3033         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
3034         sfu = &si->sta_flags;
3035         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
3036                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3037                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
3038                     BIT(NL80211_STA_FLAG_AUTHORIZED);
3039         if (fw_sta_flags & BRCMF_STA_WME)
3040                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
3041         if (fw_sta_flags & BRCMF_STA_AUTHE)
3042                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3043         if (fw_sta_flags & BRCMF_STA_ASSOC)
3044                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3045         if (fw_sta_flags & BRCMF_STA_AUTHO)
3046                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3047 }
3048
3049 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
3050 {
3051         struct brcmf_pub *drvr = ifp->drvr;
3052         struct {
3053                 __le32 len;
3054                 struct brcmf_bss_info_le bss_le;
3055         } *buf;
3056         u16 capability;
3057         int err;
3058
3059         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3060         if (!buf)
3061                 return;
3062
3063         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
3064         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
3065                                      WL_BSS_INFO_MAX);
3066         if (err) {
3067                 bphy_err(drvr, "Failed to get bss info (%d)\n", err);
3068                 goto out_kfree;
3069         }
3070         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
3071         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
3072         si->bss_param.dtim_period = buf->bss_le.dtim_period;
3073         capability = le16_to_cpu(buf->bss_le.capability);
3074         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
3075                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
3076         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3077                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
3078         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
3079                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
3080
3081 out_kfree:
3082         kfree(buf);
3083 }
3084
3085 static s32
3086 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
3087                                 struct station_info *sinfo)
3088 {
3089         struct brcmf_pub *drvr = ifp->drvr;
3090         struct brcmf_scb_val_le scbval;
3091         struct brcmf_pktcnt_le pktcnt;
3092         s32 err;
3093         u32 rate;
3094         u32 rssi;
3095
3096         /* Get the current tx rate */
3097         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
3098         if (err < 0) {
3099                 bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
3100                 return err;
3101         }
3102         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3103         sinfo->txrate.legacy = rate * 5;
3104
3105         memset(&scbval, 0, sizeof(scbval));
3106         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
3107                                      sizeof(scbval));
3108         if (err) {
3109                 bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
3110                 return err;
3111         }
3112         rssi = le32_to_cpu(scbval.val);
3113         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3114         sinfo->signal = rssi;
3115
3116         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
3117                                      sizeof(pktcnt));
3118         if (err) {
3119                 bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
3120                 return err;
3121         }
3122         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
3123                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
3124                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
3125                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3126         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
3127         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
3128         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
3129         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
3130
3131         return 0;
3132 }
3133
3134 static s32
3135 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
3136                            const u8 *mac, struct station_info *sinfo)
3137 {
3138         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3139         struct brcmf_if *ifp = netdev_priv(ndev);
3140         struct brcmf_pub *drvr = cfg->pub;
3141         struct brcmf_scb_val_le scb_val;
3142         s32 err = 0;
3143         struct brcmf_sta_info_le sta_info_le;
3144         u32 sta_flags;
3145         u32 is_tdls_peer;
3146         s32 total_rssi_avg = 0;
3147         s32 total_rssi = 0;
3148         s32 count_rssi = 0;
3149         int rssi;
3150         u32 i;
3151
3152         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
3153         if (!check_vif_up(ifp->vif))
3154                 return -EIO;
3155
3156         if (brcmf_is_ibssmode(ifp->vif))
3157                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
3158
3159         memset(&sta_info_le, 0, sizeof(sta_info_le));
3160         memcpy(&sta_info_le, mac, ETH_ALEN);
3161         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
3162                                        &sta_info_le,
3163                                        sizeof(sta_info_le));
3164         is_tdls_peer = !err;
3165         if (err) {
3166                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
3167                                                &sta_info_le,
3168                                                sizeof(sta_info_le));
3169                 if (err < 0) {
3170                         bphy_err(drvr, "GET STA INFO failed, %d\n", err);
3171                         goto done;
3172                 }
3173         }
3174         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
3175         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
3176         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
3177         sta_flags = le32_to_cpu(sta_info_le.flags);
3178         brcmf_convert_sta_flags(sta_flags, sinfo);
3179         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3180         if (is_tdls_peer)
3181                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3182         else
3183                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3184         if (sta_flags & BRCMF_STA_ASSOC) {
3185                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
3186                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
3187                 brcmf_fill_bss_param(ifp, sinfo);
3188         }
3189         if (sta_flags & BRCMF_STA_SCBSTATS) {
3190                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3191                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
3192                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
3193                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
3194                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
3195                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
3196                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
3197                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
3198                 if (sinfo->tx_packets) {
3199                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3200                         sinfo->txrate.legacy =
3201                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
3202                 }
3203                 if (sinfo->rx_packets) {
3204                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
3205                         sinfo->rxrate.legacy =
3206                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
3207                 }
3208                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
3209                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
3210                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
3211                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
3212                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
3213                 }
3214                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
3215                         if (sta_info_le.rssi[i] == 0 ||
3216                             sta_info_le.rx_lastpkt_rssi[i] == 0)
3217                                 continue;
3218                         sinfo->chains |= BIT(count_rssi);
3219                         sinfo->chain_signal[count_rssi] =
3220                                 sta_info_le.rx_lastpkt_rssi[i];
3221                         sinfo->chain_signal_avg[count_rssi] =
3222                                 sta_info_le.rssi[i];
3223                         total_rssi += sta_info_le.rx_lastpkt_rssi[i];
3224                         total_rssi_avg += sta_info_le.rssi[i];
3225                         count_rssi++;
3226                 }
3227                 if (count_rssi) {
3228                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3229                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
3230                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
3231                         sinfo->filled |=
3232                                 BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
3233                         sinfo->signal = total_rssi / count_rssi;
3234                         sinfo->signal_avg = total_rssi_avg / count_rssi;
3235                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
3236                         &ifp->vif->sme_state)) {
3237                         memset(&scb_val, 0, sizeof(scb_val));
3238                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
3239                                                      &scb_val, sizeof(scb_val));
3240                         if (err) {
3241                                 bphy_err(drvr, "Could not get rssi (%d)\n",
3242                                          err);
3243                                 goto done;
3244                         } else {
3245                                 rssi = le32_to_cpu(scb_val.val);
3246                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3247                                 sinfo->signal = rssi;
3248                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
3249                         }
3250                 }
3251         }
3252 done:
3253         brcmf_dbg(TRACE, "Exit\n");
3254         return err;
3255 }
3256
3257 static int
3258 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
3259                             int idx, u8 *mac, struct station_info *sinfo)
3260 {
3261         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3262         struct brcmf_if *ifp = netdev_priv(ndev);
3263         struct brcmf_pub *drvr = cfg->pub;
3264         s32 err;
3265
3266         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
3267
3268         if (idx == 0) {
3269                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
3270                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
3271                                              &cfg->assoclist,
3272                                              sizeof(cfg->assoclist));
3273                 if (err) {
3274                         /* GET_ASSOCLIST unsupported by firmware of older chips */
3275                         if (err == -EBADE)
3276                                 bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
3277                         else
3278                                 bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
3279                                          err);
3280
3281                         cfg->assoclist.count = 0;
3282                         return -EOPNOTSUPP;
3283                 }
3284         }
3285         if (idx < le32_to_cpu(cfg->assoclist.count)) {
3286                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
3287                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
3288         }
3289         return -ENOENT;
3290 }
3291
3292 static s32
3293 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
3294                            bool enabled, s32 timeout)
3295 {
3296         s32 pm;
3297         s32 err = 0;
3298         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3299         struct brcmf_if *ifp = netdev_priv(ndev);
3300         struct brcmf_pub *drvr = cfg->pub;
3301
3302         brcmf_dbg(TRACE, "Enter\n");
3303
3304         /*
3305          * Powersave enable/disable request is coming from the
3306          * cfg80211 even before the interface is up. In that
3307          * scenario, driver will be storing the power save
3308          * preference in cfg struct to apply this to
3309          * FW later while initializing the dongle
3310          */
3311         cfg->pwr_save = enabled;
3312         if (!check_vif_up(ifp->vif)) {
3313
3314                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
3315                 goto done;
3316         }
3317
3318         pm = enabled ? PM_FAST : PM_OFF;
3319         /* Do not enable the power save after assoc if it is a p2p interface */
3320         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
3321                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
3322                 pm = PM_OFF;
3323         }
3324         brcmf_info("power save %s\n", (pm ? "enabled" : "disabled"));
3325
3326         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
3327         if (err) {
3328                 if (err == -ENODEV)
3329                         bphy_err(drvr, "net_device is not ready yet\n");
3330                 else
3331                         bphy_err(drvr, "error (%d)\n", err);
3332         }
3333
3334         timeout = 2000; /* 2000ms - the maximum */
3335         err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
3336                                 min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
3337         if (err)
3338                 bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
3339
3340 done:
3341         brcmf_dbg(TRACE, "Exit\n");
3342         return err;
3343 }
3344
3345 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
3346                                    struct brcmf_bss_info_le *bi)
3347 {
3348         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3349         struct brcmf_pub *drvr = cfg->pub;
3350         struct cfg80211_bss *bss;
3351         enum nl80211_band band;
3352         struct brcmu_chan ch;
3353         u16 channel;
3354         u32 freq;
3355         u16 notify_capability;
3356         u16 notify_interval;
3357         u8 *notify_ie;
3358         size_t notify_ielen;
3359         struct cfg80211_inform_bss bss_data = {};
3360
3361         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
3362                 bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
3363                 return -EINVAL;
3364         }
3365
3366         if (!bi->ctl_ch) {
3367                 ch.chspec = le16_to_cpu(bi->chanspec);
3368                 cfg->d11inf.decchspec(&ch);
3369                 bi->ctl_ch = ch.control_ch_num;
3370         }
3371         channel = bi->ctl_ch;
3372
3373         if (channel <= CH_MAX_2G_CHANNEL)
3374                 band = NL80211_BAND_2GHZ;
3375         else
3376                 band = NL80211_BAND_5GHZ;
3377
3378         freq = ieee80211_channel_to_frequency(channel, band);
3379         bss_data.chan = ieee80211_get_channel(wiphy, freq);
3380         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3381         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3382
3383         notify_capability = le16_to_cpu(bi->capability);
3384         notify_interval = le16_to_cpu(bi->beacon_period);
3385         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3386         notify_ielen = le32_to_cpu(bi->ie_length);
3387         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3388
3389         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3390         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3391         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3392         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3393         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3394
3395         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3396                                        CFG80211_BSS_FTYPE_UNKNOWN,
3397                                        (const u8 *)bi->BSSID,
3398                                        0, notify_capability,
3399                                        notify_interval, notify_ie,
3400                                        notify_ielen, GFP_KERNEL);
3401
3402         if (!bss)
3403                 return -ENOMEM;
3404
3405         cfg80211_put_bss(wiphy, bss);
3406
3407         return 0;
3408 }
3409
3410 static struct brcmf_bss_info_le *
3411 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3412 {
3413         if (bss == NULL)
3414                 return list->bss_info_le;
3415         return (struct brcmf_bss_info_le *)((unsigned long)bss +
3416                                             le32_to_cpu(bss->length));
3417 }
3418
3419 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3420 {
3421         struct brcmf_pub *drvr = cfg->pub;
3422         struct brcmf_scan_results *bss_list;
3423         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
3424         s32 err = 0;
3425         int i;
3426
3427         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3428         if (bss_list->count != 0 &&
3429             bss_list->version != BRCMF_BSS_INFO_VERSION) {
3430                 bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3431                          bss_list->version);
3432                 return -EOPNOTSUPP;
3433         }
3434         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3435         for (i = 0; i < bss_list->count; i++) {
3436                 bi = next_bss_le(bss_list, bi);
3437                 err = brcmf_inform_single_bss(cfg, bi);
3438                 if (err)
3439                         break;
3440         }
3441         return err;
3442 }
3443
3444 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3445                              struct net_device *ndev, const u8 *bssid)
3446 {
3447         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3448         struct brcmf_pub *drvr = cfg->pub;
3449         struct ieee80211_channel *notify_channel;
3450         struct brcmf_bss_info_le *bi = NULL;
3451         struct ieee80211_supported_band *band;
3452         struct cfg80211_bss *bss;
3453         struct brcmu_chan ch;
3454         u8 *buf = NULL;
3455         s32 err = 0;
3456         u32 freq;
3457         u16 notify_capability;
3458         u16 notify_interval;
3459         u8 *notify_ie;
3460         size_t notify_ielen;
3461         s32 notify_signal;
3462
3463         brcmf_dbg(TRACE, "Enter\n");
3464
3465         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3466         if (buf == NULL) {
3467                 err = -ENOMEM;
3468                 goto CleanUp;
3469         }
3470
3471         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3472
3473         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3474                                      buf, WL_BSS_INFO_MAX);
3475         if (err) {
3476                 bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3477                 goto CleanUp;
3478         }
3479
3480         bi = (struct brcmf_bss_info_le *)(buf + 4);
3481
3482         ch.chspec = le16_to_cpu(bi->chanspec);
3483         cfg->d11inf.decchspec(&ch);
3484
3485         if (ch.band == BRCMU_CHAN_BAND_2G)
3486                 band = wiphy->bands[NL80211_BAND_2GHZ];
3487         else
3488                 band = wiphy->bands[NL80211_BAND_5GHZ];
3489
3490         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3491         cfg->channel = freq;
3492         notify_channel = ieee80211_get_channel(wiphy, freq);
3493
3494         notify_capability = le16_to_cpu(bi->capability);
3495         notify_interval = le16_to_cpu(bi->beacon_period);
3496         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3497         notify_ielen = le32_to_cpu(bi->ie_length);
3498         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3499
3500         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3501         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3502         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3503         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3504
3505         bss = cfg80211_inform_bss(wiphy, notify_channel,
3506                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3507                                   notify_capability, notify_interval,
3508                                   notify_ie, notify_ielen, notify_signal,
3509                                   GFP_KERNEL);
3510
3511         if (!bss) {
3512                 err = -ENOMEM;
3513                 goto CleanUp;
3514         }
3515
3516         cfg80211_put_bss(wiphy, bss);
3517
3518 CleanUp:
3519
3520         kfree(buf);
3521
3522         brcmf_dbg(TRACE, "Exit\n");
3523
3524         return err;
3525 }
3526
3527 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3528                                  struct brcmf_if *ifp)
3529 {
3530         struct brcmf_pub *drvr = cfg->pub;
3531         struct brcmf_bss_info_le *bi = NULL;
3532         s32 err = 0;
3533
3534         brcmf_dbg(TRACE, "Enter\n");
3535         if (brcmf_is_ibssmode(ifp->vif))
3536                 return err;
3537
3538         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3539         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3540                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3541         if (err) {
3542                 bphy_err(drvr, "Could not get bss info %d\n", err);
3543                 goto update_bss_info_out;
3544         }
3545         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3546         err = brcmf_inform_single_bss(cfg, bi);
3547
3548 update_bss_info_out:
3549         brcmf_dbg(TRACE, "Exit");
3550         return err;
3551 }
3552
3553 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3554 {
3555         struct escan_info *escan = &cfg->escan_info;
3556
3557         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3558         if (cfg->int_escan_map || cfg->scan_request) {
3559                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3560                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3561         }
3562         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3563         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3564 }
3565
3566 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3567 {
3568         struct brcmf_cfg80211_info *cfg =
3569                         container_of(work, struct brcmf_cfg80211_info,
3570                                      escan_timeout_work);
3571
3572         brcmf_inform_bss(cfg);
3573         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3574 }
3575
3576 static void brcmf_escan_timeout(struct timer_list *t)
3577 {
3578         struct brcmf_cfg80211_info *cfg =
3579                         from_timer(cfg, t, escan_timeout);
3580         struct brcmf_pub *drvr = cfg->pub;
3581
3582         if (cfg->int_escan_map || cfg->scan_request) {
3583                 bphy_err(drvr, "timer expired\n");
3584                 schedule_work(&cfg->escan_timeout_work);
3585         }
3586 }
3587
3588 static s32
3589 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3590                               struct brcmf_bss_info_le *bss,
3591                               struct brcmf_bss_info_le *bss_info_le)
3592 {
3593         struct brcmu_chan ch_bss, ch_bss_info_le;
3594
3595         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3596         cfg->d11inf.decchspec(&ch_bss);
3597         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3598         cfg->d11inf.decchspec(&ch_bss_info_le);
3599
3600         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3601                 ch_bss.band == ch_bss_info_le.band &&
3602                 bss_info_le->SSID_len == bss->SSID_len &&
3603                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3604                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3605                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3606                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3607                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3608
3609                         /* preserve max RSSI if the measurements are
3610                         * both on-channel or both off-channel
3611                         */
3612                         if (bss_info_rssi > bss_rssi)
3613                                 bss->RSSI = bss_info_le->RSSI;
3614                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3615                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3616                         /* preserve the on-channel rssi measurement
3617                         * if the new measurement is off channel
3618                         */
3619                         bss->RSSI = bss_info_le->RSSI;
3620                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3621                 }
3622                 return 1;
3623         }
3624         return 0;
3625 }
3626
3627 static s32
3628 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3629                              const struct brcmf_event_msg *e, void *data)
3630 {
3631         struct brcmf_pub *drvr = ifp->drvr;
3632         struct brcmf_cfg80211_info *cfg = drvr->config;
3633         s32 status;
3634         struct brcmf_escan_result_le *escan_result_le;
3635         u32 escan_buflen;
3636         struct brcmf_bss_info_le *bss_info_le;
3637         struct brcmf_bss_info_le *bss = NULL;
3638         u32 bi_length;
3639         struct brcmf_scan_results *list;
3640         u32 i;
3641         bool aborted;
3642
3643         status = e->status;
3644
3645         if (status == BRCMF_E_STATUS_ABORT)
3646                 goto exit;
3647
3648         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3649                 bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3650                          ifp->bsscfgidx);
3651                 return -EPERM;
3652         }
3653
3654         if (status == BRCMF_E_STATUS_PARTIAL) {
3655                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3656                 if (e->datalen < sizeof(*escan_result_le)) {
3657                         bphy_err(drvr, "invalid event data length\n");
3658                         goto exit;
3659                 }
3660                 escan_result_le = (struct brcmf_escan_result_le *) data;
3661                 if (!escan_result_le) {
3662                         bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3663                         goto exit;
3664                 }
3665                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3666                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3667                     escan_buflen > e->datalen ||
3668                     escan_buflen < sizeof(*escan_result_le)) {
3669                         bphy_err(drvr, "Invalid escan buffer length: %d\n",
3670                                  escan_buflen);
3671                         goto exit;
3672                 }
3673                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3674                         bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3675                                  escan_result_le->bss_count);
3676                         goto exit;
3677                 }
3678                 bss_info_le = &escan_result_le->bss_info_le;
3679
3680                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3681                         goto exit;
3682
3683                 if (!cfg->int_escan_map && !cfg->scan_request) {
3684                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3685                         goto exit;
3686                 }
3687
3688                 bi_length = le32_to_cpu(bss_info_le->length);
3689                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3690                         bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3691                                  bi_length);
3692                         goto exit;
3693                 }
3694
3695                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3696                                         BIT(NL80211_IFTYPE_ADHOC))) {
3697                         if (le16_to_cpu(bss_info_le->capability) &
3698                                                 WLAN_CAPABILITY_IBSS) {
3699                                 bphy_err(drvr, "Ignoring IBSS result\n");
3700                                 goto exit;
3701                         }
3702                 }
3703
3704                 list = (struct brcmf_scan_results *)
3705                                 cfg->escan_info.escan_buf;
3706                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3707                         bphy_err(drvr, "Buffer is too small: ignoring\n");
3708                         goto exit;
3709                 }
3710
3711                 for (i = 0; i < list->count; i++) {
3712                         bss = bss ? (struct brcmf_bss_info_le *)
3713                                 ((unsigned char *)bss +
3714                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3715                         if (brcmf_compare_update_same_bss(cfg, bss,
3716                                                           bss_info_le))
3717                                 goto exit;
3718                 }
3719                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3720                        bi_length);
3721                 list->version = le32_to_cpu(bss_info_le->version);
3722                 list->buflen += bi_length;
3723                 list->count++;
3724         } else {
3725                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3726                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3727                         goto exit;
3728                 if (cfg->int_escan_map || cfg->scan_request) {
3729                         brcmf_inform_bss(cfg);
3730                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3731                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3732                 } else
3733                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3734                                   status);
3735         }
3736 exit:
3737         return 0;
3738 }
3739
3740 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3741 {
3742         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3743                             brcmf_cfg80211_escan_handler);
3744         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3745         /* Init scan_timeout timer */
3746         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3747         INIT_WORK(&cfg->escan_timeout_work,
3748                   brcmf_cfg80211_escan_timeout_worker);
3749 }
3750
3751 static struct cfg80211_scan_request *
3752 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3753         struct cfg80211_scan_request *req;
3754         size_t req_size;
3755
3756         req_size = sizeof(*req) +
3757                    n_netinfo * sizeof(req->channels[0]) +
3758                    n_netinfo * sizeof(*req->ssids);
3759
3760         req = kzalloc(req_size, GFP_KERNEL);
3761         if (req) {
3762                 req->wiphy = wiphy;
3763                 req->ssids = (void *)(&req->channels[0]) +
3764                              n_netinfo * sizeof(req->channels[0]);
3765         }
3766         return req;
3767 }
3768
3769 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3770                                          u8 *ssid, u8 ssid_len, u8 channel)
3771 {
3772         struct ieee80211_channel *chan;
3773         enum nl80211_band band;
3774         int freq, i;
3775
3776         if (channel <= CH_MAX_2G_CHANNEL)
3777                 band = NL80211_BAND_2GHZ;
3778         else
3779                 band = NL80211_BAND_5GHZ;
3780
3781         freq = ieee80211_channel_to_frequency(channel, band);
3782         if (!freq)
3783                 return -EINVAL;
3784
3785         chan = ieee80211_get_channel(req->wiphy, freq);
3786         if (!chan)
3787                 return -EINVAL;
3788
3789         for (i = 0; i < req->n_channels; i++) {
3790                 if (req->channels[i] == chan)
3791                         break;
3792         }
3793         if (i == req->n_channels) {
3794                 req->n_channels++;
3795                 req->channels[i] = chan;
3796         }
3797
3798         for (i = 0; i < req->n_ssids; i++) {
3799                 if (req->ssids[i].ssid_len == ssid_len &&
3800                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3801                         break;
3802         }
3803         if (i == req->n_ssids) {
3804                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3805                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3806         }
3807         return 0;
3808 }
3809
3810 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3811                                       struct cfg80211_scan_request *request)
3812 {
3813         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3814         int err;
3815
3816         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3817                 if (cfg->int_escan_map)
3818                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3819                                   cfg->int_escan_map);
3820                 /* Abort any on-going scan */
3821                 brcmf_abort_scanning(cfg);
3822         }
3823
3824         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3825         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3826         cfg->escan_info.run = brcmf_run_escan;
3827         err = brcmf_do_escan(ifp, request);
3828         if (err) {
3829                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3830                 return err;
3831         }
3832         cfg->int_escan_map = fwmap;
3833         return 0;
3834 }
3835
3836 static struct brcmf_pno_net_info_le *
3837 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3838 {
3839         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3840         struct brcmf_pno_net_info_le *netinfo;
3841
3842         switch (pfn_v1->version) {
3843         default:
3844                 WARN_ON(1);
3845                 fallthrough;
3846         case cpu_to_le32(1):
3847                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3848                 break;
3849         case cpu_to_le32(2):
3850                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3851                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3852                 break;
3853         }
3854
3855         return netinfo;
3856 }
3857
3858 /* PFN result doesn't have all the info which are required by the supplicant
3859  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3860  * via wl_inform_single_bss in the required format. Escan does require the
3861  * scan request in the form of cfg80211_scan_request. For timebeing, create
3862  * cfg80211_scan_request one out of the received PNO event.
