drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2010 Broadcom Corporation
   4  */
   5
   6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/vmalloc.h>
  12 #include <linux/ctype.h>
  13 #include <net/cfg80211.h>
  14 #include <net/netlink.h>
  15 #include <uapi/linux/if_arp.h>
  16
  17 #include <brcmu_utils.h>
  18 #include <defs.h>
  19 #include <brcmu_wifi.h>
  20 #include <brcm_hw_ids.h>
  21 #include "core.h"
  22 #include "debug.h"
  23 #include "tracepoint.h"
  24 #include "fwil_types.h"
  25 #include "p2p.h"
  26 #include "btcoex.h"
  27 #include "pno.h"
  28 #include "fwsignal.h"
  29 #include "cfg80211.h"
  30 #include "feature.h"
  31 #include "fwil.h"
  32 #include "proto.h"
  33 #include "vendor.h"
  34 #include "bus.h"
  35 #include "common.h"
  36
  37 #define BRCMF_SCAN_IE_LEN_MAX           2048
  38
  39 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  40 #define WPA_OUI_TYPE                    1
  41 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  42 #define WME_OUI_TYPE                    2
  43 #define WPS_OUI_TYPE                    4
  44
  45 #define VS_IE_FIXED_HDR_LEN             6
  46 #define WPA_IE_VERSION_LEN              2
  47 #define WPA_IE_MIN_OUI_LEN              4
  48 #define WPA_IE_SUITE_COUNT_LEN          2
  49
  50 #define WPA_CIPHER_NONE                 0       /* None */
  51 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  52 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  53 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  54 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  55
  56 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  57 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  58 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  59 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  60 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  61 #define RSN_AKM_SAE                     8       /* SAE */
  62 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  63 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  64 #define RSN_CAP_MFPR_MASK               BIT(6)
  65 #define RSN_CAP_MFPC_MASK               BIT(7)
  66 #define RSN_PMKID_COUNT_LEN             2
  67
  68 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  69                                                  * string :"add", "del" (+ NUL)
  70                                                  */
  71 #define VNDR_IE_COUNT_OFFSET            4
  72 #define VNDR_IE_PKTFLAG_OFFSET          8
  73 #define VNDR_IE_VSIE_OFFSET             12
  74 #define VNDR_IE_HDR_SIZE                12
  75 #define VNDR_IE_PARSE_LIMIT             5
  76
  77 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  78 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  79
  80 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  81 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  82 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  83
  84 #define BRCMF_SCAN_CHANNEL_TIME         40
  85 #define BRCMF_SCAN_UNASSOC_TIME         40
  86 #define BRCMF_SCAN_PASSIVE_TIME         120
  87
  88 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  89
  90 #define BRCMF_PS_MAX_TIMEOUT_MS         2000
  91
  92 /* Dump obss definitions */
  93 #define ACS_MSRMNT_DELAY                80
  94 #define CHAN_NOISE_DUMMY                (-80)
  95 #define OBSS_TOKEN_IDX                  15
  96 #define IBSS_TOKEN_IDX                  15
  97 #define TX_TOKEN_IDX                    14
  98 #define CTG_TOKEN_IDX                   13
  99 #define PKT_TOKEN_IDX                   15
 100 #define IDLE_TOKEN_IDX                  12
 101
 102 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 103         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 104
 105 #define BRCMF_MAX_CHANSPEC_LIST \
 106         (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
 107
 108 struct brcmf_dump_survey {
 109         u32 obss;
 110         u32 ibss;
 111         u32 no_ctg;
 112         u32 no_pckt;
 113         u32 tx;
 114         u32 idle;
 115 };
 116
 117 struct cca_stats_n_flags {
 118         u32 msrmnt_time; /* Time for Measurement (msec) */
 119         u32 msrmnt_done; /* flag set when measurement complete */
 120         char buf[1];
 121 };
 122
 123 struct cca_msrmnt_query {
 124         u32 msrmnt_query;
 125         u32 time_req;
 126 };
 127
 128 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 129 {
 130         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 131                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 132                           vif->sme_state);
 133                 return false;
 134         }
 135         return true;
 136 }
 137
 138 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 139 #define RATETAB_ENT(_rateid, _flags) \
 140         {                                                               \
 141                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 142                 .hw_value       = (_rateid),                            \
 143                 .flags          = (_flags),                             \
 144         }
 145
 146 static struct ieee80211_rate __wl_rates[] = {
 147         RATETAB_ENT(BRCM_RATE_1M, 0),
 148         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 151         RATETAB_ENT(BRCM_RATE_6M, 0),
 152         RATETAB_ENT(BRCM_RATE_9M, 0),
 153         RATETAB_ENT(BRCM_RATE_12M, 0),
 154         RATETAB_ENT(BRCM_RATE_18M, 0),
 155         RATETAB_ENT(BRCM_RATE_24M, 0),
 156         RATETAB_ENT(BRCM_RATE_36M, 0),
 157         RATETAB_ENT(BRCM_RATE_48M, 0),
 158         RATETAB_ENT(BRCM_RATE_54M, 0),
 159 };
 160
 161 #define wl_g_rates              (__wl_rates + 0)
 162 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 163 #define wl_a_rates              (__wl_rates + 4)
 164 #define wl_a_rates_size         (wl_g_rates_size - 4)
 165
 166 #define CHAN2G(_channel, _freq) {                               \
 167         .band                   = NL80211_BAND_2GHZ,            \
 168         .center_freq            = (_freq),                      \
 169         .hw_value               = (_channel),                   \
 170         .max_antenna_gain       = 0,                            \
 171         .max_power              = 30,                           \
 172 }
 173
 174 #define CHAN5G(_channel) {                                      \
 175         .band                   = NL80211_BAND_5GHZ,            \
 176         .center_freq            = 5000 + (5 * (_channel)),      \
 177         .hw_value               = (_channel),                   \
 178         .max_antenna_gain       = 0,                            \
 179         .max_power              = 30,                           \
 180 }
 181
 182 static struct ieee80211_channel __wl_2ghz_channels[] = {
 183         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 184         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 185         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 186         CHAN2G(13, 2472), CHAN2G(14, 2484)
 187 };
 188
 189 static struct ieee80211_channel __wl_5ghz_channels[] = {
 190         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 191         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 192         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 193         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 194         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 195         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 196 };
 197
 198 /* Band templates duplicated per wiphy. The channel info
 199  * above is added to the band during setup.
 200  */
 201 static const struct ieee80211_supported_band __wl_band_2ghz = {
 202         .band = NL80211_BAND_2GHZ,
 203         .bitrates = wl_g_rates,
 204         .n_bitrates = wl_g_rates_size,
 205 };
 206
 207 static const struct ieee80211_supported_band __wl_band_5ghz = {
 208         .band = NL80211_BAND_5GHZ,
 209         .bitrates = wl_a_rates,
 210         .n_bitrates = wl_a_rates_size,
 211 };
 212
 213 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 214  * By default world regulatory domain defined in reg.c puts the flags
 215  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 216  * With respect to these flags, wpa_supplicant doesn't * start p2p
 217  * operations on 5GHz channels. All the changes in world regulatory
 218  * domain are to be done here.
 219  */
 220 static const struct ieee80211_regdomain brcmf_regdom = {
 221         .n_reg_rules = 4,
 222         .alpha2 =  "99",
 223         .reg_rules = {
 224                 /* IEEE 802.11b/g, channels 1..11 */
 225                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 226                 /* If any */
 227                 /* IEEE 802.11 channel 14 - Only JP enables
 228                  * this and for 802.11b only
 229                  */
 230                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 231                 /* IEEE 802.11a, channel 36..64 */
 232                 REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
 233                 /* IEEE 802.11a, channel 100..165 */
 234                 REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
 235 };
 236
 237 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 238  * are supported. A pointer to this array and the number of entries is passed
 239  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 240  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 241  * device does not support MFP then the number of suites will be decreased by 1
 242  */
 243 static const u32 brcmf_cipher_suites[] = {
 244         WLAN_CIPHER_SUITE_WEP40,
 245         WLAN_CIPHER_SUITE_WEP104,
 246         WLAN_CIPHER_SUITE_TKIP,
 247         WLAN_CIPHER_SUITE_CCMP,
 248         /* Keep as last entry: */
 249         WLAN_CIPHER_SUITE_AES_CMAC
 250 };
 251
 252 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 253 struct brcmf_vs_tlv {
 254         u8 id;
 255         u8 len;
 256         u8 oui[3];
 257         u8 oui_type;
 258 };
 259
 260 struct parsed_vndr_ie_info {
 261         u8 *ie_ptr;
 262         u32 ie_len;     /* total length including id & length field */
 263         struct brcmf_vs_tlv vndrie;
 264 };
 265
 266 struct parsed_vndr_ies {
 267         u32 count;
 268         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 269 };
 270
 271 #define WL_INTERFACE_CREATE_VER_1               1
 272 #define WL_INTERFACE_CREATE_VER_2               2
 273 #define WL_INTERFACE_CREATE_VER_3               3
 274 #define WL_INTERFACE_CREATE_VER_MAX             WL_INTERFACE_CREATE_VER_3
 275
 276 #define WL_INTERFACE_MAC_DONT_USE       0x0
 277 #define WL_INTERFACE_MAC_USE            0x2
 278
 279 #define WL_INTERFACE_CREATE_STA         0x0
 280 #define WL_INTERFACE_CREATE_AP          0x1
 281
 282 struct wl_interface_create_v1 {
 283         u16     ver;                    /* structure version */
 284         u32     flags;                  /* flags for operation */
 285         u8      mac_addr[ETH_ALEN];     /* MAC address */
 286         u32     wlc_index;              /* optional for wlc index */
 287 };
 288
 289 struct wl_interface_create_v2 {
 290         u16     ver;                    /* structure version */
 291         u8      pad1[2];
 292         u32     flags;                  /* flags for operation */
 293         u8      mac_addr[ETH_ALEN];     /* MAC address */
 294         u8      iftype;                 /* type of interface created */
 295         u8      pad2;
 296         u32     wlc_index;              /* optional for wlc index */
 297 };
 298
 299 struct wl_interface_create_v3 {
 300         u16 ver;                        /* structure version */
 301         u16 len;                        /* length of structure + data */
 302         u16 fixed_len;                  /* length of structure */
 303         u8 iftype;                      /* type of interface created */
 304         u8 wlc_index;                   /* optional for wlc index */
 305         u32 flags;                      /* flags for operation */
 306         u8 mac_addr[ETH_ALEN];          /* MAC address */
 307         u8 bssid[ETH_ALEN];             /* optional for BSSID */
 308         u8 if_index;                    /* interface index request */
 309         u8 pad[3];
 310         u8 data[];                      /* Optional for specific data */
 311 };
 312
 313 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 314 {
 315         switch (band) {
 316         case NL80211_BAND_2GHZ:
 317                 return WLC_BAND_2G;
 318         case NL80211_BAND_5GHZ:
 319                 return WLC_BAND_5G;
 320         default:
 321                 WARN_ON(1);
 322                 break;
 323         }
 324         return 0;
 325 }
 326
 327 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 328                                struct cfg80211_chan_def *ch)
 329 {
 330         struct brcmu_chan ch_inf;
 331         s32 primary_offset;
 332
 333         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 334                   ch->chan->center_freq, ch->center_freq1, ch->width);
 335         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 336         primary_offset = ch->chan->center_freq - ch->center_freq1;
 337         switch (ch->width) {
 338         case NL80211_CHAN_WIDTH_20:
 339         case NL80211_CHAN_WIDTH_20_NOHT:
 340                 ch_inf.bw = BRCMU_CHAN_BW_20;
 341                 WARN_ON(primary_offset != 0);
 342                 break;
 343         case NL80211_CHAN_WIDTH_40:
 344                 ch_inf.bw = BRCMU_CHAN_BW_40;
 345                 if (primary_offset > 0)
 346                         ch_inf.sb = BRCMU_CHAN_SB_U;
 347                 else
 348                         ch_inf.sb = BRCMU_CHAN_SB_L;
 349                 break;
 350         case NL80211_CHAN_WIDTH_80:
 351                 ch_inf.bw = BRCMU_CHAN_BW_80;
 352                 if (primary_offset == -30)
 353                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 354                 else if (primary_offset == -10)
 355                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 356                 else if (primary_offset == 10)
 357                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 358                 else
 359                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 360                 break;
 361         case NL80211_CHAN_WIDTH_160:
 362                 ch_inf.bw = BRCMU_CHAN_BW_160;
 363                 if (primary_offset == -70)
 364                         ch_inf.sb = BRCMU_CHAN_SB_LLL;
 365                 else if (primary_offset == -50)
 366                         ch_inf.sb = BRCMU_CHAN_SB_LLU;
 367                 else if (primary_offset == -30)
 368                         ch_inf.sb = BRCMU_CHAN_SB_LUL;
 369                 else if (primary_offset == -10)
 370                         ch_inf.sb = BRCMU_CHAN_SB_LUU;
 371                 else if (primary_offset == 10)
 372                         ch_inf.sb = BRCMU_CHAN_SB_ULL;
 373                 else if (primary_offset == 30)
 374                         ch_inf.sb = BRCMU_CHAN_SB_ULU;
 375                 else if (primary_offset == 50)
 376                         ch_inf.sb = BRCMU_CHAN_SB_UUL;
 377                 else
 378                         ch_inf.sb = BRCMU_CHAN_SB_UUU;
 379                 break;
 380         case NL80211_CHAN_WIDTH_80P80:
 381         case NL80211_CHAN_WIDTH_5:
 382         case NL80211_CHAN_WIDTH_10:
 383         default:
 384                 WARN_ON_ONCE(1);
 385         }
 386         switch (ch->chan->band) {
 387         case NL80211_BAND_2GHZ:
 388                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 389                 break;
 390         case NL80211_BAND_5GHZ:
 391                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 392                 break;
 393         case NL80211_BAND_60GHZ:
 394         default:
 395                 WARN_ON_ONCE(1);
 396         }
 397         d11inf->encchspec(&ch_inf);
 398
 399         brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
 400         return ch_inf.chspec;
 401 }
 402
 403 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 404                         struct ieee80211_channel *ch)
 405 {
 406         struct brcmu_chan ch_inf;
 407
 408         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 409         ch_inf.bw = BRCMU_CHAN_BW_20;
 410         d11inf->encchspec(&ch_inf);
 411
 412         return ch_inf.chspec;
 413 }
 414
 415 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 416  * triples, returning a pointer to the substring whose first element
 417  * matches tag
 418  */
 419 static const struct brcmf_tlv *
 420 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 421 {
 422         const struct brcmf_tlv *elt = buf;
 423         int totlen = buflen;
 424
 425         /* find tagged parameter */
 426         while (totlen >= TLV_HDR_LEN) {
 427                 int len = elt->len;
 428
 429                 /* validate remaining totlen */
 430                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 431                         return elt;
 432
 433                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 434                 totlen -= (len + TLV_HDR_LEN);
 435         }
 436
 437         return NULL;
 438 }
 439
 440 /* Is any of the tlvs the expected entry? If
 441  * not update the tlvs buffer pointer/length.
 442  */
 443 static bool
 444 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 445                  const u8 *oui, u32 oui_len, u8 type)
 446 {
 447         /* If the contents match the OUI and the type */
 448         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 449             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 450             type == ie[TLV_BODY_OFF + oui_len]) {
 451                 return true;
 452         }
 453
 454         if (tlvs == NULL)
 455                 return false;
 456         /* point to the next ie */
 457         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 458         /* calculate the length of the rest of the buffer */
 459         *tlvs_len -= (int)(ie - *tlvs);
 460         /* update the pointer to the start of the buffer */
 461         *tlvs = ie;
 462
 463         return false;
 464 }
 465
 466 static struct brcmf_vs_tlv *
 467 brcmf_find_wpaie(const u8 *parse, u32 len)
 468 {
 469         const struct brcmf_tlv *ie;
 470
 471         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 472                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 473                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 474                         return (struct brcmf_vs_tlv *)ie;
 475         }
 476         return NULL;
 477 }
 478
 479 static struct brcmf_vs_tlv *
 480 brcmf_find_wpsie(const u8 *parse, u32 len)
 481 {
 482         const struct brcmf_tlv *ie;
 483
 484         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 485                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 486                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 487                         return (struct brcmf_vs_tlv *)ie;
 488         }
 489         return NULL;
 490 }
 491
 492 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 493                                      struct brcmf_cfg80211_vif *vif,
 494                                      enum nl80211_iftype new_type)
 495 {
 496         struct brcmf_cfg80211_vif *pos;
 497         bool check_combos = false;
 498         int ret = 0;
 499         struct iface_combination_params params = {
 500                 .num_different_channels = 1,
 501         };
 502
 503         list_for_each_entry(pos, &cfg->vif_list, list)
 504                 if (pos == vif) {
 505                         params.iftype_num[new_type]++;
 506                 } else {
 507                         /* concurrent interfaces so need check combinations */
 508                         check_combos = true;
 509                         params.iftype_num[pos->wdev.iftype]++;
 510                 }
 511
 512         if (check_combos)
 513                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 514
 515         return ret;
 516 }
 517
 518 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 519                                   enum nl80211_iftype new_type)
 520 {
 521         struct brcmf_cfg80211_vif *pos;
 522         struct iface_combination_params params = {
 523                 .num_different_channels = 1,
 524         };
 525
 526         list_for_each_entry(pos, &cfg->vif_list, list)
 527                 params.iftype_num[pos->wdev.iftype]++;
 528
 529         params.iftype_num[new_type]++;
 530         return cfg80211_check_combinations(cfg->wiphy, &params);
 531 }
 532
 533 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 534                                  struct brcmf_wsec_key_le *key_le)
 535 {
 536         key_le->index = cpu_to_le32(key->index);
 537         key_le->len = cpu_to_le32(key->len);
 538         key_le->algo = cpu_to_le32(key->algo);
 539         key_le->flags = cpu_to_le32(key->flags);
 540         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 541         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 542         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 543         memcpy(key_le->data, key->data, sizeof(key->data));
 544         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 545 }
 546
 547 static int
 548 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 549 {
 550         struct brcmf_pub *drvr = ifp->drvr;
 551         int err;
 552         struct brcmf_wsec_key_le key_le;
 553
 554         convert_key_from_CPU(key, &key_le);
 555
 556         brcmf_netdev_wait_pend8021x(ifp);
 557
 558         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 559                                         sizeof(key_le));
 560
 561         if (err)
 562                 bphy_err(drvr, "wsec_key error (%d)\n", err);
 563         return err;
 564 }
 565
 566 static void
 567 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 568 {
 569         struct brcmf_cfg80211_vif *vif;
 570         struct brcmf_if *ifp;
 571
 572         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 573         ifp = vif->ifp;
 574
 575         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 576             (wdev->iftype == NL80211_IFTYPE_AP) ||
 577             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 578                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 579                                                 ADDR_DIRECT);
 580         else
 581                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 582                                                 ADDR_INDIRECT);
 583 }
 584
 585 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 586 {
 587         int bsscfgidx;
 588
 589         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 590                 /* bsscfgidx 1 is reserved for legacy P2P */
 591                 if (bsscfgidx == 1)
 592                         continue;
 593                 if (!drvr->iflist[bsscfgidx])
 594                         return bsscfgidx;
 595         }
 596
 597         return -ENOMEM;
 598 }
 599
 600 static void brcmf_set_vif_sta_macaddr(struct brcmf_if *ifp, u8 *mac_addr)
 601 {
 602         u8 mac_idx = ifp->drvr->sta_mac_idx;
 603
 604         /* set difference MAC address with locally administered bit */
 605         memcpy(mac_addr, ifp->mac_addr, ETH_ALEN);
 606         mac_addr[0] |= 0x02;
 607         mac_addr[3] ^= mac_idx ? 0xC0 : 0xA0;
 608         mac_idx++;
 609         mac_idx = mac_idx % 2;
 610         ifp->drvr->sta_mac_idx = mac_idx;
 611 }
 612
 613 static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
 614 {
 615         struct wl_interface_create_v1 iface_v1;
 616         struct wl_interface_create_v2 iface_v2;
 617         struct wl_interface_create_v3 iface_v3;
 618         u32 iface_create_ver;
 619         int err;
 620
 621         /* interface_create version 1 */
 622         memset(&iface_v1, 0, sizeof(iface_v1));
 623         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 624         iface_v1.flags = WL_INTERFACE_CREATE_STA |
 625                          WL_INTERFACE_MAC_USE;
 626         if (!is_zero_ether_addr(macaddr))
 627                 memcpy(iface_v1.mac_addr, macaddr, ETH_ALEN);
 628         else
 629                 brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 630
 631         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 632                                        &iface_v1,
 633                                        sizeof(iface_v1));
 634         if (err) {
 635                 brcmf_info("failed to create interface(v1), err=%d\n",
 636                            err);
 637         } else {
 638                 brcmf_dbg(INFO, "interface created(v1)\n");
 639                 return 0;
 640         }
 641
 642         /* interface_create version 2 */
 643         memset(&iface_v2, 0, sizeof(iface_v2));
 644         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 645         iface_v2.flags = WL_INTERFACE_MAC_USE;
 646         iface_v2.iftype = WL_INTERFACE_CREATE_STA;
 647         if (!is_zero_ether_addr(macaddr))
 648                 memcpy(iface_v2.mac_addr, macaddr, ETH_ALEN);
 649         else
 650                 brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 651
 652         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 653                                        &iface_v2,
 654                                        sizeof(iface_v2));
 655         if (err) {
 656                 brcmf_info("failed to create interface(v2), err=%d\n",
 657                            err);
 658         } else {
 659                 brcmf_dbg(INFO, "interface created(v2)\n");
 660                 return 0;
 661         }
 662
 663         /* interface_create version 3+ */
 664         /* get supported version from firmware side */
 665         iface_create_ver = 0;
 666         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 667                                        &iface_create_ver);
 668         if (err) {
 669                 brcmf_err("fail to get supported version, err=%d\n", err);
 670                 return -EOPNOTSUPP;
 671         }
 672
 673         switch (iface_create_ver) {
 674         case WL_INTERFACE_CREATE_VER_3:
 675                 memset(&iface_v3, 0, sizeof(iface_v3));
 676                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 677                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 678                 iface_v3.iftype = WL_INTERFACE_CREATE_STA;
 679                 if (!is_zero_ether_addr(macaddr))
 680                         memcpy(iface_v3.mac_addr, macaddr, ETH_ALEN);
 681                 else
 682                         brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 683
 684                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 685                                                &iface_v3,
 686                                                sizeof(iface_v3));
 687
 688                 if (!err)
 689                         brcmf_dbg(INFO, "interface created(v3)\n");
 690                 break;
 691         default:
 692                 brcmf_err("not support interface create(v%d)\n",
 693                           iface_create_ver);
 694                 err = -EOPNOTSUPP;
 695                 break;
 696         }
 697
 698         if (err) {
 699                 brcmf_info("station interface creation failed (%d)\n",
 700                            err);
 701                 return -EIO;
 702         }
 703
 704         return 0;
 705 }
 706
 707 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 708 {
 709         struct wl_interface_create_v1 iface_v1;
 710         struct wl_interface_create_v2 iface_v2;
 711         struct wl_interface_create_v3 iface_v3;
 712         u32 iface_create_ver;
 713         struct brcmf_pub *drvr = ifp->drvr;
 714         struct brcmf_mbss_ssid_le mbss_ssid_le;
 715         int bsscfgidx;
 716         int err;
 717
 718         /* interface_create version 1 */
 719         memset(&iface_v1, 0, sizeof(iface_v1));
 720         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 721         iface_v1.flags = WL_INTERFACE_CREATE_AP |
 722                          WL_INTERFACE_MAC_USE;
 723
 724         brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 725
 726         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 727                                        &iface_v1,
 728                                        sizeof(iface_v1));
 729         if (err) {
 730                 brcmf_info("failed to create interface(v1), err=%d\n",
 731                            err);
 732         } else {
 733                 brcmf_dbg(INFO, "interface created(v1)\n");
 734                 return 0;
 735         }
 736
 737         /* interface_create version 2 */
 738         memset(&iface_v2, 0, sizeof(iface_v2));
 739         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 740         iface_v2.flags = WL_INTERFACE_MAC_USE;
 741         iface_v2.iftype = WL_INTERFACE_CREATE_AP;
 742
 743         brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 744
 745         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 746                                        &iface_v2,
 747                                        sizeof(iface_v2));
 748         if (err) {
 749                 brcmf_info("failed to create interface(v2), err=%d\n",
 750                            err);
 751         } else {
 752                 brcmf_dbg(INFO, "interface created(v2)\n");
 753                 return 0;
 754         }
 755
 756         /* interface_create version 3+ */
 757         /* get supported version from firmware side */
 758         iface_create_ver = 0;
 759         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 760                                        &iface_create_ver);
 761         if (err) {
 762                 brcmf_err("fail to get supported version, err=%d\n", err);
 763                 return -EOPNOTSUPP;
 764         }
 765
 766         switch (iface_create_ver) {
 767         case WL_INTERFACE_CREATE_VER_3:
 768                 memset(&iface_v3, 0, sizeof(iface_v3));
 769                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 770                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 771                 iface_v3.iftype = WL_INTERFACE_CREATE_AP;
 772                 brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 773
 774                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 775                                                &iface_v3,
 776                                                sizeof(iface_v3));
 777
 778                 if (!err)
 779                         brcmf_dbg(INFO, "interface created(v3)\n");
 780                 break;
 781         default:
 782                 brcmf_err("not support interface create(v%d)\n",
 783                           iface_create_ver);
 784                 err = -EOPNOTSUPP;
 785                 break;
 786         }
 787
 788         if (err) {
 789                 brcmf_info("Does not support interface_create (%d)\n",
 790                            err);
 791                 memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 792                 bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 793                 if (bsscfgidx < 0)
 794                         return bsscfgidx;
 795
 796                 mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 797                 mbss_ssid_le.SSID_len = cpu_to_le32(5);
 798                 sprintf(mbss_ssid_le.SSID, "ssid%d", bsscfgidx);
 799
 800                 err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 801                                                 sizeof(mbss_ssid_le));
 802
 803                 if (err < 0)
 804                         bphy_err(drvr, "setting ssid failed %d\n", err);
 805         }
 806
 807         return err;
 808 }
 809
 810 /**
 811  * brcmf_apsta_add_vif() - create a new AP or STA virtual interface
 812  *
 813  * @wiphy: wiphy device of new interface.
 814  * @name: name of the new interface.
 815  * @params: contains mac address for AP or STA device.
 816  * @type: interface type.
 817  */
 818 static
 819 struct wireless_dev *brcmf_apsta_add_vif(struct wiphy *wiphy, const char *name,
 820                                          struct vif_params *params,
 821                                          enum nl80211_iftype type)
 822 {
 823         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 824         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 825         struct brcmf_pub *drvr = cfg->pub;
 826         struct brcmf_cfg80211_vif *vif;
 827         int err;
 828
 829         if (type != NL80211_IFTYPE_STATION && type != NL80211_IFTYPE_AP)
 830                 return ERR_PTR(-EINVAL);
 831
 832         if (brcmf_cfg80211_vif_event_armed(cfg))
 833                 return ERR_PTR(-EBUSY);
 834
 835         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 836
 837         vif = brcmf_alloc_vif(cfg, type);
 838         if (IS_ERR(vif))
 839                 return (struct wireless_dev *)vif;
 840
 841         brcmf_cfg80211_arm_vif_event(cfg, vif);
 842
 843         if (type == NL80211_IFTYPE_STATION)
 844                 err = brcmf_cfg80211_request_sta_if(ifp, params->macaddr);
 845         else
 846                 err = brcmf_cfg80211_request_ap_if(ifp);
 847         if (err) {
 848                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 849                 goto fail;
 850         }
 851
 852         /* wait for firmware event */
 853         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 854                                             BRCMF_VIF_EVENT_TIMEOUT);
 855         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 856         if (!err) {
 857                 bphy_err(drvr, "timeout occurred\n");
 858                 err = -EIO;
 859                 goto fail;
 860         }
 861
 862         /* interface created in firmware */
 863         ifp = vif->ifp;
 864         if (!ifp) {
 865                 bphy_err(drvr, "no if pointer provided\n");
 866                 err = -ENOENT;
 867                 goto fail;
 868         }
 869
 870         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 871         err = brcmf_net_attach(ifp, true);
 872         if (err) {
 873                 bphy_err(drvr, "Registering netdevice failed\n");
 874                 free_netdev(ifp->ndev);
 875                 goto fail;
 876         }
 877
 878         return &ifp->vif->wdev;
 879
 880 fail:
 881         brcmf_free_vif(vif);
 882         return ERR_PTR(err);
 883 }
 884
 885 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 886 {
 887         enum nl80211_iftype iftype;
 888
 889         iftype = vif->wdev.iftype;
 890         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 891 }
 892
 893 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 894 {
 895         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 896 }
 897
 898 /**
 899  * brcmf_mon_add_vif() - create monitor mode virtual interface
 900  *
 901  * @wiphy: wiphy device of new interface.