3863  */
3864 static s32
3865 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3866                                 const struct brcmf_event_msg *e, void *data)
3867 {
3868         struct brcmf_pub *drvr = ifp->drvr;
3869         struct brcmf_cfg80211_info *cfg = drvr->config;
3870         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3871         struct cfg80211_scan_request *request = NULL;
3872         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3873         int i, err = 0;
3874         struct brcmf_pno_scanresults_le *pfn_result;
3875         u32 bucket_map;
3876         u32 result_count;
3877         u32 status;
3878         u32 datalen;
3879
3880         brcmf_dbg(SCAN, "Enter\n");
3881
3882         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3883                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3884                 return 0;
3885         }
3886
3887         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3888                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3889                 return 0;
3890         }
3891
3892         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3893         result_count = le32_to_cpu(pfn_result->count);
3894         status = le32_to_cpu(pfn_result->status);
3895
3896         /* PFN event is limited to fit 512 bytes so we may get
3897          * multiple NET_FOUND events. For now place a warning here.
3898          */
3899         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3900         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3901         if (!result_count) {
3902                 bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3903                 goto out_err;
3904         }
3905
3906         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3907         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3908         if (datalen < result_count * sizeof(*netinfo)) {
3909                 bphy_err(drvr, "insufficient event data\n");
3910                 goto out_err;
3911         }
3912
3913         request = brcmf_alloc_internal_escan_request(wiphy,
3914                                                      result_count);
3915         if (!request) {
3916                 err = -ENOMEM;
3917                 goto out_err;
3918         }
3919
3920         bucket_map = 0;
3921         for (i = 0; i < result_count; i++) {
3922                 netinfo = &netinfo_start[i];
3923
3924                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3925                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3926                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3927                           netinfo->SSID, netinfo->channel);
3928                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3929                 err = brcmf_internal_escan_add_info(request,
3930                                                     netinfo->SSID,
3931                                                     netinfo->SSID_len,
3932                                                     netinfo->channel);
3933                 if (err)
3934                         goto out_err;
3935         }
3936
3937         if (!bucket_map)
3938                 goto free_req;
3939
3940         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3941         if (!err)
3942                 goto free_req;
3943
3944 out_err:
3945         cfg80211_sched_scan_stopped(wiphy, 0);
3946 free_req:
3947         kfree(request);
3948         return err;
3949 }
3950
3951 static int
3952 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3953                                 struct net_device *ndev,
3954                                 struct cfg80211_sched_scan_request *req)
3955 {
3956         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3957         struct brcmf_if *ifp = netdev_priv(ndev);
3958         struct brcmf_pub *drvr = cfg->pub;
3959
3960         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3961                   req->n_match_sets, req->n_ssids);
3962
3963         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3964                 bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3965                          cfg->scan_status);
3966                 return -EAGAIN;
3967         }
3968
3969         if (req->n_match_sets <= 0) {
3970                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3971                           req->n_match_sets);
3972                 return -EINVAL;
3973         }
3974
3975         return brcmf_pno_start_sched_scan(ifp, req);
3976 }
3977
3978 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3979                                           struct net_device *ndev, u64 reqid)
3980 {
3981         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3982         struct brcmf_if *ifp = netdev_priv(ndev);
3983
3984         brcmf_dbg(SCAN, "enter\n");
3985         brcmf_pno_stop_sched_scan(ifp, reqid);
3986         if (cfg->int_escan_map)
3987                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3988         return 0;
3989 }
3990
3991 static __always_inline void brcmf_delay(u32 ms)
3992 {
3993         if (ms < 1000 / HZ) {
3994                 cond_resched();
3995                 mdelay(ms);
3996         } else {
3997                 msleep(ms);
3998         }
3999 }
4000
4001 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
4002                                      u8 *pattern, u32 patternsize, u8 *mask,
4003                                      u32 packet_offset)
4004 {
4005         struct brcmf_fil_wowl_pattern_le *filter;
4006         u32 masksize;
4007         u32 patternoffset;
4008         u8 *buf;
4009         u32 bufsize;
4010         s32 ret;
4011
4012         masksize = (patternsize + 7) / 8;
4013         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
4014
4015         bufsize = sizeof(*filter) + patternsize + masksize;
4016         buf = kzalloc(bufsize, GFP_KERNEL);
4017         if (!buf)
4018                 return -ENOMEM;
4019         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
4020
4021         memcpy(filter->cmd, cmd, 4);
4022         filter->masksize = cpu_to_le32(masksize);
4023         filter->offset = cpu_to_le32(packet_offset);
4024         filter->patternoffset = cpu_to_le32(patternoffset);
4025         filter->patternsize = cpu_to_le32(patternsize);
4026         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
4027
4028         if ((mask) && (masksize))
4029                 memcpy(buf + sizeof(*filter), mask, masksize);
4030         if ((pattern) && (patternsize))
4031                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
4032
4033         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
4034
4035         kfree(buf);
4036         return ret;
4037 }
4038
4039 static s32
4040 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
4041                       void *data)
4042 {
4043         struct brcmf_pub *drvr = ifp->drvr;
4044         struct brcmf_cfg80211_info *cfg = drvr->config;
4045         struct brcmf_pno_scanresults_le *pfn_result;
4046         struct brcmf_pno_net_info_le *netinfo;
4047
4048         brcmf_dbg(SCAN, "Enter\n");
4049
4050         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
4051                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
4052                 return 0;
4053         }
4054
4055         pfn_result = (struct brcmf_pno_scanresults_le *)data;
4056
4057         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
4058                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
4059                 return 0;
4060         }
4061
4062         if (le32_to_cpu(pfn_result->count) < 1) {
4063                 bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
4064                          le32_to_cpu(pfn_result->count));
4065                 return -EINVAL;
4066         }
4067
4068         netinfo = brcmf_get_netinfo_array(pfn_result);
4069         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
4070                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
4071         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
4072         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
4073         cfg->wowl.nd->n_channels = 1;
4074         cfg->wowl.nd->channels[0] =
4075                 ieee80211_channel_to_frequency(netinfo->channel,
4076                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
4077                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
4078         cfg->wowl.nd_info->n_matches = 1;
4079         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
4080
4081         /* Inform (the resume task) that the net detect information was recvd */
4082         cfg->wowl.nd_data_completed = true;
4083         wake_up(&cfg->wowl.nd_data_wait);
4084
4085         return 0;
4086 }
4087
4088 #ifdef CONFIG_PM
4089
4090 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4091 {
4092         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4093         struct brcmf_pub *drvr = cfg->pub;
4094         struct brcmf_wowl_wakeind_le wake_ind_le;
4095         struct cfg80211_wowlan_wakeup wakeup_data;
4096         struct cfg80211_wowlan_wakeup *wakeup;
4097         u32 wakeind;
4098         s32 err;
4099         int timeout;
4100
4101         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
4102                                        sizeof(wake_ind_le));
4103         if (err) {
4104                 bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
4105                 return;
4106         }
4107
4108         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
4109         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
4110                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
4111                        BRCMF_WOWL_PFN_FOUND)) {
4112                 wakeup = &wakeup_data;
4113                 memset(&wakeup_data, 0, sizeof(wakeup_data));
4114                 wakeup_data.pattern_idx = -1;
4115
4116                 if (wakeind & BRCMF_WOWL_MAGIC) {
4117                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
4118                         wakeup_data.magic_pkt = true;
4119                 }
4120                 if (wakeind & BRCMF_WOWL_DIS) {
4121                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
4122                         wakeup_data.disconnect = true;
4123                 }
4124                 if (wakeind & BRCMF_WOWL_BCN) {
4125                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
4126                         wakeup_data.disconnect = true;
4127                 }
4128                 if (wakeind & BRCMF_WOWL_RETR) {
4129                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
4130                         wakeup_data.disconnect = true;
4131                 }
4132                 if (wakeind & BRCMF_WOWL_NET) {
4133                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
4134                         /* For now always map to pattern 0, no API to get
4135                          * correct information available at the moment.
4136                          */
4137                         wakeup_data.pattern_idx = 0;
4138                 }
4139                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
4140                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
4141                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
4142                                 cfg->wowl.nd_data_completed,
4143                                 BRCMF_ND_INFO_TIMEOUT);
4144                         if (!timeout)
4145                                 bphy_err(drvr, "No result for wowl net detect\n");
4146                         else
4147                                 wakeup_data.net_detect = cfg->wowl.nd_info;
4148                 }
4149                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
4150                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
4151                         wakeup_data.gtk_rekey_failure = true;
4152                 }
4153         } else {
4154                 wakeup = NULL;
4155         }
4156         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
4157 }
4158
4159 #else
4160
4161 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4162 {
4163 }
4164
4165 #endif /* CONFIG_PM */
4166
4167 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
4168 {
4169         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4170         struct net_device *ndev = cfg_to_ndev(cfg);
4171         struct brcmf_if *ifp = netdev_priv(ndev);
4172
4173         brcmf_dbg(TRACE, "Enter\n");
4174
4175         if (cfg->wowl.active) {
4176                 brcmf_report_wowl_wakeind(wiphy, ifp);
4177                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
4178                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
4179                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4180                         brcmf_configure_arp_nd_offload(ifp, true);
4181                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
4182                                       cfg->wowl.pre_pmmode);
4183                 cfg->wowl.active = false;
4184                 if (cfg->wowl.nd_enabled) {
4185                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
4186                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4187                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4188                                             brcmf_notify_sched_scan_results);
4189                         cfg->wowl.nd_enabled = false;
4190                 }
4191         }
4192         return 0;
4193 }
4194
4195 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
4196                                  struct brcmf_if *ifp,
4197                                  struct cfg80211_wowlan *wowl)
4198 {
4199         u32 wowl_config;
4200         struct brcmf_wowl_wakeind_le wowl_wakeind;
4201         u32 i;
4202
4203         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
4204
4205         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4206                 brcmf_configure_arp_nd_offload(ifp, false);
4207         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
4208         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
4209
4210         wowl_config = 0;
4211         if (wowl->disconnect)
4212                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
4213         if (wowl->magic_pkt)
4214                 wowl_config |= BRCMF_WOWL_MAGIC;
4215         if ((wowl->patterns) && (wowl->n_patterns)) {
4216                 wowl_config |= BRCMF_WOWL_NET;
4217                 for (i = 0; i < wowl->n_patterns; i++) {
4218                         brcmf_config_wowl_pattern(ifp, "add",
4219                                 (u8 *)wowl->patterns[i].pattern,
4220                                 wowl->patterns[i].pattern_len,
4221                                 (u8 *)wowl->patterns[i].mask,
4222                                 wowl->patterns[i].pkt_offset);
4223                 }
4224         }
4225         if (wowl->nd_config) {
4226                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
4227                                                 wowl->nd_config);
4228                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
4229
4230                 cfg->wowl.nd_data_completed = false;
4231                 cfg->wowl.nd_enabled = true;
4232                 /* Now reroute the event for PFN to the wowl function. */
4233                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4234                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4235                                     brcmf_wowl_nd_results);
4236         }
4237         if (wowl->gtk_rekey_failure)
4238                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
4239         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4240                 wowl_config |= BRCMF_WOWL_UNASSOC;
4241
4242         memcpy(&wowl_wakeind, "clear", 6);
4243         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
4244                                  sizeof(wowl_wakeind));
4245         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
4246         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
4247         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
4248         cfg->wowl.active = true;
4249 }
4250
4251 static int brcmf_keepalive_start(struct brcmf_if *ifp, unsigned int interval)
4252 {
4253         struct brcmf_mkeep_alive_pkt_le kalive = {0};
4254         int ret = 0;
4255
4256         /* Configure Null function/data keepalive */
4257         kalive.version = cpu_to_le16(1);
4258         kalive.period_msec = cpu_to_le32(interval * MSEC_PER_SEC);
4259         kalive.len_bytes = cpu_to_le16(0);
4260         kalive.keep_alive_id = 0;
4261
4262         ret = brcmf_fil_iovar_data_set(ifp, "mkeep_alive", &kalive, sizeof(kalive));
4263         if (ret)
4264                 brcmf_err("keep-alive packet config failed, ret=%d\n", ret);
4265
4266         return ret;
4267 }
4268
4269 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
4270                                   struct cfg80211_wowlan *wowl)
4271 {
4272         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4273         struct net_device *ndev = cfg_to_ndev(cfg);
4274         struct brcmf_if *ifp = netdev_priv(ndev);
4275         struct brcmf_cfg80211_vif *vif;
4276
4277         brcmf_dbg(TRACE, "Enter\n");
4278
4279         /* if the primary net_device is not READY there is nothing
4280          * we can do but pray resume goes smoothly.
4281          */
4282         if (!check_vif_up(ifp->vif))
4283                 goto exit;
4284
4285         /* Stop scheduled scan */
4286         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
4287                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
4288
4289         /* end any scanning */
4290         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
4291                 brcmf_abort_scanning(cfg);
4292
4293         if (wowl == NULL) {
4294                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
4295                 list_for_each_entry(vif, &cfg->vif_list, list) {
4296                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
4297                                 continue;
4298                         /* While going to suspend if associated with AP
4299                          * disassociate from AP to save power while system is
4300                          * in suspended state
4301                          */
4302                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
4303                         /* Make sure WPA_Supplicant receives all the event
4304                          * generated due to DISASSOC call to the fw to keep
4305                          * the state fw and WPA_Supplicant state consistent
4306                          */
4307                         brcmf_delay(500);
4308                 }
4309                 /* Configure MPC */
4310                 brcmf_set_mpc(ifp, 1);
4311
4312         } else {
4313                 /* Configure WOWL paramaters */
4314                 brcmf_configure_wowl(cfg, ifp, wowl);
4315
4316                 /* Prevent disassociation due to inactivity with keep-alive */
4317                 brcmf_keepalive_start(ifp, 30);
4318         }
4319
4320 exit:
4321         brcmf_dbg(TRACE, "Exit\n");
4322         /* clear any scanning activity */
4323         cfg->scan_status = 0;
4324         return 0;
4325 }
4326
4327 static s32
4328 brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
4329                   bool alive)
4330 {
4331         struct brcmf_pmk_op_v3_le *pmk_op;
4332         int length = offsetof(struct brcmf_pmk_op_v3_le, pmk);
4333         int ret;
4334
4335         pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
4336         pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
4337
4338         if (!pmksa) {
4339                 /* Flush operation, operate on entire list */
4340                 pmk_op->count = cpu_to_le16(0);
4341         } else {
4342                 /* Single PMK operation */
4343                 pmk_op->count = cpu_to_le16(1);
4344                 length += sizeof(struct brcmf_pmksa_v3);
4345                 memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
4346                 memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4347                 pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
4348                 pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
4349         }
4350
4351         pmk_op->length = cpu_to_le16(length);
4352
4353         ret = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_op, sizeof(*pmk_op));
4354         kfree(pmk_op);
4355         return ret;
4356 }
4357
4358 static __used s32
4359 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
4360 {
4361         struct brcmf_pmk_list_le *pmk_list;
4362         int i;
4363         u32 npmk;
4364
4365         pmk_list = &cfg->pmk_list;
4366         npmk = le32_to_cpu(pmk_list->npmk);
4367
4368         brcmf_dbg(CONN, "No of elements %d\n", npmk);
4369         for (i = 0; i < npmk; i++)
4370                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
4371
4372         return brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
4373                         sizeof(*pmk_list));
4374 }
4375
4376 static s32
4377 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4378                          struct cfg80211_pmksa *pmksa)
4379 {
4380         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4381         struct brcmf_if *ifp = netdev_priv(ndev);
4382         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4383         struct brcmf_pub *drvr = cfg->pub;
4384         s32 err;
4385         u32 npmk, i;
4386
4387         brcmf_dbg(TRACE, "Enter\n");
4388         if (!check_vif_up(ifp->vif))
4389                 return -EIO;
4390
4391         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmksa->bssid);
4392         brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmksa->pmkid);
4393
4394         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4395                 return brcmf_pmksa_v3_op(ifp, pmksa, true);
4396
4397         /* TODO: implement PMKID_V2 */
4398
4399         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4400         for (i = 0; i < npmk; i++)
4401                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4402                         break;
4403         if (i < BRCMF_MAXPMKID) {
4404                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4405                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4406                 if (i == npmk) {
4407                         npmk++;
4408                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
4409                 }
4410         } else {
4411                 bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4412                 return -EINVAL;
4413         }
4414
4415         err = brcmf_update_pmklist(cfg, ifp);
4416
4417         brcmf_dbg(TRACE, "Exit\n");
4418         return err;
4419 }
4420
4421 static s32
4422 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4423                          struct cfg80211_pmksa *pmksa)
4424 {
4425         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4426         struct brcmf_if *ifp = netdev_priv(ndev);
4427         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4428         struct brcmf_pub *drvr = cfg->pub;
4429         s32 err;
4430         u32 npmk, i;
4431
4432         brcmf_dbg(TRACE, "Enter\n");
4433         if (!check_vif_up(ifp->vif))
4434                 return -EIO;
4435
4436         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4437
4438         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4439                 return brcmf_pmksa_v3_op(ifp, pmksa, false);
4440
4441         /* TODO: implement PMKID_V2 */
4442
4443         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4444         for (i = 0; i < npmk; i++)
4445                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4446                         break;
4447
4448         if ((npmk > 0) && (i < npmk)) {
4449                 for (; i < (npmk - 1); i++) {
4450                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4451                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4452                                WLAN_PMKID_LEN);
4453                 }
4454                 memset(&pmk[i], 0, sizeof(*pmk));
4455                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4456         } else {
4457                 bphy_err(drvr, "Cache entry not found\n");
4458                 return -EINVAL;
4459         }
4460
4461         err = brcmf_update_pmklist(cfg, ifp);
4462
4463         brcmf_dbg(TRACE, "Exit\n");
4464         return err;
4465
4466 }
4467
4468 static s32
4469 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4470 {
4471         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4472         struct brcmf_if *ifp = netdev_priv(ndev);
4473         s32 err;
4474
4475         brcmf_dbg(TRACE, "Enter\n");
4476         if (!check_vif_up(ifp->vif))
4477                 return -EIO;
4478
4479         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4480                 return brcmf_pmksa_v3_op(ifp, NULL, false);
4481
4482         /* TODO: implement PMKID_V2 */
4483
4484         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4485         err = brcmf_update_pmklist(cfg, ifp);
4486
4487         brcmf_dbg(TRACE, "Exit\n");
4488         return err;
4489
4490 }
4491
4492 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4493 {
4494         struct brcmf_pub *drvr = ifp->drvr;
4495         s32 err;
4496         s32 wpa_val;
4497
4498         /* set auth */
4499         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4500         if (err < 0) {
4501                 bphy_err(drvr, "auth error %d\n", err);
4502                 return err;
4503         }
4504         /* set wsec */
4505         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4506         if (err < 0) {
4507                 bphy_err(drvr, "wsec error %d\n", err);
4508                 return err;
4509         }
4510         /* set upper-layer auth */
4511         if (brcmf_is_ibssmode(ifp->vif))
4512                 wpa_val = WPA_AUTH_NONE;
4513         else
4514                 wpa_val = WPA_AUTH_DISABLED;
4515         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4516         if (err < 0) {
4517                 bphy_err(drvr, "wpa_auth error %d\n", err);
4518                 return err;
4519         }
4520
4521         return 0;
4522 }
4523
4524 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4525 {
4526         if (is_rsn_ie)
4527                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4528
4529         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4530 }
4531
4532 static s32
4533 brcmf_configure_wpaie(struct brcmf_if *ifp,
4534                       const struct brcmf_vs_tlv *wpa_ie,
4535                       bool is_rsn_ie)
4536 {
4537         struct brcmf_pub *drvr = ifp->drvr;
4538         u32 auth = 0; /* d11 open authentication */
4539         u16 count;
4540         s32 err = 0;
4541         s32 len;
4542         u32 i;
4543         u32 wsec;
4544         u32 pval = 0;
4545         u32 gval = 0;
4546         u32 wpa_auth = 0;
4547         u32 offset;
4548         u8 *data;
4549         u16 rsn_cap;
4550         u32 wme_bss_disable;
4551         u32 mfp;
4552
4553         brcmf_dbg(TRACE, "Enter\n");
4554         if (wpa_ie == NULL)
4555                 goto exit;
4556
4557         len = wpa_ie->len + TLV_HDR_LEN;
4558         data = (u8 *)wpa_ie;
4559         offset = TLV_HDR_LEN;
4560         if (!is_rsn_ie)
4561                 offset += VS_IE_FIXED_HDR_LEN;
4562         else
4563                 offset += WPA_IE_VERSION_LEN;
4564
4565         /* check for multicast cipher suite */
4566         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4567                 err = -EINVAL;
4568                 bphy_err(drvr, "no multicast cipher suite\n");
4569                 goto exit;
4570         }
4571
4572         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4573                 err = -EINVAL;
4574                 bphy_err(drvr, "ivalid OUI\n");
4575                 goto exit;
4576         }
4577         offset += TLV_OUI_LEN;
4578
4579         /* pick up multicast cipher */
4580         switch (data[offset]) {
4581         case WPA_CIPHER_NONE:
4582                 gval = 0;
4583                 break;
4584         case WPA_CIPHER_WEP_40:
4585         case WPA_CIPHER_WEP_104:
4586                 gval = WEP_ENABLED;
4587                 break;
4588         case WPA_CIPHER_TKIP:
4589                 gval = TKIP_ENABLED;
4590                 break;
4591         case WPA_CIPHER_AES_CCM:
4592                 gval = AES_ENABLED;
4593                 break;
4594         default:
4595                 err = -EINVAL;
4596                 bphy_err(drvr, "Invalid multi cast cipher info\n");
4597                 goto exit;
4598         }
4599
4600         offset++;
4601         /* walk thru unicast cipher list and pick up what we recognize */
4602         count = data[offset] + (data[offset + 1] << 8);
4603         offset += WPA_IE_SUITE_COUNT_LEN;
4604         /* Check for unicast suite(s) */
4605         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4606                 err = -EINVAL;
4607                 bphy_err(drvr, "no unicast cipher suite\n");
4608                 goto exit;
4609         }
4610         for (i = 0; i < count; i++) {
4611                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4612                         err = -EINVAL;
4613                         bphy_err(drvr, "ivalid OUI\n");
4614                         goto exit;
4615                 }
4616                 offset += TLV_OUI_LEN;
4617                 switch (data[offset]) {
4618                 case WPA_CIPHER_NONE:
4619                         break;
4620                 case WPA_CIPHER_WEP_40:
4621                 case WPA_CIPHER_WEP_104:
4622                         pval |= WEP_ENABLED;
4623                         break;
4624                 case WPA_CIPHER_TKIP:
4625                         pval |= TKIP_ENABLED;
4626                         break;
4627                 case WPA_CIPHER_AES_CCM:
4628                         pval |= AES_ENABLED;
4629                         break;
4630                 default:
4631                         bphy_err(drvr, "Invalid unicast security info\n");
4632                 }
4633                 offset++;
4634         }
4635         /* walk thru auth management suite list and pick up what we recognize */
4636         count = data[offset] + (data[offset + 1] << 8);
4637         offset += WPA_IE_SUITE_COUNT_LEN;
4638         /* Check for auth key management suite(s) */
4639         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4640                 err = -EINVAL;
4641                 bphy_err(drvr, "no auth key mgmt suite\n");
4642                 goto exit;
4643         }
4644         for (i = 0; i < count; i++) {
4645                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4646                         err = -EINVAL;
4647                         bphy_err(drvr, "ivalid OUI\n");
4648                         goto exit;
4649                 }
4650                 offset += TLV_OUI_LEN;
4651                 switch (data[offset]) {
4652                 case RSN_AKM_NONE:
4653                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4654                         wpa_auth |= WPA_AUTH_NONE;
4655                         break;
4656                 case RSN_AKM_UNSPECIFIED:
4657                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4658                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4659                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4660                         break;
4661                 case RSN_AKM_PSK:
4662                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4663                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4664                                     (wpa_auth |= WPA_AUTH_PSK);
4665                         break;
4666                 case RSN_AKM_SHA256_PSK:
4667                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4668                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4669                         break;
4670                 case RSN_AKM_SHA256_1X:
4671                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4672                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4673                         break;
4674                 case RSN_AKM_SAE:
4675                         brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4676                         wpa_auth |= WPA3_AUTH_SAE_PSK;
4677                         break;
4678                 default:
4679                         bphy_err(drvr, "Invalid key mgmt info\n");
4680                 }
4681                 offset++;
4682         }
4683
4684         mfp = BRCMF_MFP_NONE;
4685         if (is_rsn_ie) {
4686                 wme_bss_disable = 1;
4687                 if ((offset + RSN_CAP_LEN) <= len) {
4688                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4689                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4690                                 wme_bss_disable = 0;
4691                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4692                                 brcmf_dbg(TRACE, "MFP Required\n");
4693                                 mfp = BRCMF_MFP_REQUIRED;
4694                                 /* Firmware only supports mfp required in
4695                                  * combination with WPA2_AUTH_PSK_SHA256,
4696                                  * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4697                                  */
4698                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4699                                                   WPA2_AUTH_1X_SHA256 |
4700                                                   WPA3_AUTH_SAE_PSK))) {
4701                                         err = -EINVAL;
4702                                         goto exit;
4703                                 }
4704                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4705                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4706                                  * is to be included in the rsn ie.
4707                                  */
4708                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4709                                         wpa_auth |= WPA2_AUTH_PSK;
4710                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4711                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4712                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4713                                 brcmf_dbg(TRACE, "MFP Capable\n");
4714                                 mfp = BRCMF_MFP_CAPABLE;
4715                         }
4716                 }
4717                 offset += RSN_CAP_LEN;
4718                 /* set wme_bss_disable to sync RSN Capabilities */
4719                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4720                                                wme_bss_disable);
4721                 if (err < 0) {
4722                         bphy_err(drvr, "wme_bss_disable error %d\n", err);
4723                         goto exit;
4724                 }
4725
4726                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4727                 offset += RSN_PMKID_COUNT_LEN;
4728
4729                 /* See if there is BIP wpa suite left for MFP */
4730                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4731                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4732                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4733                                                         &data[offset],
4734                                                         WPA_IE_MIN_OUI_LEN);
4735                         if (err < 0) {
4736                                 bphy_err(drvr, "bip error %d\n", err);
4737                                 goto exit;
4738                         }
4739                 }
4740         }
4741         /* FOR WPS , set SES_OW_ENABLED */
4742         wsec = (pval | gval | SES_OW_ENABLED);
4743
4744         /* set auth */
4745         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4746         if (err < 0) {
4747                 bphy_err(drvr, "auth error %d\n", err);
4748                 goto exit;
4749         }
4750         /* set wsec */
4751         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4752         if (err < 0) {
4753                 bphy_err(drvr, "wsec error %d\n", err);
4754                 goto exit;
4755         }
4756         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4757          * will overwrite the values set by MFP
4758          */
4759         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4760                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4761                 if (err < 0) {
4762                         bphy_err(drvr, "mfp error %d\n", err);
4763                         goto exit;
4764                 }
4765         }
4766         /* set upper-layer auth */
4767         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4768         if (err < 0) {
4769                 bphy_err(drvr, "wpa_auth error %d\n", err);
4770                 goto exit;
4771         }
4772
4773 exit:
4774         return err;
4775 }
4776
4777 static s32
4778 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4779                      struct parsed_vndr_ies *vndr_ies)
4780 {
4781         struct brcmf_vs_tlv *vndrie;
4782         struct brcmf_tlv *ie;
4783         struct parsed_vndr_ie_info *parsed_info;
4784         s32 remaining_len;
4785
4786         remaining_len = (s32)vndr_ie_len;
4787         memset(vndr_ies, 0, sizeof(*vndr_ies));
4788
4789         ie = (struct brcmf_tlv *)vndr_ie_buf;
4790         while (ie) {
4791                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4792                         goto next;
4793                 vndrie = (struct brcmf_vs_tlv *)ie;
4794                 /* len should be bigger than OUI length + one */
4795                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4796                         brcmf_err("invalid vndr ie. length is too small %d\n",
4797                                   vndrie->len);
4798                         goto next;
4799                 }
4800                 /* if wpa or wme ie, do not add ie */
4801                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4802                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4803                     (vndrie->oui_type == WME_OUI_TYPE))) {
4804                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4805                         goto next;
4806                 }
4807
4808                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4809
4810                 /* save vndr ie information */
4811                 parsed_info->ie_ptr = (char *)vndrie;
4812                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4813                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4814
4815                 vndr_ies->count++;
4816
4817                 brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4818                           parsed_info->vndrie.oui,
4819                           parsed_info->vndrie.oui_type);
4820
4821                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4822                         break;
4823 next:
4824                 remaining_len -= (ie->len + TLV_HDR_LEN);
4825                 if (remaining_len <= TLV_HDR_LEN)
4826                         ie = NULL;
4827                 else
4828                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4829                                 TLV_HDR_LEN);
4830         }
4831         return 0;
4832 }
4833
4834 static u32
4835 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4836 {
4837         strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4838
4839         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4840
4841         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4842
4843         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4844
4845         return ie_len + VNDR_IE_HDR_SIZE;
4846 }
4847
4848 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4849                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4850 {
4851         struct brcmf_pub *drvr;
4852         struct brcmf_if *ifp;
4853         struct vif_saved_ie *saved_ie;
4854         s32 err = 0;
4855         u8  *iovar_ie_buf;
4856         u8  *curr_ie_buf;
4857         u8  *mgmt_ie_buf = NULL;
4858         int mgmt_ie_buf_len;
4859         u32 *mgmt_ie_len;
4860         u32 del_add_ie_buf_len = 0;
4861         u32 total_ie_buf_len = 0;
4862         u32 parsed_ie_buf_len = 0;
4863         struct parsed_vndr_ies old_vndr_ies;
4864         struct parsed_vndr_ies new_vndr_ies;
4865         struct parsed_vndr_ie_info *vndrie_info;
4866         s32 i;
4867         u8 *ptr;
4868         int remained_buf_len;
4869
4870         if (!vif)
4871                 return -ENODEV;
4872         ifp = vif->ifp;
4873         drvr = ifp->drvr;
4874         saved_ie = &vif->saved_ie;
4875
4876         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4877                   pktflag);
4878         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4879         if (!iovar_ie_buf)
4880                 return -ENOMEM;
4881         curr_ie_buf = iovar_ie_buf;
4882         switch (pktflag) {
4883         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4884                 mgmt_ie_buf = saved_ie->probe_req_ie;
4885                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4886                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4887                 break;
4888         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4889                 mgmt_ie_buf = saved_ie->probe_res_ie;
4890                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4891                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4892                 break;
4893         case BRCMF_VNDR_IE_BEACON_FLAG:
4894                 mgmt_ie_buf = saved_ie->beacon_ie;
4895                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4896                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4897                 break;
4898         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4899                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4900                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4901                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4902                 break;
4903         case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4904                 mgmt_ie_buf = saved_ie->assoc_res_ie;
4905                 mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4906                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4907                 break;
4908         default:
4909                 err = -EPERM;
4910                 bphy_err(drvr, "not suitable type\n");
4911                 goto exit;
4912         }
4913
4914         if (vndr_ie_len > mgmt_ie_buf_len) {
4915                 err = -ENOMEM;
4916                 bphy_err(drvr, "extra IE size too big\n");
4917                 goto exit;
4918         }
4919
4920         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4921         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4922                 ptr = curr_ie_buf;
4923                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4924                 for (i = 0; i < new_vndr_ies.count; i++) {
4925                         vndrie_info = &new_vndr_ies.ie_info[i];
4926                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4927                                vndrie_info->ie_len);
4928                         parsed_ie_buf_len += vndrie_info->ie_len;
4929                 }
4930         }
4931
4932         if (mgmt_ie_buf && *mgmt_ie_len) {
4933                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4934                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4935                             parsed_ie_buf_len) == 0)) {
4936                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4937                         goto exit;
4938                 }
4939
4940                 /* parse old vndr_ie */
4941                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4942
4943                 /* make a command to delete old ie */
4944                 for (i = 0; i < old_vndr_ies.count; i++) {
4945                         vndrie_info = &old_vndr_ies.ie_info[i];
4946
4947                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4948                                   vndrie_info->vndrie.id,
4949                                   vndrie_info->vndrie.len,
4950                                   vndrie_info->vndrie.oui);
4951
4952                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4953                                                            vndrie_info->ie_ptr,
4954                                                            vndrie_info->ie_len,
4955                                                            "del");
4956                         curr_ie_buf += del_add_ie_buf_len;
4957                         total_ie_buf_len += del_add_ie_buf_len;
4958                 }
4959         }
4960
4961         *mgmt_ie_len = 0;
4962         /* Add if there is any extra IE */
4963         if (mgmt_ie_buf && parsed_ie_buf_len) {
4964                 ptr = mgmt_ie_buf;
4965
4966                 remained_buf_len = mgmt_ie_buf_len;
4967
4968                 /* make a command to add new ie */
4969                 for (i = 0; i < new_vndr_ies.count; i++) {
4970                         vndrie_info = &new_vndr_ies.ie_info[i];
4971
4972                         /* verify remained buf size before copy data */
4973                         if (remained_buf_len < (vndrie_info->vndrie.len +
4974                                                         VNDR_IE_VSIE_OFFSET)) {
4975                                 bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4976                                          remained_buf_len);
4977                                 break;
4978                         }
4979                         remained_buf_len -= (vndrie_info->ie_len +
4980                                              VNDR_IE_VSIE_OFFSET);
4981
4982                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4983                                   vndrie_info->vndrie.id,
4984                                   vndrie_info->vndrie.len,
4985                                   vndrie_info->vndrie.oui);
4986
4987                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4988                                                            vndrie_info->ie_ptr,
4989                                                            vndrie_info->ie_len,
4990                                                            "add");
4991
4992                         /* save the parsed IE in wl struct */
4993                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4994                                vndrie_info->ie_len);
4995                         *mgmt_ie_len += vndrie_info->ie_len;
4996
4997                         curr_ie_buf += del_add_ie_buf_len;
4998                         total_ie_buf_len += del_add_ie_buf_len;
4999                 }
5000         }
5001         if (total_ie_buf_len) {
5002                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
5003                                                  total_ie_buf_len);
5004                 if (err)
5005                         bphy_err(drvr, "vndr ie set error : %d\n", err);
5006         }
5007
5008 exit:
5009         kfree(iovar_ie_buf);
5010         return err;
5011 }
5012
5013 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
5014 {
5015         static const s32 pktflags[] = {
5016                 BRCMF_VNDR_IE_PRBREQ_FLAG,
5017                 BRCMF_VNDR_IE_PRBRSP_FLAG,
5018                 BRCMF_VNDR_IE_BEACON_FLAG
5019         };
5020         int i;
5021
5022         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
5023                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
5024
5025         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
5026         return 0;
5027 }
5028
5029 static s32
5030 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
5031                         struct cfg80211_beacon_data *beacon)
5032 {
5033         struct brcmf_pub *drvr = vif->ifp->drvr;
5034         s32 err;
5035
5036         /* Set Beacon IEs to FW */
5037         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
5038                                     beacon->tail, beacon->tail_len);
5039         if (err) {
5040                 bphy_err(drvr, "Set Beacon IE Failed\n");
5041                 return err;
5042         }
5043         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
5044
5045         /* Set Probe Response IEs to FW */
5046         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
5047                                     beacon->proberesp_ies,
5048                                     beacon->proberesp_ies_len);
5049         if (err)
5050                 bphy_err(drvr, "Set Probe Resp IE Failed\n");
5051         else
5052                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
5053
5054         /* Set Assoc Response IEs to FW */
5055         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
5056                                     beacon->assocresp_ies,
5057                                     beacon->assocresp_ies_len);
5058         if (err)
5059                 brcmf_err("Set Assoc Resp IE Failed\n");
5060         else
5061                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
5062
5063         return err;
5064 }
5065
5066 static s32
5067 brcmf_parse_configure_security(struct brcmf_if *ifp,
5068                                struct cfg80211_ap_settings *settings,
5069                                enum nl80211_iftype dev_role)
5070 {
5071         const struct brcmf_tlv *rsn_ie;
5072         const struct brcmf_vs_tlv *wpa_ie;
5073         s32 err = 0;
5074
5075         /* find the RSN_IE */
5076         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5077                                   settings->beacon.tail_len, WLAN_EID_RSN);
5078
5079         /* find the WPA_IE */
5080         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
5081                                   settings->beacon.tail_len);
5082
5083         if (wpa_ie || rsn_ie) {
5084                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
5085                 if (wpa_ie) {
5086                         /* WPA IE */
5087                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
5088                         if (err < 0)
5089                                 return err;
5090                 } else {
5091                         struct brcmf_vs_tlv *tmp_ie;
5092
5093                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
5094
5095                         /* RSN IE */
5096                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
5097                         if (err < 0)
5098                                 return err;
5099                 }
5100         } else {
5101                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
5102                 brcmf_configure_opensecurity(ifp);
5103         }
5104
5105         return err;
5106 }
5107
5108 static s32
5109 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
5110                         struct cfg80211_ap_settings *settings)
5111 {
5112         s32 ie_offset;
5113         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5114         struct brcmf_if *ifp = netdev_priv(ndev);
5115         struct brcmf_pub *drvr = cfg->pub;
5116         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5117         struct cfg80211_crypto_settings *crypto = &settings->crypto;
5118         const struct brcmf_tlv *ssid_ie;
5119         const struct brcmf_tlv *country_ie;
5120         struct brcmf_ssid_le ssid_le;
5121         s32 err = -EPERM;
5122         struct brcmf_join_params join_params;
5123         enum nl80211_iftype dev_role;
5124         struct brcmf_fil_bss_enable_le bss_enable;
5125         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
5126         bool mbss;
5127         int is_11d;
5128         bool supports_11d;
5129
5130         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
5131                   settings->chandef.chan->hw_value,
5132                   settings->chandef.center_freq1, settings->chandef.width,
5133                   settings->beacon_interval, settings->dtim_period);
5134         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
5135                   settings->ssid, settings->ssid_len, settings->auth_type,
5136                   settings->inactivity_timeout);
5137         dev_role = ifp->vif->wdev.iftype;
5138         mbss = ifp->vif->mbss;
5139
5140         /* store current 11d setting */
5141         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
5142                                   &ifp->vif->is_11d)) {
5143                 is_11d = supports_11d = false;
5144         } else {
5145                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5146                                               settings->beacon.tail_len,
5147                                               WLAN_EID_COUNTRY);
5148                 is_11d = country_ie ? 1 : 0;
5149                 supports_11d = true;
5150         }
5151
5152         memset(&ssid_le, 0, sizeof(ssid_le));
5153         if (settings->ssid == NULL || settings->ssid_len == 0) {
5154                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
5155                 ssid_ie = brcmf_parse_tlvs(
5156                                 (u8 *)&settings->beacon.head[ie_offset],
5157                                 settings->beacon.head_len - ie_offset,
5158                                 WLAN_EID_SSID);
5159                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
5160                         return -EINVAL;
5161
5162                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
5163                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
5164                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
5165         } else {
5166                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
5167                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
5168         }
5169
5170         if (!mbss) {
5171                 brcmf_set_mpc(ifp, 0);
5172                 brcmf_configure_arp_nd_offload(ifp, false);
5173         }
5174
5175         /* Parameters shared by all radio interfaces */
5176         if (!mbss) {
5177                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
5178                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5179                                                     is_11d);
5180                         if (err < 0) {
5181                                 bphy_err(drvr, "Regulatory Set Error, %d\n",
5182                                          err);
5183                                 goto exit;
5184                         }
5185                 }
5186                 if (settings->beacon_interval) {
5187                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
5188                                                     settings->beacon_interval);
5189                         if (err < 0) {
5190                                 bphy_err(drvr, "Beacon Interval Set Error, %d\n",
5191                                          err);
5192                                 goto exit;
5193                         }
5194                 }
5195                 if (settings->dtim_period) {
5196                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
5197                                                     settings->dtim_period);
5198                         if (err < 0) {
5199                                 bphy_err(drvr, "DTIM Interval Set Error, %d\n",
5200                                          err);
5201                                 goto exit;
5202                         }
5203                 }
5204
5205                 if ((dev_role == NL80211_IFTYPE_AP) &&
5206                     ((ifp->ifidx == 0) ||
5207                      (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
5208                       !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
5209                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5210                         if (err < 0) {
5211                                 bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
5212                                          err);
5213                                 goto exit;
5214                         }
5215                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
5216                 }
5217
5218                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
5219                 if (err < 0) {
5220                         bphy_err(drvr, "SET INFRA error %d\n", err);
5221                         goto exit;
5222                 }
5223         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
5224                 /* Multiple-BSS should use same 11d configuration */
5225                 err = -EINVAL;
5226                 goto exit;
5227         }
5228
5229         /* Interface specific setup */
5230         if (dev_role == NL80211_IFTYPE_AP) {
5231                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
5232                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
5233
5234                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
5235                 if (err < 0) {
5236                         bphy_err(drvr, "setting AP mode failed %d\n",
5237                                  err);
5238                         goto exit;
5239                 }
5240                 if (!mbss) {
5241                         /* Firmware 10.x requires setting channel after enabling
5242                          * AP and before bringing interface up.