 902  * @name: name of the new interface.
 903  */
 904 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
 905                                               const char *name)
 906 {
 907         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 908         struct brcmf_cfg80211_vif *vif;
 909         struct net_device *ndev;
 910         struct brcmf_if *ifp;
 911         int err;
 912
 913         if (cfg->pub->mon_if) {
 914                 err = -EEXIST;
 915                 goto err_out;
 916         }
 917
 918         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
 919         if (IS_ERR(vif)) {
 920                 err = PTR_ERR(vif);
 921                 goto err_out;
 922         }
 923
 924         ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
 925         if (!ndev) {
 926                 err = -ENOMEM;
 927                 goto err_free_vif;
 928         }
 929         ndev->type = ARPHRD_IEEE80211_RADIOTAP;
 930         ndev->ieee80211_ptr = &vif->wdev;
 931         ndev->needs_free_netdev = true;
 932         ndev->priv_destructor = brcmf_cfg80211_free_netdev;
 933         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
 934
 935         ifp = netdev_priv(ndev);
 936         ifp->vif = vif;
 937         ifp->ndev = ndev;
 938         ifp->drvr = cfg->pub;
 939
 940         vif->ifp = ifp;
 941         vif->wdev.netdev = ndev;
 942
 943         err = brcmf_net_mon_attach(ifp);
 944         if (err) {
 945                 brcmf_err("Failed to attach %s device\n", ndev->name);
 946                 free_netdev(ndev);
 947                 goto err_free_vif;
 948         }
 949
 950         cfg->pub->mon_if = ifp;
 951
 952         return &vif->wdev;
 953
 954 err_free_vif:
 955         brcmf_free_vif(vif);
 956 err_out:
 957         return ERR_PTR(err);
 958 }
 959
 960 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 961 {
 962         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 963         struct net_device *ndev = wdev->netdev;
 964
 965         ndev->netdev_ops->ndo_stop(ndev);
 966
 967         brcmf_net_detach(ndev, true);
 968
 969         cfg->pub->mon_if = NULL;
 970
 971         return 0;
 972 }
 973
 974 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 975                                                      const char *name,
 976                                                      unsigned char name_assign_type,
 977                                                      enum nl80211_iftype type,
 978                                                      struct vif_params *params)
 979 {
 980         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 981         struct brcmf_pub *drvr = cfg->pub;
 982         struct wireless_dev *wdev;
 983         int err;
 984
 985         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 986         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 987         if (err) {
 988                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 989                 return ERR_PTR(err);
 990         }
 991         switch (type) {
 992         case NL80211_IFTYPE_ADHOC:
 993         case NL80211_IFTYPE_AP_VLAN:
 994         case NL80211_IFTYPE_WDS:
 995         case NL80211_IFTYPE_MESH_POINT:
 996                 return ERR_PTR(-EOPNOTSUPP);
 997         case NL80211_IFTYPE_MONITOR:
 998                 return brcmf_mon_add_vif(wiphy, name);
 999         case NL80211_IFTYPE_STATION:
1000         case NL80211_IFTYPE_AP:
1001                 wdev = brcmf_apsta_add_vif(wiphy, name, params, type);
1002                 break;
1003         case NL80211_IFTYPE_P2P_CLIENT:
1004         case NL80211_IFTYPE_P2P_GO:
1005         case NL80211_IFTYPE_P2P_DEVICE:
1006                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
1007                 break;
1008         case NL80211_IFTYPE_UNSPECIFIED:
1009         default:
1010                 return ERR_PTR(-EINVAL);
1011         }
1012
1013         if (IS_ERR(wdev))
1014                 bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
1015                          type, (int)PTR_ERR(wdev));
1016         else
1017                 brcmf_cfg80211_update_proto_addr_mode(wdev);
1018
1019         return wdev;
1020 }
1021
1022 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
1023 {
1024         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
1025                 brcmf_set_mpc(ifp, mpc);
1026 }
1027
1028 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
1029 {
1030         struct brcmf_pub *drvr = ifp->drvr;
1031         s32 err = 0;
1032
1033         if (check_vif_up(ifp->vif)) {
1034                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
1035                 if (err) {
1036                         bphy_err(drvr, "fail to set mpc\n");
1037                         return;
1038                 }
1039                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
1040         }
1041 }
1042
1043 static void brcmf_scan_params_v2_to_v1(struct brcmf_scan_params_v2_le *params_v2_le,
1044                                        struct brcmf_scan_params_le *params_le)
1045 {
1046         size_t params_size;
1047         u32 ch;
1048         int n_channels, n_ssids;
1049
1050         memcpy(&params_le->ssid_le, &params_v2_le->ssid_le,
1051                sizeof(params_le->ssid_le));
1052         memcpy(&params_le->bssid, &params_v2_le->bssid,
1053                sizeof(params_le->bssid));
1054
1055         params_le->bss_type = params_v2_le->bss_type;
1056         params_le->scan_type = le32_to_cpu(params_v2_le->scan_type);
1057         params_le->nprobes = params_v2_le->nprobes;
1058         params_le->active_time = params_v2_le->active_time;
1059         params_le->passive_time = params_v2_le->passive_time;
1060         params_le->home_time = params_v2_le->home_time;
1061         params_le->channel_num = params_v2_le->channel_num;
1062
1063         ch = le32_to_cpu(params_v2_le->channel_num);
1064         n_channels = ch & BRCMF_SCAN_PARAMS_COUNT_MASK;
1065         n_ssids = ch >> BRCMF_SCAN_PARAMS_NSSID_SHIFT;
1066
1067         params_size = sizeof(u16) * n_channels;
1068         if (n_ssids > 0) {
1069                 params_size = roundup(params_size, sizeof(u32));
1070                 params_size += sizeof(struct brcmf_ssid_le) * n_ssids;
1071         }
1072
1073         memcpy(&params_le->channel_list[0],
1074                &params_v2_le->channel_list[0], params_size);
1075 }
1076
1077 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1078                              struct brcmf_scan_params_v2_le *params_le,
1079                              struct cfg80211_scan_request *request)
1080 {
1081         u32 n_ssids;
1082         u32 n_channels;
1083         s32 i;
1084         s32 offset;
1085         u16 chanspec;
1086         char *ptr;
1087         int length;
1088         struct brcmf_ssid_le ssid_le;
1089
1090         eth_broadcast_addr(params_le->bssid);
1091
1092         length = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1093
1094         params_le->version = cpu_to_le16(BRCMF_SCAN_PARAMS_VERSION_V2);
1095         params_le->bss_type = DOT11_BSSTYPE_ANY;
1096         params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_ACTIVE);
1097         params_le->channel_num = 0;
1098         params_le->nprobes = cpu_to_le32(-1);
1099         params_le->active_time = cpu_to_le32(-1);
1100         params_le->passive_time = cpu_to_le32(-1);
1101         params_le->home_time = cpu_to_le32(-1);
1102         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1103
1104         /* Scan abort */
1105         if (!request) {
1106                 length += sizeof(u16);
1107                 params_le->channel_num = cpu_to_le32(1);
1108                 params_le->channel_list[0] = cpu_to_le16(-1);
1109                 params_le->length = cpu_to_le16(length);
1110                 return;
1111         }
1112
1113         n_ssids = request->n_ssids;
1114         n_channels = request->n_channels;
1115
1116         /* Copy channel array if applicable */
1117         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1118                   n_channels);
1119         if (n_channels > 0) {
1120                 length += roundup(sizeof(u16) * n_channels, sizeof(u32));
1121                 for (i = 0; i < n_channels; i++) {
1122                         chanspec = channel_to_chanspec(&cfg->d11inf,
1123                                                        request->channels[i]);
1124                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1125                                   request->channels[i]->hw_value, chanspec);
1126                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1127                 }
1128         } else {
1129                 brcmf_dbg(SCAN, "Scanning all channels\n");
1130         }
1131
1132         /* Copy ssid array if applicable */
1133         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1134         if (n_ssids > 0) {
1135                 offset = offsetof(struct brcmf_scan_params_v2_le, channel_list) +
1136                                 n_channels * sizeof(u16);
1137                 offset = roundup(offset, sizeof(u32));
1138                 length += sizeof(ssid_le) * n_ssids,
1139                 ptr = (char *)params_le + offset;
1140                 for (i = 0; i < n_ssids; i++) {
1141                         memset(&ssid_le, 0, sizeof(ssid_le));
1142                         ssid_le.SSID_len =
1143                                         cpu_to_le32(request->ssids[i].ssid_len);
1144                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1145                                request->ssids[i].ssid_len);
1146                         if (!ssid_le.SSID_len)
1147                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1148                         else
1149                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1150                                           i, ssid_le.SSID, ssid_le.SSID_len);
1151                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1152                         ptr += sizeof(ssid_le);
1153                 }
1154         } else {
1155                 brcmf_dbg(SCAN, "Performing passive scan\n");
1156                 params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_PASSIVE);
1157         }
1158         params_le->length = cpu_to_le16(length);
1159         /* Adding mask to channel numbers */
1160         params_le->channel_num =
1161                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1162                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1163 }
1164
1165 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
1166                                 struct brcmf_if *ifp, bool aborted,
1167                                 bool fw_abort)
1168 {
1169         struct brcmf_pub *drvr = cfg->pub;
1170         struct brcmf_scan_params_v2_le params_v2_le;
1171         struct cfg80211_scan_request *scan_request;
1172         u64 reqid;
1173         u32 bucket;
1174         s32 err = 0;
1175
1176         brcmf_dbg(SCAN, "Enter\n");
1177
1178         /* clear scan request, because the FW abort can cause a second call */
1179         /* to this functon and might cause a double cfg80211_scan_done      */
1180         scan_request = cfg->scan_request;
1181         cfg->scan_request = NULL;
1182
1183         if (timer_pending(&cfg->escan_timeout))
1184                 del_timer_sync(&cfg->escan_timeout);
1185
1186         if (fw_abort) {
1187                 /* Do a scan abort to stop the driver's scan engine */
1188                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
1189
1190                 brcmf_escan_prep(cfg, &params_v2_le, NULL);
1191
1192                 /* E-Scan (or anyother type) can be aborted by SCAN */
1193                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1194                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1195                                                      &params_v2_le,
1196                                                      sizeof(params_v2_le));
1197                 } else {
1198                         struct brcmf_scan_params_le params_le;
1199
1200                         brcmf_scan_params_v2_to_v1(&params_v2_le, &params_le);
1201                         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1202                                                      &params_le,
1203                                                      sizeof(params_le));
1204                 }
1205
1206                 if (err)
1207                         bphy_err(drvr, "Scan abort failed\n");
1208         }
1209
1210         brcmf_scan_config_mpc(ifp, 1);
1211
1212         /*
1213          * e-scan can be initiated internally
1214          * which takes precedence.
1215          */
1216         if (cfg->int_escan_map) {
1217                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
1218                           cfg->int_escan_map);
1219                 while (cfg->int_escan_map) {
1220                         bucket = __ffs(cfg->int_escan_map);
1221                         cfg->int_escan_map &= ~BIT(bucket);
1222                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
1223                                                                bucket);
1224                         if (!aborted) {
1225                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
1226                                           reqid);
1227                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
1228                                                             reqid);
1229                         }
1230                 }
1231         } else if (scan_request) {
1232                 struct cfg80211_scan_info info = {
1233                         .aborted = aborted,
1234                 };
1235
1236                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
1237                           aborted ? "Aborted" : "Done");
1238                 cfg80211_scan_done(scan_request, &info);
1239         }
1240         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
1241                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
1242
1243         return err;
1244 }
1245
1246 static int brcmf_cfg80211_del_apsta_iface(struct wiphy *wiphy,
1247                                           struct wireless_dev *wdev)
1248 {
1249         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1250         struct net_device *ndev = wdev->netdev;
1251         struct brcmf_if *ifp = netdev_priv(ndev);
1252         struct brcmf_pub *drvr = cfg->pub;
1253         int ret;
1254         int err;
1255
1256         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
1257
1258         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
1259         if (err) {
1260                 bphy_err(drvr, "interface_remove failed %d\n", err);
1261                 goto err_unarm;
1262         }
1263
1264         /* wait for firmware event */
1265         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
1266                                             BRCMF_VIF_EVENT_TIMEOUT);
1267         if (!ret) {
1268                 bphy_err(drvr, "timeout occurred\n");
1269                 err = -EIO;
1270                 goto err_unarm;
1271         }
1272
1273         brcmf_remove_interface(ifp, true);
1274
1275 err_unarm:
1276         brcmf_cfg80211_arm_vif_event(cfg, NULL);
1277         return err;
1278 }
1279
1280 static
1281 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
1282 {
1283         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1284         struct net_device *ndev = wdev->netdev;
1285
1286         if (ndev && ndev == cfg_to_ndev(cfg))
1287                 return -ENOTSUPP;
1288
1289         /* vif event pending in firmware */
1290         if (brcmf_cfg80211_vif_event_armed(cfg))
1291                 return -EBUSY;
1292
1293         if (ndev) {
1294                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
1295                     cfg->escan_info.ifp == netdev_priv(ndev))
1296                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
1297                                                     true, true);
1298
1299                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
1300         }
1301
1302         switch (wdev->iftype) {
1303         case NL80211_IFTYPE_ADHOC:
1304         case NL80211_IFTYPE_AP_VLAN:
1305         case NL80211_IFTYPE_WDS:
1306         case NL80211_IFTYPE_MESH_POINT:
1307                 return -EOPNOTSUPP;
1308         case NL80211_IFTYPE_MONITOR:
1309                 return brcmf_mon_del_vif(wiphy, wdev);
1310         case NL80211_IFTYPE_STATION:
1311         case NL80211_IFTYPE_AP:
1312                 return brcmf_cfg80211_del_apsta_iface(wiphy, wdev);
1313         case NL80211_IFTYPE_P2P_CLIENT:
1314         case NL80211_IFTYPE_P2P_GO:
1315         case NL80211_IFTYPE_P2P_DEVICE:
1316                 return brcmf_p2p_del_vif(wiphy, wdev);
1317         case NL80211_IFTYPE_UNSPECIFIED:
1318         default:
1319                 return -EINVAL;
1320         }
1321         return -EOPNOTSUPP;
1322 }
1323
1324 static s32
1325 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
1326                          enum nl80211_iftype type,
1327                          struct vif_params *params)
1328 {
1329         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1330         struct brcmf_if *ifp = netdev_priv(ndev);
1331         struct brcmf_cfg80211_vif *vif = ifp->vif;
1332         struct brcmf_pub *drvr = cfg->pub;
1333         s32 infra = 0;
1334         s32 ap = 0;
1335         s32 err = 0;
1336
1337         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
1338                   type);
1339
1340         /* WAR: There are a number of p2p interface related problems which
1341          * need to be handled initially (before doing the validate).
1342          * wpa_supplicant tends to do iface changes on p2p device/client/go
1343          * which are not always possible/allowed. However we need to return
1344          * OK otherwise the wpa_supplicant wont start. The situation differs
1345          * on configuration and setup (p2pon=1 module param). The first check
1346          * is to see if the request is a change to station for p2p iface.
1347          */
1348         if ((type == NL80211_IFTYPE_STATION) &&
1349             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
1350              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
1351              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
1352                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
1353                 /* Now depending on whether module param p2pon=1 was used the
1354                  * response needs to be either 0 or EOPNOTSUPP. The reason is
1355                  * that if p2pon=1 is used, but a newer supplicant is used then
1356                  * we should return an error, as this combination wont work.
1357                  * In other situations 0 is returned and supplicant will start
1358                  * normally. It will give a trace in cfg80211, but it is the
1359                  * only way to get it working. Unfortunately this will result
1360                  * in situation where we wont support new supplicant in
1361                  * combination with module param p2pon=1, but that is the way
1362                  * it is. If the user tries this then unloading of driver might
1363                  * fail/lock.
1364                  */
1365                 if (cfg->p2p.p2pdev_dynamically)
1366                         return -EOPNOTSUPP;
1367                 else
1368                         return 0;
1369         }
1370         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
1371         if (err) {
1372                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
1373                 return err;
1374         }
1375         switch (type) {
1376         case NL80211_IFTYPE_MONITOR:
1377         case NL80211_IFTYPE_WDS:
1378                 bphy_err(drvr, "type (%d) : currently we do not support this type\n",
1379                          type);
1380                 return -EOPNOTSUPP;
1381         case NL80211_IFTYPE_ADHOC:
1382                 infra = 0;
1383                 break;
1384         case NL80211_IFTYPE_STATION:
1385                 infra = 1;
1386                 break;
1387         case NL80211_IFTYPE_AP:
1388         case NL80211_IFTYPE_P2P_GO:
1389                 ap = 1;
1390                 break;
1391         default:
1392                 err = -EINVAL;
1393                 goto done;
1394         }
1395
1396         if (ap) {
1397                 if (type == NL80211_IFTYPE_P2P_GO) {
1398                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
1399                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1400                 }
1401                 if (!err) {
1402                         brcmf_dbg(INFO, "IF Type = AP\n");
1403                 }
1404         } else {
1405                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1406                 if (err) {
1407                         bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1408                         err = -EAGAIN;
1409                         goto done;
1410                 }
1411                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1412                           "Adhoc" : "Infra");
1413         }
1414         ndev->ieee80211_ptr->iftype = type;
1415
1416         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1417
1418 done:
1419         brcmf_dbg(TRACE, "Exit\n");
1420
1421         return err;
1422 }
1423
1424 static s32
1425 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1426                 struct cfg80211_scan_request *request)
1427 {
1428         struct brcmf_pub *drvr = cfg->pub;
1429         s32 params_size = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE +
1430                           offsetof(struct brcmf_escan_params_le, params_v2_le);
1431         struct brcmf_escan_params_le *params;
1432         s32 err = 0;
1433
1434         brcmf_dbg(SCAN, "E-SCAN START\n");
1435
1436         if (request != NULL) {
1437                 /* Allocate space for populating ssids in struct */
1438                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1439
1440                 /* Allocate space for populating ssids in struct */
1441                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1442         }
1443
1444         params = kzalloc(params_size, GFP_KERNEL);
1445         if (!params) {
1446                 err = -ENOMEM;
1447                 goto exit;
1448         }
1449         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1450         brcmf_escan_prep(cfg, &params->params_v2_le, request);
1451
1452         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
1453
1454         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1455                 struct brcmf_escan_params_le *params_v1;
1456
1457                 params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1458                 params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
1459                 params_v1 = kzalloc(params_size, GFP_KERNEL);
1460                 if (!params_v1) {
1461                         err = -ENOMEM;
1462                         goto exit_params;
1463                 }
1464                 params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1465                 brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
1466                 kfree(params);
1467                 params = params_v1;
1468         }
1469
1470         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1471         params->sync_id = cpu_to_le16(0x1234);
1472
1473         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1474         if (err) {
1475                 if (err == -EBUSY)
1476                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1477                 else
1478                         bphy_err(drvr, "error (%d)\n", err);
1479         }
1480
1481 exit_params:
1482         kfree(params);
1483 exit:
1484         return err;
1485 }
1486
1487 static s32
1488 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1489 {
1490         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1491         s32 err;
1492         struct brcmf_scan_results *results;
1493         struct escan_info *escan = &cfg->escan_info;
1494
1495         brcmf_dbg(SCAN, "Enter\n");
1496         escan->ifp = ifp;
1497         escan->wiphy = cfg->wiphy;
1498         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1499
1500         brcmf_scan_config_mpc(ifp, 0);
1501         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1502         results->version = 0;
1503         results->count = 0;
1504         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1505
1506         err = escan->run(cfg, ifp, request);
1507         if (err)
1508                 brcmf_scan_config_mpc(ifp, 1);
1509         return err;
1510 }
1511
1512 static s32
1513 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1514 {
1515         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1516         struct brcmf_pub *drvr = cfg->pub;
1517         struct brcmf_cfg80211_vif *vif;
1518         s32 err = 0;
1519
1520         brcmf_dbg(TRACE, "Enter\n");
1521         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1522         if (!check_vif_up(vif))
1523                 return -EIO;
1524
1525         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1526                 bphy_err(drvr, "Scanning already: status (%lu)\n",
1527                          cfg->scan_status);
1528                 return -EAGAIN;
1529         }
1530         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1531                 bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1532                          cfg->scan_status);
1533                 return -EAGAIN;
1534         }
1535         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1536                 bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1537                          cfg->scan_status);
1538                 return -EAGAIN;
1539         }
1540         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1541                 bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1542                 return -EAGAIN;
1543         }
1544
1545         /* If scan req comes for p2p0, send it over primary I/F */
1546         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1547                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1548
1549         brcmf_dbg(SCAN, "START ESCAN\n");
1550
1551         cfg->scan_request = request;
1552         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1553
1554         cfg->escan_info.run = brcmf_run_escan;
1555         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1556         if (err)
1557                 goto scan_out;
1558
1559         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1560                                     request->ie, request->ie_len);
1561         if (err)
1562                 goto scan_out;
1563
1564         err = brcmf_do_escan(vif->ifp, request);
1565         if (err)
1566                 goto scan_out;
1567
1568         /* Arm scan timeout timer */
1569         mod_timer(&cfg->escan_timeout,
1570                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1571
1572         return 0;
1573
1574 scan_out:
1575         bphy_err(drvr, "scan error (%d)\n", err);
1576         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1577         cfg->scan_request = NULL;
1578         return err;
1579 }
1580
1581 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1582 {
1583         struct brcmf_if *ifp = netdev_priv(ndev);
1584         struct brcmf_pub *drvr = ifp->drvr;
1585         s32 err = 0;
1586
1587         err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1588         if (err)
1589                 bphy_err(drvr, "Error (%d)\n", err);
1590
1591         return err;
1592 }
1593
1594 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1595 {
1596         struct brcmf_if *ifp = netdev_priv(ndev);
1597         struct brcmf_pub *drvr = ifp->drvr;
1598         s32 err = 0;
1599
1600         err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1601                                       frag_threshold);
1602         if (err)
1603                 bphy_err(drvr, "Error (%d)\n", err);
1604
1605         return err;
1606 }
1607
1608 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1609 {
1610         struct brcmf_if *ifp = netdev_priv(ndev);
1611         struct brcmf_pub *drvr = ifp->drvr;
1612         s32 err = 0;
1613         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1614
1615         err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1616         if (err) {
1617                 bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1618                 return err;
1619         }
1620         return err;
1621 }
1622
1623 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1624 {
1625         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1626         struct net_device *ndev = cfg_to_ndev(cfg);
1627         struct brcmf_if *ifp = netdev_priv(ndev);
1628         s32 err = 0;
1629
1630         brcmf_dbg(TRACE, "Enter\n");
1631         if (!check_vif_up(ifp->vif))
1632                 return -EIO;
1633
1634         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1635             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1636                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1637                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1638                 if (!err)
1639                         goto done;
1640         }
1641         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1642             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1643                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1644                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1645                 if (!err)
1646                         goto done;
1647         }
1648         if (changed & WIPHY_PARAM_RETRY_LONG
1649             && (cfg->conf->retry_long != wiphy->retry_long)) {
1650                 cfg->conf->retry_long = wiphy->retry_long;
1651                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1652                 if (!err)
1653                         goto done;
1654         }
1655         if (changed & WIPHY_PARAM_RETRY_SHORT
1656             && (cfg->conf->retry_short != wiphy->retry_short)) {
1657                 cfg->conf->retry_short = wiphy->retry_short;
1658                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1659                 if (!err)
1660                         goto done;
1661         }
1662
1663 done:
1664         brcmf_dbg(TRACE, "Exit\n");
1665         return err;
1666 }
1667
1668 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1669 {
1670         memset(prof, 0, sizeof(*prof));
1671 }
1672
1673 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1674 {
1675         u16 reason;
1676
1677         switch (e->event_code) {
1678         case BRCMF_E_DEAUTH:
1679         case BRCMF_E_DEAUTH_IND:
1680         case BRCMF_E_DISASSOC_IND:
1681                 reason = e->reason;
1682                 break;
1683         case BRCMF_E_LINK:
1684         default:
1685                 reason = 0;
1686                 break;
1687         }
1688         return reason;
1689 }
1690
1691 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1692 {
1693         struct brcmf_pub *drvr = ifp->drvr;
1694         struct brcmf_wsec_pmk_le pmk;
1695         int err;
1696
1697         memset(&pmk, 0, sizeof(pmk));
1698
1699         /* pass pmk directly */
1700         pmk.key_len = cpu_to_le16(pmk_len);
1701         pmk.flags = cpu_to_le16(0);
1702         memcpy(pmk.key, pmk_data, pmk_len);
1703
1704         /* store psk in firmware */
1705         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1706                                      &pmk, sizeof(pmk));
1707         if (err < 0)
1708                 bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1709                          pmk_len);
1710
1711         return err;
1712 }
1713
1714 static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
1715                                   u16 pwd_len)
1716 {
1717         struct brcmf_pub *drvr = ifp->drvr;
1718         struct brcmf_wsec_sae_pwd_le sae_pwd;
1719         int err;
1720
1721         if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
1722                 bphy_err(drvr, "sae_password must be less than %d\n",
1723                          BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
1724                 return -EINVAL;
1725         }
1726
1727         sae_pwd.key_len = cpu_to_le16(pwd_len);
1728         memcpy(sae_pwd.key, pwd_data, pwd_len);
1729
1730         err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
1731                                        sizeof(sae_pwd));
1732         if (err < 0)
1733                 bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
1734                          pwd_len);
1735
1736         return err;
1737 }
1738
1739 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1740                             bool locally_generated)
1741 {
1742         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1743         struct brcmf_pub *drvr = cfg->pub;
1744         bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1745         s32 err = 0;
1746
1747         brcmf_dbg(TRACE, "Enter\n");
1748
1749         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1750                 if (bus_up) {
1751                         brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1752                         err = brcmf_fil_cmd_data_set(vif->ifp,
1753                                                      BRCMF_C_DISASSOC, NULL, 0);
1754                         if (err)
1755                                 bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1756                                          err);
1757                 }
1758
1759                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1760                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1761                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1762                                               locally_generated, GFP_KERNEL);
1763         }
1764         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1765         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
1766         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
1767         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1768         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1769         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1770                 if (bus_up)
1771                         brcmf_set_pmk(vif->ifp, NULL, 0);
1772                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1773         }
1774         brcmf_dbg(TRACE, "Exit\n");
1775 }
1776
1777 static s32
1778 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1779                       struct cfg80211_ibss_params *params)
1780 {
1781         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1782         struct brcmf_if *ifp = netdev_priv(ndev);
1783         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1784         struct brcmf_pub *drvr = cfg->pub;
1785         struct brcmf_join_params join_params;
1786         size_t join_params_size = 0;
1787         s32 err = 0;
1788         s32 wsec = 0;
1789         s32 bcnprd;
1790         u16 chanspec;
1791         u32 ssid_len;
1792
1793         brcmf_dbg(TRACE, "Enter\n");
1794         if (!check_vif_up(ifp->vif))
1795                 return -EIO;
1796
1797         if (params->ssid)
1798                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1799         else {
1800                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1801                 return -EOPNOTSUPP;
1802         }
1803
1804         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1805
1806         if (params->bssid)
1807                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1808         else
1809                 brcmf_dbg(CONN, "No BSSID specified\n");
1810
1811         if (params->chandef.chan)
1812                 brcmf_dbg(CONN, "channel: %d\n",
1813                           params->chandef.chan->center_freq);
1814         else
1815                 brcmf_dbg(CONN, "no channel specified\n");
1816
1817         if (params->channel_fixed)
1818                 brcmf_dbg(CONN, "fixed channel required\n");
1819         else
1820                 brcmf_dbg(CONN, "no fixed channel required\n");
1821
1822         if (params->ie && params->ie_len)
1823                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1824         else
1825                 brcmf_dbg(CONN, "no ie specified\n");
1826
1827         if (params->beacon_interval)
1828                 brcmf_dbg(CONN, "beacon interval: %d\n",
1829                           params->beacon_interval);
1830         else
1831                 brcmf_dbg(CONN, "no beacon interval specified\n");
1832
1833         if (params->basic_rates)
1834                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1835         else
1836                 brcmf_dbg(CONN, "no basic rates specified\n");
1837
1838         if (params->privacy)
1839                 brcmf_dbg(CONN, "privacy required\n");
1840         else
1841                 brcmf_dbg(CONN, "no privacy required\n");
1842
1843         /* Configure Privacy for starter */
1844         if (params->privacy)
1845                 wsec |= WEP_ENABLED;
1846
1847         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1848         if (err) {
1849                 bphy_err(drvr, "wsec failed (%d)\n", err);
1850                 goto done;
1851         }
1852
1853         /* Configure Beacon Interval for starter */
1854         if (params->beacon_interval)
1855                 bcnprd = params->beacon_interval;
1856         else
1857                 bcnprd = 100;
1858
1859         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1860         if (err) {
1861                 bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1862                 goto done;
1863         }
1864
1865         /* Configure required join parameter */
1866         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1867
1868         /* SSID */
1869         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1870         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1871         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1872         join_params_size = sizeof(join_params.ssid_le);
1873
1874         /* BSSID */
1875         if (params->bssid) {
1876                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1877                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1878                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1879         } else {
1880                 eth_broadcast_addr(join_params.params_le.bssid);
1881                 eth_zero_addr(profile->bssid);
1882         }
1883
1884         /* Channel */
1885         if (params->chandef.chan) {
1886                 u32 target_channel;
1887
1888                 cfg->channel =
1889                         ieee80211_frequency_to_channel(
1890                                 params->chandef.chan->center_freq);
1891                 if (params->channel_fixed) {
1892                         /* adding chanspec */
1893                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1894                                                        &params->chandef);
1895                         join_params.params_le.chanspec_list[0] =
1896                                 cpu_to_le16(chanspec);
1897                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1898                         join_params_size += sizeof(join_params.params_le);
1899                 }
1900
1901                 /* set channel for starter */
1902                 target_channel = cfg->channel;
1903                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1904                                             target_channel);
1905                 if (err) {
1906                         bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1907                         goto done;
1908                 }
1909         } else
1910                 cfg->channel = 0;
1911
1912         cfg->ibss_starter = false;
1913
1914
1915         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1916                                      &join_params, join_params_size);
1917         if (err) {
1918                 bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1919                 goto done;
1920         }
1921
1922 done:
1923         if (err)
1924                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1925         brcmf_dbg(TRACE, "Exit\n");
1926         return err;
1927 }
1928
1929 static s32
1930 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1931 {
1932         struct brcmf_if *ifp = netdev_priv(ndev);
1933
1934         brcmf_dbg(TRACE, "Enter\n");
1935         if (!check_vif_up(ifp->vif)) {
1936                 /* When driver is being unloaded, it can end up here. If an
1937                  * error is returned then later on a debug trace in the wireless
1938                  * core module will be printed. To avoid this 0 is returned.