5243                          */
5244                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5245                         if (err < 0) {
5246                                 bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5247                                          chanspec, err);
5248                                 goto exit;
5249                         }
5250                 }
5251                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5252                 if (err < 0) {
5253                         bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
5254                         goto exit;
5255                 }
5256
5257                 if (crypto->psk) {
5258                         brcmf_dbg(INFO, "using PSK offload\n");
5259                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
5260                         err = brcmf_set_pmk(ifp, crypto->psk,
5261                                             BRCMF_WSEC_MAX_PSK_LEN);
5262                         if (err < 0)
5263                                 goto exit;
5264                 }
5265                 if (crypto->sae_pwd) {
5266                         brcmf_dbg(INFO, "using SAE offload\n");
5267                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
5268                         err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
5269                                                      crypto->sae_pwd_len);
5270                         if (err < 0)
5271                                 goto exit;
5272                 }
5273                 if (profile->use_fwauth == 0)
5274                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5275
5276                 err = brcmf_parse_configure_security(ifp, settings,
5277                                                      NL80211_IFTYPE_AP);
5278                 if (err < 0) {
5279                         bphy_err(drvr, "brcmf_parse_configure_security error\n");
5280                         goto exit;
5281                 }
5282
5283                 /* On DOWN the firmware removes the WEP keys, reconfigure
5284                  * them if they were set.
5285                  */
5286                 brcmf_cfg80211_reconfigure_wep(ifp);
5287
5288                 memset(&join_params, 0, sizeof(join_params));
5289                 /* join parameters starts with ssid */
5290                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
5291                 /* create softap */
5292                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5293                                              &join_params, sizeof(join_params));
5294                 if (err < 0) {
5295                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5296                         goto exit;
5297                 }
5298
5299                 err = brcmf_fil_iovar_int_set(ifp, "closednet",
5300                                               settings->hidden_ssid);
5301                 if (err) {
5302                         bphy_err(drvr, "%s closednet error (%d)\n",
5303                                  settings->hidden_ssid ?
5304                                  "enabled" : "disabled",
5305                                  err);
5306                         goto exit;
5307                 }
5308
5309                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
5310         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
5311                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5312                 if (err < 0) {
5313                         bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5314                                  chanspec, err);
5315                         goto exit;
5316                 }
5317
5318                 err = brcmf_parse_configure_security(ifp, settings,
5319                                                      NL80211_IFTYPE_P2P_GO);
5320                 if (err < 0) {
5321                         brcmf_err("brcmf_parse_configure_security error\n");
5322                         goto exit;
5323                 }
5324
5325                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
5326                                                 sizeof(ssid_le));
5327                 if (err < 0) {
5328                         bphy_err(drvr, "setting ssid failed %d\n", err);
5329                         goto exit;
5330                 }
5331                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5332                 bss_enable.enable = cpu_to_le32(1);
5333                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5334                                                sizeof(bss_enable));
5335                 if (err < 0) {
5336                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5337                         goto exit;
5338                 }
5339
5340                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
5341         } else {
5342                 WARN_ON(1);
5343         }
5344
5345         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
5346         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5347         brcmf_net_setcarrier(ifp, true);
5348
5349 exit:
5350         if ((err) && (!mbss)) {
5351                 brcmf_set_mpc(ifp, 1);
5352                 brcmf_configure_arp_nd_offload(ifp, true);
5353         }
5354         return err;
5355 }
5356
5357 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
5358                                   unsigned int link_id)
5359 {
5360         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5361         struct brcmf_if *ifp = netdev_priv(ndev);
5362         struct brcmf_pub *drvr = cfg->pub;
5363         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5364         s32 err;
5365         struct brcmf_fil_bss_enable_le bss_enable;
5366         struct brcmf_join_params join_params;
5367
5368         brcmf_dbg(TRACE, "Enter\n");
5369
5370         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
5371                 /* Due to most likely deauths outstanding we sleep */
5372                 /* first to make sure they get processed by fw. */
5373                 msleep(400);
5374
5375                 if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
5376                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
5377                                 brcmf_set_pmk(ifp, NULL, 0);
5378                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
5379                                 brcmf_set_sae_password(ifp, NULL, 0);
5380                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5381                 }
5382
5383                 if (ifp->vif->mbss) {
5384                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5385                         return err;
5386                 }
5387
5388                 /* First BSS doesn't get a full reset */
5389                 if (ifp->bsscfgidx == 0)
5390                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
5391
5392                 memset(&join_params, 0, sizeof(join_params));
5393                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5394                                              &join_params, sizeof(join_params));
5395                 if (err < 0)
5396                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5397                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5398                 if (err < 0)
5399                         bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
5400                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
5401                 if (err < 0)
5402                         bphy_err(drvr, "setting AP mode failed %d\n", err);
5403                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
5404                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
5405                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5406                                       ifp->vif->is_11d);
5407                 /* Bring device back up so it can be used again */
5408                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5409                 if (err < 0)
5410                         bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
5411
5412                 brcmf_vif_clear_mgmt_ies(ifp->vif);
5413         } else {
5414                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5415                 bss_enable.enable = cpu_to_le32(0);
5416                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5417                                                sizeof(bss_enable));
5418                 if (err < 0)
5419                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5420         }
5421         brcmf_set_mpc(ifp, 1);
5422         brcmf_configure_arp_nd_offload(ifp, true);
5423         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5424         brcmf_net_setcarrier(ifp, false);
5425
5426         return err;
5427 }
5428
5429 static s32
5430 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5431                              struct cfg80211_beacon_data *info)
5432 {
5433         struct brcmf_if *ifp = netdev_priv(ndev);
5434
5435         brcmf_dbg(TRACE, "Enter\n");
5436
5437         return brcmf_config_ap_mgmt_ie(ifp->vif, info);
5438 }
5439
5440 static int
5441 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5442                            struct station_del_parameters *params)
5443 {
5444         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5445         struct brcmf_pub *drvr = cfg->pub;
5446         struct brcmf_scb_val_le scbval;
5447         struct brcmf_if *ifp = netdev_priv(ndev);
5448         s32 err;
5449
5450         if (!params->mac)
5451                 return -EFAULT;
5452
5453         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5454
5455         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5456                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5457         if (!check_vif_up(ifp->vif))
5458                 return -EIO;
5459
5460         memcpy(&scbval.ea, params->mac, ETH_ALEN);
5461         scbval.val = cpu_to_le32(params->reason_code);
5462         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5463                                      &scbval, sizeof(scbval));
5464         if (err)
5465                 bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5466                          err);
5467
5468         brcmf_dbg(TRACE, "Exit\n");
5469         return err;
5470 }
5471
5472 static int
5473 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5474                               const u8 *mac, struct station_parameters *params)
5475 {
5476         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5477         struct brcmf_pub *drvr = cfg->pub;
5478         struct brcmf_if *ifp = netdev_priv(ndev);
5479         s32 err;
5480
5481         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5482                   params->sta_flags_mask, params->sta_flags_set);
5483
5484         /* Ignore all 00 MAC */
5485         if (is_zero_ether_addr(mac))
5486                 return 0;
5487
5488         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5489                 return 0;
5490
5491         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5492                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5493                                              (void *)mac, ETH_ALEN);
5494         else
5495                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5496                                              (void *)mac, ETH_ALEN);
5497         if (err < 0)
5498                 bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5499
5500         return err;
5501 }
5502
5503 static void
5504 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5505                                                struct wireless_dev *wdev,
5506                                                struct mgmt_frame_regs *upd)
5507 {
5508         struct brcmf_cfg80211_vif *vif;
5509
5510         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5511
5512         vif->mgmt_rx_reg = upd->interface_stypes;
5513 }
5514
5515
5516 static int
5517 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5518                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5519 {
5520         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5521         struct ieee80211_channel *chan = params->chan;
5522         struct brcmf_pub *drvr = cfg->pub;
5523         const u8 *buf = params->buf;
5524         size_t len = params->len;
5525         const struct ieee80211_mgmt *mgmt;
5526         struct brcmf_cfg80211_vif *vif;
5527         s32 err = 0;
5528         s32 ie_offset;
5529         s32 ie_len;
5530         struct brcmf_fil_action_frame_le *action_frame;
5531         struct brcmf_fil_af_params_le *af_params;
5532         bool ack = false;
5533         s32 chan_nr;
5534         u32 freq;
5535         struct brcmf_mf_params_le *mf_params;
5536         u32 mf_params_len;
5537         s32 timeout;
5538
5539         brcmf_dbg(TRACE, "Enter\n");
5540
5541         *cookie = 0;
5542
5543         mgmt = (const struct ieee80211_mgmt *)buf;
5544
5545         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5546                 bphy_err(drvr, "Driver only allows MGMT packet type\n");
5547                 return -EPERM;
5548         }
5549
5550         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5551
5552         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5553                 /* Right now the only reason to get a probe response */
5554                 /* is for p2p listen response or for p2p GO from     */
5555                 /* wpa_supplicant. Unfortunately the probe is send   */
5556                 /* on primary ndev, while dongle wants it on the p2p */
5557                 /* vif. Since this is only reason for a probe        */
5558                 /* response to be sent, the vif is taken from cfg.   */
5559                 /* If ever desired to send proberesp for non p2p     */
5560                 /* response then data should be checked for          */
5561                 /* "DIRECT-". Note in future supplicant will take    */
5562                 /* dedicated p2p wdev to do this and then this 'hack'*/
5563                 /* is not needed anymore.                            */
5564                 ie_offset =  DOT11_MGMT_HDR_LEN +
5565                              DOT11_BCN_PRB_FIXED_LEN;
5566                 ie_len = len - ie_offset;
5567                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5568                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5569                 err = brcmf_vif_set_mgmt_ie(vif,
5570                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
5571                                             &buf[ie_offset],
5572                                             ie_len);
5573                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5574                                         GFP_KERNEL);
5575         } else if (ieee80211_is_action(mgmt->frame_control)) {
5576                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5577                         bphy_err(drvr, "invalid action frame length\n");
5578                         err = -EINVAL;
5579                         goto exit;
5580                 }
5581                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5582                 if (af_params == NULL) {
5583                         bphy_err(drvr, "unable to allocate frame\n");
5584                         err = -ENOMEM;
5585                         goto exit;
5586                 }
5587                 action_frame = &af_params->action_frame;
5588                 /* Add the packet Id */
5589                 action_frame->packet_id = cpu_to_le32(*cookie);
5590                 /* Add BSSID */
5591                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5592                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5593                 /* Add the length exepted for 802.11 header  */
5594                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5595                 /* Add the channel. Use the one specified as parameter if any or
5596                  * the current one (got from the firmware) otherwise
5597                  */
5598                 if (chan)
5599                         freq = chan->center_freq;
5600                 else
5601                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5602                                               &freq);
5603                 chan_nr = ieee80211_frequency_to_channel(freq);
5604                 af_params->channel = cpu_to_le32(chan_nr);
5605                 af_params->dwell_time = cpu_to_le32(params->wait);
5606                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5607                        le16_to_cpu(action_frame->len));
5608
5609                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5610                           *cookie, le16_to_cpu(action_frame->len), freq);
5611
5612                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5613                                                   af_params);
5614
5615                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5616                                         GFP_KERNEL);
5617                 kfree(af_params);
5618         } else if (ieee80211_is_auth(mgmt->frame_control)) {
5619                 reinit_completion(&vif->mgmt_tx);
5620                 clear_bit(BRCMF_MGMT_TX_ACK, &vif->mgmt_tx_status);
5621                 clear_bit(BRCMF_MGMT_TX_NOACK, &vif->mgmt_tx_status);
5622                 clear_bit(BRCMF_MGMT_TX_OFF_CHAN_COMPLETED,
5623                           &vif->mgmt_tx_status);
5624
5625                 mf_params_len = offsetof(struct brcmf_mf_params_le, data) +
5626                                 (len - DOT11_MGMT_HDR_LEN);
5627                 mf_params = kzalloc(mf_params_len, GFP_KERNEL);
5628                 if (!mf_params) {
5629                         err = -ENOMEM;
5630                         goto exit;
5631                 }
5632
5633                 mf_params->dwell_time = cpu_to_le32(MGMT_AUTH_FRAME_DWELL_TIME);
5634                 mf_params->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5635                 mf_params->frame_control = mgmt->frame_control;
5636
5637                 if (chan)
5638                         freq = chan->center_freq;
5639                 else
5640                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5641                                               &freq);
5642                 chan_nr = ieee80211_frequency_to_channel(freq);
5643                 mf_params->channel = cpu_to_le32(chan_nr);
5644                 memcpy(&mf_params->da[0], &mgmt->da[0], ETH_ALEN);
5645                 memcpy(&mf_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5646                 mf_params->packet_id = cpu_to_le32(*cookie);
5647                 memcpy(mf_params->data, &buf[DOT11_MGMT_HDR_LEN],
5648                        le16_to_cpu(mf_params->len));
5649
5650                 brcmf_dbg(TRACE, "Auth frame, cookie=%d, fc=%04x, len=%d, channel=%d\n",
5651                           le32_to_cpu(mf_params->packet_id),
5652                           le16_to_cpu(mf_params->frame_control),
5653                           le16_to_cpu(mf_params->len),
5654                           le32_to_cpu(mf_params->channel));
5655
5656                 vif->mgmt_tx_id = le32_to_cpu(mf_params->packet_id);
5657                 set_bit(BRCMF_MGMT_TX_SEND_FRAME, &vif->mgmt_tx_status);
5658
5659                 err = brcmf_fil_bsscfg_data_set(vif->ifp, "mgmt_frame",
5660                                                 mf_params, mf_params_len);
5661                 if (err) {
5662                         bphy_err(drvr, "Failed to send Auth frame: err=%d\n",
5663                                  err);
5664                         goto tx_status;
5665                 }
5666
5667                 timeout =
5668                         wait_for_completion_timeout(&vif->mgmt_tx,
5669                                                     MGMT_AUTH_FRAME_WAIT_TIME);
5670                 if (test_bit(BRCMF_MGMT_TX_ACK, &vif->mgmt_tx_status)) {
5671                         brcmf_dbg(TRACE, "TX Auth frame operation is success\n");
5672                         ack = true;
5673                 } else {
5674                         bphy_err(drvr, "TX Auth frame operation is failed: status=%ld)\n",
5675                                  vif->mgmt_tx_status);
5676                 }
5677
5678 tx_status:
5679                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5680                                         GFP_KERNEL);
5681                 kfree(mf_params);
5682
5683         } else {
5684                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5685                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5686         }
5687
5688 exit:
5689         return err;
5690 }
5691
5692 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5693                                                     struct net_device *ndev,
5694                                                     s32 rssi_low, s32 rssi_high)
5695 {
5696         struct brcmf_cfg80211_vif *vif;
5697         struct brcmf_if *ifp;
5698         int err = 0;
5699
5700         brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5701
5702         ifp = netdev_priv(ndev);
5703         vif = ifp->vif;
5704
5705         if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5706                 /* The firmware will send an event when the RSSI is less than or
5707                  * equal to a configured level and the previous RSSI event was
5708                  * less than or equal to a different level. Set a third level
5709                  * so that we also detect the transition from rssi <= rssi_high
5710                  * to rssi > rssi_high.