1939                  */
1940                 return 0;
1941         }
1942
1943         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1944         brcmf_net_setcarrier(ifp, false);
1945
1946         brcmf_dbg(TRACE, "Exit\n");
1947
1948         return 0;
1949 }
1950
1951 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1952                                  struct cfg80211_connect_params *sme)
1953 {
1954         struct brcmf_if *ifp = netdev_priv(ndev);
1955         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1956         struct brcmf_pub *drvr = ifp->drvr;
1957         struct brcmf_cfg80211_security *sec;
1958         s32 val = 0;
1959         s32 err = 0;
1960
1961         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1962                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1963         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1964                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1965         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
1966                 val = WPA3_AUTH_SAE_PSK;
1967         else
1968                 val = WPA_AUTH_DISABLED;
1969         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1970         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1971         if (err) {
1972                 bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1973                 return err;
1974         }
1975         sec = &profile->sec;
1976         sec->wpa_versions = sme->crypto.wpa_versions;
1977         return err;
1978 }
1979
1980 static s32 brcmf_set_auth_type(struct net_device *ndev,
1981                                struct cfg80211_connect_params *sme)
1982 {
1983         struct brcmf_if *ifp = netdev_priv(ndev);
1984         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1985         struct brcmf_pub *drvr = ifp->drvr;
1986         struct brcmf_cfg80211_security *sec;
1987         s32 val = 0;
1988         s32 err = 0;
1989
1990         switch (sme->auth_type) {
1991         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1992                 val = 0;
1993                 brcmf_dbg(CONN, "open system\n");
1994                 break;
1995         case NL80211_AUTHTYPE_SHARED_KEY:
1996                 val = 1;
1997                 brcmf_dbg(CONN, "shared key\n");
1998                 break;
1999         case NL80211_AUTHTYPE_SAE:
2000                 val = 3;
2001                 brcmf_dbg(CONN, "SAE authentication\n");
2002                 break;
2003         default:
2004                 val = 2;
2005                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
2006                 break;
2007         }
2008
2009         err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2010         if (err) {
2011                 bphy_err(drvr, "set auth failed (%d)\n", err);
2012                 return err;
2013         }
2014         sec = &profile->sec;
2015         sec->auth_type = sme->auth_type;
2016         return err;
2017 }
2018
2019 static s32
2020 brcmf_set_wsec_mode(struct net_device *ndev,
2021                     struct cfg80211_connect_params *sme)
2022 {
2023         struct brcmf_if *ifp = netdev_priv(ndev);
2024         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2025         struct brcmf_pub *drvr = ifp->drvr;
2026         struct brcmf_cfg80211_security *sec;
2027         s32 pval = 0;
2028         s32 gval = 0;
2029         s32 wsec;
2030         s32 err = 0;
2031
2032         if (sme->crypto.n_ciphers_pairwise) {
2033                 switch (sme->crypto.ciphers_pairwise[0]) {
2034                 case WLAN_CIPHER_SUITE_WEP40:
2035                 case WLAN_CIPHER_SUITE_WEP104:
2036                         pval = WEP_ENABLED;
2037                         break;
2038                 case WLAN_CIPHER_SUITE_TKIP:
2039                         pval = TKIP_ENABLED;
2040                         break;
2041                 case WLAN_CIPHER_SUITE_CCMP:
2042                         pval = AES_ENABLED;
2043                         break;
2044                 case WLAN_CIPHER_SUITE_AES_CMAC:
2045                         pval = AES_ENABLED;
2046                         break;
2047                 default:
2048                         bphy_err(drvr, "invalid cipher pairwise (%d)\n",
2049                                  sme->crypto.ciphers_pairwise[0]);
2050                         return -EINVAL;
2051                 }
2052         }
2053         if (sme->crypto.cipher_group) {
2054                 switch (sme->crypto.cipher_group) {
2055                 case WLAN_CIPHER_SUITE_WEP40:
2056                 case WLAN_CIPHER_SUITE_WEP104:
2057                         gval = WEP_ENABLED;
2058                         break;
2059                 case WLAN_CIPHER_SUITE_TKIP:
2060                         gval = TKIP_ENABLED;
2061                         break;
2062                 case WLAN_CIPHER_SUITE_CCMP:
2063                         gval = AES_ENABLED;
2064                         break;
2065                 case WLAN_CIPHER_SUITE_AES_CMAC:
2066                         gval = AES_ENABLED;
2067                         break;
2068                 default:
2069                         bphy_err(drvr, "invalid cipher group (%d)\n",
2070                                  sme->crypto.cipher_group);
2071                         return -EINVAL;
2072                 }
2073         }
2074
2075         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
2076         /* In case of privacy, but no security and WPS then simulate */
2077         /* setting AES. WPS-2.0 allows no security                   */
2078         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
2079             sme->privacy)
2080                 pval = AES_ENABLED;
2081
2082         wsec = pval | gval;
2083         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2084         if (err) {
2085                 bphy_err(drvr, "error (%d)\n", err);
2086                 return err;
2087         }
2088
2089         sec = &profile->sec;
2090         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
2091         sec->cipher_group = sme->crypto.cipher_group;
2092
2093         return err;
2094 }
2095
2096 static s32
2097 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
2098 {
2099         struct brcmf_if *ifp = netdev_priv(ndev);
2100         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2101         struct brcmf_pub *drvr = ifp->drvr;
2102         s32 val;
2103         s32 err;
2104         const struct brcmf_tlv *rsn_ie;
2105         const u8 *ie;
2106         u32 ie_len;
2107         u32 offset;
2108         u16 rsn_cap;
2109         u32 mfp;
2110         u16 count;
2111
2112         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2113         profile->is_ft = false;
2114
2115         if (!sme->crypto.n_akm_suites)
2116                 return 0;
2117
2118         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
2119         if (err) {
2120                 bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
2121                 return err;
2122         }
2123         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
2124                 switch (sme->crypto.akm_suites[0]) {
2125                 case WLAN_AKM_SUITE_8021X:
2126                         val = WPA_AUTH_UNSPECIFIED;
2127                         if (sme->want_1x)
2128                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2129                         break;
2130                 case WLAN_AKM_SUITE_PSK:
2131                         val = WPA_AUTH_PSK;
2132                         break;
2133                 default:
2134                         bphy_err(drvr, "invalid akm suite (%d)\n",
2135                                  sme->crypto.akm_suites[0]);
2136                         return -EINVAL;
2137                 }
2138         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
2139                 switch (sme->crypto.akm_suites[0]) {
2140                 case WLAN_AKM_SUITE_8021X:
2141                         val = WPA2_AUTH_UNSPECIFIED;
2142                         if (sme->want_1x)
2143                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2144                         break;
2145                 case WLAN_AKM_SUITE_8021X_SHA256:
2146                         val = WPA2_AUTH_1X_SHA256;
2147                         if (sme->want_1x)
2148                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2149                         break;
2150                 case WLAN_AKM_SUITE_PSK_SHA256:
2151                         val = WPA2_AUTH_PSK_SHA256;
2152                         break;
2153                 case WLAN_AKM_SUITE_PSK:
2154                         val = WPA2_AUTH_PSK;
2155                         break;
2156                 case WLAN_AKM_SUITE_FT_8021X:
2157                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
2158                         profile->is_ft = true;
2159                         if (sme->want_1x)
2160                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2161                         break;
2162                 case WLAN_AKM_SUITE_FT_PSK:
2163                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
2164                         profile->is_ft = true;
2165                         break;
2166                 default:
2167                         bphy_err(drvr, "invalid akm suite (%d)\n",
2168                                  sme->crypto.akm_suites[0]);
2169                         return -EINVAL;
2170                 }
2171         } else if (val & WPA3_AUTH_SAE_PSK) {
2172                 switch (sme->crypto.akm_suites[0]) {
2173                 case WLAN_AKM_SUITE_SAE:
2174                         val = WPA3_AUTH_SAE_PSK;
2175                         if (sme->crypto.sae_pwd) {
2176                                 brcmf_dbg(INFO, "using SAE offload\n");
2177                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2178                         }
2179                         break;
2180                 case WLAN_AKM_SUITE_FT_OVER_SAE:
2181                         val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
2182                         profile->is_ft = true;
2183                         if (sme->crypto.sae_pwd) {
2184                                 brcmf_dbg(INFO, "using SAE offload\n");
2185                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2186                         }
2187                         break;
2188                 default:
2189                         bphy_err(drvr, "invalid akm suite (%d)\n",
2190                                  sme->crypto.akm_suites[0]);
2191                         return -EINVAL;
2192                 }
2193         }
2194
2195         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
2196                 brcmf_dbg(INFO, "using 1X offload\n");
2197
2198         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2199                 goto skip_mfp_config;
2200         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
2201          * IE will not be verified, just a quick search for MFP config
2202          */
2203         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
2204                                   WLAN_EID_RSN);
2205         if (!rsn_ie)
2206                 goto skip_mfp_config;
2207         ie = (const u8 *)rsn_ie;
2208         ie_len = rsn_ie->len + TLV_HDR_LEN;
2209         /* Skip unicast suite */
2210         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
2211         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2212                 goto skip_mfp_config;
2213         /* Skip multicast suite */
2214         count = ie[offset] + (ie[offset + 1] << 8);
2215         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2216         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2217                 goto skip_mfp_config;
2218         /* Skip auth key management suite(s) */
2219         count = ie[offset] + (ie[offset + 1] << 8);
2220         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2221         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
2222                 goto skip_mfp_config;
2223         /* Ready to read capabilities */
2224         mfp = BRCMF_MFP_NONE;
2225         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
2226         if (rsn_cap & RSN_CAP_MFPR_MASK)
2227                 mfp = BRCMF_MFP_REQUIRED;
2228         else if (rsn_cap & RSN_CAP_MFPC_MASK)
2229                 mfp = BRCMF_MFP_CAPABLE;
2230         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
2231
2232 skip_mfp_config:
2233         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
2234         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
2235         if (err) {
2236                 bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
2237                 return err;
2238         }
2239
2240         return err;
2241 }
2242
2243 static s32
2244 brcmf_set_sharedkey(struct net_device *ndev,
2245                     struct cfg80211_connect_params *sme)
2246 {
2247         struct brcmf_if *ifp = netdev_priv(ndev);
2248         struct brcmf_pub *drvr = ifp->drvr;
2249         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2250         struct brcmf_cfg80211_security *sec;
2251         struct brcmf_wsec_key key;
2252         s32 val;
2253         s32 err = 0;
2254
2255         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
2256
2257         if (sme->key_len == 0)
2258                 return 0;
2259
2260         sec = &profile->sec;
2261         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
2262                   sec->wpa_versions, sec->cipher_pairwise);
2263
2264         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
2265                                  NL80211_WPA_VERSION_3))
2266                 return 0;
2267
2268         if (!(sec->cipher_pairwise &
2269             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
2270                 return 0;
2271
2272         memset(&key, 0, sizeof(key));
2273         key.len = (u32) sme->key_len;
2274         key.index = (u32) sme->key_idx;
2275         if (key.len > sizeof(key.data)) {
2276                 bphy_err(drvr, "Too long key length (%u)\n", key.len);
2277                 return -EINVAL;
2278         }
2279         memcpy(key.data, sme->key, key.len);
2280         key.flags = BRCMF_PRIMARY_KEY;
2281         switch (sec->cipher_pairwise) {
2282         case WLAN_CIPHER_SUITE_WEP40:
2283                 key.algo = CRYPTO_ALGO_WEP1;
2284                 break;
2285         case WLAN_CIPHER_SUITE_WEP104:
2286                 key.algo = CRYPTO_ALGO_WEP128;
2287                 break;
2288         default:
2289                 bphy_err(drvr, "Invalid algorithm (%d)\n",
2290                          sme->crypto.ciphers_pairwise[0]);
2291                 return -EINVAL;
2292         }
2293         /* Set the new key/index */
2294         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
2295                   key.len, key.index, key.algo);
2296         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
2297         err = send_key_to_dongle(ifp, &key);
2298         if (err)
2299                 return err;
2300
2301         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
2302                 brcmf_dbg(CONN, "set auth_type to shared key\n");
2303                 val = WL_AUTH_SHARED_KEY;       /* shared key */
2304                 err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2305                 if (err)
2306                         bphy_err(drvr, "set auth failed (%d)\n", err);
2307         }
2308         return err;
2309 }
2310
2311 static
2312 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
2313                                            enum nl80211_auth_type type)
2314 {
2315         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
2316             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
2317                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
2318                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2319         }
2320         return type;
2321 }
2322
2323 static void brcmf_set_join_pref(struct brcmf_if *ifp,
2324                                 struct cfg80211_bss_selection *bss_select)
2325 {
2326         struct brcmf_pub *drvr = ifp->drvr;
2327         struct brcmf_join_pref_params join_pref_params[2];
2328         enum nl80211_band band;
2329         int err, i = 0;
2330
2331         join_pref_params[i].len = 2;
2332         join_pref_params[i].rssi_gain = 0;
2333
2334         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
2335                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
2336
2337         switch (bss_select->behaviour) {
2338         case __NL80211_BSS_SELECT_ATTR_INVALID:
2339                 brcmf_c_set_joinpref_default(ifp);
2340                 return;
2341         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
2342                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
2343                 band = bss_select->param.band_pref;
2344                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2345                 i++;
2346                 break;
2347         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2348                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2349                 band = bss_select->param.adjust.band;
2350                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2351                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2352                 i++;
2353                 break;
2354         case NL80211_BSS_SELECT_ATTR_RSSI:
2355         default:
2356                 break;
2357         }
2358         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2359         join_pref_params[i].len = 2;
2360         join_pref_params[i].rssi_gain = 0;
2361         join_pref_params[i].band = 0;
2362         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2363                                        sizeof(join_pref_params));
2364         if (err)
2365                 bphy_err(drvr, "Set join_pref error (%d)\n", err);
2366 }
2367
2368 static s32
2369 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2370                        struct cfg80211_connect_params *sme)
2371 {
2372         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2373         struct brcmf_if *ifp = netdev_priv(ndev);
2374         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2375         struct ieee80211_channel *chan = sme->channel;
2376         struct brcmf_pub *drvr = ifp->drvr;
2377         struct brcmf_join_params join_params;
2378         size_t join_params_size;
2379         const struct brcmf_tlv *rsn_ie;
2380         const struct brcmf_vs_tlv *wpa_ie;
2381         const void *ie;
2382         u32 ie_len;
2383         struct brcmf_ext_join_params_le *ext_join_params;
2384         u16 chanspec;
2385         s32 err = 0;
2386         u32 ssid_len;
2387
2388         brcmf_dbg(TRACE, "Enter\n");
2389         if (!check_vif_up(ifp->vif))
2390                 return -EIO;
2391
2392         if (!sme->ssid) {
2393                 bphy_err(drvr, "Invalid ssid\n");
2394                 return -EOPNOTSUPP;
2395         }
2396
2397         if (sme->channel_hint)
2398                 chan = sme->channel_hint;
2399
2400         if (sme->bssid_hint)
2401                 sme->bssid = sme->bssid_hint;
2402
2403         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2404                 /* A normal (non P2P) connection request setup. */
2405                 ie = NULL;
2406                 ie_len = 0;
2407                 /* find the WPA_IE */
2408                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2409                 if (wpa_ie) {
2410                         ie = wpa_ie;
2411                         ie_len = wpa_ie->len + TLV_HDR_LEN;
2412                 } else {
2413                         /* find the RSN_IE */
2414                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2415                                                   sme->ie_len,
2416                                                   WLAN_EID_RSN);
2417                         if (rsn_ie) {
2418                                 ie = rsn_ie;
2419                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
2420                         }
2421                 }
2422                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2423         }
2424
2425         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2426                                     sme->ie, sme->ie_len);
2427         if (err)
2428                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2429         else
2430                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2431
2432         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2433
2434         if (chan) {
2435                 cfg->channel =
2436                         ieee80211_frequency_to_channel(chan->center_freq);
2437                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2438                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2439                           cfg->channel, chan->center_freq, chanspec);
2440         } else {
2441                 cfg->channel = 0;
2442                 chanspec = 0;
2443         }
2444
2445         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2446
2447         err = brcmf_set_wpa_version(ndev, sme);
2448         if (err) {
2449                 bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2450                 goto done;
2451         }
2452
2453         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2454         err = brcmf_set_auth_type(ndev, sme);
2455         if (err) {
2456                 bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2457                 goto done;
2458         }
2459
2460         err = brcmf_set_wsec_mode(ndev, sme);
2461         if (err) {
2462                 bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2463                 goto done;
2464         }
2465
2466         err = brcmf_set_key_mgmt(ndev, sme);
2467         if (err) {
2468                 bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2469                 goto done;
2470         }
2471
2472         err = brcmf_set_sharedkey(ndev, sme);
2473         if (err) {
2474                 bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2475                 goto done;
2476         }
2477
2478         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
2479                 if (sme->crypto.psk) {
2480                         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2481                                 if (WARN_ON(profile->use_fwsup !=
2482                                         BRCMF_PROFILE_FWSUP_NONE)) {
2483                                         err = -EINVAL;
2484                                         goto done;
2485                                 }
2486                                 brcmf_dbg(INFO, "using PSK offload\n");
2487                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2488                         }
2489                 } else {
2490                         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2491                 }
2492
2493                 if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2494                         /* enable firmware supplicant for this interface */
2495                         err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2496                         if (err < 0) {
2497                                 bphy_err(drvr, "failed to enable fw supplicant\n");
2498                                 goto done;
2499                         }
2500                 } else {
2501                         err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
2502                 }
2503
2504                 if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2505                         err = brcmf_set_pmk(ifp, sme->crypto.psk,
2506                                             BRCMF_WSEC_MAX_PSK_LEN);
2507                 else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2508                         /* clean up user-space RSNE */
2509                         if (brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0)) {
2510                                 bphy_err(drvr, "failed to clean up user-space RSNE\n");
2511                                 goto done;
2512                         }
2513                         err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
2514                                                      sme->crypto.sae_pwd_len);
2515                         if (!err && sme->crypto.psk)
2516                                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2517                                                     BRCMF_WSEC_MAX_PSK_LEN);
2518                 }
2519                 if (err)
2520                         goto done;
2521         }
2522         /* Join with specific BSSID and cached SSID
2523          * If SSID is zero join based on BSSID only
2524          */
2525         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2526                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2527         if (cfg->channel)
2528                 join_params_size += sizeof(u16);
2529         ext_join_params = kzalloc(sizeof(*ext_join_params), GFP_KERNEL);
2530         if (ext_join_params == NULL) {
2531                 err = -ENOMEM;
2532                 goto done;
2533         }
2534         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2535         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2536         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2537         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2538                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2539                           ext_join_params->ssid_le.SSID, ssid_len);
2540
2541         /* Set up join scan parameters */
2542         ext_join_params->scan_le.scan_type = -1;
2543         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2544
2545         if (sme->bssid)
2546                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2547         else
2548                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2549
2550         if (cfg->channel) {
2551                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2552
2553                 ext_join_params->assoc_le.chanspec_list[0] =
2554                         cpu_to_le16(chanspec);
2555                 /* Increase dwell time to receive probe response or detect
2556                  * beacon from target AP at a noisy air only during connect
2557                  * command.
2558                  */
2559                 ext_join_params->scan_le.active_time =
2560                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2561                 ext_join_params->scan_le.passive_time =
2562                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2563                 /* To sync with presence period of VSDB GO send probe request
2564                  * more frequently. Probe request will be stopped when it gets
2565                  * probe response from target AP/GO.
2566                  */
2567                 ext_join_params->scan_le.nprobes =
2568                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2569                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2570         } else {
2571                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2572                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2573                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2574         }
2575
2576         brcmf_set_join_pref(ifp, &sme->bss_select);
2577
2578         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2579                                          join_params_size);
2580         kfree(ext_join_params);
2581         if (!err)
2582                 /* This is it. join command worked, we are done */
2583                 goto done;
2584
2585         /* join command failed, fallback to set ssid */
2586         memset(&join_params, 0, sizeof(join_params));
2587         join_params_size = sizeof(join_params.ssid_le);
2588
2589         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2590         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2591
2592         if (sme->bssid)
2593                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2594         else
2595                 eth_broadcast_addr(join_params.params_le.bssid);
2596
2597         if (cfg->channel) {
2598                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2599                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2600                 join_params_size += sizeof(join_params.params_le);
2601         }
2602         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2603                                      &join_params, join_params_size);
2604         if (err)
2605                 bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2606
2607 done:
2608         if (err)
2609                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2610         brcmf_dbg(TRACE, "Exit\n");
2611         return err;
2612 }
2613
2614 static s32
2615 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2616                        u16 reason_code)
2617 {
2618         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2619         struct brcmf_if *ifp = netdev_priv(ndev);
2620         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2621         struct brcmf_pub *drvr = cfg->pub;
2622         struct brcmf_scb_val_le scbval;
2623         s32 err = 0;
2624
2625         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2626         if (!check_vif_up(ifp->vif))
2627                 return -EIO;
2628
2629         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2630         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2631         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &ifp->vif->sme_state);
2632         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &ifp->vif->sme_state);
2633         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2634
2635         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2636         scbval.val = cpu_to_le32(reason_code);
2637         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2638                                      &scbval, sizeof(scbval));
2639         if (err)
2640                 bphy_err(drvr, "error (%d)\n", err);
2641
2642         brcmf_dbg(TRACE, "Exit\n");
2643         return err;
2644 }
2645
2646 static s32
2647 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2648                             enum nl80211_tx_power_setting type, s32 mbm)
2649 {
2650         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2651         struct net_device *ndev = cfg_to_ndev(cfg);
2652         struct brcmf_if *ifp = netdev_priv(ndev);
2653         struct brcmf_pub *drvr = cfg->pub;
2654         s32 err;
2655         s32 disable;
2656         u32 qdbm = 127;
2657
2658         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2659         if (!check_vif_up(ifp->vif))
2660                 return -EIO;
2661
2662         switch (type) {
2663         case NL80211_TX_POWER_AUTOMATIC:
2664                 break;
2665         case NL80211_TX_POWER_LIMITED:
2666         case NL80211_TX_POWER_FIXED:
2667                 if (mbm < 0) {
2668                         bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2669                         err = -EINVAL;
2670                         goto done;
2671                 }
2672                 qdbm =  MBM_TO_DBM(4 * mbm);
2673                 if (qdbm > 127)
2674                         qdbm = 127;
2675                 qdbm |= WL_TXPWR_OVERRIDE;
2676                 break;
2677         default:
2678                 bphy_err(drvr, "Unsupported type %d\n", type);
2679                 err = -EINVAL;
2680                 goto done;
2681         }
2682         /* Make sure radio is off or on as far as software is concerned */
2683         disable = WL_RADIO_SW_DISABLE << 16;
2684         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2685         if (err)
2686                 bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2687
2688         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2689         if (err)
2690                 bphy_err(drvr, "qtxpower error (%d)\n", err);
2691
2692 done:
2693         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2694         return err;
2695 }
2696
2697 static s32
2698 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2699                             s32 *dbm)
2700 {
2701         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2702         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2703         struct brcmf_pub *drvr = cfg->pub;
2704         s32 qdbm = 0;
2705         s32 err;
2706
2707         brcmf_dbg(TRACE, "Enter\n");
2708         if (!check_vif_up(vif))
2709                 return -EIO;
2710
2711         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2712         if (err) {
2713                 bphy_err(drvr, "error (%d)\n", err);
2714                 goto done;
2715         }
2716         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2717
2718 done:
2719         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2720         return err;
2721 }
2722
2723 static s32
2724 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2725                                   int link_id, u8 key_idx, bool unicast,
2726                                   bool multicast)
2727 {
2728         struct brcmf_if *ifp = netdev_priv(ndev);
2729         struct brcmf_pub *drvr = ifp->drvr;
2730         u32 index;
2731         u32 wsec;
2732         s32 err = 0;
2733
2734         brcmf_dbg(TRACE, "Enter\n");
2735         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2736         if (!check_vif_up(ifp->vif))
2737                 return -EIO;
2738
2739         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2740         if (err) {
2741                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2742                 goto done;
2743         }
2744
2745         if (wsec & WEP_ENABLED) {
2746                 /* Just select a new current key */
2747                 index = key_idx;
2748                 err = brcmf_fil_cmd_int_set(ifp,
2749                                             BRCMF_C_SET_KEY_PRIMARY, index);
2750                 if (err)
2751                         bphy_err(drvr, "error (%d)\n", err);
2752         }
2753 done:
2754         brcmf_dbg(TRACE, "Exit\n");
2755         return err;
2756 }
2757
2758 static s32
2759 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2760                        int link_id, u8 key_idx, bool pairwise,
2761                        const u8 *mac_addr)
2762 {
2763         struct brcmf_if *ifp = netdev_priv(ndev);
2764         struct brcmf_wsec_key *key;
2765         s32 err;
2766
2767         brcmf_dbg(TRACE, "Enter\n");
2768         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2769
2770         if (!check_vif_up(ifp->vif))
2771                 return -EIO;
2772
2773         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2774                 /* we ignore this key index in this case */
2775                 return -EINVAL;
2776         }
2777
2778         key = &ifp->vif->profile.key[key_idx];
2779
2780         if (key->algo == CRYPTO_ALGO_OFF) {
2781                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2782                 return -EINVAL;
2783         }
2784
2785         memset(key, 0, sizeof(*key));
2786         key->index = (u32)key_idx;
2787         key->flags = BRCMF_PRIMARY_KEY;
2788
2789         /* Clear the key/index */
2790         err = send_key_to_dongle(ifp, key);
2791
2792         brcmf_dbg(TRACE, "Exit\n");
2793         return err;
2794 }
2795
2796 static s32
2797 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2798                        int link_id, u8 key_idx, bool pairwise,
2799                        const u8 *mac_addr, struct key_params *params)
2800 {
2801         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2802         struct brcmf_if *ifp = netdev_priv(ndev);
2803         struct brcmf_pub *drvr = cfg->pub;
2804         struct brcmf_wsec_key *key;
2805         s32 val;
2806         s32 wsec;
2807         s32 err;
2808         u8 keybuf[8];
2809         bool ext_key;
2810
2811         brcmf_dbg(TRACE, "Enter\n");
2812         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2813         if (!check_vif_up(ifp->vif))
2814                 return -EIO;
2815
2816         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2817                 /* we ignore this key index in this case */
2818                 bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2819                 return -EINVAL;
2820         }
2821
2822         if (params->key_len == 0)
2823                 return brcmf_cfg80211_del_key(wiphy, ndev, -1, key_idx,
2824                                               pairwise, mac_addr);
2825
2826         if (params->key_len > sizeof(key->data)) {
2827                 bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2828                 return -EINVAL;
2829         }
2830
2831         ext_key = false;
2832         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2833             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2834                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2835                 ext_key = true;
2836         }
2837
2838         key = &ifp->vif->profile.key[key_idx];
2839         memset(key, 0, sizeof(*key));
2840         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2841                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2842         key->len = params->key_len;
2843         key->index = key_idx;
2844         memcpy(key->data, params->key, key->len);
2845         if (!ext_key)
2846                 key->flags = BRCMF_PRIMARY_KEY;
2847
2848         if (params->seq && params->seq_len == 6) {
2849                 /* rx iv */
2850                 u8 *ivptr;
2851
2852                 ivptr = (u8 *)params->seq;
2853                 key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2854                         (ivptr[3] << 8) | ivptr[2];
2855                 key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2856                 key->iv_initialized = true;
2857         }
2858
2859         switch (params->cipher) {
2860         case WLAN_CIPHER_SUITE_WEP40:
2861                 key->algo = CRYPTO_ALGO_WEP1;
2862                 val = WEP_ENABLED;
2863                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2864                 break;
2865         case WLAN_CIPHER_SUITE_WEP104:
2866                 key->algo = CRYPTO_ALGO_WEP128;
2867                 val = WEP_ENABLED;
2868                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2869                 break;
2870         case WLAN_CIPHER_SUITE_TKIP:
2871                 if (!brcmf_is_apmode(ifp->vif)) {
2872                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2873                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2874                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2875                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2876                 }
2877                 key->algo = CRYPTO_ALGO_TKIP;
2878                 val = TKIP_ENABLED;
2879                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2880                 break;
2881         case WLAN_CIPHER_SUITE_AES_CMAC:
2882                 key->algo = CRYPTO_ALGO_AES_CCM;
2883                 val = AES_ENABLED;
2884                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2885                 break;
2886         case WLAN_CIPHER_SUITE_CCMP:
2887                 key->algo = CRYPTO_ALGO_AES_CCM;
2888                 val = AES_ENABLED;
2889                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2890                 break;
2891         default:
2892                 bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2893                 err = -EINVAL;
2894                 goto done;
2895         }
2896
2897         err = send_key_to_dongle(ifp, key);
2898         if (ext_key || err)
2899                 goto done;
2900
2901         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2902         if (err) {
2903                 bphy_err(drvr, "get wsec error (%d)\n", err);
2904                 goto done;
2905         }
2906         wsec |= val;
2907         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2908         if (err) {
2909                 bphy_err(drvr, "set wsec error (%d)\n", err);
2910                 goto done;
2911         }
2912
2913 done:
2914         brcmf_dbg(TRACE, "Exit\n");
2915         return err;
2916 }
2917
2918 static s32
2919 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2920                        int link_id, u8 key_idx, bool pairwise,
2921                        const u8 *mac_addr, void *cookie,
2922                        void (*callback)(void *cookie,
2923                                         struct key_params *params))
2924 {
2925         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2926         struct key_params params;
2927         struct brcmf_if *ifp = netdev_priv(ndev);
2928         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2929         struct brcmf_pub *drvr = cfg->pub;
2930         struct brcmf_cfg80211_security *sec;
2931         s32 wsec;
2932         s32 err = 0;
2933
2934         brcmf_dbg(TRACE, "Enter\n");
2935         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2936         if (!check_vif_up(ifp->vif))
2937                 return -EIO;
2938
2939         memset(&params, 0, sizeof(params));
2940
2941         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2942         if (err) {
2943                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2944                 /* Ignore this error, may happen during DISASSOC */
2945                 err = -EAGAIN;
2946                 goto done;
2947         }
2948         if (wsec & WEP_ENABLED) {
2949                 sec = &profile->sec;
2950                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2951                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2952                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2953                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2954                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2955                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2956                 }
2957         } else if (wsec & TKIP_ENABLED) {
2958                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2959                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2960         } else if (wsec & AES_ENABLED) {
2961                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2962                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2963         } else  {
2964                 bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2965                 err = -EINVAL;
2966                 goto done;
2967         }
2968         callback(cookie, &params);
2969
2970 done:
2971         brcmf_dbg(TRACE, "Exit\n");
2972         return err;
2973 }
2974
2975 static s32
2976 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2977                                        struct net_device *ndev, int link_id,
2978                                        u8 key_idx)
2979 {
2980         struct brcmf_if *ifp = netdev_priv(ndev);
2981
2982         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2983
2984         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2985                 return 0;
2986
2987         brcmf_dbg(INFO, "Not supported\n");
2988
2989         return -EOPNOTSUPP;
2990 }
2991
2992 static void
2993 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2994 {
2995         struct brcmf_pub *drvr = ifp->drvr;
2996         s32 err;
2997         u8 key_idx;
2998         struct brcmf_wsec_key *key;
2999         s32 wsec;
3000
3001         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
3002                 key = &ifp->vif->profile.key[key_idx];
3003                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
3004                     (key->algo == CRYPTO_ALGO_WEP128))
3005                         break;
3006         }
3007         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
3008                 return;
3009
3010         err = send_key_to_dongle(ifp, key);
3011         if (err) {
3012                 bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
3013                 return;
3014         }
3015         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
3016         if (err) {
3017                 bphy_err(drvr, "get wsec error (%d)\n", err);
3018                 return;
3019         }
3020         wsec |= WEP_ENABLED;
3021         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3022         if (err)
3023                 bphy_err(drvr, "set wsec error (%d)\n", err);
3024 }
3025
3026 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
3027 {
3028         struct nl80211_sta_flag_update *sfu;
3029
3030         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
3031         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
3032         sfu = &si->sta_flags;
3033         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
3034                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3035                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
3036                     BIT(NL80211_STA_FLAG_AUTHORIZED);
3037         if (fw_sta_flags & BRCMF_STA_WME)
3038                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
3039         if (fw_sta_flags & BRCMF_STA_AUTHE)
3040                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3041         if (fw_sta_flags & BRCMF_STA_ASSOC)
3042                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3043         if (fw_sta_flags & BRCMF_STA_AUTHO)
3044                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3045 }
3046
3047 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
3048 {
3049         struct brcmf_pub *drvr = ifp->drvr;
3050         struct {
3051                 __le32 len;
3052                 struct brcmf_bss_info_le bss_le;
3053         } *buf;
3054         u16 capability;
3055         int err;
3056
3057         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3058         if (!buf)
3059                 return;
3060
3061         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
3062         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
3063                                      WL_BSS_INFO_MAX);
3064         if (err) {
3065                 bphy_err(drvr, "Failed to get bss info (%d)\n", err);
3066                 goto out_kfree;
3067         }
3068         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
3069         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
3070         si->bss_param.dtim_period = buf->bss_le.dtim_period;
3071         capability = le16_to_cpu(buf->bss_le.capability);
3072         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
3073                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
3074         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3075                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
3076         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
3077                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
3078
3079 out_kfree:
3080         kfree(buf);
3081 }
3082
3083 static s32
3084 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
3085                                 struct station_info *sinfo)
3086 {
3087         struct brcmf_pub *drvr = ifp->drvr;
3088         struct brcmf_scb_val_le scbval;
3089         struct brcmf_pktcnt_le pktcnt;
3090         s32 err;
3091         u32 rate;
3092         u32 rssi;
3093
3094         /* Get the current tx rate */
3095         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
3096         if (err < 0) {
3097                 bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
3098                 return err;
3099         }
3100         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3101         sinfo->txrate.legacy = rate * 5;
3102
3103         memset(&scbval, 0, sizeof(scbval));
3104         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
3105                                      sizeof(scbval));
3106         if (err) {
3107                 bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
3108                 return err;
3109         }
3110         rssi = le32_to_cpu(scbval.val);
3111         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3112         sinfo->signal = rssi;
3113
3114         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
3115                                      sizeof(pktcnt));
3116         if (err) {
3117                 bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
3118                 return err;
3119         }
3120         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
3121                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
3122                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
3123                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3124         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
3125         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
3126         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
3127         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
3128
3129         return 0;
3130 }
3131
3132 static s32
3133 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
3134                            const u8 *mac, struct station_info *sinfo)
3135 {
3136         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3137         struct brcmf_if *ifp = netdev_priv(ndev);
3138         struct brcmf_pub *drvr = cfg->pub;
3139         struct brcmf_scb_val_le scb_val;
3140         s32 err = 0;
3141         struct brcmf_sta_info_le sta_info_le;
3142         u32 sta_flags;
3143         u32 is_tdls_peer;
3144         s32 total_rssi_avg = 0;
3145         s32 total_rssi = 0;
3146         s32 count_rssi = 0;
3147         int rssi;
3148         u32 i;
3149
3150         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
3151         if (!check_vif_up(ifp->vif))
3152                 return -EIO;
3153
3154         if (brcmf_is_ibssmode(ifp->vif))
3155                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
3156
3157         memset(&sta_info_le, 0, sizeof(sta_info_le));
3158         memcpy(&sta_info_le, mac, ETH_ALEN);
3159         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
3160                                        &sta_info_le,
3161                                        sizeof(sta_info_le));
3162         is_tdls_peer = !err;
3163         if (err) {
3164                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
3165                                                &sta_info_le,
3166                                                sizeof(sta_info_le));
3167                 if (err < 0) {
3168                         bphy_err(drvr, "GET STA INFO failed, %d\n", err);
3169                         goto done;
3170                 }
3171         }
3172         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
3173         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
3174         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
3175         sta_flags = le32_to_cpu(sta_info_le.flags);
3176         brcmf_convert_sta_flags(sta_flags, sinfo);
3177         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3178         if (is_tdls_peer)
3179                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3180         else
3181                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3182         if (sta_flags & BRCMF_STA_ASSOC) {
3183                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
3184                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
3185                 brcmf_fill_bss_param(ifp, sinfo);
3186         }
3187         if (sta_flags & BRCMF_STA_SCBSTATS) {
3188                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3189                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
3190                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
3191                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
3192                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
3193                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
3194                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
3195                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
3196                 if (sinfo->tx_packets) {
3197                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3198                         sinfo->txrate.legacy =
3199                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
3200                 }
3201                 if (sinfo->rx_packets) {
3202                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
3203                         sinfo->rxrate.legacy =
3204                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
3205                 }
3206                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
3207                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
3208                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
3209                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
3210                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
3211                 }
3212                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
3213                         if (sta_info_le.rssi[i] == 0 ||
3214                             sta_info_le.rx_lastpkt_rssi[i] == 0)
3215                                 continue;
3216                         sinfo->chains |= BIT(count_rssi);
3217                         sinfo->chain_signal[count_rssi] =
3218                                 sta_info_le.rx_lastpkt_rssi[i];
3219                         sinfo->chain_signal_avg[count_rssi] =
3220                                 sta_info_le.rssi[i];
3221                         total_rssi += sta_info_le.rx_lastpkt_rssi[i];
3222                         total_rssi_avg += sta_info_le.rssi[i];
3223                         count_rssi++;
3224                 }
3225                 if (count_rssi) {
3226                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3227                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
3228                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
3229                         sinfo->filled |=
3230                                 BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
3231                         sinfo->signal = total_rssi / count_rssi;
3232                         sinfo->signal_avg = total_rssi_avg / count_rssi;
3233                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
3234                         &ifp->vif->sme_state)) {
3235                         memset(&scb_val, 0, sizeof(scb_val));
3236                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
3237                                                      &scb_val, sizeof(scb_val));
3238                         if (err) {
3239                                 bphy_err(drvr, "Could not get rssi (%d)\n",
3240                                          err);
3241                                 goto done;
3242                         } else {
3243                                 rssi = le32_to_cpu(scb_val.val);
3244                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3245                                 sinfo->signal = rssi;
3246                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
3247                         }
3248                 }
3249         }
3250 done:
3251         brcmf_dbg(TRACE, "Exit\n");
3252         return err;
3253 }
3254
3255 static int
3256 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
3257                             int idx, u8 *mac, struct station_info *sinfo)
3258 {
3259         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3260         struct brcmf_if *ifp = netdev_priv(ndev);
3261         struct brcmf_pub *drvr = cfg->pub;
3262         s32 err;
3263
3264         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
3265
3266         if (idx == 0) {
3267                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
3268                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
3269                                              &cfg->assoclist,
3270                                              sizeof(cfg->assoclist));
3271                 if (err) {
3272                         /* GET_ASSOCLIST unsupported by firmware of older chips */
3273                         if (err == -EBADE)
3274                                 bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
3275                         else
3276                                 bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
3277                                          err);
3278
3279                         cfg->assoclist.count = 0;
3280                         return -EOPNOTSUPP;
3281                 }
3282         }
3283         if (idx < le32_to_cpu(cfg->assoclist.count)) {
3284                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
3285                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
3286         }
3287         return -ENOENT;
3288 }
3289
3290 static s32
3291 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
3292                            bool enabled, s32 timeout)
3293 {
3294         s32 pm;
3295         s32 err = 0;
3296         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3297         struct brcmf_if *ifp = netdev_priv(ndev);
3298         struct brcmf_pub *drvr = cfg->pub;
3299
3300         brcmf_dbg(TRACE, "Enter\n");
3301
3302         /*
3303          * Powersave enable/disable request is coming from the
3304          * cfg80211 even before the interface is up. In that
3305          * scenario, driver will be storing the power save
3306          * preference in cfg struct to apply this to
3307          * FW later while initializing the dongle
3308          */
3309         cfg->pwr_save = enabled;
3310         if (!check_vif_up(ifp->vif)) {
3311
3312                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
3313                 goto done;
3314         }
3315
3316         pm = enabled ? PM_FAST : PM_OFF;
3317         /* Do not enable the power save after assoc if it is a p2p interface */
3318         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
3319                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
3320                 pm = PM_OFF;
3321         }
3322         brcmf_info("power save %s\n", (pm ? "enabled" : "disabled"));
3323
3324         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
3325         if (err) {
3326                 if (err == -ENODEV)
3327                         bphy_err(drvr, "net_device is not ready yet\n");
3328                 else
3329                         bphy_err(drvr, "error (%d)\n", err);
3330         }
3331
3332         timeout = 2000; /* 2000ms - the maximum */
3333         err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
3334                                 min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
3335         if (err)
3336                 bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
3337
3338 done:
3339         brcmf_dbg(TRACE, "Exit\n");
3340         return err;
3341 }
3342
3343 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
3344                                    struct brcmf_bss_info_le *bi)
3345 {
3346         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3347         struct brcmf_pub *drvr = cfg->pub;
3348         struct cfg80211_bss *bss;
3349         enum nl80211_band band;
3350         struct brcmu_chan ch;
3351         u16 channel;
3352         u32 freq;
3353         u16 notify_capability;
3354         u16 notify_interval;
3355         u8 *notify_ie;
3356         size_t notify_ielen;
3357         struct cfg80211_inform_bss bss_data = {};
3358
3359         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
3360                 bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
3361                 return -EINVAL;
3362         }
3363
3364         if (!bi->ctl_ch) {
3365                 ch.chspec = le16_to_cpu(bi->chanspec);
3366                 cfg->d11inf.decchspec(&ch);
3367                 bi->ctl_ch = ch.control_ch_num;
3368         }
3369         channel = bi->ctl_ch;
3370
3371         if (channel <= CH_MAX_2G_CHANNEL)
3372                 band = NL80211_BAND_2GHZ;
3373         else
3374                 band = NL80211_BAND_5GHZ;
3375
3376         freq = ieee80211_channel_to_frequency(channel, band);
3377         bss_data.chan = ieee80211_get_channel(wiphy, freq);
3378         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3379         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3380
3381         notify_capability = le16_to_cpu(bi->capability);
3382         notify_interval = le16_to_cpu(bi->beacon_period);
3383         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3384         notify_ielen = le32_to_cpu(bi->ie_length);
3385         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3386
3387         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3388         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3389         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3390         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3391         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3392
3393         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3394                                        CFG80211_BSS_FTYPE_UNKNOWN,
3395                                        (const u8 *)bi->BSSID,
3396                                        0, notify_capability,
3397                                        notify_interval, notify_ie,
3398                                        notify_ielen, GFP_KERNEL);
3399
3400         if (!bss)
3401                 return -ENOMEM;
3402
3403         cfg80211_put_bss(wiphy, bss);
3404
3405         return 0;
3406 }
3407
3408 static struct brcmf_bss_info_le *
3409 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3410 {
3411         if (bss == NULL)
3412                 return list->bss_info_le;
3413         return (struct brcmf_bss_info_le *)((unsigned long)bss +
3414                                             le32_to_cpu(bss->length));
3415 }
3416
3417 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3418 {
3419         struct brcmf_pub *drvr = cfg->pub;
3420         struct brcmf_scan_results *bss_list;
3421         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
3422         s32 err = 0;
3423         int i;
3424
3425         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3426         if (bss_list->count != 0 &&
3427             bss_list->version != BRCMF_BSS_INFO_VERSION) {
3428                 bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3429                          bss_list->version);
3430                 return -EOPNOTSUPP;
3431         }
3432         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3433         for (i = 0; i < bss_list->count; i++) {
3434                 bi = next_bss_le(bss_list, bi);
3435                 err = brcmf_inform_single_bss(cfg, bi);
3436                 if (err)
3437                         break;
3438         }
3439         return err;
3440 }
3441
3442 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3443                              struct net_device *ndev, const u8 *bssid)
3444 {
3445         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3446         struct brcmf_pub *drvr = cfg->pub;
3447         struct ieee80211_channel *notify_channel;
3448         struct brcmf_bss_info_le *bi = NULL;
3449         struct ieee80211_supported_band *band;
3450         struct cfg80211_bss *bss;
3451         struct brcmu_chan ch;
3452         u8 *buf = NULL;
3453         s32 err = 0;
3454         u32 freq;
3455         u16 notify_capability;
3456         u16 notify_interval;
3457         u8 *notify_ie;
3458         size_t notify_ielen;
3459         s32 notify_signal;
3460
3461         brcmf_dbg(TRACE, "Enter\n");
3462
3463         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3464         if (buf == NULL) {
3465                 err = -ENOMEM;
3466                 goto CleanUp;
3467         }
3468
3469         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3470
3471         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3472                                      buf, WL_BSS_INFO_MAX);
3473         if (err) {
3474                 bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3475                 goto CleanUp;
3476         }
3477
3478         bi = (struct brcmf_bss_info_le *)(buf + 4);
3479
3480         ch.chspec = le16_to_cpu(bi->chanspec);
3481         cfg->d11inf.decchspec(&ch);
3482
3483         if (ch.band == BRCMU_CHAN_BAND_2G)
3484                 band = wiphy->bands[NL80211_BAND_2GHZ];
3485         else
3486                 band = wiphy->bands[NL80211_BAND_5GHZ];
3487
3488         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3489         cfg->channel = freq;
3490         notify_channel = ieee80211_get_channel(wiphy, freq);
3491
3492         notify_capability = le16_to_cpu(bi->capability);
3493         notify_interval = le16_to_cpu(bi->beacon_period);
3494         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3495         notify_ielen = le32_to_cpu(bi->ie_length);
3496         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3497
3498         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3499         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3500         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3501         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3502
3503         bss = cfg80211_inform_bss(wiphy, notify_channel,
3504                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3505                                   notify_capability, notify_interval,
3506                                   notify_ie, notify_ielen, notify_signal,
3507                                   GFP_KERNEL);
3508
3509         if (!bss) {
3510                 err = -ENOMEM;
3511                 goto CleanUp;
3512         }
3513
3514         cfg80211_put_bss(wiphy, bss);
3515
3516 CleanUp:
3517
3518         kfree(buf);
3519
3520         brcmf_dbg(TRACE, "Exit\n");
3521
3522         return err;
3523 }
3524
3525 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3526                                  struct brcmf_if *ifp)
3527 {
3528         struct brcmf_pub *drvr = cfg->pub;
3529         struct brcmf_bss_info_le *bi = NULL;
3530         s32 err = 0;
3531
3532         brcmf_dbg(TRACE, "Enter\n");
3533         if (brcmf_is_ibssmode(ifp->vif))
3534                 return err;
3535
3536         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3537         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3538                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3539         if (err) {
3540                 bphy_err(drvr, "Could not get bss info %d\n", err);
3541                 goto update_bss_info_out;
3542         }
3543         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3544         err = brcmf_inform_single_bss(cfg, bi);
3545
3546 update_bss_info_out:
3547         brcmf_dbg(TRACE, "Exit");
3548         return err;
3549 }
3550
3551 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3552 {
3553         struct escan_info *escan = &cfg->escan_info;
3554
3555         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3556         if (cfg->int_escan_map || cfg->scan_request) {
3557                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3558                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3559         }
3560         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3561         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3562 }
3563
3564 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3565 {
3566         struct brcmf_cfg80211_info *cfg =
3567                         container_of(work, struct brcmf_cfg80211_info,
3568                                      escan_timeout_work);
3569
3570         brcmf_inform_bss(cfg);
3571         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3572 }
3573
3574 static void brcmf_escan_timeout(struct timer_list *t)
3575 {
3576         struct brcmf_cfg80211_info *cfg =
3577                         from_timer(cfg, t, escan_timeout);
3578         struct brcmf_pub *drvr = cfg->pub;
3579
3580         if (cfg->int_escan_map || cfg->scan_request) {
3581                 bphy_err(drvr, "timer expired\n");
3582                 schedule_work(&cfg->escan_timeout_work);
3583         }
3584 }
3585
3586 static s32
3587 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3588                               struct brcmf_bss_info_le *bss,
3589                               struct brcmf_bss_info_le *bss_info_le)
3590 {
3591         struct brcmu_chan ch_bss, ch_bss_info_le;
3592
3593         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3594         cfg->d11inf.decchspec(&ch_bss);
3595         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3596         cfg->d11inf.decchspec(&ch_bss_info_le);
3597
3598         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3599                 ch_bss.band == ch_bss_info_le.band &&
3600                 bss_info_le->SSID_len == bss->SSID_len &&
3601                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3602                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3603                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3604                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3605                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3606
3607                         /* preserve max RSSI if the measurements are
3608                         * both on-channel or both off-channel
3609                         */
3610                         if (bss_info_rssi > bss_rssi)
3611                                 bss->RSSI = bss_info_le->RSSI;
3612                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3613                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3614                         /* preserve the on-channel rssi measurement
3615                         * if the new measurement is off channel
3616                         */
3617                         bss->RSSI = bss_info_le->RSSI;
3618                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3619                 }
3620                 return 1;
3621         }
3622         return 0;
3623 }
3624
3625 static s32
3626 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3627                              const struct brcmf_event_msg *e, void *data)
3628 {
3629         struct brcmf_pub *drvr = ifp->drvr;
3630         struct brcmf_cfg80211_info *cfg = drvr->config;
3631         s32 status;
3632         struct brcmf_escan_result_le *escan_result_le;
3633         u32 escan_buflen;
3634         struct brcmf_bss_info_le *bss_info_le;
3635         struct brcmf_bss_info_le *bss = NULL;
3636         u32 bi_length;
3637         struct brcmf_scan_results *list;
3638         u32 i;
3639         bool aborted;
3640
3641         status = e->status;
3642
3643         if (status == BRCMF_E_STATUS_ABORT)
3644                 goto exit;
3645
3646         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3647                 bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3648                          ifp->bsscfgidx);
3649                 return -EPERM;
3650         }
3651
3652         if (status == BRCMF_E_STATUS_PARTIAL) {
3653                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3654                 if (e->datalen < sizeof(*escan_result_le)) {
3655                         bphy_err(drvr, "invalid event data length\n");
3656                         goto exit;
3657                 }
3658                 escan_result_le = (struct brcmf_escan_result_le *) data;
3659                 if (!escan_result_le) {
3660                         bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3661                         goto exit;
3662                 }
3663                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3664                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3665                     escan_buflen > e->datalen ||
3666                     escan_buflen < sizeof(*escan_result_le)) {
3667                         bphy_err(drvr, "Invalid escan buffer length: %d\n",
3668                                  escan_buflen);
3669                         goto exit;
3670                 }
3671                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3672                         bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3673                                  escan_result_le->bss_count);
3674                         goto exit;
3675                 }
3676                 bss_info_le = &escan_result_le->bss_info_le;
3677
3678                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3679                         goto exit;
3680
3681                 if (!cfg->int_escan_map && !cfg->scan_request) {
3682                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3683                         goto exit;
3684                 }
3685
3686                 bi_length = le32_to_cpu(bss_info_le->length);
3687                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3688                         bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3689                                  bi_length);
3690                         goto exit;
3691                 }
3692
3693                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3694                                         BIT(NL80211_IFTYPE_ADHOC))) {
3695                         if (le16_to_cpu(bss_info_le->capability) &
3696                                                 WLAN_CAPABILITY_IBSS) {
3697                                 bphy_err(drvr, "Ignoring IBSS result\n");
3698                                 goto exit;
3699                         }
3700                 }
3701
3702                 list = (struct brcmf_scan_results *)
3703                                 cfg->escan_info.escan_buf;
3704                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3705                         bphy_err(drvr, "Buffer is too small: ignoring\n");
3706                         goto exit;
3707                 }
3708
3709                 for (i = 0; i < list->count; i++) {
3710                         bss = bss ? (struct brcmf_bss_info_le *)
3711                                 ((unsigned char *)bss +
3712                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3713                         if (brcmf_compare_update_same_bss(cfg, bss,
3714                                                           bss_info_le))
3715                                 goto exit;
3716                 }
3717                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3718                        bi_length);
3719                 list->version = le32_to_cpu(bss_info_le->version);
3720                 list->buflen += bi_length;
3721                 list->count++;
3722         } else {
3723                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3724                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3725                         goto exit;
3726                 if (cfg->int_escan_map || cfg->scan_request) {
3727                         brcmf_inform_bss(cfg);
3728                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3729                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3730                 } else
3731                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3732                                   status);
3733         }
3734 exit:
3735         return 0;
3736 }
3737
3738 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3739 {
3740         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3741                             brcmf_cfg80211_escan_handler);
3742         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3743         /* Init scan_timeout timer */
3744         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3745         INIT_WORK(&cfg->escan_timeout_work,
3746                   brcmf_cfg80211_escan_timeout_worker);
3747 }
3748
3749 static struct cfg80211_scan_request *
3750 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3751         struct cfg80211_scan_request *req;
3752         size_t req_size;
3753
3754         req_size = sizeof(*req) +
3755                    n_netinfo * sizeof(req->channels[0]) +
3756                    n_netinfo * sizeof(*req->ssids);
3757
3758         req = kzalloc(req_size, GFP_KERNEL);
3759         if (req) {
3760                 req->wiphy = wiphy;
3761                 req->ssids = (void *)(&req->channels[0]) +
3762                              n_netinfo * sizeof(req->channels[0]);
3763         }
3764         return req;
3765 }
3766
3767 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3768                                          u8 *ssid, u8 ssid_len, u8 channel)
3769 {
3770         struct ieee80211_channel *chan;
3771         enum nl80211_band band;
3772         int freq, i;
3773
3774         if (channel <= CH_MAX_2G_CHANNEL)
3775                 band = NL80211_BAND_2GHZ;
3776         else
3777                 band = NL80211_BAND_5GHZ;
3778
3779         freq = ieee80211_channel_to_frequency(channel, band);
3780         if (!freq)
3781                 return -EINVAL;
3782
3783         chan = ieee80211_get_channel(req->wiphy, freq);
3784         if (!chan)
3785                 return -EINVAL;
3786
3787         for (i = 0; i < req->n_channels; i++) {
3788                 if (req->channels[i] == chan)
3789                         break;
3790         }
3791         if (i == req->n_channels) {
3792                 req->n_channels++;
3793                 req->channels[i] = chan;
3794         }
3795
3796         for (i = 0; i < req->n_ssids; i++) {
3797                 if (req->ssids[i].ssid_len == ssid_len &&
3798                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3799                         break;
3800         }
3801         if (i == req->n_ssids) {
3802                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3803                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3804         }
3805         return 0;
3806 }
3807
3808 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3809                                       struct cfg80211_scan_request *request)
3810 {
3811         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3812         int err;
3813
3814         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3815                 if (cfg->int_escan_map)
3816                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3817                                   cfg->int_escan_map);
3818                 /* Abort any on-going scan */
3819                 brcmf_abort_scanning(cfg);
3820         }
3821
3822         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3823         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3824         cfg->escan_info.run = brcmf_run_escan;
3825         err = brcmf_do_escan(ifp, request);
3826         if (err) {
3827                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3828                 return err;
3829         }
3830         cfg->int_escan_map = fwmap;
3831         return 0;
3832 }
3833
3834 static struct brcmf_pno_net_info_le *
3835 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3836 {
3837         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3838         struct brcmf_pno_net_info_le *netinfo;
3839
3840         switch (pfn_v1->version) {
3841         default:
3842                 WARN_ON(1);
3843                 fallthrough;
3844         case cpu_to_le32(1):
3845                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3846                 break;
3847         case cpu_to_le32(2):
3848                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3849                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3850                 break;
3851         }
3852
3853         return netinfo;
3854 }
3855
3856 /* PFN result doesn't have all the info which are required by the supplicant
3857  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3858  * via wl_inform_single_bss in the required format. Escan does require the
3859  * scan request in the form of cfg80211_scan_request. For timebeing, create
3860  * cfg80211_scan_request one out of the received PNO event.