5711                  */
5712                 struct brcmf_rssi_event_le config = {
5713                         .rate_limit_msec = cpu_to_le32(0),
5714                         .rssi_level_num = 3,
5715                         .rssi_levels = {
5716                                 clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5717                                 clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5718                                 S8_MAX,
5719                         },
5720                 };
5721
5722                 err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5723                                                sizeof(config));
5724                 if (err) {
5725                         err = -EINVAL;
5726                 } else {
5727                         vif->cqm_rssi_low = rssi_low;
5728                         vif->cqm_rssi_high = rssi_high;
5729                 }
5730         }
5731
5732         return err;
5733 }
5734
5735 static int
5736 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5737                                         struct wireless_dev *wdev,
5738                                         u64 cookie)
5739 {
5740         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5741         struct brcmf_pub *drvr = cfg->pub;
5742         struct brcmf_cfg80211_vif *vif;
5743         int err = 0;
5744
5745         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5746
5747         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5748         if (vif == NULL) {
5749                 bphy_err(drvr, "No p2p device available for probe response\n");
5750                 err = -ENODEV;
5751                 goto exit;
5752         }
5753         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5754 exit:
5755         return err;
5756 }
5757
5758 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5759                                       struct wireless_dev *wdev,
5760                                       unsigned int link_id,
5761                                       struct cfg80211_chan_def *chandef)
5762 {
5763         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5764         struct net_device *ndev = wdev->netdev;
5765         struct brcmf_pub *drvr = cfg->pub;
5766         struct brcmu_chan ch;
5767         enum nl80211_band band = 0;
5768         enum nl80211_chan_width width = 0;
5769         u32 chanspec;
5770         int freq, err;
5771
5772         if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5773                 return -ENODEV;
5774
5775         err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5776         if (err) {
5777                 bphy_err(drvr, "chanspec failed (%d)\n", err);
5778                 return err;
5779         }
5780
5781         ch.chspec = chanspec;
5782         cfg->d11inf.decchspec(&ch);
5783
5784         switch (ch.band) {
5785         case BRCMU_CHAN_BAND_2G:
5786                 band = NL80211_BAND_2GHZ;
5787                 break;
5788         case BRCMU_CHAN_BAND_5G:
5789                 band = NL80211_BAND_5GHZ;
5790                 break;
5791         }
5792
5793         switch (ch.bw) {
5794         case BRCMU_CHAN_BW_80:
5795                 width = NL80211_CHAN_WIDTH_80;
5796                 break;
5797         case BRCMU_CHAN_BW_40:
5798                 width = NL80211_CHAN_WIDTH_40;
5799                 break;
5800         case BRCMU_CHAN_BW_20:
5801                 width = NL80211_CHAN_WIDTH_20;
5802                 break;
5803         case BRCMU_CHAN_BW_80P80:
5804                 width = NL80211_CHAN_WIDTH_80P80;
5805                 break;
5806         case BRCMU_CHAN_BW_160:
5807                 width = NL80211_CHAN_WIDTH_160;
5808                 break;
5809         }
5810
5811         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5812         chandef->chan = ieee80211_get_channel(wiphy, freq);
5813         chandef->width = width;
5814         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5815         chandef->center_freq2 = 0;
5816
5817         return 0;
5818 }
5819
5820 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5821                                            struct wireless_dev *wdev,
5822                                            enum nl80211_crit_proto_id proto,
5823                                            u16 duration)
5824 {
5825         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5826         struct brcmf_cfg80211_vif *vif;
5827
5828         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5829
5830         /* only DHCP support for now */
5831         if (proto != NL80211_CRIT_PROTO_DHCP)
5832                 return -EINVAL;
5833
5834         /* suppress and abort scanning */
5835         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5836         brcmf_abort_scanning(cfg);
5837
5838         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5839 }
5840
5841 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5842                                            struct wireless_dev *wdev)
5843 {
5844         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5845         struct brcmf_cfg80211_vif *vif;
5846
5847         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5848
5849         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5850         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5851 }
5852
5853 static s32
5854 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5855                              const struct brcmf_event_msg *e, void *data)
5856 {
5857         switch (e->reason) {
5858         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5859                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5860                 break;
5861         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5862                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5863                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5864                 break;
5865         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5866                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5867                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5868                 break;
5869         }
5870
5871         return 0;
5872 }
5873
5874 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5875 {
5876         int ret;
5877
5878         switch (oper) {
5879         case NL80211_TDLS_DISCOVERY_REQ:
5880                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5881                 break;
5882         case NL80211_TDLS_SETUP:
5883                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5884                 break;
5885         case NL80211_TDLS_TEARDOWN:
5886                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5887                 break;
5888         default:
5889                 brcmf_err("unsupported operation: %d\n", oper);
5890                 ret = -EOPNOTSUPP;
5891         }
5892         return ret;
5893 }
5894
5895 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5896                                     struct net_device *ndev, const u8 *peer,
5897                                     enum nl80211_tdls_operation oper)
5898 {
5899         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5900         struct brcmf_pub *drvr = cfg->pub;
5901         struct brcmf_if *ifp;
5902         struct brcmf_tdls_iovar_le info;
5903         int ret = 0;
5904
5905         ret = brcmf_convert_nl80211_tdls_oper(oper);
5906         if (ret < 0)
5907                 return ret;
5908
5909         ifp = netdev_priv(ndev);
5910         memset(&info, 0, sizeof(info));
5911         info.mode = (u8)ret;
5912         if (peer)
5913                 memcpy(info.ea, peer, ETH_ALEN);
5914
5915         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5916                                        &info, sizeof(info));
5917         if (ret < 0)
5918                 bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5919
5920         return ret;
5921 }
5922
5923 static int
5924 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5925                                   struct net_device *ndev,
5926                                   struct cfg80211_connect_params *sme,
5927                                   u32 changed)
5928 {
5929         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5930         struct brcmf_pub *drvr = cfg->pub;
5931         struct brcmf_if *ifp;
5932         int err;
5933
5934         if (!(changed & UPDATE_ASSOC_IES))
5935                 return 0;
5936
5937         ifp = netdev_priv(ndev);
5938         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5939                                     sme->ie, sme->ie_len);
5940         if (err)
5941                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5942         else
5943                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5944
5945         return err;
5946 }
5947
5948 #ifdef CONFIG_PM
5949 static int
5950 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5951                               struct cfg80211_gtk_rekey_data *gtk)
5952 {
5953         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5954         struct brcmf_pub *drvr = cfg->pub;
5955         struct brcmf_if *ifp = netdev_priv(ndev);
5956         struct brcmf_gtk_keyinfo_le gtk_le;
5957         int ret;
5958
5959         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5960
5961         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5962         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5963         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5964                sizeof(gtk_le.replay_counter));
5965
5966         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5967                                        sizeof(gtk_le));
5968         if (ret < 0)
5969                 bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5970
5971         return ret;
5972 }
5973 #endif
5974
5975 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5976                                   const struct cfg80211_pmk_conf *conf)
5977 {
5978         struct brcmf_if *ifp;
5979
5980         brcmf_dbg(TRACE, "enter\n");
5981
5982         /* expect using firmware supplicant for 1X */
5983         ifp = netdev_priv(dev);
5984         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5985                 return -EINVAL;
5986
5987         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5988                 return -ERANGE;
5989
5990         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5991 }
5992
5993 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5994                                   const u8 *aa)
5995 {
5996         struct brcmf_if *ifp;
5997
5998         brcmf_dbg(TRACE, "enter\n");
5999         ifp = netdev_priv(dev);
6000         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
6001                 return -EINVAL;
6002
6003         return brcmf_set_pmk(ifp, NULL, 0);
6004 }
6005
6006 static int
6007 brcmf_cfg80211_external_auth(struct wiphy *wiphy, struct net_device *dev,
6008                              struct cfg80211_external_auth_params *params)
6009 {
6010         struct brcmf_if *ifp;
6011         struct brcmf_pub *drvr;
6012         struct brcmf_auth_req_status_le auth_status;
6013         int ret = 0;
6014
6015         brcmf_dbg(TRACE, "Enter\n");
6016
6017         ifp = netdev_priv(dev);
6018         drvr = ifp->drvr;
6019         if (params->status == WLAN_STATUS_SUCCESS) {
6020                 auth_status.flags = cpu_to_le16(BRCMF_EXTAUTH_SUCCESS);
6021         } else {
6022                 bphy_err(drvr, "External authentication failed: status=%d\n",
6023                          params->status);
6024                 auth_status.flags = cpu_to_le16(BRCMF_EXTAUTH_FAIL);
6025         }
6026
6027         memcpy(auth_status.peer_mac, params->bssid, ETH_ALEN);
6028         auth_status.ssid_len = cpu_to_le32(min_t(u8, params->ssid.ssid_len,
6029                                                  IEEE80211_MAX_SSID_LEN));
6030         memcpy(auth_status.ssid, params->ssid.ssid, auth_status.ssid_len);
6031
6032         ret = brcmf_fil_iovar_data_set(ifp, "auth_status", &auth_status,
6033                                        sizeof(auth_status));
6034         if (ret < 0)
6035                 bphy_err(drvr, "auth_status iovar failed: ret=%d\n", ret);
6036
6037         return ret;
6038 }
6039
6040 static struct cfg80211_ops brcmf_cfg80211_ops = {
6041         .add_virtual_intf = brcmf_cfg80211_add_iface,
6042         .del_virtual_intf = brcmf_cfg80211_del_iface,
6043         .change_virtual_intf = brcmf_cfg80211_change_iface,
6044         .scan = brcmf_cfg80211_scan,
6045         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
6046         .join_ibss = brcmf_cfg80211_join_ibss,
6047         .leave_ibss = brcmf_cfg80211_leave_ibss,
6048         .get_station = brcmf_cfg80211_get_station,
6049         .dump_station = brcmf_cfg80211_dump_station,
6050         .set_tx_power = brcmf_cfg80211_set_tx_power,
6051         .get_tx_power = brcmf_cfg80211_get_tx_power,
6052         .add_key = brcmf_cfg80211_add_key,
6053         .del_key = brcmf_cfg80211_del_key,
6054         .get_key = brcmf_cfg80211_get_key,
6055         .set_default_key = brcmf_cfg80211_config_default_key,
6056         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
6057         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
6058         .connect = brcmf_cfg80211_connect,
6059         .disconnect = brcmf_cfg80211_disconnect,
6060         .suspend = brcmf_cfg80211_suspend,
6061         .resume = brcmf_cfg80211_resume,
6062         .set_pmksa = brcmf_cfg80211_set_pmksa,
6063         .del_pmksa = brcmf_cfg80211_del_pmksa,
6064         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
6065         .start_ap = brcmf_cfg80211_start_ap,
6066         .stop_ap = brcmf_cfg80211_stop_ap,
6067         .change_beacon = brcmf_cfg80211_change_beacon,
6068         .del_station = brcmf_cfg80211_del_station,
6069         .change_station = brcmf_cfg80211_change_station,
6070         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
6071         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
6072         .update_mgmt_frame_registrations =
6073                 brcmf_cfg80211_update_mgmt_frame_registrations,
6074         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
6075         .set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
6076         .remain_on_channel = brcmf_p2p_remain_on_channel,
6077         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
6078         .get_channel = brcmf_cfg80211_get_channel,
6079         .start_p2p_device = brcmf_p2p_start_device,
6080         .stop_p2p_device = brcmf_p2p_stop_device,
6081         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
6082         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
6083         .tdls_oper = brcmf_cfg80211_tdls_oper,
6084         .update_connect_params = brcmf_cfg80211_update_conn_params,
6085         .set_pmk = brcmf_cfg80211_set_pmk,
6086         .del_pmk = brcmf_cfg80211_del_pmk,
6087         .external_auth = brcmf_cfg80211_external_auth,
6088 };
6089
6090 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
6091 {
6092         struct cfg80211_ops *ops;
6093
6094         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
6095                        GFP_KERNEL);
6096
6097         if (ops && settings->roamoff)
6098                 ops->update_connect_params = NULL;
6099
6100         return ops;
6101 }
6102
6103 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
6104                                            enum nl80211_iftype type)
6105 {
6106         struct brcmf_cfg80211_vif *vif_walk;
6107         struct brcmf_cfg80211_vif *vif;
6108         bool mbss;
6109         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
6110
6111         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
6112                   sizeof(*vif));
6113         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
6114         if (!vif)
6115                 return ERR_PTR(-ENOMEM);
6116
6117         vif->wdev.wiphy = cfg->wiphy;
6118         vif->wdev.iftype = type;
6119
6120         brcmf_init_prof(&vif->profile);
6121
6122         if (type == NL80211_IFTYPE_AP &&
6123             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
6124                 mbss = false;
6125                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
6126                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
6127                                 mbss = true;
6128                                 break;
6129                         }
6130                 }
6131                 vif->mbss = mbss;
6132         }
6133
6134         init_completion(&vif->mgmt_tx);
6135         list_add_tail(&vif->list, &cfg->vif_list);
6136         return vif;
6137 }
6138
6139 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
6140 {
6141         list_del(&vif->list);
6142         kfree(vif);
6143 }
6144
6145 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
6146 {
6147         struct brcmf_cfg80211_vif *vif;
6148         struct brcmf_if *ifp;
6149
6150         ifp = netdev_priv(ndev);
6151         vif = ifp->vif;
6152
6153         if (vif)
6154                 brcmf_free_vif(vif);
6155 }
6156
6157 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
6158                             const struct brcmf_event_msg *e)
6159 {
6160         u32 event = e->event_code;
6161         u32 status = e->status;
6162
6163         if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
6164              vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
6165             event == BRCMF_E_PSK_SUP &&
6166             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
6167                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6168         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
6169                 brcmf_dbg(CONN, "Processing set ssid\n");
6170                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
6171                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
6172                     vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
6173                         return true;
6174
6175                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6176         }
6177
6178         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
6179             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
6180                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6181                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6182                 return true;
6183         }
6184         return false;
6185 }
6186
6187 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
6188                             const struct brcmf_event_msg *e)
6189 {
6190         u32 event = e->event_code;
6191         u16 flags = e->flags;
6192
6193         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
6194             (event == BRCMF_E_DISASSOC_IND) ||
6195             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
6196                 brcmf_dbg(CONN, "Processing link down\n");
6197                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6198                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6199                 return true;
6200         }
6201         return false;
6202 }
6203
6204 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
6205                                const struct brcmf_event_msg *e)
6206 {
6207         u32 event = e->event_code;
6208         u32 status = e->status;
6209
6210         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
6211                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
6212                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
6213                 return true;
6214         }
6215
6216         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
6217                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
6218                 return true;
6219         }
6220
6221         if (event == BRCMF_E_PSK_SUP &&
6222             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
6223                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
6224                           status);
6225                 return true;
6226         }
6227
6228         return false;
6229 }
6230
6231 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
6232 {
6233         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6234
6235         kfree(conn_info->req_ie);
6236         conn_info->req_ie = NULL;
6237         conn_info->req_ie_len = 0;
6238         kfree(conn_info->resp_ie);
6239         conn_info->resp_ie = NULL;
6240         conn_info->resp_ie_len = 0;
6241 }
6242
6243 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
6244 {
6245         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6246
6247         if (!cfg)
6248                 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
6249                        (prio ^ 2) : prio;
6250
6251         /* For those AC(s) with ACM flag set to 1, convert its 4-level priority
6252          * to an 8-level precedence which is the same as BE's
6253          */
6254         if (prio > PRIO_8021D_EE &&
6255             cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
6256                 return cfg->ac_priority[prio] * 2;
6257
6258         /* Conversion of 4-level priority to 8-level precedence */
6259         if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
6260             prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
6261                 return cfg->ac_priority[prio] * 2;
6262         else
6263                 return cfg->ac_priority[prio] * 2 + 1;
6264 }
6265
6266 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
6267 {
6268         /* Prio here refers to the 802.1d priority in range of 0 to 7.
6269          * ACI here refers to the WLAN AC Index in range of 0 to 3.
6270          * This function will return ACI corresponding to input prio.
6271          */
6272         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6273
6274         if (cfg)
6275                 return cfg->ac_priority[prio];
6276
6277         return prio;
6278 }
6279
6280 static void brcmf_init_wmm_prio(u8 *priority)
6281 {
6282         /* Initialize AC priority array to default
6283          * 802.1d priority as per following table:
6284          * 802.1d prio 0,3 maps to BE
6285          * 802.1d prio 1,2 maps to BK
6286          * 802.1d prio 4,5 maps to VI
6287          * 802.1d prio 6,7 maps to VO
6288          */
6289         priority[0] = BRCMF_FWS_FIFO_AC_BE;
6290         priority[3] = BRCMF_FWS_FIFO_AC_BE;
6291         priority[1] = BRCMF_FWS_FIFO_AC_BK;
6292         priority[2] = BRCMF_FWS_FIFO_AC_BK;
6293         priority[4] = BRCMF_FWS_FIFO_AC_VI;
6294         priority[5] = BRCMF_FWS_FIFO_AC_VI;
6295         priority[6] = BRCMF_FWS_FIFO_AC_VO;
6296         priority[7] = BRCMF_FWS_FIFO_AC_VO;
6297 }
6298
6299 static void brcmf_wifi_prioritize_acparams(const
6300         struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
6301 {
6302         u8 aci;
6303         u8 aifsn;
6304         u8 ecwmin;
6305         u8 ecwmax;
6306         u8 acm;
6307         u8 ranking_basis[EDCF_AC_COUNT];
6308         u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
6309         u8 index;
6310
6311         for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
6312                 aifsn  = acp->ACI & EDCF_AIFSN_MASK;
6313                 acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
6314                 ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
6315                 ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
6316                 brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
6317                           aci, aifsn, acm, ecwmin, ecwmax);
6318                 /* Default AC_VO will be the lowest ranking value */
6319                 ranking_basis[aci] = aifsn + ecwmin + ecwmax;
6320                 /* Initialise priority starting at 0 (AC_BE) */
6321                 aci_prio[aci] = 0;
6322
6323                 /* If ACM is set, STA can't use this AC as per 802.11.
6324                  * Change the ranking to BE
6325                  */
6326                 if (aci != AC_BE && aci != AC_BK && acm == 1)
6327                         ranking_basis[aci] = ranking_basis[AC_BE];
6328         }
6329
6330         /* Ranking method which works for AC priority
6331          * swapping when values for cwmin, cwmax and aifsn are varied
6332          * Compare each aci_prio against each other aci_prio
6333          */
6334         for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
6335                 for (index = 0; index < EDCF_AC_COUNT; index++) {
6336                         if (index != aci) {
6337                                 /* Smaller ranking value has higher priority,
6338                                  * so increment priority for each ACI which has
6339                                  * a higher ranking value
6340                                  */
6341                                 if (ranking_basis[aci] < ranking_basis[index])
6342                                         aci_prio[aci]++;
6343                         }
6344                 }
6345         }
6346
6347         /* By now, aci_prio[] will be in range of 0 to 3.
6348          * Use ACI prio to get the new priority value for
6349          * each 802.1d traffic type, in this range.
6350          */
6351         if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
6352               aci_prio[AC_BK] == aci_prio[AC_VI] &&
6353               aci_prio[AC_VI] == aci_prio[AC_VO])) {
6354                 /* 802.1d 0,3 maps to BE */
6355                 priority[0] = aci_prio[AC_BE];
6356                 priority[3] = aci_prio[AC_BE];
6357
6358                 /* 802.1d 1,2 maps to BK */
6359                 priority[1] = aci_prio[AC_BK];
6360                 priority[2] = aci_prio[AC_BK];
6361
6362                 /* 802.1d 4,5 maps to VO */
6363                 priority[4] = aci_prio[AC_VI];
6364                 priority[5] = aci_prio[AC_VI];
6365
6366                 /* 802.1d 6,7 maps to VO */
6367                 priority[6] = aci_prio[AC_VO];
6368                 priority[7] = aci_prio[AC_VO];
6369         } else {
6370                 /* Initialize to default priority */
6371                 brcmf_init_wmm_prio(priority);
6372         }
6373
6374         brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
6375                   priority[0], priority[1], priority[2], priority[3]);
6376
6377         brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
6378                   priority[4], priority[5], priority[6], priority[7]);
6379 }
6380
6381 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
6382                                struct brcmf_if *ifp)
6383 {
6384         struct brcmf_pub *drvr = cfg->pub;
6385         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
6386         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6387         struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
6388         u32 req_len;
6389         u32 resp_len;
6390         s32 err = 0;
6391
6392         brcmf_clear_assoc_ies(cfg);
6393
6394         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
6395                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
6396         if (err) {
6397                 bphy_err(drvr, "could not get assoc info (%d)\n", err);
6398                 return err;
6399         }
6400         assoc_info =
6401                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
6402         req_len = le32_to_cpu(assoc_info->req_len);
6403         resp_len = le32_to_cpu(assoc_info->resp_len);
6404         if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
6405                 bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
6406                          req_len, resp_len);
6407                 return -EINVAL;
6408         }
6409         if (req_len) {
6410                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
6411                                                cfg->extra_buf,
6412                                                WL_ASSOC_INFO_MAX);
6413                 if (err) {
6414                         bphy_err(drvr, "could not get assoc req (%d)\n", err);
6415                         return err;
6416                 }
6417                 conn_info->req_ie_len = req_len;
6418                 conn_info->req_ie =
6419                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
6420                             GFP_KERNEL);
6421                 if (!conn_info->req_ie)
6422                         conn_info->req_ie_len = 0;
6423         } else {
6424                 conn_info->req_ie_len = 0;
6425                 conn_info->req_ie = NULL;
6426         }
6427         if (resp_len) {
6428                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
6429                                                cfg->extra_buf,
6430                                                WL_ASSOC_INFO_MAX);
6431                 if (err) {
6432                         bphy_err(drvr, "could not get assoc resp (%d)\n", err);
6433                         return err;
6434                 }
6435                 conn_info->resp_ie_len = resp_len;
6436                 conn_info->resp_ie =
6437                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
6438                             GFP_KERNEL);
6439                 if (!conn_info->resp_ie)
6440                         conn_info->resp_ie_len = 0;
6441
6442                 err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
6443                                                edcf_acparam_info,
6444                                                sizeof(edcf_acparam_info));
6445                 if (err) {
6446                         brcmf_err("could not get wme_ac_sta (%d)\n", err);
6447                         return err;
6448                 }
6449
6450                 brcmf_wifi_prioritize_acparams(edcf_acparam_info,
6451                                                cfg->ac_priority);
6452         } else {
6453                 conn_info->resp_ie_len = 0;
6454                 conn_info->resp_ie = NULL;
6455         }
6456         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
6457                   conn_info->req_ie_len, conn_info->resp_ie_len);
6458
6459         return err;
6460 }
6461
6462 static s32
6463 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
6464                        struct net_device *ndev,
6465                        const struct brcmf_event_msg *e)
6466 {
6467         struct brcmf_if *ifp = netdev_priv(ndev);
6468         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6469         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6470         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6471         struct ieee80211_channel *notify_channel = NULL;
6472         struct ieee80211_supported_band *band;
6473         struct brcmf_bss_info_le *bi;
6474         struct brcmu_chan ch;
6475         struct cfg80211_roam_info roam_info = {};
6476         u32 freq;
6477         s32 err = 0;
6478         u8 *buf;
6479
6480         brcmf_dbg(TRACE, "Enter\n");
6481
6482         brcmf_get_assoc_ies(cfg, ifp);
6483         memcpy(profile->bssid, e->addr, ETH_ALEN);
6484         brcmf_update_bss_info(cfg, ifp);
6485
6486         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
6487         if (buf == NULL) {
6488                 err = -ENOMEM;
6489                 goto done;
6490         }
6491
6492         /* data sent to dongle has to be little endian */
6493         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
6494         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
6495                                      buf, WL_BSS_INFO_MAX);
6496
6497         if (err)
6498                 goto done;
6499
6500         bi = (struct brcmf_bss_info_le *)(buf + 4);
6501         ch.chspec = le16_to_cpu(bi->chanspec);
6502         cfg->d11inf.decchspec(&ch);
6503
6504         if (ch.band == BRCMU_CHAN_BAND_2G)
6505                 band = wiphy->bands[NL80211_BAND_2GHZ];
6506         else