3861  */
3862 static s32
3863 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3864                                 const struct brcmf_event_msg *e, void *data)
3865 {
3866         struct brcmf_pub *drvr = ifp->drvr;
3867         struct brcmf_cfg80211_info *cfg = drvr->config;
3868         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3869         struct cfg80211_scan_request *request = NULL;
3870         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3871         int i, err = 0;
3872         struct brcmf_pno_scanresults_le *pfn_result;
3873         u32 bucket_map;
3874         u32 result_count;
3875         u32 status;
3876         u32 datalen;
3877
3878         brcmf_dbg(SCAN, "Enter\n");
3879
3880         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3881                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3882                 return 0;
3883         }
3884
3885         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3886                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3887                 return 0;
3888         }
3889
3890         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3891         result_count = le32_to_cpu(pfn_result->count);
3892         status = le32_to_cpu(pfn_result->status);
3893
3894         /* PFN event is limited to fit 512 bytes so we may get
3895          * multiple NET_FOUND events. For now place a warning here.
3896          */
3897         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3898         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3899         if (!result_count) {
3900                 bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3901                 goto out_err;
3902         }
3903
3904         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3905         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3906         if (datalen < result_count * sizeof(*netinfo)) {
3907                 bphy_err(drvr, "insufficient event data\n");
3908                 goto out_err;
3909         }
3910
3911         request = brcmf_alloc_internal_escan_request(wiphy,
3912                                                      result_count);
3913         if (!request) {
3914                 err = -ENOMEM;
3915                 goto out_err;
3916         }
3917
3918         bucket_map = 0;
3919         for (i = 0; i < result_count; i++) {
3920                 netinfo = &netinfo_start[i];
3921
3922                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3923                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3924                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3925                           netinfo->SSID, netinfo->channel);
3926                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3927                 err = brcmf_internal_escan_add_info(request,
3928                                                     netinfo->SSID,
3929                                                     netinfo->SSID_len,
3930                                                     netinfo->channel);
3931                 if (err)
3932                         goto out_err;
3933         }
3934
3935         if (!bucket_map)
3936                 goto free_req;
3937
3938         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3939         if (!err)
3940                 goto free_req;
3941
3942 out_err:
3943         cfg80211_sched_scan_stopped(wiphy, 0);
3944 free_req:
3945         kfree(request);
3946         return err;
3947 }
3948
3949 static int
3950 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3951                                 struct net_device *ndev,
3952                                 struct cfg80211_sched_scan_request *req)
3953 {
3954         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3955         struct brcmf_if *ifp = netdev_priv(ndev);
3956         struct brcmf_pub *drvr = cfg->pub;
3957
3958         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3959                   req->n_match_sets, req->n_ssids);
3960
3961         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3962                 bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3963                          cfg->scan_status);
3964                 return -EAGAIN;
3965         }
3966
3967         if (req->n_match_sets <= 0) {
3968                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3969                           req->n_match_sets);
3970                 return -EINVAL;
3971         }
3972
3973         return brcmf_pno_start_sched_scan(ifp, req);
3974 }
3975
3976 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3977                                           struct net_device *ndev, u64 reqid)
3978 {
3979         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3980         struct brcmf_if *ifp = netdev_priv(ndev);
3981
3982         brcmf_dbg(SCAN, "enter\n");
3983         brcmf_pno_stop_sched_scan(ifp, reqid);
3984         if (cfg->int_escan_map)
3985                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3986         return 0;
3987 }
3988
3989 static __always_inline void brcmf_delay(u32 ms)
3990 {
3991         if (ms < 1000 / HZ) {
3992                 cond_resched();
3993                 mdelay(ms);
3994         } else {
3995                 msleep(ms);
3996         }
3997 }
3998
3999 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
4000                                      u8 *pattern, u32 patternsize, u8 *mask,
4001                                      u32 packet_offset)
4002 {
4003         struct brcmf_fil_wowl_pattern_le *filter;
4004         u32 masksize;
4005         u32 patternoffset;
4006         u8 *buf;
4007         u32 bufsize;
4008         s32 ret;
4009
4010         masksize = (patternsize + 7) / 8;
4011         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
4012
4013         bufsize = sizeof(*filter) + patternsize + masksize;
4014         buf = kzalloc(bufsize, GFP_KERNEL);
4015         if (!buf)
4016                 return -ENOMEM;
4017         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
4018
4019         memcpy(filter->cmd, cmd, 4);
4020         filter->masksize = cpu_to_le32(masksize);
4021         filter->offset = cpu_to_le32(packet_offset);
4022         filter->patternoffset = cpu_to_le32(patternoffset);
4023         filter->patternsize = cpu_to_le32(patternsize);
4024         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
4025
4026         if ((mask) && (masksize))
4027                 memcpy(buf + sizeof(*filter), mask, masksize);
4028         if ((pattern) && (patternsize))
4029                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
4030
4031         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
4032
4033         kfree(buf);
4034         return ret;
4035 }
4036
4037 static s32
4038 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
4039                       void *data)
4040 {
4041         struct brcmf_pub *drvr = ifp->drvr;
4042         struct brcmf_cfg80211_info *cfg = drvr->config;
4043         struct brcmf_pno_scanresults_le *pfn_result;
4044         struct brcmf_pno_net_info_le *netinfo;
4045
4046         brcmf_dbg(SCAN, "Enter\n");
4047
4048         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
4049                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
4050                 return 0;
4051         }
4052
4053         pfn_result = (struct brcmf_pno_scanresults_le *)data;
4054
4055         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
4056                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
4057                 return 0;
4058         }
4059
4060         if (le32_to_cpu(pfn_result->count) < 1) {
4061                 bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
4062                          le32_to_cpu(pfn_result->count));
4063                 return -EINVAL;
4064         }
4065
4066         netinfo = brcmf_get_netinfo_array(pfn_result);
4067         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
4068                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
4069         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
4070         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
4071         cfg->wowl.nd->n_channels = 1;
4072         cfg->wowl.nd->channels[0] =
4073                 ieee80211_channel_to_frequency(netinfo->channel,
4074                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
4075                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
4076         cfg->wowl.nd_info->n_matches = 1;
4077         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
4078
4079         /* Inform (the resume task) that the net detect information was recvd */
4080         cfg->wowl.nd_data_completed = true;
4081         wake_up(&cfg->wowl.nd_data_wait);
4082
4083         return 0;
4084 }
4085
4086 #ifdef CONFIG_PM
4087
4088 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4089 {
4090         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4091         struct brcmf_pub *drvr = cfg->pub;
4092         struct brcmf_wowl_wakeind_le wake_ind_le;
4093         struct cfg80211_wowlan_wakeup wakeup_data;
4094         struct cfg80211_wowlan_wakeup *wakeup;
4095         u32 wakeind;
4096         s32 err;
4097         int timeout;
4098
4099         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
4100                                        sizeof(wake_ind_le));
4101         if (err) {
4102                 bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
4103                 return;
4104         }
4105
4106         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
4107         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
4108                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
4109                        BRCMF_WOWL_PFN_FOUND)) {
4110                 wakeup = &wakeup_data;
4111                 memset(&wakeup_data, 0, sizeof(wakeup_data));
4112                 wakeup_data.pattern_idx = -1;
4113
4114                 if (wakeind & BRCMF_WOWL_MAGIC) {
4115                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
4116                         wakeup_data.magic_pkt = true;
4117                 }
4118                 if (wakeind & BRCMF_WOWL_DIS) {
4119                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
4120                         wakeup_data.disconnect = true;
4121                 }
4122                 if (wakeind & BRCMF_WOWL_BCN) {
4123                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
4124                         wakeup_data.disconnect = true;
4125                 }
4126                 if (wakeind & BRCMF_WOWL_RETR) {
4127                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
4128                         wakeup_data.disconnect = true;
4129                 }
4130                 if (wakeind & BRCMF_WOWL_NET) {
4131                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
4132                         /* For now always map to pattern 0, no API to get
4133                          * correct information available at the moment.
4134                          */
4135                         wakeup_data.pattern_idx = 0;
4136                 }
4137                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
4138                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
4139                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
4140                                 cfg->wowl.nd_data_completed,
4141                                 BRCMF_ND_INFO_TIMEOUT);
4142                         if (!timeout)
4143                                 bphy_err(drvr, "No result for wowl net detect\n");
4144                         else
4145                                 wakeup_data.net_detect = cfg->wowl.nd_info;
4146                 }
4147                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
4148                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
4149                         wakeup_data.gtk_rekey_failure = true;
4150                 }
4151         } else {
4152                 wakeup = NULL;
4153         }
4154         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
4155 }
4156
4157 #else
4158
4159 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4160 {
4161 }
4162
4163 #endif /* CONFIG_PM */
4164
4165 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
4166 {
4167         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4168         struct net_device *ndev = cfg_to_ndev(cfg);
4169         struct brcmf_if *ifp = netdev_priv(ndev);
4170
4171         brcmf_dbg(TRACE, "Enter\n");
4172
4173         if (cfg->wowl.active) {
4174                 brcmf_report_wowl_wakeind(wiphy, ifp);
4175                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
4176                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
4177                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4178                         brcmf_configure_arp_nd_offload(ifp, true);
4179                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
4180                                       cfg->wowl.pre_pmmode);
4181                 cfg->wowl.active = false;
4182                 if (cfg->wowl.nd_enabled) {
4183                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
4184                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4185                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4186                                             brcmf_notify_sched_scan_results);
4187                         cfg->wowl.nd_enabled = false;
4188                 }
4189         }
4190         return 0;
4191 }
4192
4193 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
4194                                  struct brcmf_if *ifp,
4195                                  struct cfg80211_wowlan *wowl)
4196 {
4197         u32 wowl_config;
4198         struct brcmf_wowl_wakeind_le wowl_wakeind;
4199         u32 i;
4200
4201         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
4202
4203         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4204                 brcmf_configure_arp_nd_offload(ifp, false);
4205         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
4206         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
4207
4208         wowl_config = 0;
4209         if (wowl->disconnect)
4210                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
4211         if (wowl->magic_pkt)
4212                 wowl_config |= BRCMF_WOWL_MAGIC;
4213         if ((wowl->patterns) && (wowl->n_patterns)) {
4214                 wowl_config |= BRCMF_WOWL_NET;
4215                 for (i = 0; i < wowl->n_patterns; i++) {
4216                         brcmf_config_wowl_pattern(ifp, "add",
4217                                 (u8 *)wowl->patterns[i].pattern,
4218                                 wowl->patterns[i].pattern_len,
4219                                 (u8 *)wowl->patterns[i].mask,
4220                                 wowl->patterns[i].pkt_offset);
4221                 }
4222         }
4223         if (wowl->nd_config) {
4224                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
4225                                                 wowl->nd_config);
4226                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
4227
4228                 cfg->wowl.nd_data_completed = false;
4229                 cfg->wowl.nd_enabled = true;
4230                 /* Now reroute the event for PFN to the wowl function. */
4231                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4232                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4233                                     brcmf_wowl_nd_results);
4234         }
4235         if (wowl->gtk_rekey_failure)
4236                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
4237         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4238                 wowl_config |= BRCMF_WOWL_UNASSOC;
4239
4240         memcpy(&wowl_wakeind, "clear", 6);
4241         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
4242                                  sizeof(wowl_wakeind));
4243         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
4244         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
4245         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
4246         cfg->wowl.active = true;
4247 }
4248
4249 static int brcmf_keepalive_start(struct brcmf_if *ifp, unsigned int interval)
4250 {
4251         struct brcmf_mkeep_alive_pkt_le kalive = {0};
4252         int ret = 0;
4253
4254         /* Configure Null function/data keepalive */
4255         kalive.version = cpu_to_le16(1);
4256         kalive.period_msec = cpu_to_le32(interval * MSEC_PER_SEC);
4257         kalive.len_bytes = cpu_to_le16(0);
4258         kalive.keep_alive_id = 0;
4259
4260         ret = brcmf_fil_iovar_data_set(ifp, "mkeep_alive", &kalive, sizeof(kalive));
4261         if (ret)
4262                 brcmf_err("keep-alive packet config failed, ret=%d\n", ret);
4263
4264         return ret;
4265 }
4266
4267 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
4268                                   struct cfg80211_wowlan *wowl)
4269 {
4270         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4271         struct net_device *ndev = cfg_to_ndev(cfg);
4272         struct brcmf_if *ifp = netdev_priv(ndev);
4273         struct brcmf_cfg80211_vif *vif;
4274
4275         brcmf_dbg(TRACE, "Enter\n");
4276
4277         /* if the primary net_device is not READY there is nothing
4278          * we can do but pray resume goes smoothly.
4279          */
4280         if (!check_vif_up(ifp->vif))
4281                 goto exit;
4282
4283         /* Stop scheduled scan */
4284         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
4285                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
4286
4287         /* end any scanning */
4288         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
4289                 brcmf_abort_scanning(cfg);
4290
4291         if (wowl == NULL) {
4292                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
4293                 list_for_each_entry(vif, &cfg->vif_list, list) {
4294                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
4295                                 continue;
4296                         /* While going to suspend if associated with AP
4297                          * disassociate from AP to save power while system is
4298                          * in suspended state
4299                          */
4300                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
4301                         /* Make sure WPA_Supplicant receives all the event
4302                          * generated due to DISASSOC call to the fw to keep
4303                          * the state fw and WPA_Supplicant state consistent
4304                          */
4305                         brcmf_delay(500);
4306                 }
4307                 /* Configure MPC */
4308                 brcmf_set_mpc(ifp, 1);
4309
4310         } else {
4311                 /* Configure WOWL paramaters */
4312                 brcmf_configure_wowl(cfg, ifp, wowl);
4313
4314                 /* Prevent disassociation due to inactivity with keep-alive */
4315                 brcmf_keepalive_start(ifp, 30);
4316         }
4317
4318 exit:
4319         brcmf_dbg(TRACE, "Exit\n");
4320         /* clear any scanning activity */
4321         cfg->scan_status = 0;
4322         return 0;
4323 }
4324
4325 static s32
4326 brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
4327                   bool alive)
4328 {
4329         struct brcmf_pmk_op_v3_le *pmk_op;
4330         int length = offsetof(struct brcmf_pmk_op_v3_le, pmk);
4331         int ret;
4332
4333         pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
4334         pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
4335
4336         if (!pmksa) {
4337                 /* Flush operation, operate on entire list */
4338                 pmk_op->count = cpu_to_le16(0);
4339         } else {
4340                 /* Single PMK operation */
4341                 pmk_op->count = cpu_to_le16(1);
4342                 length += sizeof(struct brcmf_pmksa_v3);
4343                 memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
4344                 memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4345                 pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
4346                 pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
4347         }
4348
4349         pmk_op->length = cpu_to_le16(length);
4350
4351         ret = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_op, sizeof(*pmk_op));
4352         kfree(pmk_op);
4353         return ret;
4354 }
4355
4356 static __used s32
4357 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
4358 {
4359         struct brcmf_pmk_list_le *pmk_list;
4360         int i;
4361         u32 npmk;
4362
4363         pmk_list = &cfg->pmk_list;
4364         npmk = le32_to_cpu(pmk_list->npmk);
4365
4366         brcmf_dbg(CONN, "No of elements %d\n", npmk);
4367         for (i = 0; i < npmk; i++)
4368                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
4369
4370         return brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
4371                         sizeof(*pmk_list));
4372 }
4373
4374 static s32
4375 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4376                          struct cfg80211_pmksa *pmksa)
4377 {
4378         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4379         struct brcmf_if *ifp = netdev_priv(ndev);
4380         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4381         struct brcmf_pub *drvr = cfg->pub;
4382         s32 err;
4383         u32 npmk, i;
4384
4385         brcmf_dbg(TRACE, "Enter\n");
4386         if (!check_vif_up(ifp->vif))
4387                 return -EIO;
4388
4389         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmksa->bssid);
4390         brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmksa->pmkid);
4391
4392         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4393                 return brcmf_pmksa_v3_op(ifp, pmksa, true);
4394
4395         /* TODO: implement PMKID_V2 */
4396
4397         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4398         for (i = 0; i < npmk; i++)
4399                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4400                         break;
4401         if (i < BRCMF_MAXPMKID) {
4402                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4403                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4404                 if (i == npmk) {
4405                         npmk++;
4406                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
4407                 }
4408         } else {
4409                 bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4410                 return -EINVAL;
4411         }
4412
4413         err = brcmf_update_pmklist(cfg, ifp);
4414
4415         brcmf_dbg(TRACE, "Exit\n");
4416         return err;
4417 }
4418
4419 static s32
4420 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4421                          struct cfg80211_pmksa *pmksa)
4422 {
4423         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4424         struct brcmf_if *ifp = netdev_priv(ndev);
4425         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4426         struct brcmf_pub *drvr = cfg->pub;
4427         s32 err;
4428         u32 npmk, i;
4429
4430         brcmf_dbg(TRACE, "Enter\n");
4431         if (!check_vif_up(ifp->vif))
4432                 return -EIO;
4433
4434         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4435
4436         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4437                 return brcmf_pmksa_v3_op(ifp, pmksa, false);
4438
4439         /* TODO: implement PMKID_V2 */
4440
4441         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4442         for (i = 0; i < npmk; i++)
4443                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4444                         break;
4445
4446         if ((npmk > 0) && (i < npmk)) {
4447                 for (; i < (npmk - 1); i++) {
4448                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4449                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4450                                WLAN_PMKID_LEN);
4451                 }
4452                 memset(&pmk[i], 0, sizeof(*pmk));
4453                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4454         } else {
4455                 bphy_err(drvr, "Cache entry not found\n");
4456                 return -EINVAL;
4457         }
4458
4459         err = brcmf_update_pmklist(cfg, ifp);
4460
4461         brcmf_dbg(TRACE, "Exit\n");
4462         return err;
4463
4464 }
4465
4466 static s32
4467 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4468 {
4469         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4470         struct brcmf_if *ifp = netdev_priv(ndev);
4471         s32 err;
4472
4473         brcmf_dbg(TRACE, "Enter\n");
4474         if (!check_vif_up(ifp->vif))
4475                 return -EIO;
4476
4477         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4478                 return brcmf_pmksa_v3_op(ifp, NULL, false);
4479
4480         /* TODO: implement PMKID_V2 */
4481
4482         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4483         err = brcmf_update_pmklist(cfg, ifp);
4484
4485         brcmf_dbg(TRACE, "Exit\n");
4486         return err;
4487
4488 }
4489
4490 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4491 {
4492         struct brcmf_pub *drvr = ifp->drvr;
4493         s32 err;
4494         s32 wpa_val;
4495
4496         /* set auth */
4497         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4498         if (err < 0) {
4499                 bphy_err(drvr, "auth error %d\n", err);
4500                 return err;
4501         }
4502         /* set wsec */
4503         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4504         if (err < 0) {
4505                 bphy_err(drvr, "wsec error %d\n", err);
4506                 return err;
4507         }
4508         /* set upper-layer auth */
4509         if (brcmf_is_ibssmode(ifp->vif))
4510                 wpa_val = WPA_AUTH_NONE;
4511         else
4512                 wpa_val = WPA_AUTH_DISABLED;
4513         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4514         if (err < 0) {
4515                 bphy_err(drvr, "wpa_auth error %d\n", err);
4516                 return err;
4517         }
4518
4519         return 0;
4520 }
4521
4522 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4523 {
4524         if (is_rsn_ie)
4525                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4526
4527         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4528 }
4529
4530 static s32
4531 brcmf_configure_wpaie(struct brcmf_if *ifp,
4532                       const struct brcmf_vs_tlv *wpa_ie,
4533                       bool is_rsn_ie)
4534 {
4535         struct brcmf_pub *drvr = ifp->drvr;
4536         u32 auth = 0; /* d11 open authentication */
4537         u16 count;
4538         s32 err = 0;
4539         s32 len;
4540         u32 i;
4541         u32 wsec;
4542         u32 pval = 0;
4543         u32 gval = 0;
4544         u32 wpa_auth = 0;
4545         u32 offset;
4546         u8 *data;
4547         u16 rsn_cap;
4548         u32 wme_bss_disable;
4549         u32 mfp;
4550
4551         brcmf_dbg(TRACE, "Enter\n");
4552         if (wpa_ie == NULL)
4553                 goto exit;
4554
4555         len = wpa_ie->len + TLV_HDR_LEN;
4556         data = (u8 *)wpa_ie;
4557         offset = TLV_HDR_LEN;
4558         if (!is_rsn_ie)
4559                 offset += VS_IE_FIXED_HDR_LEN;
4560         else
4561                 offset += WPA_IE_VERSION_LEN;
4562
4563         /* check for multicast cipher suite */
4564         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4565                 err = -EINVAL;
4566                 bphy_err(drvr, "no multicast cipher suite\n");
4567                 goto exit;
4568         }
4569
4570         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4571                 err = -EINVAL;
4572                 bphy_err(drvr, "ivalid OUI\n");
4573                 goto exit;
4574         }
4575         offset += TLV_OUI_LEN;
4576
4577         /* pick up multicast cipher */
4578         switch (data[offset]) {
4579         case WPA_CIPHER_NONE:
4580                 gval = 0;
4581                 break;
4582         case WPA_CIPHER_WEP_40:
4583         case WPA_CIPHER_WEP_104:
4584                 gval = WEP_ENABLED;
4585                 break;
4586         case WPA_CIPHER_TKIP:
4587                 gval = TKIP_ENABLED;
4588                 break;
4589         case WPA_CIPHER_AES_CCM:
4590                 gval = AES_ENABLED;
4591                 break;
4592         default:
4593                 err = -EINVAL;
4594                 bphy_err(drvr, "Invalid multi cast cipher info\n");
4595                 goto exit;
4596         }
4597
4598         offset++;
4599         /* walk thru unicast cipher list and pick up what we recognize */
4600         count = data[offset] + (data[offset + 1] << 8);
4601         offset += WPA_IE_SUITE_COUNT_LEN;
4602         /* Check for unicast suite(s) */
4603         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4604                 err = -EINVAL;
4605                 bphy_err(drvr, "no unicast cipher suite\n");
4606                 goto exit;
4607         }
4608         for (i = 0; i < count; i++) {
4609                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4610                         err = -EINVAL;
4611                         bphy_err(drvr, "ivalid OUI\n");
4612                         goto exit;
4613                 }
4614                 offset += TLV_OUI_LEN;
4615                 switch (data[offset]) {
4616                 case WPA_CIPHER_NONE:
4617                         break;
4618                 case WPA_CIPHER_WEP_40:
4619                 case WPA_CIPHER_WEP_104:
4620                         pval |= WEP_ENABLED;
4621                         break;
4622                 case WPA_CIPHER_TKIP:
4623                         pval |= TKIP_ENABLED;
4624                         break;
4625                 case WPA_CIPHER_AES_CCM:
4626                         pval |= AES_ENABLED;
4627                         break;
4628                 default:
4629                         bphy_err(drvr, "Invalid unicast security info\n");
4630                 }
4631                 offset++;
4632         }
4633         /* walk thru auth management suite list and pick up what we recognize */
4634         count = data[offset] + (data[offset + 1] << 8);
4635         offset += WPA_IE_SUITE_COUNT_LEN;
4636         /* Check for auth key management suite(s) */
4637         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4638                 err = -EINVAL;
4639                 bphy_err(drvr, "no auth key mgmt suite\n");
4640                 goto exit;
4641         }
4642         for (i = 0; i < count; i++) {
4643                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4644                         err = -EINVAL;
4645                         bphy_err(drvr, "ivalid OUI\n");
4646                         goto exit;
4647                 }
4648                 offset += TLV_OUI_LEN;
4649                 switch (data[offset]) {
4650                 case RSN_AKM_NONE:
4651                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4652                         wpa_auth |= WPA_AUTH_NONE;
4653                         break;
4654                 case RSN_AKM_UNSPECIFIED:
4655                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4656                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4657                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4658                         break;
4659                 case RSN_AKM_PSK:
4660                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4661                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4662                                     (wpa_auth |= WPA_AUTH_PSK);
4663                         break;
4664                 case RSN_AKM_SHA256_PSK:
4665                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4666                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4667                         break;
4668                 case RSN_AKM_SHA256_1X:
4669                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4670                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4671                         break;
4672                 case RSN_AKM_SAE:
4673                         brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4674                         wpa_auth |= WPA3_AUTH_SAE_PSK;
4675                         break;
4676                 default:
4677                         bphy_err(drvr, "Invalid key mgmt info\n");
4678                 }
4679                 offset++;
4680         }
4681
4682         mfp = BRCMF_MFP_NONE;
4683         if (is_rsn_ie) {
4684                 wme_bss_disable = 1;
4685                 if ((offset + RSN_CAP_LEN) <= len) {
4686                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4687                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4688                                 wme_bss_disable = 0;
4689                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4690                                 brcmf_dbg(TRACE, "MFP Required\n");
4691                                 mfp = BRCMF_MFP_REQUIRED;
4692                                 /* Firmware only supports mfp required in
4693                                  * combination with WPA2_AUTH_PSK_SHA256,
4694                                  * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4695                                  */
4696                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4697                                                   WPA2_AUTH_1X_SHA256 |
4698                                                   WPA3_AUTH_SAE_PSK))) {
4699                                         err = -EINVAL;
4700                                         goto exit;
4701                                 }
4702                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4703                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4704                                  * is to be included in the rsn ie.
4705                                  */
4706                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4707                                         wpa_auth |= WPA2_AUTH_PSK;
4708                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4709                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4710                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4711                                 brcmf_dbg(TRACE, "MFP Capable\n");
4712                                 mfp = BRCMF_MFP_CAPABLE;
4713                         }
4714                 }
4715                 offset += RSN_CAP_LEN;
4716                 /* set wme_bss_disable to sync RSN Capabilities */
4717                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4718                                                wme_bss_disable);
4719                 if (err < 0) {
4720                         bphy_err(drvr, "wme_bss_disable error %d\n", err);
4721                         goto exit;
4722                 }
4723
4724                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4725                 offset += RSN_PMKID_COUNT_LEN;
4726
4727                 /* See if there is BIP wpa suite left for MFP */
4728                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4729                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4730                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4731                                                         &data[offset],
4732                                                         WPA_IE_MIN_OUI_LEN);
4733                         if (err < 0) {
4734                                 bphy_err(drvr, "bip error %d\n", err);
4735                                 goto exit;
4736                         }
4737                 }
4738         }
4739         /* FOR WPS , set SES_OW_ENABLED */
4740         wsec = (pval | gval | SES_OW_ENABLED);
4741
4742         /* set auth */
4743         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4744         if (err < 0) {
4745                 bphy_err(drvr, "auth error %d\n", err);
4746                 goto exit;
4747         }
4748         /* set wsec */
4749         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4750         if (err < 0) {
4751                 bphy_err(drvr, "wsec error %d\n", err);
4752                 goto exit;
4753         }
4754         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4755          * will overwrite the values set by MFP
4756          */
4757         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4758                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4759                 if (err < 0) {
4760                         bphy_err(drvr, "mfp error %d\n", err);
4761                         goto exit;
4762                 }
4763         }
4764         /* set upper-layer auth */
4765         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4766         if (err < 0) {
4767                 bphy_err(drvr, "wpa_auth error %d\n", err);
4768                 goto exit;
4769         }
4770
4771 exit:
4772         return err;
4773 }
4774
4775 static s32
4776 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4777                      struct parsed_vndr_ies *vndr_ies)
4778 {
4779         struct brcmf_vs_tlv *vndrie;
4780         struct brcmf_tlv *ie;
4781         struct parsed_vndr_ie_info *parsed_info;
4782         s32 remaining_len;
4783
4784         remaining_len = (s32)vndr_ie_len;
4785         memset(vndr_ies, 0, sizeof(*vndr_ies));
4786
4787         ie = (struct brcmf_tlv *)vndr_ie_buf;
4788         while (ie) {
4789                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4790                         goto next;
4791                 vndrie = (struct brcmf_vs_tlv *)ie;
4792                 /* len should be bigger than OUI length + one */
4793                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4794                         brcmf_err("invalid vndr ie. length is too small %d\n",
4795                                   vndrie->len);
4796                         goto next;
4797                 }
4798                 /* if wpa or wme ie, do not add ie */
4799                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4800                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4801                     (vndrie->oui_type == WME_OUI_TYPE))) {
4802                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4803                         goto next;
4804                 }
4805
4806                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4807
4808                 /* save vndr ie information */
4809                 parsed_info->ie_ptr = (char *)vndrie;
4810                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4811                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4812
4813                 vndr_ies->count++;
4814
4815                 brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4816                           parsed_info->vndrie.oui,
4817                           parsed_info->vndrie.oui_type);
4818
4819                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4820                         break;
4821 next:
4822                 remaining_len -= (ie->len + TLV_HDR_LEN);
4823                 if (remaining_len <= TLV_HDR_LEN)
4824                         ie = NULL;
4825                 else
4826                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4827                                 TLV_HDR_LEN);
4828         }
4829         return 0;
4830 }
4831
4832 static u32
4833 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4834 {
4835         strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4836
4837         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4838
4839         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4840
4841         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4842
4843         return ie_len + VNDR_IE_HDR_SIZE;
4844 }
4845
4846 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4847                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4848 {
4849         struct brcmf_pub *drvr;
4850         struct brcmf_if *ifp;
4851         struct vif_saved_ie *saved_ie;
4852         s32 err = 0;
4853         u8  *iovar_ie_buf;
4854         u8  *curr_ie_buf;
4855         u8  *mgmt_ie_buf = NULL;
4856         int mgmt_ie_buf_len;
4857         u32 *mgmt_ie_len;
4858         u32 del_add_ie_buf_len = 0;
4859         u32 total_ie_buf_len = 0;
4860         u32 parsed_ie_buf_len = 0;
4861         struct parsed_vndr_ies old_vndr_ies;
4862         struct parsed_vndr_ies new_vndr_ies;
4863         struct parsed_vndr_ie_info *vndrie_info;
4864         s32 i;
4865         u8 *ptr;
4866         int remained_buf_len;
4867
4868         if (!vif)
4869                 return -ENODEV;
4870         ifp = vif->ifp;
4871         drvr = ifp->drvr;
4872         saved_ie = &vif->saved_ie;
4873
4874         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4875                   pktflag);
4876         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4877         if (!iovar_ie_buf)
4878                 return -ENOMEM;
4879         curr_ie_buf = iovar_ie_buf;
4880         switch (pktflag) {
4881         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4882                 mgmt_ie_buf = saved_ie->probe_req_ie;
4883                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4884                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4885                 break;
4886         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4887                 mgmt_ie_buf = saved_ie->probe_res_ie;
4888                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4889                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4890                 break;
4891         case BRCMF_VNDR_IE_BEACON_FLAG:
4892                 mgmt_ie_buf = saved_ie->beacon_ie;
4893                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4894                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4895                 break;
4896         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4897                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4898                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4899                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4900                 break;
4901         case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4902                 mgmt_ie_buf = saved_ie->assoc_res_ie;
4903                 mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4904                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4905                 break;
4906         default:
4907                 err = -EPERM;
4908                 bphy_err(drvr, "not suitable type\n");
4909                 goto exit;
4910         }
4911
4912         if (vndr_ie_len > mgmt_ie_buf_len) {
4913                 err = -ENOMEM;
4914                 bphy_err(drvr, "extra IE size too big\n");
4915                 goto exit;
4916         }
4917
4918         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4919         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4920                 ptr = curr_ie_buf;
4921                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4922                 for (i = 0; i < new_vndr_ies.count; i++) {
4923                         vndrie_info = &new_vndr_ies.ie_info[i];
4924                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4925                                vndrie_info->ie_len);
4926                         parsed_ie_buf_len += vndrie_info->ie_len;
4927                 }
4928         }
4929
4930         if (mgmt_ie_buf && *mgmt_ie_len) {
4931                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4932                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4933                             parsed_ie_buf_len) == 0)) {
4934                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4935                         goto exit;
4936                 }
4937
4938                 /* parse old vndr_ie */
4939                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4940
4941                 /* make a command to delete old ie */
4942                 for (i = 0; i < old_vndr_ies.count; i++) {
4943                         vndrie_info = &old_vndr_ies.ie_info[i];
4944
4945                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4946                                   vndrie_info->vndrie.id,
4947                                   vndrie_info->vndrie.len,
4948                                   vndrie_info->vndrie.oui);
4949
4950                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4951                                                            vndrie_info->ie_ptr,
4952                                                            vndrie_info->ie_len,
4953                                                            "del");
4954                         curr_ie_buf += del_add_ie_buf_len;
4955                         total_ie_buf_len += del_add_ie_buf_len;
4956                 }
4957         }
4958
4959         *mgmt_ie_len = 0;
4960         /* Add if there is any extra IE */
4961         if (mgmt_ie_buf && parsed_ie_buf_len) {
4962                 ptr = mgmt_ie_buf;
4963
4964                 remained_buf_len = mgmt_ie_buf_len;
4965
4966                 /* make a command to add new ie */
4967                 for (i = 0; i < new_vndr_ies.count; i++) {
4968                         vndrie_info = &new_vndr_ies.ie_info[i];
4969
4970                         /* verify remained buf size before copy data */
4971                         if (remained_buf_len < (vndrie_info->vndrie.len +
4972                                                         VNDR_IE_VSIE_OFFSET)) {
4973                                 bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4974                                          remained_buf_len);
4975                                 break;
4976                         }
4977                         remained_buf_len -= (vndrie_info->ie_len +
4978                                              VNDR_IE_VSIE_OFFSET);
4979
4980                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4981                                   vndrie_info->vndrie.id,
4982                                   vndrie_info->vndrie.len,
4983                                   vndrie_info->vndrie.oui);
4984
4985                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4986                                                            vndrie_info->ie_ptr,
4987                                                            vndrie_info->ie_len,
4988                                                            "add");
4989
4990                         /* save the parsed IE in wl struct */
4991                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4992                                vndrie_info->ie_len);
4993                         *mgmt_ie_len += vndrie_info->ie_len;
4994
4995                         curr_ie_buf += del_add_ie_buf_len;
4996                         total_ie_buf_len += del_add_ie_buf_len;
4997                 }
4998         }
4999         if (total_ie_buf_len) {
5000                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
5001                                                  total_ie_buf_len);
5002                 if (err)
5003                         bphy_err(drvr, "vndr ie set error : %d\n", err);
5004         }
5005
5006 exit:
5007         kfree(iovar_ie_buf);
5008         return err;
5009 }
5010
5011 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
5012 {
5013         static const s32 pktflags[] = {
5014                 BRCMF_VNDR_IE_PRBREQ_FLAG,
5015                 BRCMF_VNDR_IE_PRBRSP_FLAG,
5016                 BRCMF_VNDR_IE_BEACON_FLAG
5017         };
5018         int i;
5019
5020         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
5021                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
5022
5023         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
5024         return 0;
5025 }
5026
5027 static s32
5028 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
5029                         struct cfg80211_beacon_data *beacon)
5030 {
5031         struct brcmf_pub *drvr = vif->ifp->drvr;
5032         s32 err;
5033
5034         /* Set Beacon IEs to FW */
5035         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
5036                                     beacon->tail, beacon->tail_len);
5037         if (err) {
5038                 bphy_err(drvr, "Set Beacon IE Failed\n");
5039                 return err;
5040         }
5041         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
5042
5043         /* Set Probe Response IEs to FW */
5044         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
5045                                     beacon->proberesp_ies,
5046                                     beacon->proberesp_ies_len);
5047         if (err)
5048                 bphy_err(drvr, "Set Probe Resp IE Failed\n");
5049         else
5050                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
5051
5052         /* Set Assoc Response IEs to FW */
5053         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
5054                                     beacon->assocresp_ies,
5055                                     beacon->assocresp_ies_len);
5056         if (err)
5057                 brcmf_err("Set Assoc Resp IE Failed\n");
5058         else
5059                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
5060
5061         return err;
5062 }
5063
5064 static s32
5065 brcmf_parse_configure_security(struct brcmf_if *ifp,
5066                                struct cfg80211_ap_settings *settings,
5067                                enum nl80211_iftype dev_role)
5068 {
5069         const struct brcmf_tlv *rsn_ie;
5070         const struct brcmf_vs_tlv *wpa_ie;
5071         s32 err = 0;
5072
5073         /* find the RSN_IE */
5074         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5075                                   settings->beacon.tail_len, WLAN_EID_RSN);
5076
5077         /* find the WPA_IE */
5078         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
5079                                   settings->beacon.tail_len);
5080
5081         if (wpa_ie || rsn_ie) {
5082                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
5083                 if (wpa_ie) {
5084                         /* WPA IE */
5085                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
5086                         if (err < 0)
5087                                 return err;
5088                 } else {
5089                         struct brcmf_vs_tlv *tmp_ie;
5090
5091                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
5092
5093                         /* RSN IE */
5094                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
5095                         if (err < 0)
5096                                 return err;
5097                 }
5098         } else {
5099                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
5100                 brcmf_configure_opensecurity(ifp);
5101         }
5102
5103         return err;
5104 }
5105
5106 static s32
5107 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
5108                         struct cfg80211_ap_settings *settings)
5109 {
5110         s32 ie_offset;
5111         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5112         struct brcmf_if *ifp = netdev_priv(ndev);
5113         struct brcmf_pub *drvr = cfg->pub;
5114         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5115         struct cfg80211_crypto_settings *crypto = &settings->crypto;
5116         const struct brcmf_tlv *ssid_ie;
5117         const struct brcmf_tlv *country_ie;
5118         struct brcmf_ssid_le ssid_le;
5119         s32 err = -EPERM;
5120         struct brcmf_join_params join_params;
5121         enum nl80211_iftype dev_role;
5122         struct brcmf_fil_bss_enable_le bss_enable;
5123         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
5124         bool mbss;
5125         int is_11d;
5126         bool supports_11d;
5127
5128         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
5129                   settings->chandef.chan->hw_value,
5130                   settings->chandef.center_freq1, settings->chandef.width,
5131                   settings->beacon_interval, settings->dtim_period);
5132         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
5133                   settings->ssid, settings->ssid_len, settings->auth_type,
5134                   settings->inactivity_timeout);
5135         dev_role = ifp->vif->wdev.iftype;
5136         mbss = ifp->vif->mbss;
5137
5138         /* store current 11d setting */
5139         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
5140                                   &ifp->vif->is_11d)) {
5141                 is_11d = supports_11d = false;
5142         } else {
5143                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5144                                               settings->beacon.tail_len,
5145                                               WLAN_EID_COUNTRY);
5146                 is_11d = country_ie ? 1 : 0;
5147                 supports_11d = true;
5148         }
5149
5150         memset(&ssid_le, 0, sizeof(ssid_le));
5151         if (settings->ssid == NULL || settings->ssid_len == 0) {
5152                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
5153                 ssid_ie = brcmf_parse_tlvs(
5154                                 (u8 *)&settings->beacon.head[ie_offset],
5155                                 settings->beacon.head_len - ie_offset,
5156                                 WLAN_EID_SSID);
5157                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
5158                         return -EINVAL;
5159
5160                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
5161                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
5162                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
5163         } else {
5164                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
5165                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
5166         }
5167
5168         if (!mbss) {
5169                 brcmf_set_mpc(ifp, 0);
5170                 brcmf_configure_arp_nd_offload(ifp, false);
5171         }
5172
5173         /* Parameters shared by all radio interfaces */
5174         if (!mbss) {
5175                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
5176                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5177                                                     is_11d);
5178                         if (err < 0) {
5179                                 bphy_err(drvr, "Regulatory Set Error, %d\n",
5180                                          err);
5181                                 goto exit;
5182                         }
5183                 }
5184                 if (settings->beacon_interval) {
5185                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
5186                                                     settings->beacon_interval);
5187                         if (err < 0) {
5188                                 bphy_err(drvr, "Beacon Interval Set Error, %d\n",
5189                                          err);
5190                                 goto exit;
5191                         }
5192                 }
5193                 if (settings->dtim_period) {
5194                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
5195                                                     settings->dtim_period);
5196                         if (err < 0) {
5197                                 bphy_err(drvr, "DTIM Interval Set Error, %d\n",
5198                                          err);
5199                                 goto exit;
5200                         }
5201                 }
5202
5203                 if ((dev_role == NL80211_IFTYPE_AP) &&
5204                     ((ifp->ifidx == 0) ||
5205                      (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
5206                       !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
5207                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5208                         if (err < 0) {
5209                                 bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
5210                                          err);
5211                                 goto exit;
5212                         }
5213                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
5214                 }
5215
5216                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
5217                 if (err < 0) {
5218                         bphy_err(drvr, "SET INFRA error %d\n", err);
5219                         goto exit;
5220                 }
5221         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
5222                 /* Multiple-BSS should use same 11d configuration */
5223                 err = -EINVAL;
5224                 goto exit;
5225         }
5226
5227         /* Interface specific setup */
5228         if (dev_role == NL80211_IFTYPE_AP) {
5229                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
5230                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
5231
5232                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
5233                 if (err < 0) {
5234                         bphy_err(drvr, "setting AP mode failed %d\n",
5235                                  err);
5236                         goto exit;
5237                 }
5238                 if (!mbss) {
5239                         /* Firmware 10.x requires setting channel after enabling
5240                          * AP and before bringing interface up.
5241                          */
5242                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5243                         if (err < 0) {
5244                                 bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5245                                          chanspec, err);
5246                                 goto exit;
5247                         }
5248                 }
5249                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5250                 if (err < 0) {
5251                         bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
5252                         goto exit;
5253                 }
5254
5255                 if (crypto->psk) {
5256                         brcmf_dbg(INFO, "using PSK offload\n");
5257                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
5258                         err = brcmf_set_pmk(ifp, crypto->psk,
5259                                             BRCMF_WSEC_MAX_PSK_LEN);
5260                         if (err < 0)
5261                                 goto exit;
5262                 }
5263                 if (crypto->sae_pwd) {
5264                         brcmf_dbg(INFO, "using SAE offload\n");
5265                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
5266                         err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
5267                                                      crypto->sae_pwd_len);
5268                         if (err < 0)
5269                                 goto exit;
5270                 }
5271                 if (profile->use_fwauth == 0)
5272                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5273
5274                 err = brcmf_parse_configure_security(ifp, settings,
5275                                                      NL80211_IFTYPE_AP);
5276                 if (err < 0) {
5277                         bphy_err(drvr, "brcmf_parse_configure_security error\n");
5278                         goto exit;
5279                 }
5280
5281                 /* On DOWN the firmware removes the WEP keys, reconfigure
5282                  * them if they were set.
5283                  */
5284                 brcmf_cfg80211_reconfigure_wep(ifp);
5285
5286                 memset(&join_params, 0, sizeof(join_params));
5287                 /* join parameters starts with ssid */
5288                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
5289                 /* create softap */
5290                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5291                                              &join_params, sizeof(join_params));
5292                 if (err < 0) {
5293                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5294                         goto exit;
5295                 }
5296
5297                 err = brcmf_fil_iovar_int_set(ifp, "closednet",
5298                                               settings->hidden_ssid);
5299                 if (err) {
5300                         bphy_err(drvr, "%s closednet error (%d)\n",
5301                                  settings->hidden_ssid ?
5302                                  "enabled" : "disabled",
5303                                  err);
5304                         goto exit;
5305                 }
5306
5307                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
5308         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
5309                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5310                 if (err < 0) {
5311                         bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5312                                  chanspec, err);
5313                         goto exit;
5314                 }
5315
5316                 err = brcmf_parse_configure_security(ifp, settings,
5317                                                      NL80211_IFTYPE_P2P_GO);
5318                 if (err < 0) {
5319                         brcmf_err("brcmf_parse_configure_security error\n");
5320                         goto exit;
5321                 }
5322
5323                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
5324                                                 sizeof(ssid_le));
5325                 if (err < 0) {
5326                         bphy_err(drvr, "setting ssid failed %d\n", err);
5327                         goto exit;
5328                 }
5329                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5330                 bss_enable.enable = cpu_to_le32(1);
5331                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5332                                                sizeof(bss_enable));
5333                 if (err < 0) {
5334                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5335                         goto exit;
5336                 }
5337
5338                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
5339         } else {
5340                 WARN_ON(1);
5341         }
5342
5343         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
5344         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5345         brcmf_net_setcarrier(ifp, true);
5346
5347 exit:
5348         if ((err) && (!mbss)) {
5349                 brcmf_set_mpc(ifp, 1);
5350                 brcmf_configure_arp_nd_offload(ifp, true);
5351         }
5352         return err;
5353 }
5354
5355 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
5356                                   unsigned int link_id)
5357 {
5358         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5359         struct brcmf_if *ifp = netdev_priv(ndev);
5360         struct brcmf_pub *drvr = cfg->pub;
5361         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5362         s32 err;
5363         struct brcmf_fil_bss_enable_le bss_enable;
5364         struct brcmf_join_params join_params;
5365
5366         brcmf_dbg(TRACE, "Enter\n");
5367
5368         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
5369                 /* Due to most likely deauths outstanding we sleep */
5370                 /* first to make sure they get processed by fw. */
5371                 msleep(400);
5372
5373                 if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
5374                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
5375                                 brcmf_set_pmk(ifp, NULL, 0);
5376                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
5377                                 brcmf_set_sae_password(ifp, NULL, 0);
5378                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5379                 }
5380
5381                 if (ifp->vif->mbss) {
5382                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5383                         return err;
5384                 }
5385
5386                 /* First BSS doesn't get a full reset */
5387                 if (ifp->bsscfgidx == 0)
5388                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
5389
5390                 memset(&join_params, 0, sizeof(join_params));
5391                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5392                                              &join_params, sizeof(join_params));
5393                 if (err < 0)
5394                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5395                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5396                 if (err < 0)
5397                         bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
5398                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
5399                 if (err < 0)
5400                         bphy_err(drvr, "setting AP mode failed %d\n", err);
5401                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
5402                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
5403                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5404                                       ifp->vif->is_11d);
5405                 /* Bring device back up so it can be used again */
5406                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5407                 if (err < 0)
5408                         bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
5409
5410                 brcmf_vif_clear_mgmt_ies(ifp->vif);
5411         } else {
5412                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5413                 bss_enable.enable = cpu_to_le32(0);
5414                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5415                                                sizeof(bss_enable));
5416                 if (err < 0)
5417                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5418         }
5419         brcmf_set_mpc(ifp, 1);
5420         brcmf_configure_arp_nd_offload(ifp, true);
5421         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5422         brcmf_net_setcarrier(ifp, false);
5423
5424         return err;
5425 }
5426
5427 static s32
5428 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5429                              struct cfg80211_beacon_data *info)
5430 {
5431         struct brcmf_if *ifp = netdev_priv(ndev);
5432
5433         brcmf_dbg(TRACE, "Enter\n");
5434
5435         return brcmf_config_ap_mgmt_ie(ifp->vif, info);
5436 }
5437
5438 static int
5439 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5440                            struct station_del_parameters *params)
5441 {
5442         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5443         struct brcmf_pub *drvr = cfg->pub;
5444         struct brcmf_scb_val_le scbval;
5445         struct brcmf_if *ifp = netdev_priv(ndev);
5446         s32 err;
5447
5448         if (!params->mac)
5449                 return -EFAULT;
5450
5451         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5452
5453         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5454                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5455         if (!check_vif_up(ifp->vif))
5456                 return -EIO;
5457
5458         memcpy(&scbval.ea, params->mac, ETH_ALEN);
5459         scbval.val = cpu_to_le32(params->reason_code);
5460         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5461                                      &scbval, sizeof(scbval));
5462         if (err)
5463                 bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5464                          err);
5465
5466         brcmf_dbg(TRACE, "Exit\n");
5467         return err;
5468 }
5469
5470 static int
5471 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5472                               const u8 *mac, struct station_parameters *params)
5473 {
5474         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5475         struct brcmf_pub *drvr = cfg->pub;
5476         struct brcmf_if *ifp = netdev_priv(ndev);
5477         s32 err;
5478
5479         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5480                   params->sta_flags_mask, params->sta_flags_set);
5481
5482         /* Ignore all 00 MAC */
5483         if (is_zero_ether_addr(mac))
5484                 return 0;
5485
5486         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5487                 return 0;
5488
5489         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5490                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5491                                              (void *)mac, ETH_ALEN);
5492         else
5493                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5494                                              (void *)mac, ETH_ALEN);
5495         if (err < 0)
5496                 bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5497
5498         return err;
5499 }
5500
5501 static void
5502 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5503                                                struct wireless_dev *wdev,
5504                                                struct mgmt_frame_regs *upd)
5505 {
5506         struct brcmf_cfg80211_vif *vif;
5507
5508         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5509
5510         vif->mgmt_rx_reg = upd->interface_stypes;
5511 }
5512
5513
5514 static int
5515 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5516                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5517 {
5518         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5519         struct ieee80211_channel *chan = params->chan;
5520         struct brcmf_pub *drvr = cfg->pub;
5521         const u8 *buf = params->buf;
5522         size_t len = params->len;
5523         const struct ieee80211_mgmt *mgmt;
5524         struct brcmf_cfg80211_vif *vif;
5525         s32 err = 0;
5526         s32 ie_offset;
5527         s32 ie_len;
5528         struct brcmf_fil_action_frame_le *action_frame;
5529         struct brcmf_fil_af_params_le *af_params;
5530         bool ack;
5531         s32 chan_nr;
5532         u32 freq;
5533
5534         brcmf_dbg(TRACE, "Enter\n");
5535
5536         *cookie = 0;
5537
5538         mgmt = (const struct ieee80211_mgmt *)buf;
5539
5540         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5541                 bphy_err(drvr, "Driver only allows MGMT packet type\n");
5542                 return -EPERM;
5543         }
5544
5545         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5546
5547         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5548                 /* Right now the only reason to get a probe response */
5549                 /* is for p2p listen response or for p2p GO from     */
5550                 /* wpa_supplicant. Unfortunately the probe is send   */
5551                 /* on primary ndev, while dongle wants it on the p2p */
5552                 /* vif. Since this is only reason for a probe        */
5553                 /* response to be sent, the vif is taken from cfg.   */
5554                 /* If ever desired to send proberesp for non p2p     */
5555                 /* response then data should be checked for          */
5556                 /* "DIRECT-". Note in future supplicant will take    */
5557                 /* dedicated p2p wdev to do this and then this 'hack'*/
5558                 /* is not needed anymore.                            */
5559                 ie_offset =  DOT11_MGMT_HDR_LEN +
5560                              DOT11_BCN_PRB_FIXED_LEN;
5561                 ie_len = len - ie_offset;
5562                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5563                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5564                 err = brcmf_vif_set_mgmt_ie(vif,
5565                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
5566                                             &buf[ie_offset],
5567                                             ie_len);
5568                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5569                                         GFP_KERNEL);
5570         } else if (ieee80211_is_action(mgmt->frame_control)) {
5571                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5572                         bphy_err(drvr, "invalid action frame length\n");
5573                         err = -EINVAL;
5574                         goto exit;
5575                 }
5576                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5577                 if (af_params == NULL) {
5578                         bphy_err(drvr, "unable to allocate frame\n");
5579                         err = -ENOMEM;
5580                         goto exit;
5581                 }
5582                 action_frame = &af_params->action_frame;
5583                 /* Add the packet Id */
5584                 action_frame->packet_id = cpu_to_le32(*cookie);
5585                 /* Add BSSID */
5586                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5587                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5588                 /* Add the length exepted for 802.11 header  */
5589                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5590                 /* Add the channel. Use the one specified as parameter if any or
5591                  * the current one (got from the firmware) otherwise
5592                  */
5593                 if (chan)
5594                         freq = chan->center_freq;
5595                 else
5596                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5597                                               &freq);
5598                 chan_nr = ieee80211_frequency_to_channel(freq);
5599                 af_params->channel = cpu_to_le32(chan_nr);
5600                 af_params->dwell_time = cpu_to_le32(params->wait);
5601                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5602                        le16_to_cpu(action_frame->len));
5603
5604                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5605                           *cookie, le16_to_cpu(action_frame->len), freq);
5606
5607                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5608                                                   af_params);
5609
5610                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5611                                         GFP_KERNEL);
5612                 kfree(af_params);
5613         } else {
5614                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5615                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5616         }
5617
5618 exit:
5619         return err;
5620 }
5621
5622 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5623                                                     struct net_device *ndev,
5624                                                     s32 rssi_low, s32 rssi_high)
5625 {
5626         struct brcmf_cfg80211_vif *vif;
5627         struct brcmf_if *ifp;
5628         int err = 0;
5629
5630         brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5631
5632         ifp = netdev_priv(ndev);
5633         vif = ifp->vif;
5634
5635         if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5636                 /* The firmware will send an event when the RSSI is less than or
5637                  * equal to a configured level and the previous RSSI event was
5638                  * less than or equal to a different level. Set a third level
5639                  * so that we also detect the transition from rssi <= rssi_high
5640                  * to rssi > rssi_high.