6507                 band = wiphy->bands[NL80211_BAND_5GHZ];
6508
6509         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
6510         notify_channel = ieee80211_get_channel(wiphy, freq);
6511
6512 done:
6513         kfree(buf);
6514
6515         roam_info.links[0].channel = notify_channel;
6516         roam_info.links[0].bssid = profile->bssid;
6517         roam_info.req_ie = conn_info->req_ie;
6518         roam_info.req_ie_len = conn_info->req_ie_len;
6519         roam_info.resp_ie = conn_info->resp_ie;
6520         roam_info.resp_ie_len = conn_info->resp_ie_len;
6521
6522         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6523         brcmf_dbg(CONN, "Report roaming result\n");
6524
6525         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6526                 cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
6527                 brcmf_dbg(CONN, "Report port authorized\n");
6528         }
6529
6530         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6531         brcmf_dbg(TRACE, "Exit\n");
6532         return err;
6533 }
6534
6535 static s32
6536 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6537                        struct net_device *ndev, const struct brcmf_event_msg *e,
6538                        bool completed)
6539 {
6540         struct brcmf_if *ifp = netdev_priv(ndev);
6541         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6542         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6543         struct cfg80211_connect_resp_params conn_params;
6544
6545         brcmf_dbg(TRACE, "Enter\n");
6546
6547         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6548                                &ifp->vif->sme_state)) {
6549                 memset(&conn_params, 0, sizeof(conn_params));
6550                 if (completed) {
6551                         brcmf_get_assoc_ies(cfg, ifp);
6552                         brcmf_update_bss_info(cfg, ifp);
6553                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6554                                 &ifp->vif->sme_state);
6555                         conn_params.status = WLAN_STATUS_SUCCESS;
6556                 } else {
6557                         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS,
6558                                   &ifp->vif->sme_state);
6559                         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
6560                                   &ifp->vif->sme_state);
6561                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6562                 }
6563                 conn_params.links[0].bssid = profile->bssid;
6564                 conn_params.req_ie = conn_info->req_ie;
6565                 conn_params.req_ie_len = conn_info->req_ie_len;
6566                 conn_params.resp_ie = conn_info->resp_ie;
6567                 conn_params.resp_ie_len = conn_info->resp_ie_len;
6568                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6569                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
6570                           completed ? "succeeded" : "failed");
6571         }
6572         brcmf_dbg(TRACE, "Exit\n");
6573         return 0;
6574 }
6575
6576 static s32
6577 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6578                                struct net_device *ndev,
6579                                const struct brcmf_event_msg *e, void *data)
6580 {
6581         struct brcmf_pub *drvr = cfg->pub;
6582         static int generation;
6583         u32 event = e->event_code;
6584         u32 reason = e->reason;
6585         struct station_info *sinfo;
6586
6587         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6588                   brcmf_fweh_event_name(event), event, reason);
6589         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6590             ndev != cfg_to_ndev(cfg)) {
6591                 brcmf_dbg(CONN, "AP mode link down\n");
6592                 complete(&cfg->vif_disabled);
6593                 return 0;
6594         }
6595
6596         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6597             (reason == BRCMF_E_STATUS_SUCCESS)) {
6598                 if (!data) {
6599                         bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6600                         return -EINVAL;
6601                 }
6602
6603                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6604                 if (!sinfo)
6605                         return -ENOMEM;
6606
6607                 sinfo->assoc_req_ies = data;
6608                 sinfo->assoc_req_ies_len = e->datalen;
6609                 generation++;
6610                 sinfo->generation = generation;
6611                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6612
6613                 kfree(sinfo);
6614         } else if ((event == BRCMF_E_DISASSOC_IND) ||
6615                    (event == BRCMF_E_DEAUTH_IND) ||
6616                    (event == BRCMF_E_DEAUTH)) {
6617                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6618         }
6619         return 0;
6620 }
6621
6622 static s32
6623 brcmf_notify_connect_status(struct brcmf_if *ifp,
6624                             const struct brcmf_event_msg *e, void *data)
6625 {
6626         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6627         struct net_device *ndev = ifp->ndev;
6628         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6629         struct ieee80211_channel *chan;
6630         s32 err = 0;
6631
6632         if ((e->event_code == BRCMF_E_DEAUTH) ||
6633             (e->event_code == BRCMF_E_DEAUTH_IND) ||
6634             (e->event_code == BRCMF_E_DISASSOC_IND) ||
6635             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6636                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6637         }
6638
6639         if (brcmf_is_apmode(ifp->vif)) {
6640                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6641         } else if (brcmf_is_linkup(ifp->vif, e)) {
6642                 brcmf_dbg(CONN, "Linkup\n");
6643                 if (brcmf_is_ibssmode(ifp->vif)) {
6644                         brcmf_inform_ibss(cfg, ndev, e->addr);
6645                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6646                         memcpy(profile->bssid, e->addr, ETH_ALEN);
6647                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6648                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6649                                   &ifp->vif->sme_state);
6650                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6651                                 &ifp->vif->sme_state);
6652                 } else
6653                         brcmf_bss_connect_done(cfg, ndev, e, true);
6654                 brcmf_net_setcarrier(ifp, true);
6655         } else if (brcmf_is_linkdown(ifp->vif, e)) {
6656                 brcmf_dbg(CONN, "Linkdown\n");
6657                 if (!brcmf_is_ibssmode(ifp->vif) &&
6658                     (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6659                               &ifp->vif->sme_state) ||
6660                      test_bit(BRCMF_VIF_STATUS_CONNECTING,
6661                               &ifp->vif->sme_state))) {
6662                         if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6663                                      &ifp->vif->sme_state) &&
6664                             memcmp(profile->bssid, e->addr, ETH_ALEN))
6665                                 return err;
6666
6667                         brcmf_bss_connect_done(cfg, ndev, e, false);
6668                         brcmf_link_down(ifp->vif,
6669                                         brcmf_map_fw_linkdown_reason(e),
6670                                         e->event_code &
6671                                         (BRCMF_E_DEAUTH_IND |
6672                                         BRCMF_E_DISASSOC_IND)
6673                                         ? false : true);
6674                         brcmf_init_prof(ndev_to_prof(ndev));
6675                         if (ndev != cfg_to_ndev(cfg))
6676                                 complete(&cfg->vif_disabled);
6677                         brcmf_net_setcarrier(ifp, false);
6678                 }
6679         } else if (brcmf_is_nonetwork(cfg, e)) {
6680                 if (brcmf_is_ibssmode(ifp->vif))
6681                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6682                                   &ifp->vif->sme_state);
6683                 else
6684                         brcmf_bss_connect_done(cfg, ndev, e, false);
6685         }
6686
6687         return err;
6688 }
6689
6690 static s32
6691 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6692                             const struct brcmf_event_msg *e, void *data)
6693 {
6694         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6695         u32 event = e->event_code;
6696         u32 status = e->status;
6697
6698         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6699                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6700                              &ifp->vif->sme_state)) {
6701                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6702                 } else {
6703                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6704                         brcmf_net_setcarrier(ifp, true);
6705                 }
6706         }
6707
6708         return 0;
6709 }
6710
6711 static s32
6712 brcmf_notify_mic_status(struct brcmf_if *ifp,
6713                         const struct brcmf_event_msg *e, void *data)
6714 {
6715         u16 flags = e->flags;
6716         enum nl80211_key_type key_type;
6717
6718         if (flags & BRCMF_EVENT_MSG_GROUP)
6719                 key_type = NL80211_KEYTYPE_GROUP;
6720         else
6721                 key_type = NL80211_KEYTYPE_PAIRWISE;
6722
6723         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6724                                      NULL, GFP_KERNEL);
6725
6726         return 0;
6727 }
6728
6729 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6730                              const struct brcmf_event_msg *e, void *data)
6731 {
6732         struct brcmf_cfg80211_vif *vif = ifp->vif;
6733         struct brcmf_rssi_be *info = data;
6734         s32 rssi, snr = 0, noise = 0;
6735         s32 low, high, last;
6736
6737         if (e->datalen >= sizeof(*info)) {
6738                 rssi = be32_to_cpu(info->rssi);
6739                 snr = be32_to_cpu(info->snr);
6740                 noise = be32_to_cpu(info->noise);
6741         } else if (e->datalen >= sizeof(rssi)) {
6742                 rssi = be32_to_cpu(*(__be32 *)data);
6743         } else {
6744                 brcmf_err("insufficient RSSI event data\n");
6745                 return 0;
6746         }
6747
6748         low = vif->cqm_rssi_low;
6749         high = vif->cqm_rssi_high;
6750         last = vif->cqm_rssi_last;
6751
6752         brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6753                   rssi, snr, noise, low, high, last);
6754
6755         vif->cqm_rssi_last = rssi;
6756
6757         if (rssi <= low || rssi == 0) {
6758                 brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6759                 cfg80211_cqm_rssi_notify(ifp->ndev,
6760                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6761                                          rssi, GFP_KERNEL);
6762         } else if (rssi > high) {
6763                 brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6764                 cfg80211_cqm_rssi_notify(ifp->ndev,
6765                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6766                                          rssi, GFP_KERNEL);
6767         }
6768
6769         return 0;
6770 }
6771
6772 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6773                                   const struct brcmf_event_msg *e, void *data)
6774 {
6775         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6776         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6777         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6778         struct brcmf_cfg80211_vif *vif;
6779
6780         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6781                   ifevent->action, ifevent->flags, ifevent->ifidx,
6782                   ifevent->bsscfgidx);
6783
6784         spin_lock(&event->vif_event_lock);
6785         event->action = ifevent->action;
6786         vif = event->vif;
6787
6788         switch (ifevent->action) {
6789         case BRCMF_E_IF_ADD:
6790                 /* waiting process may have timed out */
6791                 if (!cfg->vif_event.vif) {
6792                         spin_unlock(&event->vif_event_lock);
6793                         return -EBADF;
6794                 }
6795
6796                 ifp->vif = vif;
6797                 vif->ifp = ifp;
6798                 if (ifp->ndev) {
6799                         vif->wdev.netdev = ifp->ndev;
6800                         ifp->ndev->ieee80211_ptr = &vif->wdev;
6801                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6802                 }
6803                 spin_unlock(&event->vif_event_lock);
6804                 wake_up(&event->vif_wq);
6805                 return 0;
6806
6807         case BRCMF_E_IF_DEL:
6808                 spin_unlock(&event->vif_event_lock);
6809                 /* event may not be upon user request */
6810                 if (brcmf_cfg80211_vif_event_armed(cfg))
6811                         wake_up(&event->vif_wq);
6812                 return 0;
6813
6814         case BRCMF_E_IF_CHANGE:
6815                 spin_unlock(&event->vif_event_lock);
6816                 wake_up(&event->vif_wq);
6817                 return 0;
6818
6819         default:
6820                 spin_unlock(&event->vif_event_lock);
6821                 break;
6822         }
6823         return -EINVAL;
6824 }
6825
6826 static s32
6827 brcmf_notify_ext_auth_request(struct brcmf_if *ifp,
6828                               const struct brcmf_event_msg *e, void *data)
6829 {
6830         struct brcmf_pub *drvr = ifp->drvr;
6831         struct cfg80211_external_auth_params params;
6832         struct brcmf_auth_req_status_le *auth_req =
6833                 (struct brcmf_auth_req_status_le *)data;
6834         s32 err = 0;
6835
6836         brcmf_dbg(INFO, "Enter: event %s (%d) received\n",
6837                   brcmf_fweh_event_name(e->event_code), e->event_code);
6838
6839         if (e->datalen < sizeof(*auth_req)) {
6840                 bphy_err(drvr, "Event %s (%d) data too small. Ignore\n",
6841                          brcmf_fweh_event_name(e->event_code), e->event_code);
6842                 return -EINVAL;
6843         }
6844
6845         memset(&params, 0, sizeof(params));
6846         params.action = NL80211_EXTERNAL_AUTH_START;
6847         params.key_mgmt_suite = ntohl(WLAN_AKM_SUITE_SAE);
6848         params.status = WLAN_STATUS_SUCCESS;
6849         params.ssid.ssid_len = min_t(u32, 32, le32_to_cpu(auth_req->ssid_len));
6850         memcpy(params.ssid.ssid, auth_req->ssid, params.ssid.ssid_len);
6851         memcpy(params.bssid, auth_req->peer_mac, ETH_ALEN);
6852
6853         err = cfg80211_external_auth_request(ifp->ndev, &params, GFP_ATOMIC);
6854         if (err)
6855                 bphy_err(drvr, "Ext Auth request to supplicant failed (%d)\n",
6856                          err);
6857
6858         return err;
6859 }
6860
6861 static s32
6862 brcmf_notify_auth_frame_rx(struct brcmf_if *ifp,
6863                            const struct brcmf_event_msg *e, void *data)
6864 {
6865         struct brcmf_pub *drvr = ifp->drvr;
6866         struct brcmf_cfg80211_info *cfg = drvr->config;
6867         struct wireless_dev *wdev;
6868         u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
6869         struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
6870         u8 *frame = (u8 *)(rxframe + 1);
6871         struct brcmu_chan ch;
6872         struct ieee80211_mgmt *mgmt_frame;
6873         s32 freq;
6874
6875         brcmf_dbg(INFO, "Enter: event %s (%d) received\n",
6876                   brcmf_fweh_event_name(e->event_code), e->event_code);
6877
6878         if (e->datalen < sizeof(*rxframe)) {
6879                 bphy_err(drvr, "Event %s (%d) data too small. Ignore\n",
6880                          brcmf_fweh_event_name(e->event_code), e->event_code);
6881                 return -EINVAL;
6882         }
6883
6884         wdev = &ifp->vif->wdev;
6885         WARN_ON(!wdev);
6886
6887         ch.chspec = be16_to_cpu(rxframe->chanspec);
6888         cfg->d11inf.decchspec(&ch);
6889
6890         mgmt_frame = kzalloc(mgmt_frame_len, GFP_KERNEL);
6891         if (!mgmt_frame)
6892                 return -ENOMEM;
6893
6894         mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_AUTH);
6895         memcpy(mgmt_frame->da, ifp->mac_addr, ETH_ALEN);
6896         memcpy(mgmt_frame->sa, e->addr, ETH_ALEN);
6897         brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSSID, mgmt_frame->bssid,
6898                                ETH_ALEN);
6899         frame += offsetof(struct ieee80211_mgmt, u);
6900         memcpy(&mgmt_frame->u, frame,
6901                mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));
6902
6903         freq = ieee80211_channel_to_frequency(ch.control_ch_num,
6904                                               ch.band == BRCMU_CHAN_BAND_2G ?
6905                                               NL80211_BAND_2GHZ :
6906                                               NL80211_BAND_5GHZ);
6907
6908         cfg80211_rx_mgmt(wdev, freq, 0, (u8 *)mgmt_frame, mgmt_frame_len,
6909                          NL80211_RXMGMT_FLAG_EXTERNAL_AUTH);
6910         kfree(mgmt_frame);
6911         return 0;
6912 }
6913
6914 static s32
6915 brcmf_notify_mgmt_tx_status(struct brcmf_if *ifp,
6916                             const struct brcmf_event_msg *e, void *data)
6917 {
6918         struct brcmf_cfg80211_vif *vif = ifp->vif;
6919         u32 *packet_id = (u32 *)data;
6920
6921         brcmf_dbg(INFO, "Enter: event %s (%d), status=%d\n",
6922                   brcmf_fweh_event_name(e->event_code), e->event_code,
6923                   e->status);
6924
6925         if (!test_bit(BRCMF_MGMT_TX_SEND_FRAME, &vif->mgmt_tx_status) ||
6926             (*packet_id != vif->mgmt_tx_id))
6927                 return 0;
6928
6929         if (e->event_code == BRCMF_E_MGMT_FRAME_TXSTATUS) {
6930                 if (e->status == BRCMF_E_STATUS_SUCCESS)
6931                         set_bit(BRCMF_MGMT_TX_ACK, &vif->mgmt_tx_status);
6932                 else
6933                         set_bit(BRCMF_MGMT_TX_NOACK, &vif->mgmt_tx_status);
6934         } else {
6935                 set_bit(BRCMF_MGMT_TX_OFF_CHAN_COMPLETED, &vif->mgmt_tx_status);
6936         }
6937
6938         complete(&vif->mgmt_tx);
6939         return 0;
6940 }
6941
6942 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6943 {
6944         conf->frag_threshold = (u32)-1;
6945         conf->rts_threshold = (u32)-1;
6946         conf->retry_short = (u32)-1;
6947         conf->retry_long = (u32)-1;
6948 }
6949
6950 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6951 {
6952         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6953                             brcmf_notify_connect_status);
6954         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6955                             brcmf_notify_connect_status);
6956         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6957                             brcmf_notify_connect_status);
6958         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6959                             brcmf_notify_connect_status);
6960         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6961                             brcmf_notify_connect_status);
6962         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6963                             brcmf_notify_connect_status);
6964         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6965                             brcmf_notify_roaming_status);
6966         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6967                             brcmf_notify_mic_status);
6968         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6969                             brcmf_notify_connect_status);
6970         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6971                             brcmf_notify_sched_scan_results);
6972         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6973                             brcmf_notify_vif_event);
6974         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6975                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6976         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6977                             brcmf_p2p_notify_listen_complete);
6978         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6979                             brcmf_p2p_notify_action_frame_rx);
6980         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6981                             brcmf_p2p_notify_action_tx_complete);
6982         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6983                             brcmf_p2p_notify_action_tx_complete);
6984         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6985                             brcmf_notify_connect_status);
6986         brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI,
6987                                 brcmf_notify_rssi);
6988         brcmf_fweh_register(cfg->pub, BRCMF_E_EXT_AUTH_REQ,
6989                             brcmf_notify_ext_auth_request);
6990         brcmf_fweh_register(cfg->pub, BRCMF_E_EXT_AUTH_FRAME_RX,
6991                             brcmf_notify_auth_frame_rx);
6992         brcmf_fweh_register(cfg->pub, BRCMF_E_MGMT_FRAME_TXSTATUS,
6993                             brcmf_notify_mgmt_tx_status);
6994         brcmf_fweh_register(cfg->pub, BRCMF_E_MGMT_FRAME_OFF_CHAN_COMPLETE,
6995                             brcmf_notify_mgmt_tx_status);
6996 }
6997
6998 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6999 {
7000         kfree(cfg->conf);
7001         cfg->conf = NULL;
7002         kfree(cfg->extra_buf);
7003         cfg->extra_buf = NULL;
7004         kfree(cfg->wowl.nd);
7005         cfg->wowl.nd = NULL;
7006         kfree(cfg->wowl.nd_info);
7007         cfg->wowl.nd_info = NULL;
7008         kfree(cfg->escan_info.escan_buf);
7009         cfg->escan_info.escan_buf = NULL;
7010 }
7011
7012 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
7013 {
7014         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
7015         if (!cfg->conf)
7016                 goto init_priv_mem_out;
7017         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
7018         if (!cfg->extra_buf)
7019                 goto init_priv_mem_out;
7020         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
7021         if (!cfg->wowl.nd)
7022                 goto init_priv_mem_out;
7023         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
7024                                     sizeof(struct cfg80211_wowlan_nd_match *),
7025                                     GFP_KERNEL);
7026         if (!cfg->wowl.nd_info)
7027                 goto init_priv_mem_out;
7028         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
7029         if (!cfg->escan_info.escan_buf)
7030                 goto init_priv_mem_out;
7031
7032         return 0;
7033
7034 init_priv_mem_out:
7035         brcmf_deinit_priv_mem(cfg);
7036
7037         return -ENOMEM;
7038 }
7039
7040 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
7041 {
7042         s32 err = 0;
7043
7044         cfg->scan_request = NULL;
7045         cfg->pwr_save = true;
7046         cfg->dongle_up = false;         /* dongle is not up yet */
7047         err = brcmf_init_priv_mem(cfg);
7048         if (err)
7049                 return err;
7050         brcmf_register_event_handlers(cfg);
7051         mutex_init(&cfg->usr_sync);
7052         brcmf_init_escan(cfg);
7053         brcmf_init_conf(cfg->conf);
7054         brcmf_init_wmm_prio(cfg->ac_priority);
7055         init_completion(&cfg->vif_disabled);
7056         return err;
7057 }
7058
7059 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
7060 {
7061         cfg->dongle_up = false; /* dongle down */
7062         brcmf_abort_scanning(cfg);
7063         brcmf_deinit_priv_mem(cfg);
7064         brcmf_clear_assoc_ies(cfg);
7065 }
7066
7067 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
7068 {
7069         init_waitqueue_head(&event->vif_wq);
7070         spin_lock_init(&event->vif_event_lock);
7071 }
7072
7073 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
7074 {
7075         struct brcmf_pub *drvr = ifp->drvr;
7076         s32 err;
7077         u32 bcn_timeout;
7078         __le32 roamtrigger[2];
7079         __le32 roam_delta[2];
7080
7081         /* Configure beacon timeout value based upon roaming setting */
7082         if (ifp->drvr->settings->roamoff)
7083                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
7084         else
7085                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
7086         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
7087         if (err) {
7088                 bphy_err(drvr, "bcn_timeout error (%d)\n", err);
7089                 goto roam_setup_done;
7090         }
7091
7092         /* Enable/Disable built-in roaming to allow supplicant to take care of
7093          * roaming.
7094          */
7095         brcmf_dbg(INFO, "Internal Roaming = %s\n",
7096                   ifp->drvr->settings->roamoff ? "Off" : "On");
7097         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
7098                                       ifp->drvr->settings->roamoff);
7099         if (err) {
7100                 bphy_err(drvr, "roam_off error (%d)\n", err);
7101                 goto roam_setup_done;
7102         }
7103
7104         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
7105         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
7106         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
7107                                      (void *)roamtrigger, sizeof(roamtrigger));
7108         if (err)
7109                 bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
7110
7111         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
7112         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
7113         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
7114                                      (void *)roam_delta, sizeof(roam_delta));
7115         if (err)
7116                 bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
7117
7118         return 0;
7119
7120 roam_setup_done:
7121         return err;
7122 }
7123
7124 static s32
7125 brcmf_dongle_scantime(struct brcmf_if *ifp)
7126 {
7127         struct brcmf_pub *drvr = ifp->drvr;
7128         s32 err = 0;
7129
7130         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
7131                                     BRCMF_SCAN_CHANNEL_TIME);
7132         if (err) {
7133                 bphy_err(drvr, "Scan assoc time error (%d)\n", err);
7134                 goto dongle_scantime_out;
7135         }
7136         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
7137                                     BRCMF_SCAN_UNASSOC_TIME);
7138         if (err) {
7139                 bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
7140                 goto dongle_scantime_out;
7141         }
7142
7143         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
7144                                     BRCMF_SCAN_PASSIVE_TIME);
7145         if (err) {
7146                 bphy_err(drvr, "Scan passive time error (%d)\n", err);
7147                 goto dongle_scantime_out;
7148         }
7149
7150 dongle_scantime_out:
7151         return err;
7152 }
7153
7154 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
7155                                            struct brcmu_chan *ch)
7156 {
7157         u32 ht40_flag;
7158
7159         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
7160         if (ch->sb == BRCMU_CHAN_SB_U) {
7161                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
7162                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
7163                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
7164         } else {
7165                 /* It should be one of
7166                  * IEEE80211_CHAN_NO_HT40 or
7167                  * IEEE80211_CHAN_NO_HT40PLUS
7168                  */
7169                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
7170                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
7171                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
7172         }
7173 }
7174
7175 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
7176                                     u32 bw_cap[])
7177 {
7178         struct wiphy *wiphy = cfg_to_wiphy(cfg);
7179         struct brcmf_pub *drvr = cfg->pub;
7180         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7181         struct ieee80211_supported_band *band;
7182         struct ieee80211_channel *channel;
7183         struct brcmf_chanspec_list *list;
7184         struct brcmu_chan ch;
7185         int err;
7186         u8 *pbuf;
7187         u32 i, j;
7188         u32 total;
7189         u32 chaninfo;
7190
7191         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7192
7193         if (pbuf == NULL)
7194                 return -ENOMEM;
7195
7196         list = (struct brcmf_chanspec_list *)pbuf;
7197
7198         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
7199                                        BRCMF_DCMD_MEDLEN);
7200         if (err) {
7201                 bphy_err(drvr, "get chanspecs error (%d)\n", err);
7202                 goto fail_pbuf;
7203         }
7204
7205         band = wiphy->bands[NL80211_BAND_2GHZ];
7206         if (band)
7207                 for (i = 0; i < band->n_channels; i++)
7208                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
7209         band = wiphy->bands[NL80211_BAND_5GHZ];
7210         if (band)
7211                 for (i = 0; i < band->n_channels; i++)
7212                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
7213
7214         total = le32_to_cpu(list->count);
7215         if (total > BRCMF_MAX_CHANSPEC_LIST) {
7216                 bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7217                          total);
7218                 err = -EINVAL;
7219                 goto fail_pbuf;
7220         }
7221
7222         for (i = 0; i < total; i++) {
7223                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
7224                 cfg->d11inf.decchspec(&ch);
7225
7226                 if (ch.band == BRCMU_CHAN_BAND_2G) {
7227                         band = wiphy->bands[NL80211_BAND_2GHZ];
7228                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
7229                         band = wiphy->bands[NL80211_BAND_5GHZ];
7230                 } else {
7231                         bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
7232                                  ch.chspec);
7233                         continue;
7234                 }
7235                 if (!band)
7236                         continue;
7237                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
7238                     ch.bw == BRCMU_CHAN_BW_40)
7239                         continue;
7240                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
7241                     ch.bw == BRCMU_CHAN_BW_80)
7242                         continue;
7243
7244                 channel = NULL;
7245                 for (j = 0; j < band->n_channels; j++) {
7246                         if (band->channels[j].hw_value == ch.control_ch_num) {
7247                                 channel = &band->channels[j];
7248                                 break;
7249                         }
7250                 }
7251                 if (!channel) {
7252                         /* It seems firmware supports some channel we never
7253                          * considered. Something new in IEEE standard?