5641                  */
5642                 struct brcmf_rssi_event_le config = {
5643                         .rate_limit_msec = cpu_to_le32(0),
5644                         .rssi_level_num = 3,
5645                         .rssi_levels = {
5646                                 clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5647                                 clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5648                                 S8_MAX,
5649                         },
5650                 };
5651
5652                 err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5653                                                sizeof(config));
5654                 if (err) {
5655                         err = -EINVAL;
5656                 } else {
5657                         vif->cqm_rssi_low = rssi_low;
5658                         vif->cqm_rssi_high = rssi_high;
5659                 }
5660         }
5661
5662         return err;
5663 }
5664
5665 static int
5666 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5667                                         struct wireless_dev *wdev,
5668                                         u64 cookie)
5669 {
5670         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5671         struct brcmf_pub *drvr = cfg->pub;
5672         struct brcmf_cfg80211_vif *vif;
5673         int err = 0;
5674
5675         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5676
5677         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5678         if (vif == NULL) {
5679                 bphy_err(drvr, "No p2p device available for probe response\n");
5680                 err = -ENODEV;
5681                 goto exit;
5682         }
5683         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5684 exit:
5685         return err;
5686 }
5687
5688 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5689                                       struct wireless_dev *wdev,
5690                                       unsigned int link_id,
5691                                       struct cfg80211_chan_def *chandef)
5692 {
5693         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5694         struct net_device *ndev = wdev->netdev;
5695         struct brcmf_pub *drvr = cfg->pub;
5696         struct brcmu_chan ch;
5697         enum nl80211_band band = 0;
5698         enum nl80211_chan_width width = 0;
5699         u32 chanspec;
5700         int freq, err;
5701
5702         if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5703                 return -ENODEV;
5704
5705         err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5706         if (err) {
5707                 bphy_err(drvr, "chanspec failed (%d)\n", err);
5708                 return err;
5709         }
5710
5711         ch.chspec = chanspec;
5712         cfg->d11inf.decchspec(&ch);
5713
5714         switch (ch.band) {
5715         case BRCMU_CHAN_BAND_2G:
5716                 band = NL80211_BAND_2GHZ;
5717                 break;
5718         case BRCMU_CHAN_BAND_5G:
5719                 band = NL80211_BAND_5GHZ;
5720                 break;
5721         }
5722
5723         switch (ch.bw) {
5724         case BRCMU_CHAN_BW_80:
5725                 width = NL80211_CHAN_WIDTH_80;
5726                 break;
5727         case BRCMU_CHAN_BW_40:
5728                 width = NL80211_CHAN_WIDTH_40;
5729                 break;
5730         case BRCMU_CHAN_BW_20:
5731                 width = NL80211_CHAN_WIDTH_20;
5732                 break;
5733         case BRCMU_CHAN_BW_80P80:
5734                 width = NL80211_CHAN_WIDTH_80P80;
5735                 break;
5736         case BRCMU_CHAN_BW_160:
5737                 width = NL80211_CHAN_WIDTH_160;
5738                 break;
5739         }
5740
5741         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5742         chandef->chan = ieee80211_get_channel(wiphy, freq);
5743         chandef->width = width;
5744         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5745         chandef->center_freq2 = 0;
5746
5747         return 0;
5748 }
5749
5750 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5751                                            struct wireless_dev *wdev,
5752                                            enum nl80211_crit_proto_id proto,
5753                                            u16 duration)
5754 {
5755         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5756         struct brcmf_cfg80211_vif *vif;
5757
5758         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5759
5760         /* only DHCP support for now */
5761         if (proto != NL80211_CRIT_PROTO_DHCP)
5762                 return -EINVAL;
5763
5764         /* suppress and abort scanning */
5765         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5766         brcmf_abort_scanning(cfg);
5767
5768         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5769 }
5770
5771 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5772                                            struct wireless_dev *wdev)
5773 {
5774         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5775         struct brcmf_cfg80211_vif *vif;
5776
5777         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5778
5779         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5780         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5781 }
5782
5783 static s32
5784 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5785                              const struct brcmf_event_msg *e, void *data)
5786 {
5787         switch (e->reason) {
5788         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5789                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5790                 break;
5791         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5792                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5793                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5794                 break;
5795         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5796                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5797                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5798                 break;
5799         }
5800
5801         return 0;
5802 }
5803
5804 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5805 {
5806         int ret;
5807
5808         switch (oper) {
5809         case NL80211_TDLS_DISCOVERY_REQ:
5810                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5811                 break;
5812         case NL80211_TDLS_SETUP:
5813                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5814                 break;
5815         case NL80211_TDLS_TEARDOWN:
5816                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5817                 break;
5818         default:
5819                 brcmf_err("unsupported operation: %d\n", oper);
5820                 ret = -EOPNOTSUPP;
5821         }
5822         return ret;
5823 }
5824
5825 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5826                                     struct net_device *ndev, const u8 *peer,
5827                                     enum nl80211_tdls_operation oper)
5828 {
5829         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5830         struct brcmf_pub *drvr = cfg->pub;
5831         struct brcmf_if *ifp;
5832         struct brcmf_tdls_iovar_le info;
5833         int ret = 0;
5834
5835         ret = brcmf_convert_nl80211_tdls_oper(oper);
5836         if (ret < 0)
5837                 return ret;
5838
5839         ifp = netdev_priv(ndev);
5840         memset(&info, 0, sizeof(info));
5841         info.mode = (u8)ret;
5842         if (peer)
5843                 memcpy(info.ea, peer, ETH_ALEN);
5844
5845         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5846                                        &info, sizeof(info));
5847         if (ret < 0)
5848                 bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5849
5850         return ret;
5851 }
5852
5853 static int
5854 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5855                                   struct net_device *ndev,
5856                                   struct cfg80211_connect_params *sme,
5857                                   u32 changed)
5858 {
5859         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5860         struct brcmf_pub *drvr = cfg->pub;
5861         struct brcmf_if *ifp;
5862         int err;
5863
5864         if (!(changed & UPDATE_ASSOC_IES))
5865                 return 0;
5866
5867         ifp = netdev_priv(ndev);
5868         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5869                                     sme->ie, sme->ie_len);
5870         if (err)
5871                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5872         else
5873                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5874
5875         return err;
5876 }
5877
5878 #ifdef CONFIG_PM
5879 static int
5880 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5881                               struct cfg80211_gtk_rekey_data *gtk)
5882 {
5883         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5884         struct brcmf_pub *drvr = cfg->pub;
5885         struct brcmf_if *ifp = netdev_priv(ndev);
5886         struct brcmf_gtk_keyinfo_le gtk_le;
5887         int ret;
5888
5889         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5890
5891         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5892         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5893         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5894                sizeof(gtk_le.replay_counter));
5895
5896         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5897                                        sizeof(gtk_le));
5898         if (ret < 0)
5899                 bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5900
5901         return ret;
5902 }
5903 #endif
5904
5905 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5906                                   const struct cfg80211_pmk_conf *conf)
5907 {
5908         struct brcmf_if *ifp;
5909
5910         brcmf_dbg(TRACE, "enter\n");
5911
5912         /* expect using firmware supplicant for 1X */
5913         ifp = netdev_priv(dev);
5914         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5915                 return -EINVAL;
5916
5917         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5918                 return -ERANGE;
5919
5920         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5921 }
5922
5923 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5924                                   const u8 *aa)
5925 {
5926         struct brcmf_if *ifp;
5927
5928         brcmf_dbg(TRACE, "enter\n");
5929         ifp = netdev_priv(dev);
5930         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5931                 return -EINVAL;
5932
5933         return brcmf_set_pmk(ifp, NULL, 0);
5934 }
5935
5936 static struct cfg80211_ops brcmf_cfg80211_ops = {
5937         .add_virtual_intf = brcmf_cfg80211_add_iface,
5938         .del_virtual_intf = brcmf_cfg80211_del_iface,
5939         .change_virtual_intf = brcmf_cfg80211_change_iface,
5940         .scan = brcmf_cfg80211_scan,
5941         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5942         .join_ibss = brcmf_cfg80211_join_ibss,
5943         .leave_ibss = brcmf_cfg80211_leave_ibss,
5944         .get_station = brcmf_cfg80211_get_station,
5945         .dump_station = brcmf_cfg80211_dump_station,
5946         .set_tx_power = brcmf_cfg80211_set_tx_power,
5947         .get_tx_power = brcmf_cfg80211_get_tx_power,
5948         .add_key = brcmf_cfg80211_add_key,
5949         .del_key = brcmf_cfg80211_del_key,
5950         .get_key = brcmf_cfg80211_get_key,
5951         .set_default_key = brcmf_cfg80211_config_default_key,
5952         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5953         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5954         .connect = brcmf_cfg80211_connect,
5955         .disconnect = brcmf_cfg80211_disconnect,
5956         .suspend = brcmf_cfg80211_suspend,
5957         .resume = brcmf_cfg80211_resume,
5958         .set_pmksa = brcmf_cfg80211_set_pmksa,
5959         .del_pmksa = brcmf_cfg80211_del_pmksa,
5960         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5961         .start_ap = brcmf_cfg80211_start_ap,
5962         .stop_ap = brcmf_cfg80211_stop_ap,
5963         .change_beacon = brcmf_cfg80211_change_beacon,
5964         .del_station = brcmf_cfg80211_del_station,
5965         .change_station = brcmf_cfg80211_change_station,
5966         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5967         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5968         .update_mgmt_frame_registrations =
5969                 brcmf_cfg80211_update_mgmt_frame_registrations,
5970         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5971         .set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
5972         .remain_on_channel = brcmf_p2p_remain_on_channel,
5973         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5974         .get_channel = brcmf_cfg80211_get_channel,
5975         .start_p2p_device = brcmf_p2p_start_device,
5976         .stop_p2p_device = brcmf_p2p_stop_device,
5977         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5978         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5979         .tdls_oper = brcmf_cfg80211_tdls_oper,
5980         .update_connect_params = brcmf_cfg80211_update_conn_params,
5981         .set_pmk = brcmf_cfg80211_set_pmk,
5982         .del_pmk = brcmf_cfg80211_del_pmk,
5983 };
5984
5985 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
5986 {
5987         struct cfg80211_ops *ops;
5988
5989         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5990                        GFP_KERNEL);
5991
5992         if (ops && settings->roamoff)
5993                 ops->update_connect_params = NULL;
5994
5995         return ops;
5996 }
5997
5998 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5999                                            enum nl80211_iftype type)
6000 {
6001         struct brcmf_cfg80211_vif *vif_walk;
6002         struct brcmf_cfg80211_vif *vif;
6003         bool mbss;
6004         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
6005
6006         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
6007                   sizeof(*vif));
6008         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
6009         if (!vif)
6010                 return ERR_PTR(-ENOMEM);
6011
6012         vif->wdev.wiphy = cfg->wiphy;
6013         vif->wdev.iftype = type;
6014
6015         brcmf_init_prof(&vif->profile);
6016
6017         if (type == NL80211_IFTYPE_AP &&
6018             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
6019                 mbss = false;
6020                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
6021                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
6022                                 mbss = true;
6023                                 break;
6024                         }
6025                 }
6026                 vif->mbss = mbss;
6027         }
6028
6029         list_add_tail(&vif->list, &cfg->vif_list);
6030         return vif;
6031 }
6032
6033 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
6034 {
6035         list_del(&vif->list);
6036         kfree(vif);
6037 }
6038
6039 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
6040 {
6041         struct brcmf_cfg80211_vif *vif;
6042         struct brcmf_if *ifp;
6043
6044         ifp = netdev_priv(ndev);
6045         vif = ifp->vif;
6046
6047         if (vif)
6048                 brcmf_free_vif(vif);
6049 }
6050
6051 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
6052                             const struct brcmf_event_msg *e)
6053 {
6054         u32 event = e->event_code;
6055         u32 status = e->status;
6056
6057         if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
6058              vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
6059             event == BRCMF_E_PSK_SUP &&
6060             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
6061                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6062         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
6063                 brcmf_dbg(CONN, "Processing set ssid\n");
6064                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
6065                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
6066                     vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
6067                         return true;
6068
6069                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6070         }
6071
6072         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
6073             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
6074                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6075                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6076                 return true;
6077         }
6078         return false;
6079 }
6080
6081 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
6082                             const struct brcmf_event_msg *e)
6083 {
6084         u32 event = e->event_code;
6085         u16 flags = e->flags;
6086
6087         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
6088             (event == BRCMF_E_DISASSOC_IND) ||
6089             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
6090                 brcmf_dbg(CONN, "Processing link down\n");
6091                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6092                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6093                 return true;
6094         }
6095         return false;
6096 }
6097
6098 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
6099                                const struct brcmf_event_msg *e)
6100 {
6101         u32 event = e->event_code;
6102         u32 status = e->status;
6103
6104         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
6105                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
6106                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
6107                 return true;
6108         }
6109
6110         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
6111                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
6112                 return true;
6113         }
6114
6115         if (event == BRCMF_E_PSK_SUP &&
6116             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
6117                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
6118                           status);
6119                 return true;
6120         }
6121
6122         return false;
6123 }
6124
6125 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
6126 {
6127         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6128
6129         kfree(conn_info->req_ie);
6130         conn_info->req_ie = NULL;
6131         conn_info->req_ie_len = 0;
6132         kfree(conn_info->resp_ie);
6133         conn_info->resp_ie = NULL;
6134         conn_info->resp_ie_len = 0;
6135 }
6136
6137 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
6138 {
6139         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6140
6141         if (!cfg)
6142                 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
6143                        (prio ^ 2) : prio;
6144
6145         /* For those AC(s) with ACM flag set to 1, convert its 4-level priority
6146          * to an 8-level precedence which is the same as BE's
6147          */
6148         if (prio > PRIO_8021D_EE &&
6149             cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
6150                 return cfg->ac_priority[prio] * 2;
6151
6152         /* Conversion of 4-level priority to 8-level precedence */
6153         if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
6154             prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
6155                 return cfg->ac_priority[prio] * 2;
6156         else
6157                 return cfg->ac_priority[prio] * 2 + 1;
6158 }
6159
6160 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
6161 {
6162         /* Prio here refers to the 802.1d priority in range of 0 to 7.
6163          * ACI here refers to the WLAN AC Index in range of 0 to 3.
6164          * This function will return ACI corresponding to input prio.
6165          */
6166         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6167
6168         if (cfg)
6169                 return cfg->ac_priority[prio];
6170
6171         return prio;
6172 }
6173
6174 static void brcmf_init_wmm_prio(u8 *priority)
6175 {
6176         /* Initialize AC priority array to default
6177          * 802.1d priority as per following table:
6178          * 802.1d prio 0,3 maps to BE
6179          * 802.1d prio 1,2 maps to BK
6180          * 802.1d prio 4,5 maps to VI
6181          * 802.1d prio 6,7 maps to VO
6182          */
6183         priority[0] = BRCMF_FWS_FIFO_AC_BE;
6184         priority[3] = BRCMF_FWS_FIFO_AC_BE;
6185         priority[1] = BRCMF_FWS_FIFO_AC_BK;
6186         priority[2] = BRCMF_FWS_FIFO_AC_BK;
6187         priority[4] = BRCMF_FWS_FIFO_AC_VI;
6188         priority[5] = BRCMF_FWS_FIFO_AC_VI;
6189         priority[6] = BRCMF_FWS_FIFO_AC_VO;
6190         priority[7] = BRCMF_FWS_FIFO_AC_VO;
6191 }
6192
6193 static void brcmf_wifi_prioritize_acparams(const
6194         struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
6195 {
6196         u8 aci;
6197         u8 aifsn;
6198         u8 ecwmin;
6199         u8 ecwmax;
6200         u8 acm;
6201         u8 ranking_basis[EDCF_AC_COUNT];
6202         u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
6203         u8 index;
6204
6205         for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
6206                 aifsn  = acp->ACI & EDCF_AIFSN_MASK;
6207                 acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
6208                 ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
6209                 ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
6210                 brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
6211                           aci, aifsn, acm, ecwmin, ecwmax);
6212                 /* Default AC_VO will be the lowest ranking value */
6213                 ranking_basis[aci] = aifsn + ecwmin + ecwmax;
6214                 /* Initialise priority starting at 0 (AC_BE) */
6215                 aci_prio[aci] = 0;
6216
6217                 /* If ACM is set, STA can't use this AC as per 802.11.
6218                  * Change the ranking to BE
6219                  */
6220                 if (aci != AC_BE && aci != AC_BK && acm == 1)
6221                         ranking_basis[aci] = ranking_basis[AC_BE];
6222         }
6223
6224         /* Ranking method which works for AC priority
6225          * swapping when values for cwmin, cwmax and aifsn are varied
6226          * Compare each aci_prio against each other aci_prio
6227          */
6228         for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
6229                 for (index = 0; index < EDCF_AC_COUNT; index++) {
6230                         if (index != aci) {
6231                                 /* Smaller ranking value has higher priority,
6232                                  * so increment priority for each ACI which has
6233                                  * a higher ranking value
6234                                  */
6235                                 if (ranking_basis[aci] < ranking_basis[index])
6236                                         aci_prio[aci]++;
6237                         }
6238                 }
6239         }
6240
6241         /* By now, aci_prio[] will be in range of 0 to 3.
6242          * Use ACI prio to get the new priority value for
6243          * each 802.1d traffic type, in this range.
6244          */
6245         if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
6246               aci_prio[AC_BK] == aci_prio[AC_VI] &&
6247               aci_prio[AC_VI] == aci_prio[AC_VO])) {
6248                 /* 802.1d 0,3 maps to BE */
6249                 priority[0] = aci_prio[AC_BE];
6250                 priority[3] = aci_prio[AC_BE];
6251
6252                 /* 802.1d 1,2 maps to BK */
6253                 priority[1] = aci_prio[AC_BK];
6254                 priority[2] = aci_prio[AC_BK];
6255
6256                 /* 802.1d 4,5 maps to VO */
6257                 priority[4] = aci_prio[AC_VI];
6258                 priority[5] = aci_prio[AC_VI];
6259
6260                 /* 802.1d 6,7 maps to VO */
6261                 priority[6] = aci_prio[AC_VO];
6262                 priority[7] = aci_prio[AC_VO];
6263         } else {
6264                 /* Initialize to default priority */
6265                 brcmf_init_wmm_prio(priority);
6266         }
6267
6268         brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
6269                   priority[0], priority[1], priority[2], priority[3]);
6270
6271         brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
6272                   priority[4], priority[5], priority[6], priority[7]);
6273 }
6274
6275 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
6276                                struct brcmf_if *ifp)
6277 {
6278         struct brcmf_pub *drvr = cfg->pub;
6279         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
6280         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6281         struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
6282         u32 req_len;
6283         u32 resp_len;
6284         s32 err = 0;
6285
6286         brcmf_clear_assoc_ies(cfg);
6287
6288         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
6289                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
6290         if (err) {
6291                 bphy_err(drvr, "could not get assoc info (%d)\n", err);
6292                 return err;
6293         }
6294         assoc_info =
6295                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
6296         req_len = le32_to_cpu(assoc_info->req_len);
6297         resp_len = le32_to_cpu(assoc_info->resp_len);
6298         if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
6299                 bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
6300                          req_len, resp_len);
6301                 return -EINVAL;
6302         }
6303         if (req_len) {
6304                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
6305                                                cfg->extra_buf,
6306                                                WL_ASSOC_INFO_MAX);
6307                 if (err) {
6308                         bphy_err(drvr, "could not get assoc req (%d)\n", err);
6309                         return err;
6310                 }
6311                 conn_info->req_ie_len = req_len;
6312                 conn_info->req_ie =
6313                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
6314                             GFP_KERNEL);
6315                 if (!conn_info->req_ie)
6316                         conn_info->req_ie_len = 0;
6317         } else {
6318                 conn_info->req_ie_len = 0;
6319                 conn_info->req_ie = NULL;
6320         }
6321         if (resp_len) {
6322                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
6323                                                cfg->extra_buf,
6324                                                WL_ASSOC_INFO_MAX);
6325                 if (err) {
6326                         bphy_err(drvr, "could not get assoc resp (%d)\n", err);
6327                         return err;
6328                 }
6329                 conn_info->resp_ie_len = resp_len;
6330                 conn_info->resp_ie =
6331                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
6332                             GFP_KERNEL);
6333                 if (!conn_info->resp_ie)
6334                         conn_info->resp_ie_len = 0;
6335
6336                 err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
6337                                                edcf_acparam_info,
6338                                                sizeof(edcf_acparam_info));
6339                 if (err) {
6340                         brcmf_err("could not get wme_ac_sta (%d)\n", err);
6341                         return err;
6342                 }
6343
6344                 brcmf_wifi_prioritize_acparams(edcf_acparam_info,
6345                                                cfg->ac_priority);
6346         } else {
6347                 conn_info->resp_ie_len = 0;
6348                 conn_info->resp_ie = NULL;
6349         }
6350         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
6351                   conn_info->req_ie_len, conn_info->resp_ie_len);
6352
6353         return err;
6354 }
6355
6356 static s32
6357 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
6358                        struct net_device *ndev,
6359                        const struct brcmf_event_msg *e)
6360 {
6361         struct brcmf_if *ifp = netdev_priv(ndev);
6362         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6363         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6364         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6365         struct ieee80211_channel *notify_channel = NULL;
6366         struct ieee80211_supported_band *band;
6367         struct brcmf_bss_info_le *bi;
6368         struct brcmu_chan ch;
6369         struct cfg80211_roam_info roam_info = {};
6370         u32 freq;
6371         s32 err = 0;
6372         u8 *buf;
6373
6374         brcmf_dbg(TRACE, "Enter\n");
6375
6376         brcmf_get_assoc_ies(cfg, ifp);
6377         memcpy(profile->bssid, e->addr, ETH_ALEN);
6378         brcmf_update_bss_info(cfg, ifp);
6379
6380         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
6381         if (buf == NULL) {
6382                 err = -ENOMEM;
6383                 goto done;
6384         }
6385
6386         /* data sent to dongle has to be little endian */
6387         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
6388         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
6389                                      buf, WL_BSS_INFO_MAX);
6390
6391         if (err)
6392                 goto done;
6393
6394         bi = (struct brcmf_bss_info_le *)(buf + 4);
6395         ch.chspec = le16_to_cpu(bi->chanspec);
6396         cfg->d11inf.decchspec(&ch);
6397
6398         if (ch.band == BRCMU_CHAN_BAND_2G)
6399                 band = wiphy->bands[NL80211_BAND_2GHZ];
6400         else
6401                 band = wiphy->bands[NL80211_BAND_5GHZ];
6402
6403         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
6404         notify_channel = ieee80211_get_channel(wiphy, freq);
6405
6406 done:
6407         kfree(buf);
6408
6409         roam_info.links[0].channel = notify_channel;
6410         roam_info.links[0].bssid = profile->bssid;
6411         roam_info.req_ie = conn_info->req_ie;
6412         roam_info.req_ie_len = conn_info->req_ie_len;
6413         roam_info.resp_ie = conn_info->resp_ie;
6414         roam_info.resp_ie_len = conn_info->resp_ie_len;
6415
6416         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6417         brcmf_dbg(CONN, "Report roaming result\n");
6418
6419         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6420                 cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
6421                 brcmf_dbg(CONN, "Report port authorized\n");
6422         }
6423
6424         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6425         brcmf_dbg(TRACE, "Exit\n");
6426         return err;
6427 }
6428
6429 static s32
6430 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6431                        struct net_device *ndev, const struct brcmf_event_msg *e,
6432                        bool completed)
6433 {
6434         struct brcmf_if *ifp = netdev_priv(ndev);
6435         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6436         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6437         struct cfg80211_connect_resp_params conn_params;
6438
6439         brcmf_dbg(TRACE, "Enter\n");
6440
6441         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6442                                &ifp->vif->sme_state)) {
6443                 memset(&conn_params, 0, sizeof(conn_params));
6444                 if (completed) {
6445                         brcmf_get_assoc_ies(cfg, ifp);
6446                         brcmf_update_bss_info(cfg, ifp);
6447                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6448                                 &ifp->vif->sme_state);
6449                         conn_params.status = WLAN_STATUS_SUCCESS;
6450                 } else {
6451                         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS,
6452                                   &ifp->vif->sme_state);
6453                         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
6454                                   &ifp->vif->sme_state);
6455                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6456                 }
6457                 conn_params.links[0].bssid = profile->bssid;
6458                 conn_params.req_ie = conn_info->req_ie;
6459                 conn_params.req_ie_len = conn_info->req_ie_len;
6460                 conn_params.resp_ie = conn_info->resp_ie;
6461                 conn_params.resp_ie_len = conn_info->resp_ie_len;
6462                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6463                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
6464                           completed ? "succeeded" : "failed");
6465         }
6466         brcmf_dbg(TRACE, "Exit\n");
6467         return 0;
6468 }
6469
6470 static s32
6471 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6472                                struct net_device *ndev,
6473                                const struct brcmf_event_msg *e, void *data)
6474 {
6475         struct brcmf_pub *drvr = cfg->pub;
6476         static int generation;
6477         u32 event = e->event_code;
6478         u32 reason = e->reason;
6479         struct station_info *sinfo;
6480
6481         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6482                   brcmf_fweh_event_name(event), event, reason);
6483         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6484             ndev != cfg_to_ndev(cfg)) {
6485                 brcmf_dbg(CONN, "AP mode link down\n");
6486                 complete(&cfg->vif_disabled);
6487                 return 0;
6488         }
6489
6490         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6491             (reason == BRCMF_E_STATUS_SUCCESS)) {
6492                 if (!data) {
6493                         bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6494                         return -EINVAL;
6495                 }
6496
6497                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6498                 if (!sinfo)
6499                         return -ENOMEM;
6500
6501                 sinfo->assoc_req_ies = data;
6502                 sinfo->assoc_req_ies_len = e->datalen;
6503                 generation++;
6504                 sinfo->generation = generation;
6505                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6506
6507                 kfree(sinfo);
6508         } else if ((event == BRCMF_E_DISASSOC_IND) ||
6509                    (event == BRCMF_E_DEAUTH_IND) ||
6510                    (event == BRCMF_E_DEAUTH)) {
6511                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6512         }
6513         return 0;
6514 }
6515
6516 static s32
6517 brcmf_notify_connect_status(struct brcmf_if *ifp,
6518                             const struct brcmf_event_msg *e, void *data)
6519 {
6520         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6521         struct net_device *ndev = ifp->ndev;
6522         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6523         struct ieee80211_channel *chan;
6524         s32 err = 0;
6525
6526         if ((e->event_code == BRCMF_E_DEAUTH) ||
6527             (e->event_code == BRCMF_E_DEAUTH_IND) ||
6528             (e->event_code == BRCMF_E_DISASSOC_IND) ||
6529             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6530                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6531         }
6532
6533         if (brcmf_is_apmode(ifp->vif)) {
6534                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6535         } else if (brcmf_is_linkup(ifp->vif, e)) {
6536                 brcmf_dbg(CONN, "Linkup\n");
6537                 if (brcmf_is_ibssmode(ifp->vif)) {
6538                         brcmf_inform_ibss(cfg, ndev, e->addr);
6539                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6540                         memcpy(profile->bssid, e->addr, ETH_ALEN);
6541                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6542                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6543                                   &ifp->vif->sme_state);
6544                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6545                                 &ifp->vif->sme_state);
6546                 } else
6547                         brcmf_bss_connect_done(cfg, ndev, e, true);
6548                 brcmf_net_setcarrier(ifp, true);
6549         } else if (brcmf_is_linkdown(ifp->vif, e)) {
6550                 brcmf_dbg(CONN, "Linkdown\n");
6551                 if (!brcmf_is_ibssmode(ifp->vif) &&
6552                     (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6553                               &ifp->vif->sme_state) ||
6554                      test_bit(BRCMF_VIF_STATUS_CONNECTING,
6555                               &ifp->vif->sme_state))) {
6556                         if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6557                                      &ifp->vif->sme_state) &&
6558                             memcmp(profile->bssid, e->addr, ETH_ALEN))
6559                                 return err;
6560
6561                         brcmf_bss_connect_done(cfg, ndev, e, false);
6562                         brcmf_link_down(ifp->vif,
6563                                         brcmf_map_fw_linkdown_reason(e),
6564                                         e->event_code &
6565                                         (BRCMF_E_DEAUTH_IND |
6566                                         BRCMF_E_DISASSOC_IND)
6567                                         ? false : true);
6568                         brcmf_init_prof(ndev_to_prof(ndev));
6569                         if (ndev != cfg_to_ndev(cfg))
6570                                 complete(&cfg->vif_disabled);
6571                         brcmf_net_setcarrier(ifp, false);
6572                 }
6573         } else if (brcmf_is_nonetwork(cfg, e)) {
6574                 if (brcmf_is_ibssmode(ifp->vif))
6575                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6576                                   &ifp->vif->sme_state);
6577                 else
6578                         brcmf_bss_connect_done(cfg, ndev, e, false);
6579         }
6580
6581         return err;
6582 }
6583
6584 static s32
6585 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6586                             const struct brcmf_event_msg *e, void *data)
6587 {
6588         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6589         u32 event = e->event_code;
6590         u32 status = e->status;
6591
6592         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6593                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6594                              &ifp->vif->sme_state)) {
6595                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6596                 } else {
6597                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6598                         brcmf_net_setcarrier(ifp, true);
6599                 }
6600         }
6601
6602         return 0;
6603 }
6604
6605 static s32
6606 brcmf_notify_mic_status(struct brcmf_if *ifp,
6607                         const struct brcmf_event_msg *e, void *data)
6608 {
6609         u16 flags = e->flags;
6610         enum nl80211_key_type key_type;
6611
6612         if (flags & BRCMF_EVENT_MSG_GROUP)
6613                 key_type = NL80211_KEYTYPE_GROUP;
6614         else
6615                 key_type = NL80211_KEYTYPE_PAIRWISE;
6616
6617         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6618                                      NULL, GFP_KERNEL);
6619
6620         return 0;
6621 }
6622
6623 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6624                              const struct brcmf_event_msg *e, void *data)
6625 {
6626         struct brcmf_cfg80211_vif *vif = ifp->vif;
6627         struct brcmf_rssi_be *info = data;
6628         s32 rssi, snr = 0, noise = 0;
6629         s32 low, high, last;
6630
6631         if (e->datalen >= sizeof(*info)) {
6632                 rssi = be32_to_cpu(info->rssi);
6633                 snr = be32_to_cpu(info->snr);
6634                 noise = be32_to_cpu(info->noise);
6635         } else if (e->datalen >= sizeof(rssi)) {
6636                 rssi = be32_to_cpu(*(__be32 *)data);
6637         } else {
6638                 brcmf_err("insufficient RSSI event data\n");
6639                 return 0;
6640         }
6641
6642         low = vif->cqm_rssi_low;
6643         high = vif->cqm_rssi_high;
6644         last = vif->cqm_rssi_last;
6645
6646         brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6647                   rssi, snr, noise, low, high, last);
6648
6649         vif->cqm_rssi_last = rssi;
6650
6651         if (rssi <= low || rssi == 0) {
6652                 brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6653                 cfg80211_cqm_rssi_notify(ifp->ndev,
6654                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6655                                          rssi, GFP_KERNEL);
6656         } else if (rssi > high) {
6657                 brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6658                 cfg80211_cqm_rssi_notify(ifp->ndev,
6659                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6660                                          rssi, GFP_KERNEL);
6661         }
6662
6663         return 0;
6664 }
6665
6666 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6667                                   const struct brcmf_event_msg *e, void *data)
6668 {
6669         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6670         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6671         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6672         struct brcmf_cfg80211_vif *vif;
6673
6674         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6675                   ifevent->action, ifevent->flags, ifevent->ifidx,
6676                   ifevent->bsscfgidx);
6677
6678         spin_lock(&event->vif_event_lock);
6679         event->action = ifevent->action;
6680         vif = event->vif;
6681
6682         switch (ifevent->action) {
6683         case BRCMF_E_IF_ADD:
6684                 /* waiting process may have timed out */
6685                 if (!cfg->vif_event.vif) {
6686                         spin_unlock(&event->vif_event_lock);
6687                         return -EBADF;
6688                 }
6689
6690                 ifp->vif = vif;
6691                 vif->ifp = ifp;
6692                 if (ifp->ndev) {
6693                         vif->wdev.netdev = ifp->ndev;
6694                         ifp->ndev->ieee80211_ptr = &vif->wdev;
6695                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6696                 }
6697                 spin_unlock(&event->vif_event_lock);
6698                 wake_up(&event->vif_wq);
6699                 return 0;
6700
6701         case BRCMF_E_IF_DEL:
6702                 spin_unlock(&event->vif_event_lock);
6703                 /* event may not be upon user request */
6704                 if (brcmf_cfg80211_vif_event_armed(cfg))
6705                         wake_up(&event->vif_wq);
6706                 return 0;
6707
6708         case BRCMF_E_IF_CHANGE:
6709                 spin_unlock(&event->vif_event_lock);
6710                 wake_up(&event->vif_wq);
6711                 return 0;
6712
6713         default:
6714                 spin_unlock(&event->vif_event_lock);
6715                 break;
6716         }
6717         return -EINVAL;
6718 }
6719
6720 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6721 {
6722         conf->frag_threshold = (u32)-1;
6723         conf->rts_threshold = (u32)-1;
6724         conf->retry_short = (u32)-1;
6725         conf->retry_long = (u32)-1;
6726 }
6727
6728 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6729 {
6730         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6731                             brcmf_notify_connect_status);
6732         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6733                             brcmf_notify_connect_status);
6734         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6735                             brcmf_notify_connect_status);
6736         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6737                             brcmf_notify_connect_status);
6738         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6739                             brcmf_notify_connect_status);
6740         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6741                             brcmf_notify_connect_status);
6742         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6743                             brcmf_notify_roaming_status);
6744         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6745                             brcmf_notify_mic_status);
6746         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6747                             brcmf_notify_connect_status);
6748         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6749                             brcmf_notify_sched_scan_results);
6750         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6751                             brcmf_notify_vif_event);
6752         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6753                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6754         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6755                             brcmf_p2p_notify_listen_complete);
6756         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6757                             brcmf_p2p_notify_action_frame_rx);
6758         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6759                             brcmf_p2p_notify_action_tx_complete);
6760         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6761                             brcmf_p2p_notify_action_tx_complete);
6762         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6763                             brcmf_notify_connect_status);
6764         brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
6765 }
6766
6767 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6768 {
6769         kfree(cfg->conf);
6770         cfg->conf = NULL;
6771         kfree(cfg->extra_buf);
6772         cfg->extra_buf = NULL;
6773         kfree(cfg->wowl.nd);
6774         cfg->wowl.nd = NULL;
6775         kfree(cfg->wowl.nd_info);
6776         cfg->wowl.nd_info = NULL;
6777         kfree(cfg->escan_info.escan_buf);
6778         cfg->escan_info.escan_buf = NULL;
6779 }
6780
6781 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
6782 {
6783         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
6784         if (!cfg->conf)
6785                 goto init_priv_mem_out;
6786         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
6787         if (!cfg->extra_buf)
6788                 goto init_priv_mem_out;
6789         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
6790         if (!cfg->wowl.nd)
6791                 goto init_priv_mem_out;
6792         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
6793                                     sizeof(struct cfg80211_wowlan_nd_match *),
6794                                     GFP_KERNEL);
6795         if (!cfg->wowl.nd_info)
6796                 goto init_priv_mem_out;
6797         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
6798         if (!cfg->escan_info.escan_buf)
6799                 goto init_priv_mem_out;
6800
6801         return 0;
6802
6803 init_priv_mem_out:
6804         brcmf_deinit_priv_mem(cfg);
6805
6806         return -ENOMEM;
6807 }
6808
6809 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
6810 {
6811         s32 err = 0;
6812
6813         cfg->scan_request = NULL;
6814         cfg->pwr_save = true;
6815         cfg->dongle_up = false;         /* dongle is not up yet */
6816         err = brcmf_init_priv_mem(cfg);
6817         if (err)
6818                 return err;
6819         brcmf_register_event_handlers(cfg);
6820         mutex_init(&cfg->usr_sync);
6821         brcmf_init_escan(cfg);
6822         brcmf_init_conf(cfg->conf);
6823         brcmf_init_wmm_prio(cfg->ac_priority);
6824         init_completion(&cfg->vif_disabled);
6825         return err;
6826 }
6827
6828 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
6829 {
6830         cfg->dongle_up = false; /* dongle down */
6831         brcmf_abort_scanning(cfg);
6832         brcmf_deinit_priv_mem(cfg);
6833         brcmf_clear_assoc_ies(cfg);
6834 }
6835
6836 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
6837 {
6838         init_waitqueue_head(&event->vif_wq);
6839         spin_lock_init(&event->vif_event_lock);
6840 }
6841
6842 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
6843 {
6844         struct brcmf_pub *drvr = ifp->drvr;
6845         s32 err;
6846         u32 bcn_timeout;
6847         __le32 roamtrigger[2];
6848         __le32 roam_delta[2];
6849
6850         /* Configure beacon timeout value based upon roaming setting */
6851         if (ifp->drvr->settings->roamoff)
6852                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
6853         else
6854                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
6855         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
6856         if (err) {
6857                 bphy_err(drvr, "bcn_timeout error (%d)\n", err);
6858                 goto roam_setup_done;
6859         }
6860
6861         /* Enable/Disable built-in roaming to allow supplicant to take care of
6862          * roaming.