7254                          */
7255                         bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
7256                                  ch.control_ch_num);
7257                         continue;
7258                 }
7259
7260                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
7261                         continue;
7262
7263                 /* assuming the chanspecs order is HT20,
7264                  * HT40 upper, HT40 lower, and VHT80.
7265                  */
7266                 switch (ch.bw) {
7267                 case BRCMU_CHAN_BW_160:
7268                         channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
7269                         break;
7270                 case BRCMU_CHAN_BW_80:
7271                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
7272                         break;
7273                 case BRCMU_CHAN_BW_40:
7274                         brcmf_update_bw40_channel_flag(channel, &ch);
7275                         break;
7276                 default:
7277                         wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
7278                                    ch.bw);
7279                         fallthrough;
7280                 case BRCMU_CHAN_BW_20:
7281                         /* enable the channel and disable other bandwidths
7282                          * for now as mentioned order assure they are enabled
7283                          * for subsequent chanspecs.
7284                          */
7285                         channel->flags = IEEE80211_CHAN_NO_HT40 |
7286                                          IEEE80211_CHAN_NO_80MHZ |
7287                                          IEEE80211_CHAN_NO_160MHZ;
7288                         ch.bw = BRCMU_CHAN_BW_20;
7289                         cfg->d11inf.encchspec(&ch);
7290                         chaninfo = ch.chspec;
7291                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
7292                                                        &chaninfo);
7293                         if (!err) {
7294                                 if (chaninfo & WL_CHAN_RADAR)
7295                                         channel->flags |=
7296                                                 (IEEE80211_CHAN_RADAR |
7297                                                  IEEE80211_CHAN_NO_IR);
7298                                 if (chaninfo & WL_CHAN_PASSIVE)
7299                                         channel->flags |=
7300                                                 IEEE80211_CHAN_NO_IR;
7301                         }
7302                 }
7303         }
7304
7305 fail_pbuf:
7306         kfree(pbuf);
7307         return err;
7308 }
7309
7310 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
7311 {
7312         struct brcmf_pub *drvr = cfg->pub;
7313         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7314         struct ieee80211_supported_band *band;
7315         struct brcmf_fil_bwcap_le band_bwcap;
7316         struct brcmf_chanspec_list *list;
7317         u8 *pbuf;
7318         u32 val;
7319         int err;
7320         struct brcmu_chan ch;
7321         u32 num_chan;
7322         int i, j;
7323
7324         /* verify support for bw_cap command */
7325         val = WLC_BAND_5G;
7326         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
7327
7328         if (!err) {
7329                 /* only set 2G bandwidth using bw_cap command */
7330                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
7331                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
7332                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
7333                                                sizeof(band_bwcap));
7334         } else {
7335                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
7336                 val = WLC_N_BW_40ALL;
7337                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
7338         }
7339
7340         if (!err) {
7341                 /* update channel info in 2G band */
7342                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7343
7344                 if (pbuf == NULL)
7345                         return -ENOMEM;
7346
7347                 ch.band = BRCMU_CHAN_BAND_2G;
7348                 ch.bw = BRCMU_CHAN_BW_40;
7349                 ch.sb = BRCMU_CHAN_SB_NONE;
7350                 ch.chnum = 0;
7351                 cfg->d11inf.encchspec(&ch);
7352
7353                 /* pass encoded chanspec in query */
7354                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
7355
7356                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
7357                                                BRCMF_DCMD_MEDLEN);
7358                 if (err) {
7359                         bphy_err(drvr, "get chanspecs error (%d)\n", err);
7360                         kfree(pbuf);
7361                         return err;
7362                 }
7363
7364                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
7365                 list = (struct brcmf_chanspec_list *)pbuf;
7366                 num_chan = le32_to_cpu(list->count);
7367                 if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
7368                         bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7369                                  num_chan);
7370                         kfree(pbuf);
7371                         return -EINVAL;
7372                 }
7373
7374                 for (i = 0; i < num_chan; i++) {
7375                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
7376                         cfg->d11inf.decchspec(&ch);
7377                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
7378                                 continue;
7379                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
7380                                 continue;
7381                         for (j = 0; j < band->n_channels; j++) {
7382                                 if (band->channels[j].hw_value == ch.control_ch_num)
7383                                         break;
7384                         }
7385                         if (WARN_ON(j == band->n_channels))
7386                                 continue;
7387
7388                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
7389                 }
7390                 kfree(pbuf);
7391         }
7392         return err;
7393 }
7394
7395 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
7396 {
7397         struct brcmf_pub *drvr = ifp->drvr;
7398         u32 band, mimo_bwcap;
7399         int err;
7400
7401         band = WLC_BAND_2G;
7402         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7403         if (!err) {
7404                 bw_cap[NL80211_BAND_2GHZ] = band;
7405                 band = WLC_BAND_5G;
7406                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7407                 if (!err) {
7408                         bw_cap[NL80211_BAND_5GHZ] = band;
7409                         return;
7410                 }
7411                 WARN_ON(1);
7412                 return;
7413         }
7414         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
7415         mimo_bwcap = 0;
7416         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
7417         if (err)
7418                 /* assume 20MHz if firmware does not give a clue */
7419                 mimo_bwcap = WLC_N_BW_20ALL;
7420
7421         switch (mimo_bwcap) {
7422         case WLC_N_BW_40ALL:
7423                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
7424                 fallthrough;
7425         case WLC_N_BW_20IN2G_40IN5G:
7426                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
7427                 fallthrough;
7428         case WLC_N_BW_20ALL:
7429                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
7430                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
7431                 break;
7432         default:
7433                 bphy_err(drvr, "invalid mimo_bw_cap value\n");
7434         }
7435 }
7436
7437 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
7438                                 u32 bw_cap[2], u32 nchain)
7439 {
7440         band->ht_cap.ht_supported = true;
7441         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
7442                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
7443                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7444         }
7445         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
7446         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
7447         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
7448         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
7449         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
7450         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
7451 }
7452
7453 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
7454 {
7455         u16 mcs_map;
7456         int i;
7457
7458         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
7459                 mcs_map = (mcs_map << 2) | supp;
7460
7461         return cpu_to_le16(mcs_map);
7462 }
7463
7464 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
7465                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
7466                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
7467 {
7468         __le16 mcs_map;
7469
7470         /* not allowed in 2.4G band */
7471         if (band->band == NL80211_BAND_2GHZ)
7472                 return;
7473
7474         band->vht_cap.vht_supported = true;
7475         /* 80MHz is mandatory */
7476         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
7477         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
7478                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
7479                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
7480         }
7481         /* all support 256-QAM */
7482         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
7483         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
7484         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
7485
7486         /* Beamforming support information */
7487         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
7488                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
7489         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
7490                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
7491         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
7492                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
7493         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
7494                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
7495
7496         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
7497                 band->vht_cap.cap |=
7498                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
7499                 band->vht_cap.cap |= ((txstreams - 1) <<
7500                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
7501                 band->vht_cap.cap |=
7502                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
7503         }
7504 }
7505
7506 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
7507 {
7508         struct brcmf_pub *drvr = cfg->pub;
7509         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7510         struct wiphy *wiphy = cfg_to_wiphy(cfg);
7511         u32 nmode = 0;
7512         u32 vhtmode = 0;
7513         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
7514         u32 rxchain;
7515         u32 nchain;
7516         int err;
7517         s32 i;
7518         struct ieee80211_supported_band *band;
7519         u32 txstreams = 0;
7520         u32 txbf_bfe_cap = 0;
7521         u32 txbf_bfr_cap = 0;
7522
7523         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
7524         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
7525         if (err) {
7526                 bphy_err(drvr, "nmode error (%d)\n", err);
7527         } else {
7528                 brcmf_get_bwcap(ifp, bw_cap);
7529         }
7530         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
7531                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
7532                   bw_cap[NL80211_BAND_5GHZ]);
7533
7534         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
7535         if (err) {
7536                 /* rxchain unsupported by firmware of older chips */
7537                 if (err == -EBADE)
7538                         bphy_info_once(drvr, "rxchain unsupported\n");
7539                 else
7540                         bphy_err(drvr, "rxchain error (%d)\n", err);
7541
7542                 nchain = 1;
7543         } else {
7544                 for (nchain = 0; rxchain; nchain++)
7545                         rxchain = rxchain & (rxchain - 1);
7546         }
7547         brcmf_dbg(INFO, "nchain=%d\n", nchain);
7548
7549         err = brcmf_construct_chaninfo(cfg, bw_cap);
7550         if (err) {
7551                 bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
7552                 return err;
7553         }
7554
7555         if (vhtmode) {
7556                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
7557                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
7558                                               &txbf_bfe_cap);
7559                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
7560                                               &txbf_bfr_cap);
7561         }
7562
7563         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
7564                 band = wiphy->bands[i];
7565                 if (band == NULL)
7566                         continue;
7567
7568                 if (nmode)
7569                         brcmf_update_ht_cap(band, bw_cap, nchain);
7570                 if (vhtmode)
7571                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
7572                                              txbf_bfe_cap, txbf_bfr_cap);
7573         }
7574
7575         return 0;
7576 }
7577
7578 static const struct ieee80211_txrx_stypes
7579 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
7580         [NL80211_IFTYPE_STATION] = {
7581                 .tx = 0xffff,
7582                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7583                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7584                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7585         },
7586         [NL80211_IFTYPE_P2P_CLIENT] = {
7587                 .tx = 0xffff,
7588                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7589                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7590         },
7591         [NL80211_IFTYPE_P2P_GO] = {
7592                 .tx = 0xffff,
7593                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7594                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7595                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7596                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7597                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7598                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7599                       BIT(IEEE80211_STYPE_ACTION >> 4)
7600         },
7601         [NL80211_IFTYPE_P2P_DEVICE] = {
7602                 .tx = 0xffff,
7603                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7604                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7605         },
7606         [NL80211_IFTYPE_AP] = {
7607                 .tx = 0xffff,
7608                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7609                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7610                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7611                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7612                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7613                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7614                       BIT(IEEE80211_STYPE_ACTION >> 4)
7615         }
7616 };
7617
7618 /**
7619  * brcmf_setup_ifmodes() - determine interface modes and combinations.
7620  *
7621  * @wiphy: wiphy object.
7622  * @ifp: interface object needed for feat module api.
7623  *
7624  * The interface modes and combinations are determined dynamically here
7625  * based on firmware functionality.
7626  *
7627  * no p2p and no mbss:
7628  *
7629  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7630  *
7631  * no p2p and mbss:
7632  *
7633  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7634  *      #AP <= 4, matching BI, channels = 1, 4 total
7635  *
7636  * no p2p and rsdb:
7637  *      #STA <= 1, #AP <= 2, channels = 2, 4 total
7638  *
7639  * p2p, no mchan, and mbss:
7640  *
7641  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
7642  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7643  *      #AP <= 4, matching BI, channels = 1, 4 total
7644  *
7645  * p2p, mchan, and mbss:
7646  *
7647  *      #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
7648  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7649  *      #AP <= 4, matching BI, channels = 1, 4 total
7650  *
7651  * p2p, rsdb, and no mbss:
7652  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
7653  *       channels = 2, 4 total
7654  */
7655 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
7656 {
7657         struct ieee80211_iface_combination *combo = NULL;
7658         struct ieee80211_iface_limit *c0_limits = NULL;
7659         struct ieee80211_iface_limit *p2p_limits = NULL;
7660         struct ieee80211_iface_limit *mbss_limits = NULL;
7661         bool mon_flag, mbss, p2p, rsdb, mchan;
7662         int i, c, n_combos, n_limits;
7663
7664         mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
7665         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
7666         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
7667         rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
7668         mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
7669
7670         n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7671         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7672         if (!combo)
7673                 goto err;
7674
7675         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7676                                  BIT(NL80211_IFTYPE_ADHOC) |
7677                                  BIT(NL80211_IFTYPE_AP);
7678         if (mon_flag)
7679                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7680         if (p2p)
7681                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7682                                           BIT(NL80211_IFTYPE_P2P_GO) |
7683                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
7684
7685         c = 0;
7686         i = 0;
7687         n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7688         c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7689         if (!c0_limits)
7690                 goto err;
7691
7692         combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7693         c0_limits[i].max = 1 + (p2p && mchan);
7694         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7695         if (mon_flag) {
7696                 c0_limits[i].max = 1;
7697                 c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7698         }
7699         if (p2p) {
7700                 c0_limits[i].max = 1;
7701                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7702                 c0_limits[i].max = 1 + rsdb;
7703                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7704                                        BIT(NL80211_IFTYPE_P2P_GO);
7705         }
7706         if (p2p && rsdb) {
7707                 c0_limits[i].max = 2;
7708                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7709                 combo[c].max_interfaces = 4;
7710         } else if (p2p) {
7711                 combo[c].max_interfaces = i;
7712         } else if (rsdb) {
7713                 c0_limits[i].max = 2;
7714                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7715                 combo[c].max_interfaces = 3;
7716         } else {
7717                 c0_limits[i].max = 1;
7718                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7719                 combo[c].max_interfaces = i;
7720         }
7721         combo[c].n_limits = i;
7722         combo[c].limits = c0_limits;
7723
7724         if (p2p && !rsdb) {
7725                 c++;
7726                 i = 0;
7727                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7728                 if (!p2p_limits)
7729                         goto err;
7730                 p2p_limits[i].max = 1;
7731                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7732                 p2p_limits[i].max = 1;
7733                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7734                 p2p_limits[i].max = 1;
7735                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7736                 p2p_limits[i].max = 1;
7737                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7738                 combo[c].num_different_channels = 1;
7739                 combo[c].max_interfaces = i;
7740                 combo[c].n_limits = i;
7741                 combo[c].limits = p2p_limits;
7742         }
7743
7744         if (mbss) {
7745                 c++;
7746                 i = 0;
7747                 n_limits = 1 + mon_flag;
7748                 mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7749                                       GFP_KERNEL);
7750                 if (!mbss_limits)
7751                         goto err;
7752                 mbss_limits[i].max = 4;
7753                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7754                 if (mon_flag) {
7755                         mbss_limits[i].max = 1;
7756                         mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7757                 }
7758                 combo[c].beacon_int_infra_match = true;
7759                 combo[c].num_different_channels = 1;
7760                 combo[c].max_interfaces = 4 + mon_flag;
7761                 combo[c].n_limits = i;
7762                 combo[c].limits = mbss_limits;
7763         }
7764
7765         wiphy->n_iface_combinations = n_combos;
7766         wiphy->iface_combinations = combo;
7767         return 0;
7768
7769 err:
7770         kfree(c0_limits);
7771         kfree(p2p_limits);
7772         kfree(mbss_limits);
7773         kfree(combo);
7774         return -ENOMEM;
7775 }
7776
7777 #ifdef CONFIG_PM
7778 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7779         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7780         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
7781         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7782         .pattern_min_len = 1,
7783         .max_pkt_offset = 1500,
7784 };
7785 #endif
7786
7787 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7788 {
7789 #ifdef CONFIG_PM
7790         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7791         struct brcmf_pub *drvr = cfg->pub;
7792         struct wiphy_wowlan_support *wowl;
7793
7794         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7795                        GFP_KERNEL);
7796         if (!wowl) {
7797                 bphy_err(drvr, "only support basic wowlan features\n");
7798                 wiphy->wowlan = &brcmf_wowlan_support;
7799                 return;
7800         }
7801
7802         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7803                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7804                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7805                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7806                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
7807                 }
7808         }
7809         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7810                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7811                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7812         }
7813
7814         wiphy->wowlan = wowl;
7815 #endif
7816 }
7817
7818 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7819 {
7820         struct brcmf_pub *drvr = ifp->drvr;
7821         const struct ieee80211_iface_combination *combo;
7822         struct ieee80211_supported_band *band;
7823         u16 max_interfaces = 0;
7824         bool gscan;
7825         __le32 bandlist[3];
7826         u32 n_bands;
7827         int err, i;
7828
7829         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7830         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7831         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7832
7833         err = brcmf_setup_ifmodes(wiphy, ifp);
7834         if (err)
7835                 return err;
7836
7837         for (i = 0, combo = wiphy->iface_combinations;
7838              i < wiphy->n_iface_combinations; i++, combo++) {
7839                 max_interfaces = max(max_interfaces, combo->max_interfaces);
7840         }
7841
7842         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7843              i++) {
7844                 u8 *addr = drvr->addresses[i].addr;
7845
7846                 memcpy(addr, drvr->mac, ETH_ALEN);
7847                 if (i) {
7848                         addr[0] |= BIT(1);
7849                         addr[ETH_ALEN - 1] ^= i;
7850                 }
7851         }
7852         wiphy->addresses = drvr->addresses;
7853         wiphy->n_addresses = i;
7854
7855         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7856         wiphy->cipher_suites = brcmf_cipher_suites;
7857         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7858         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7859                 wiphy->n_cipher_suites--;
7860         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7861                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7862                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7863
7864         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7865                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
7866                         WIPHY_FLAG_HAVE_AP_SME |
7867                         WIPHY_FLAG_OFFCHAN_TX |
7868                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7869         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7870                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7871         if (!ifp->drvr->settings->roamoff)
7872                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7873         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7874                 wiphy_ext_feature_set(wiphy,
7875                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7876                 wiphy_ext_feature_set(wiphy,
7877                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7878                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7879                         wiphy_ext_feature_set(wiphy,
7880                                               NL80211_EXT_FEATURE_SAE_OFFLOAD);
7881         }
7882         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7883                 wiphy_ext_feature_set(wiphy,
7884                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7885                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7886                         wiphy_ext_feature_set(wiphy,
7887                                               NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7888         }
7889         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE_EXT))
7890                 wiphy->features |= NL80211_FEATURE_SAE;
7891         wiphy->mgmt_stypes = brcmf_txrx_stypes;
7892         wiphy->max_remain_on_channel_duration = 5000;
7893         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7894                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7895                 brcmf_pno_wiphy_params(wiphy, gscan);
7896         }
7897         /* vendor commands/events support */
7898         wiphy->vendor_commands = brcmf_vendor_cmds;
7899         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7900
7901         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7902                 brcmf_wiphy_wowl_params(wiphy, ifp);
7903         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7904                                      sizeof(bandlist));
7905         if (err) {
7906                 bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7907                 return err;
7908         }
7909         /* first entry in bandlist is number of bands */
7910         n_bands = le32_to_cpu(bandlist[0]);
7911         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7912                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7913                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7914                                        GFP_KERNEL);
7915                         if (!band)
7916                                 return -ENOMEM;
7917
7918                         band->channels = kmemdup(&__wl_2ghz_channels,
7919                                                  sizeof(__wl_2ghz_channels),
7920                                                  GFP_KERNEL);
7921                         if (!band->channels) {
7922                                 kfree(band);
7923                                 return -ENOMEM;
7924                         }
7925
7926                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7927                         wiphy->bands[NL80211_BAND_2GHZ] = band;
7928                 }
7929                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7930                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7931                                        GFP_KERNEL);
7932                         if (!band)
7933                                 return -ENOMEM;
7934
7935                         band->channels = kmemdup(&__wl_5ghz_channels,
7936                                                  sizeof(__wl_5ghz_channels),
7937                                                  GFP_KERNEL);
7938                         if (!band->channels) {
7939                                 kfree(band);
7940                                 return -ENOMEM;
7941                         }
7942
7943                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7944                         wiphy->bands[NL80211_BAND_5GHZ] = band;
7945                 }
7946         }
7947
7948         if (wiphy->bands[NL80211_BAND_5GHZ] &&
7949             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7950                 wiphy_ext_feature_set(wiphy,
7951                                       NL80211_EXT_FEATURE_DFS_OFFLOAD);
7952
7953         wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7954
7955         wiphy_read_of_freq_limits(wiphy);
7956
7957         return 0;
7958 }
7959
7960 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7961 {
7962         struct brcmf_pub *drvr = cfg->pub;
7963         struct net_device *ndev;
7964         struct wireless_dev *wdev;
7965         struct brcmf_if *ifp;
7966         s32 power_mode;
7967         s32 err = 0;
7968
7969         if (cfg->dongle_up)
7970                 return err;
7971
7972         ndev = cfg_to_ndev(cfg);
7973         wdev = ndev->ieee80211_ptr;
7974         ifp = netdev_priv(ndev);
7975
7976         /* make sure RF is ready for work */
7977         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7978
7979         brcmf_dongle_scantime(ifp);
7980
7981         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7982         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7983         if (err)
7984                 goto default_conf_out;
7985         brcmf_dbg(INFO, "power save set to %s\n",
7986                   (power_mode ? "enabled" : "disabled"));
7987
7988         err = brcmf_dongle_roam(ifp);
7989         if (err)
7990                 goto default_conf_out;
7991         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7992                                           NULL);
7993         if (err)
7994                 goto default_conf_out;
7995
7996         brcmf_configure_arp_nd_offload(ifp, true);
7997
7998         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7999         if (err) {
8000                 bphy_err(drvr, "failed to set frameburst mode\n");
8001                 goto default_conf_out;
8002         }
8003
8004         cfg->dongle_up = true;
8005 default_conf_out:
8006
8007         return err;
8008
8009 }
8010
8011 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
8012 {
8013         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
8014
8015         return brcmf_config_dongle(ifp->drvr->config);
8016 }
8017
8018 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
8019 {
8020         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
8021
8022         /*
8023          * While going down, if associated with AP disassociate
8024          * from AP to save power
8025          */
8026         if (check_vif_up(ifp->vif)) {
8027                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
8028
8029                 /* Make sure WPA_Supplicant receives all the event
8030                    generated due to DISASSOC call to the fw to keep
8031                    the state fw and WPA_Supplicant state consistent
8032                  */
8033                 brcmf_delay(500);
8034         }
8035
8036         brcmf_abort_scanning(cfg);
8037         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
8038
8039         return 0;
8040 }
8041
8042 s32 brcmf_cfg80211_up(struct net_device *ndev)
8043 {
8044         struct brcmf_if *ifp = netdev_priv(ndev);
8045         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
8046         s32 err = 0;
8047
8048         mutex_lock(&cfg->usr_sync);
8049         err = __brcmf_cfg80211_up(ifp);
8050         mutex_unlock(&cfg->usr_sync);
8051
8052         return err;
8053 }
8054
8055 s32 brcmf_cfg80211_down(struct net_device *ndev)
8056 {
8057         struct brcmf_if *ifp = netdev_priv(ndev);
8058         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
8059         s32 err = 0;
8060
8061         mutex_lock(&cfg->usr_sync);
8062         err = __brcmf_cfg80211_down(ifp);
8063         mutex_unlock(&cfg->usr_sync);
8064
8065         return err;
8066 }
8067
8068 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
8069 {
8070         struct wireless_dev *wdev = &ifp->vif->wdev;
8071
8072         return wdev->iftype;
8073 }
8074
8075 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
8076                              unsigned long state)
8077 {
8078         struct brcmf_cfg80211_vif *vif;
8079
8080         list_for_each_entry(vif, &cfg->vif_list, list) {
8081                 if (test_bit(state, &vif->sme_state))
8082                         return true;
8083         }
8084         return false;
8085 }
8086
8087 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
8088                                     u8 action)
8089 {
8090         u8 evt_action;
8091
8092         spin_lock(&event->vif_event_lock);
8093         evt_action = event->action;
8094         spin_unlock(&event->vif_event_lock);
8095         return evt_action == action;
8096 }
8097
8098 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
8099                                   struct brcmf_cfg80211_vif *vif)
8100 {
8101         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
8102
8103         spin_lock(&event->vif_event_lock);
8104         event->vif = vif;
8105         event->action = 0;
8106         spin_unlock(&event->vif_event_lock);
8107 }
8108
8109 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
8110 {
8111         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
8112         bool armed;
8113
8114         spin_lock(&event->vif_event_lock);
8115         armed = event->vif != NULL;
8116         spin_unlock(&event->vif_event_lock);
8117
8118         return armed;
8119 }
8120
8121 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
8122                                   u8 action, ulong timeout)
8123 {
8124         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
8125
8126         return wait_event_timeout(event->vif_wq,
8127                                   vif_event_equals(event, action), timeout);
8128 }
8129
8130 static bool brmcf_use_iso3166_ccode_fallback(struct brcmf_pub *drvr)
8131 {
8132         if (drvr->settings->trivial_ccode_map)
8133                 return true;
8134
8135         switch (drvr->bus_if->chip) {
8136         case BRCM_CC_43430_CHIP_ID:
8137         case BRCM_CC_4345_CHIP_ID:
8138         case BRCM_CC_4356_CHIP_ID:
8139         case BRCM_CC_43602_CHIP_ID:
8140                 return true;
8141         default:
8142                 return false;
8143         }
8144 }
8145
8146 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
8147                                         struct brcmf_fil_country_le *ccreq)
8148 {
8149         struct brcmfmac_pd_cc *country_codes;
8150         struct brcmfmac_pd_cc_entry *cc;
8151         s32 found_index;
8152         int i;
8153
8154         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
8155             (alpha2[1] == ccreq->country_abbrev[1])) {
8156                 brcmf_dbg(TRACE, "Country code already set\n");
8157                 return -EAGAIN;
8158         }
8159
8160         country_codes = drvr->settings->country_codes;
8161         if (!country_codes) {
8162                 if (brmcf_use_iso3166_ccode_fallback(drvr)) {
8163                         brcmf_dbg(TRACE, "No country codes configured for device, using ISO3166 code and 0 rev\n");
8164                         memset(ccreq, 0, sizeof(*ccreq));
8165                         ccreq->country_abbrev[0] = alpha2[0];
8166                         ccreq->country_abbrev[1] = alpha2[1];
8167                         ccreq->ccode[0] = alpha2[0];
8168                         ccreq->ccode[1] = alpha2[1];
8169                         return 0;
8170                 }
8171
8172                 brcmf_dbg(TRACE, "No country codes configured for device\n");
8173                 return -EINVAL;
8174         }
8175
8176         found_index = -1;
8177         for (i = 0; i < country_codes->table_size; i++) {
8178                 cc = &country_codes->table[i];
8179                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
8180                         found_index = i;
8181                 if ((cc->iso3166[0] == alpha2[0]) &&
8182                     (cc->iso3166[1] == alpha2[1])) {
8183                         found_index = i;
8184                         break;
8185                 }
8186         }
8187         if (found_index == -1) {
8188                 brcmf_dbg(TRACE, "No country code match found\n");
8189                 return -EINVAL;
8190         }
8191         memset(ccreq, 0, sizeof(*ccreq));
8192         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
8193         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
8194                BRCMF_COUNTRY_BUF_SZ);
8195         ccreq->country_abbrev[0] = alpha2[0];
8196         ccreq->country_abbrev[1] = alpha2[1];
8197         ccreq->country_abbrev[2] = 0;
8198
8199         return 0;
8200 }
8201
8202 static int
8203 brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
8204 {
8205         int i;
8206         char *token;
8207         char delim[] = "\n ";
8208         unsigned long val;
8209         int err = 0;
8210
8211         token = strsep(&buf, delim);
8212         while (token) {
8213                 if (!strcmp(token, "OBSS")) {
8214                         for (i = 0; i < OBSS_TOKEN_IDX; i++)
8215                                 token = strsep(&buf, delim);
8216                         err = kstrtoul(token, 10, &val);
8217                         if (err)
8218                                 break;
8219                         survey->obss = val;
8220                 }
8221
8222                 if (!strcmp(token, "IBSS")) {
8223                         for (i = 0; i < IBSS_TOKEN_IDX; i++)
8224                                 token = strsep(&buf, delim);
8225                         err = kstrtoul(token, 10, &val);
8226                         if (err)
8227                                 break;
8228                         survey->ibss = val;
8229                 }
8230
8231                 if (!strcmp(token, "TXDur")) {
8232                         for (i = 0; i < TX_TOKEN_IDX; i++)
8233                                 token = strsep(&buf, delim);
8234                         err = kstrtoul(token, 10, &val);
8235                         if (err)
8236                                 break;
8237                         survey->tx = val;
8238                 }
8239
8240                 if (!strcmp(token, "Category")) {
8241                         for (i = 0; i < CTG_TOKEN_IDX; i++)
8242                                 token = strsep(&buf, delim);
8243                         err = kstrtoul(token, 10, &val);
8244                         if (err)
8245                                 break;
8246                         survey->no_ctg = val;
8247                 }
8248
8249                 if (!strcmp(token, "Packet")) {
8250                         for (i = 0; i < PKT_TOKEN_IDX; i++)
8251                                 token = strsep(&buf, delim);
8252                         err = kstrtoul(token, 10, &val);
8253                         if (err)
8254                                 break;
8255                         survey->no_pckt = val;
8256                 }
8257
8258                 if (!strcmp(token, "Opp(time):")) {
8259                         for (i = 0; i < IDLE_TOKEN_IDX; i++)
8260                                 token = strsep(&buf, delim);
8261                         err = kstrtoul(token, 10, &val);
8262                         if (err)
8263                                 break;
8264                         survey->idle = val;
8265                 }
8266
8267                 token = strsep(&buf, delim);
8268         }
8269
8270         return err;
8271 }
8272
8273 static int
8274 brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
8275                 struct brcmf_dump_survey *survey)
8276 {
8277         struct cca_stats_n_flags *results;
8278         char *buf;
8279         int err;
8280
8281         buf = kzalloc(sizeof(char) * BRCMF_DCMD_MEDLEN, GFP_KERNEL);
8282         if (!buf)
8283                 return -ENOMEM;
8284
8285         memcpy(buf, &req, sizeof(struct cca_msrmnt_query));
8286         err = brcmf_fil_iovar_data_get(ifp, "dump_obss",
8287                                        buf, BRCMF_DCMD_MEDLEN);
8288         if (err) {
8289                 brcmf_err("dump_obss error (%d)\n", err);
8290                 err = -EINVAL;
8291                 goto exit;
8292         }
8293         results = (struct cca_stats_n_flags *)(buf);
8294
8295         if (req.msrmnt_query)
8296                 brcmf_parse_dump_obss(results->buf, survey);
8297
8298 exit:
8299         kfree(buf);
8300         return err;
8301 }
8302
8303 static s32
8304 brcmf_set_channel(struct brcmf_cfg80211_info *cfg, struct ieee80211_channel *chan)
8305 {
8306         u16 chspec = 0;
8307         int err = 0;
8308         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8309
8310         if (chan->flags & IEEE80211_CHAN_DISABLED)
8311                 return -EINVAL;
8312
8313         /* set_channel */
8314         chspec = channel_to_chanspec(&cfg->d11inf, chan);
8315         if (chspec != INVCHANSPEC) {
8316                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chspec);
8317                 if (err) {
8318                         brcmf_err("set chanspec 0x%04x fail, reason %d\n", chspec, err);
8319                         err = -EINVAL;
8320                 }
8321         } else {
8322                 brcmf_err("failed to convert host chanspec to fw chanspec\n");
8323                 err = -EINVAL;
8324         }
8325
8326         return err;
8327 }
8328
8329 static int
8330 brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
8331                            int idx, struct survey_info *info)
8332 {
8333         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8334         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8335         struct brcmf_dump_survey survey = {};
8336         struct ieee80211_supported_band *band;
8337         enum nl80211_band band_id;
8338         struct cca_msrmnt_query req;
8339         u32 noise;
8340         int err;
8341
8342         brcmf_dbg(TRACE, "Enter: channel idx=%d\n", idx);
8343
8344         /* Do not run survey when VIF in CONNECTING / CONNECTED states */
8345         if ((test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) ||
8346             (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))) {
8347                 return -EBUSY;
8348         }
8349
8350         for (band_id = 0; band_id < NUM_NL80211_BANDS; band_id++) {
8351                 band = wiphy->bands[band_id];
8352                 if (!band)
8353                         continue;
8354                 if (idx >= band->n_channels) {
8355                         idx -= band->n_channels;
8356                         continue;
8357                 }
8358
8359                 info->channel = &band->channels[idx];
8360                 break;
8361         }
8362         if (band_id == NUM_NL80211_BANDS)
8363                 return -ENOENT;
8364
8365         /* Setting current channel to the requested channel */
8366         info->filled = 0;
8367         if (brcmf_set_channel(cfg, info->channel))
8368                 return 0;
8369
8370         /* Disable mpc */
8371         brcmf_set_mpc(ifp, 0);
8372
8373         /* Set interface up, explicitly. */
8374         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
8375         if (err) {
8376                 brcmf_err("set interface up failed, err = %d\n", err);
8377                 goto exit;
8378         }
8379
8380         /* Get noise value */
8381         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
8382         if (err) {
8383                 brcmf_err("Get Phy Noise failed, use dummy value\n");
8384                 noise = CHAN_NOISE_DUMMY;
8385         }
8386
8387         /* Start Measurement for obss stats on current channel */
8388         req.msrmnt_query = 0;
8389         req.time_req = ACS_MSRMNT_DELAY;
8390         err = brcmf_dump_obss(ifp, req, &survey);
8391         if (err)
8392                 goto exit;
8393
8394         /* Add 10 ms for IOVAR completion */
8395         msleep(ACS_MSRMNT_DELAY + 10);
8396
8397         /* Issue IOVAR to collect measurement results */
8398         req.msrmnt_query = 1;
8399         err = brcmf_dump_obss(ifp, req, &survey);
8400         if (err)
8401                 goto exit;
8402
8403         info->noise = noise;
8404         info->time = ACS_MSRMNT_DELAY;
8405         info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
8406         info->time_rx = survey.obss + survey.ibss + survey.no_ctg +
8407                 survey.no_pckt;
8408         info->time_tx = survey.tx;
8409         info->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_TIME |
8410                 SURVEY_INFO_TIME_BUSY | SURVEY_INFO_TIME_RX |
8411                 SURVEY_INFO_TIME_TX;
8412
8413         brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
8414                   ieee80211_frequency_to_channel(info->channel->center_freq),
8415                   ACS_MSRMNT_DELAY);
8416         brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
8417                   info->noise, info->time_busy, info->time_rx, info->time_tx);
8418
8419 exit:
8420         if (!brcmf_is_apmode(ifp->vif))
8421                 brcmf_set_mpc(ifp, 1);
8422         return err;
8423 }
8424
8425 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
8426                                         struct regulatory_request *req)
8427 {
8428         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8429         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
8430         struct brcmf_pub *drvr = cfg->pub;
8431         struct brcmf_fil_country_le ccreq;
8432         char *alpha2;
8433         s32 err;
8434         int i;
8435
8436         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
8437         if (err) {
8438                 bphy_err(drvr, "Country code iovar returned err = %d\n", err);
8439                 return;
8440         }
8441
8442         /* The country code gets set to "00" by default at boot - substitute
8443          * any saved ccode from the nvram file unless there is a valid code
8444          * already set.
8445          */
8446         alpha2 = req->alpha2;
8447         if (alpha2[0] == '0' && alpha2[1] == '0') {
8448                 extern char saved_ccode[2];
8449
8450                 if ((isupper(ccreq.country_abbrev[0]) &&
8451                      isupper(ccreq.country_abbrev[1])) ||
8452                     !saved_ccode[0])
8453                         return;
8454                 alpha2 = saved_ccode;
8455                 pr_debug("brcmfmac: substituting saved ccode %c%c\n",
8456                          alpha2[0], alpha2[1]);
8457         }
8458
8459         /* ignore non-ISO3166 country codes */
8460         for (i = 0; i < 2; i++)
8461                 if (alpha2[i] < 'A' || alpha2[i] > 'Z') {
8462                         bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
8463                                  alpha2[0], alpha2[1]);
8464                         return;
8465                 }
8466
8467         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
8468                   alpha2[0], alpha2[1]);
8469
8470         err = brcmf_translate_country_code(ifp->drvr, alpha2, &ccreq);
8471         if (err)
8472                 return;
8473
8474         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
8475         if (err) {
8476                 bphy_err(drvr, "Firmware rejected country setting\n");
8477                 return;
8478         }
8479         brcmf_setup_wiphybands(cfg);
8480 }
8481
8482 static void brcmf_free_wiphy(struct wiphy *wiphy)
8483 {
8484         int i;
8485
8486         if (!wiphy)
8487                 return;
8488
8489         if (wiphy->iface_combinations) {
8490                 for (i = 0; i < wiphy->n_iface_combinations; i++)
8491                         kfree(wiphy->iface_combinations[i].limits);
8492         }
8493         kfree(wiphy->iface_combinations);
8494         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8495                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
8496                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
8497         }
8498         if (wiphy->bands[NL80211_BAND_5GHZ]) {
8499                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
8500                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
8501         }
8502 #if IS_ENABLED(CONFIG_PM)
8503         if (wiphy->wowlan != &brcmf_wowlan_support)
8504                 kfree(wiphy->wowlan);
8505 #endif
8506 }
8507
8508 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
8509                                                   struct cfg80211_ops *ops,
8510                                                   bool p2pdev_forced)
8511 {
8512         struct wiphy *wiphy = drvr->wiphy;
8513         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
8514         struct brcmf_cfg80211_info *cfg;
8515         struct brcmf_cfg80211_vif *vif;
8516         struct brcmf_if *ifp;
8517         s32 err = 0;
8518         s32 io_type;
8519         u16 *cap = NULL;
8520
8521         if (!ndev) {
8522                 bphy_err(drvr, "ndev is invalid\n");
8523                 return NULL;
8524         }
8525
8526         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
8527         if (!cfg) {
8528                 bphy_err(drvr, "Could not allocate wiphy device\n");
8529                 return NULL;
8530         }
8531
8532         cfg->wiphy = wiphy;
8533         cfg->pub = drvr;
8534         init_vif_event(&cfg->vif_event);
8535         INIT_LIST_HEAD(&cfg->vif_list);
8536
8537         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
8538         if (IS_ERR(vif))
8539                 goto wiphy_out;
8540
8541         ifp = netdev_priv(ndev);
8542         vif->ifp = ifp;
8543         vif->wdev.netdev = ndev;
8544         ndev->ieee80211_ptr = &vif->wdev;
8545         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
8546
8547         err = wl_init_priv(cfg);
8548         if (err) {
8549                 bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
8550                 brcmf_free_vif(vif);
8551                 goto wiphy_out;
8552         }
8553         ifp->vif = vif;
8554
8555         /* determine d11 io type before wiphy setup */
8556         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
8557         if (err) {
8558                 bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
8559                 goto priv_out;
8560         }
8561         cfg->d11inf.io_type = (u8)io_type;
8562         brcmu_d11_attach(&cfg->d11inf);
8563
8564         /* regulatory notifer below needs access to cfg so
8565          * assign it now.
8566          */
8567         drvr->config = cfg;
8568
8569         err = brcmf_setup_wiphy(wiphy, ifp);
8570         if (err < 0)
8571                 goto priv_out;
8572
8573         brcmf_dbg(INFO, "Registering custom regulatory\n");
8574         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
8575         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
8576         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
8577
8578         /* firmware defaults to 40MHz disabled in 2G band. We signal
8579          * cfg80211 here that we do and have it decide we can enable
8580          * it. But first check if device does support 2G operation.
8581          */
8582         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8583                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
8584                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8585         }
8586 #ifdef CONFIG_PM
8587         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
8588                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
8589 #endif
8590         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DUMP_OBSS))
8591                 ops->dump_survey = brcmf_cfg80211_dump_survey;
8592
8593         err = wiphy_register(wiphy);
8594         if (err < 0) {
8595                 bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
8596                 goto priv_out;
8597         }
8598
8599         err = brcmf_setup_wiphybands(cfg);
8600         if (err) {
8601                 bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
8602                 goto wiphy_unreg_out;
8603         }
8604
8605         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
8606          * setup 40MHz in 2GHz band and enable OBSS scanning.
8607          */
8608         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
8609                 err = brcmf_enable_bw40_2g(cfg);
8610                 if (!err)
8611                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
8612                                                       BRCMF_OBSS_COEX_AUTO);
8613                 else
8614                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8615         }
8616
8617         err = brcmf_fweh_activate_events(ifp);
8618         if (err) {
8619                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8620                 goto wiphy_unreg_out;
8621         }
8622
8623         err = brcmf_p2p_attach(cfg, p2pdev_forced);
8624         if (err) {
8625                 bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
8626                 goto wiphy_unreg_out;
8627         }
8628         err = brcmf_btcoex_attach(cfg);
8629         if (err) {
8630                 bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
8631                 brcmf_p2p_detach(&cfg->p2p);
8632                 goto wiphy_unreg_out;
8633         }
8634         err = brcmf_pno_attach(cfg);
8635         if (err) {
8636                 bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
8637                 brcmf_btcoex_detach(cfg);
8638                 brcmf_p2p_detach(&cfg->p2p);
8639                 goto wiphy_unreg_out;
8640         }
8641
8642         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
8643                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
8644                 if (err) {
8645                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
8646                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
8647                 } else {
8648                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
8649                                             brcmf_notify_tdls_peer_event);
8650                 }
8651         }
8652
8653         /* (re-) activate FWEH event handling */
8654         err = brcmf_fweh_activate_events(ifp);
8655         if (err) {
8656                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8657                 goto detach;
8658         }
8659
8660         /* Fill in some of the advertised nl80211 supported features */
8661         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
8662                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
8663 #ifdef CONFIG_PM
8664                 if (wiphy->wowlan &&
8665                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
8666                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8667 #endif
8668         }
8669
8670         return cfg;
8671
8672 detach:
8673         brcmf_pno_detach(cfg);
8674         brcmf_btcoex_detach(cfg);
8675         brcmf_p2p_detach(&cfg->p2p);
8676 wiphy_unreg_out:
8677         wiphy_unregister(cfg->wiphy);
8678 priv_out:
8679         wl_deinit_priv(cfg);
8680         brcmf_free_vif(vif);
8681         ifp->vif = NULL;
8682 wiphy_out:
8683         brcmf_free_wiphy(wiphy);
8684         kfree(cfg);
8685         return NULL;
8686 }
8687
8688 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
8689 {
8690         if (!cfg)
8691                 return;
8692
8693         brcmf_pno_detach(cfg);
8694         brcmf_btcoex_detach(cfg);
8695         wiphy_unregister(cfg->wiphy);
8696         wl_deinit_priv(cfg);
8697         brcmf_free_wiphy(cfg->wiphy);
8698         kfree(cfg);
8699 }