6863          */
6864         brcmf_dbg(INFO, "Internal Roaming = %s\n",
6865                   ifp->drvr->settings->roamoff ? "Off" : "On");
6866         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
6867                                       ifp->drvr->settings->roamoff);
6868         if (err) {
6869                 bphy_err(drvr, "roam_off error (%d)\n", err);
6870                 goto roam_setup_done;
6871         }
6872
6873         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
6874         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
6875         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
6876                                      (void *)roamtrigger, sizeof(roamtrigger));
6877         if (err)
6878                 bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
6879
6880         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
6881         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
6882         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
6883                                      (void *)roam_delta, sizeof(roam_delta));
6884         if (err)
6885                 bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
6886
6887         return 0;
6888
6889 roam_setup_done:
6890         return err;
6891 }
6892
6893 static s32
6894 brcmf_dongle_scantime(struct brcmf_if *ifp)
6895 {
6896         struct brcmf_pub *drvr = ifp->drvr;
6897         s32 err = 0;
6898
6899         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
6900                                     BRCMF_SCAN_CHANNEL_TIME);
6901         if (err) {
6902                 bphy_err(drvr, "Scan assoc time error (%d)\n", err);
6903                 goto dongle_scantime_out;
6904         }
6905         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
6906                                     BRCMF_SCAN_UNASSOC_TIME);
6907         if (err) {
6908                 bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
6909                 goto dongle_scantime_out;
6910         }
6911
6912         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
6913                                     BRCMF_SCAN_PASSIVE_TIME);
6914         if (err) {
6915                 bphy_err(drvr, "Scan passive time error (%d)\n", err);
6916                 goto dongle_scantime_out;
6917         }
6918
6919 dongle_scantime_out:
6920         return err;
6921 }
6922
6923 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6924                                            struct brcmu_chan *ch)
6925 {
6926         u32 ht40_flag;
6927
6928         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6929         if (ch->sb == BRCMU_CHAN_SB_U) {
6930                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6931                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6932                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6933         } else {
6934                 /* It should be one of
6935                  * IEEE80211_CHAN_NO_HT40 or
6936                  * IEEE80211_CHAN_NO_HT40PLUS
6937                  */
6938                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6939                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6940                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6941         }
6942 }
6943
6944 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6945                                     u32 bw_cap[])
6946 {
6947         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6948         struct brcmf_pub *drvr = cfg->pub;
6949         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6950         struct ieee80211_supported_band *band;
6951         struct ieee80211_channel *channel;
6952         struct brcmf_chanspec_list *list;
6953         struct brcmu_chan ch;
6954         int err;
6955         u8 *pbuf;
6956         u32 i, j;
6957         u32 total;
6958         u32 chaninfo;
6959
6960         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6961
6962         if (pbuf == NULL)
6963                 return -ENOMEM;
6964
6965         list = (struct brcmf_chanspec_list *)pbuf;
6966
6967         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6968                                        BRCMF_DCMD_MEDLEN);
6969         if (err) {
6970                 bphy_err(drvr, "get chanspecs error (%d)\n", err);
6971                 goto fail_pbuf;
6972         }
6973
6974         band = wiphy->bands[NL80211_BAND_2GHZ];
6975         if (band)
6976                 for (i = 0; i < band->n_channels; i++)
6977                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6978         band = wiphy->bands[NL80211_BAND_5GHZ];
6979         if (band)
6980                 for (i = 0; i < band->n_channels; i++)
6981                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6982
6983         total = le32_to_cpu(list->count);
6984         if (total > BRCMF_MAX_CHANSPEC_LIST) {
6985                 bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6986                          total);
6987                 err = -EINVAL;
6988                 goto fail_pbuf;
6989         }
6990
6991         for (i = 0; i < total; i++) {
6992                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6993                 cfg->d11inf.decchspec(&ch);
6994
6995                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6996                         band = wiphy->bands[NL80211_BAND_2GHZ];
6997                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6998                         band = wiphy->bands[NL80211_BAND_5GHZ];
6999                 } else {
7000                         bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
7001                                  ch.chspec);
7002                         continue;
7003                 }
7004                 if (!band)
7005                         continue;
7006                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
7007                     ch.bw == BRCMU_CHAN_BW_40)
7008                         continue;
7009                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
7010                     ch.bw == BRCMU_CHAN_BW_80)
7011                         continue;
7012
7013                 channel = NULL;
7014                 for (j = 0; j < band->n_channels; j++) {
7015                         if (band->channels[j].hw_value == ch.control_ch_num) {
7016                                 channel = &band->channels[j];
7017                                 break;
7018                         }
7019                 }
7020                 if (!channel) {
7021                         /* It seems firmware supports some channel we never
7022                          * considered. Something new in IEEE standard?
7023                          */
7024                         bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
7025                                  ch.control_ch_num);
7026                         continue;
7027                 }
7028
7029                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
7030                         continue;
7031
7032                 /* assuming the chanspecs order is HT20,
7033                  * HT40 upper, HT40 lower, and VHT80.
7034                  */
7035                 switch (ch.bw) {
7036                 case BRCMU_CHAN_BW_160:
7037                         channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
7038                         break;
7039                 case BRCMU_CHAN_BW_80:
7040                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
7041                         break;
7042                 case BRCMU_CHAN_BW_40:
7043                         brcmf_update_bw40_channel_flag(channel, &ch);
7044                         break;
7045                 default:
7046                         wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
7047                                    ch.bw);
7048                         fallthrough;
7049                 case BRCMU_CHAN_BW_20:
7050                         /* enable the channel and disable other bandwidths
7051                          * for now as mentioned order assure they are enabled
7052                          * for subsequent chanspecs.
7053                          */
7054                         channel->flags = IEEE80211_CHAN_NO_HT40 |
7055                                          IEEE80211_CHAN_NO_80MHZ |
7056                                          IEEE80211_CHAN_NO_160MHZ;
7057                         ch.bw = BRCMU_CHAN_BW_20;
7058                         cfg->d11inf.encchspec(&ch);
7059                         chaninfo = ch.chspec;
7060                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
7061                                                        &chaninfo);
7062                         if (!err) {
7063                                 if (chaninfo & WL_CHAN_RADAR)
7064                                         channel->flags |=
7065                                                 (IEEE80211_CHAN_RADAR |
7066                                                  IEEE80211_CHAN_NO_IR);
7067                                 if (chaninfo & WL_CHAN_PASSIVE)
7068                                         channel->flags |=
7069                                                 IEEE80211_CHAN_NO_IR;
7070                         }
7071                 }
7072         }
7073
7074 fail_pbuf:
7075         kfree(pbuf);
7076         return err;
7077 }
7078
7079 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
7080 {
7081         struct brcmf_pub *drvr = cfg->pub;
7082         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7083         struct ieee80211_supported_band *band;
7084         struct brcmf_fil_bwcap_le band_bwcap;
7085         struct brcmf_chanspec_list *list;
7086         u8 *pbuf;
7087         u32 val;
7088         int err;
7089         struct brcmu_chan ch;
7090         u32 num_chan;
7091         int i, j;
7092
7093         /* verify support for bw_cap command */
7094         val = WLC_BAND_5G;
7095         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
7096
7097         if (!err) {
7098                 /* only set 2G bandwidth using bw_cap command */
7099                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
7100                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
7101                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
7102                                                sizeof(band_bwcap));
7103         } else {
7104                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
7105                 val = WLC_N_BW_40ALL;
7106                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
7107         }
7108
7109         if (!err) {
7110                 /* update channel info in 2G band */
7111                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7112
7113                 if (pbuf == NULL)
7114                         return -ENOMEM;
7115
7116                 ch.band = BRCMU_CHAN_BAND_2G;
7117                 ch.bw = BRCMU_CHAN_BW_40;
7118                 ch.sb = BRCMU_CHAN_SB_NONE;
7119                 ch.chnum = 0;
7120                 cfg->d11inf.encchspec(&ch);
7121
7122                 /* pass encoded chanspec in query */
7123                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
7124
7125                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
7126                                                BRCMF_DCMD_MEDLEN);
7127                 if (err) {
7128                         bphy_err(drvr, "get chanspecs error (%d)\n", err);
7129                         kfree(pbuf);
7130                         return err;
7131                 }
7132
7133                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
7134                 list = (struct brcmf_chanspec_list *)pbuf;
7135                 num_chan = le32_to_cpu(list->count);
7136                 if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
7137                         bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7138                                  num_chan);
7139                         kfree(pbuf);
7140                         return -EINVAL;
7141                 }
7142
7143                 for (i = 0; i < num_chan; i++) {
7144                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
7145                         cfg->d11inf.decchspec(&ch);
7146                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
7147                                 continue;
7148                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
7149                                 continue;
7150                         for (j = 0; j < band->n_channels; j++) {
7151                                 if (band->channels[j].hw_value == ch.control_ch_num)
7152                                         break;
7153                         }
7154                         if (WARN_ON(j == band->n_channels))
7155                                 continue;
7156
7157                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
7158                 }
7159                 kfree(pbuf);
7160         }
7161         return err;
7162 }
7163
7164 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
7165 {
7166         struct brcmf_pub *drvr = ifp->drvr;
7167         u32 band, mimo_bwcap;
7168         int err;
7169
7170         band = WLC_BAND_2G;
7171         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7172         if (!err) {
7173                 bw_cap[NL80211_BAND_2GHZ] = band;
7174                 band = WLC_BAND_5G;
7175                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7176                 if (!err) {
7177                         bw_cap[NL80211_BAND_5GHZ] = band;
7178                         return;
7179                 }
7180                 WARN_ON(1);
7181                 return;
7182         }
7183         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
7184         mimo_bwcap = 0;
7185         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
7186         if (err)
7187                 /* assume 20MHz if firmware does not give a clue */
7188                 mimo_bwcap = WLC_N_BW_20ALL;
7189
7190         switch (mimo_bwcap) {
7191         case WLC_N_BW_40ALL:
7192                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
7193                 fallthrough;
7194         case WLC_N_BW_20IN2G_40IN5G:
7195                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
7196                 fallthrough;
7197         case WLC_N_BW_20ALL:
7198                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
7199                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
7200                 break;
7201         default:
7202                 bphy_err(drvr, "invalid mimo_bw_cap value\n");
7203         }
7204 }
7205
7206 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
7207                                 u32 bw_cap[2], u32 nchain)
7208 {
7209         band->ht_cap.ht_supported = true;
7210         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
7211                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
7212                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7213         }
7214         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
7215         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
7216         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
7217         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
7218         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
7219         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
7220 }
7221
7222 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
7223 {
7224         u16 mcs_map;
7225         int i;
7226
7227         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
7228                 mcs_map = (mcs_map << 2) | supp;
7229
7230         return cpu_to_le16(mcs_map);
7231 }
7232
7233 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
7234                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
7235                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
7236 {
7237         __le16 mcs_map;
7238
7239         /* not allowed in 2.4G band */
7240         if (band->band == NL80211_BAND_2GHZ)
7241                 return;
7242
7243         band->vht_cap.vht_supported = true;
7244         /* 80MHz is mandatory */
7245         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
7246         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
7247                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
7248                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
7249         }
7250         /* all support 256-QAM */
7251         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
7252         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
7253         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
7254
7255         /* Beamforming support information */
7256         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
7257                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
7258         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
7259                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
7260         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
7261                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
7262         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
7263                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
7264
7265         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
7266                 band->vht_cap.cap |=
7267                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
7268                 band->vht_cap.cap |= ((txstreams - 1) <<
7269                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
7270                 band->vht_cap.cap |=
7271                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
7272         }
7273 }
7274
7275 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
7276 {
7277         struct brcmf_pub *drvr = cfg->pub;
7278         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7279         struct wiphy *wiphy = cfg_to_wiphy(cfg);
7280         u32 nmode = 0;
7281         u32 vhtmode = 0;
7282         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
7283         u32 rxchain;
7284         u32 nchain;
7285         int err;
7286         s32 i;
7287         struct ieee80211_supported_band *band;
7288         u32 txstreams = 0;
7289         u32 txbf_bfe_cap = 0;
7290         u32 txbf_bfr_cap = 0;
7291
7292         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
7293         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
7294         if (err) {
7295                 bphy_err(drvr, "nmode error (%d)\n", err);
7296         } else {
7297                 brcmf_get_bwcap(ifp, bw_cap);
7298         }
7299         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
7300                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
7301                   bw_cap[NL80211_BAND_5GHZ]);
7302
7303         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
7304         if (err) {
7305                 /* rxchain unsupported by firmware of older chips */
7306                 if (err == -EBADE)
7307                         bphy_info_once(drvr, "rxchain unsupported\n");
7308                 else
7309                         bphy_err(drvr, "rxchain error (%d)\n", err);
7310
7311                 nchain = 1;
7312         } else {
7313                 for (nchain = 0; rxchain; nchain++)
7314                         rxchain = rxchain & (rxchain - 1);
7315         }
7316         brcmf_dbg(INFO, "nchain=%d\n", nchain);
7317
7318         err = brcmf_construct_chaninfo(cfg, bw_cap);
7319         if (err) {
7320                 bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
7321                 return err;
7322         }
7323
7324         if (vhtmode) {
7325                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
7326                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
7327                                               &txbf_bfe_cap);
7328                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
7329                                               &txbf_bfr_cap);
7330         }
7331
7332         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
7333                 band = wiphy->bands[i];
7334                 if (band == NULL)
7335                         continue;
7336
7337                 if (nmode)
7338                         brcmf_update_ht_cap(band, bw_cap, nchain);
7339                 if (vhtmode)
7340                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
7341                                              txbf_bfe_cap, txbf_bfr_cap);
7342         }
7343
7344         return 0;
7345 }
7346
7347 static const struct ieee80211_txrx_stypes
7348 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
7349         [NL80211_IFTYPE_STATION] = {
7350                 .tx = 0xffff,
7351                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7352                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7353         },
7354         [NL80211_IFTYPE_P2P_CLIENT] = {
7355                 .tx = 0xffff,
7356                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7357                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7358         },
7359         [NL80211_IFTYPE_P2P_GO] = {
7360                 .tx = 0xffff,
7361                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7362                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7363                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7364                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7365                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7366                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7367                       BIT(IEEE80211_STYPE_ACTION >> 4)
7368         },
7369         [NL80211_IFTYPE_P2P_DEVICE] = {
7370                 .tx = 0xffff,
7371                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7372                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7373         },
7374         [NL80211_IFTYPE_AP] = {
7375                 .tx = 0xffff,
7376                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7377                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7378                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7379                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7380                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7381                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7382                       BIT(IEEE80211_STYPE_ACTION >> 4)
7383         }
7384 };
7385
7386 /**
7387  * brcmf_setup_ifmodes() - determine interface modes and combinations.
7388  *
7389  * @wiphy: wiphy object.
7390  * @ifp: interface object needed for feat module api.
7391  *
7392  * The interface modes and combinations are determined dynamically here
7393  * based on firmware functionality.
7394  *
7395  * no p2p and no mbss:
7396  *
7397  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7398  *
7399  * no p2p and mbss:
7400  *
7401  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7402  *      #AP <= 4, matching BI, channels = 1, 4 total
7403  *
7404  * no p2p and rsdb:
7405  *      #STA <= 1, #AP <= 2, channels = 2, 4 total
7406  *
7407  * p2p, no mchan, and mbss:
7408  *
7409  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
7410  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7411  *      #AP <= 4, matching BI, channels = 1, 4 total
7412  *
7413  * p2p, mchan, and mbss:
7414  *
7415  *      #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
7416  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7417  *      #AP <= 4, matching BI, channels = 1, 4 total
7418  *
7419  * p2p, rsdb, and no mbss:
7420  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
7421  *       channels = 2, 4 total
7422  */
7423 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
7424 {
7425         struct ieee80211_iface_combination *combo = NULL;
7426         struct ieee80211_iface_limit *c0_limits = NULL;
7427         struct ieee80211_iface_limit *p2p_limits = NULL;
7428         struct ieee80211_iface_limit *mbss_limits = NULL;
7429         bool mon_flag, mbss, p2p, rsdb, mchan;
7430         int i, c, n_combos, n_limits;
7431
7432         mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
7433         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
7434         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
7435         rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
7436         mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
7437
7438         n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7439         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7440         if (!combo)
7441                 goto err;
7442
7443         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7444                                  BIT(NL80211_IFTYPE_ADHOC) |
7445                                  BIT(NL80211_IFTYPE_AP);
7446         if (mon_flag)
7447                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7448         if (p2p)
7449                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7450                                           BIT(NL80211_IFTYPE_P2P_GO) |
7451                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
7452
7453         c = 0;
7454         i = 0;
7455         n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7456         c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7457         if (!c0_limits)
7458                 goto err;
7459
7460         combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7461         c0_limits[i].max = 1 + (p2p && mchan);
7462         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7463         if (mon_flag) {
7464                 c0_limits[i].max = 1;
7465                 c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7466         }
7467         if (p2p) {
7468                 c0_limits[i].max = 1;
7469                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7470                 c0_limits[i].max = 1 + rsdb;
7471                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7472                                        BIT(NL80211_IFTYPE_P2P_GO);
7473         }
7474         if (p2p && rsdb) {
7475                 c0_limits[i].max = 2;
7476                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7477                 combo[c].max_interfaces = 4;
7478         } else if (p2p) {
7479                 combo[c].max_interfaces = i;
7480         } else if (rsdb) {
7481                 c0_limits[i].max = 2;
7482                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7483                 combo[c].max_interfaces = 3;
7484         } else {
7485                 c0_limits[i].max = 1;
7486                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7487                 combo[c].max_interfaces = i;
7488         }
7489         combo[c].n_limits = i;
7490         combo[c].limits = c0_limits;
7491
7492         if (p2p && !rsdb) {
7493                 c++;
7494                 i = 0;
7495                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7496                 if (!p2p_limits)
7497                         goto err;
7498                 p2p_limits[i].max = 1;
7499                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7500                 p2p_limits[i].max = 1;
7501                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7502                 p2p_limits[i].max = 1;
7503                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7504                 p2p_limits[i].max = 1;
7505                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7506                 combo[c].num_different_channels = 1;
7507                 combo[c].max_interfaces = i;
7508                 combo[c].n_limits = i;
7509                 combo[c].limits = p2p_limits;
7510         }
7511
7512         if (mbss) {
7513                 c++;
7514                 i = 0;
7515                 n_limits = 1 + mon_flag;
7516                 mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7517                                       GFP_KERNEL);
7518                 if (!mbss_limits)
7519                         goto err;
7520                 mbss_limits[i].max = 4;
7521                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7522                 if (mon_flag) {
7523                         mbss_limits[i].max = 1;
7524                         mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7525                 }
7526                 combo[c].beacon_int_infra_match = true;
7527                 combo[c].num_different_channels = 1;
7528                 combo[c].max_interfaces = 4 + mon_flag;
7529                 combo[c].n_limits = i;
7530                 combo[c].limits = mbss_limits;
7531         }
7532
7533         wiphy->n_iface_combinations = n_combos;
7534         wiphy->iface_combinations = combo;
7535         return 0;
7536
7537 err:
7538         kfree(c0_limits);
7539         kfree(p2p_limits);
7540         kfree(mbss_limits);
7541         kfree(combo);
7542         return -ENOMEM;
7543 }
7544
7545 #ifdef CONFIG_PM
7546 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7547         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7548         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
7549         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7550         .pattern_min_len = 1,
7551         .max_pkt_offset = 1500,
7552 };
7553 #endif
7554
7555 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7556 {
7557 #ifdef CONFIG_PM
7558         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7559         struct brcmf_pub *drvr = cfg->pub;
7560         struct wiphy_wowlan_support *wowl;
7561
7562         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7563                        GFP_KERNEL);
7564         if (!wowl) {
7565                 bphy_err(drvr, "only support basic wowlan features\n");
7566                 wiphy->wowlan = &brcmf_wowlan_support;
7567                 return;
7568         }
7569
7570         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7571                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7572                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7573                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7574                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
7575                 }
7576         }
7577         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7578                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7579                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7580         }
7581
7582         wiphy->wowlan = wowl;
7583 #endif
7584 }
7585
7586 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7587 {
7588         struct brcmf_pub *drvr = ifp->drvr;
7589         const struct ieee80211_iface_combination *combo;
7590         struct ieee80211_supported_band *band;
7591         u16 max_interfaces = 0;
7592         bool gscan;
7593         __le32 bandlist[3];
7594         u32 n_bands;
7595         int err, i;
7596
7597         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7598         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7599         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7600
7601         err = brcmf_setup_ifmodes(wiphy, ifp);
7602         if (err)
7603                 return err;
7604
7605         for (i = 0, combo = wiphy->iface_combinations;
7606              i < wiphy->n_iface_combinations; i++, combo++) {
7607                 max_interfaces = max(max_interfaces, combo->max_interfaces);
7608         }
7609
7610         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7611              i++) {
7612                 u8 *addr = drvr->addresses[i].addr;
7613
7614                 memcpy(addr, drvr->mac, ETH_ALEN);
7615                 if (i) {
7616                         addr[0] |= BIT(1);
7617                         addr[ETH_ALEN - 1] ^= i;
7618                 }
7619         }
7620         wiphy->addresses = drvr->addresses;
7621         wiphy->n_addresses = i;
7622
7623         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7624         wiphy->cipher_suites = brcmf_cipher_suites;
7625         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7626         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7627                 wiphy->n_cipher_suites--;
7628         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7629                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7630                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7631
7632         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7633                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
7634                         WIPHY_FLAG_HAVE_AP_SME |
7635                         WIPHY_FLAG_OFFCHAN_TX |
7636                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7637         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7638                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7639         if (!ifp->drvr->settings->roamoff)
7640                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7641         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7642                 wiphy_ext_feature_set(wiphy,
7643                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7644                 wiphy_ext_feature_set(wiphy,
7645                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7646                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7647                         wiphy_ext_feature_set(wiphy,
7648                                               NL80211_EXT_FEATURE_SAE_OFFLOAD);
7649         }
7650         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7651                 wiphy_ext_feature_set(wiphy,
7652                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7653                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7654                         wiphy_ext_feature_set(wiphy,
7655                                               NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7656         }
7657         wiphy->mgmt_stypes = brcmf_txrx_stypes;
7658         wiphy->max_remain_on_channel_duration = 5000;
7659         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7660                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7661                 brcmf_pno_wiphy_params(wiphy, gscan);
7662         }
7663         /* vendor commands/events support */
7664         wiphy->vendor_commands = brcmf_vendor_cmds;
7665         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7666
7667         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7668                 brcmf_wiphy_wowl_params(wiphy, ifp);
7669         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7670                                      sizeof(bandlist));
7671         if (err) {
7672                 bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7673                 return err;
7674         }
7675         /* first entry in bandlist is number of bands */
7676         n_bands = le32_to_cpu(bandlist[0]);
7677         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7678                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7679                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7680                                        GFP_KERNEL);
7681                         if (!band)
7682                                 return -ENOMEM;
7683
7684                         band->channels = kmemdup(&__wl_2ghz_channels,
7685                                                  sizeof(__wl_2ghz_channels),
7686                                                  GFP_KERNEL);
7687                         if (!band->channels) {
7688                                 kfree(band);
7689                                 return -ENOMEM;
7690                         }
7691
7692                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7693                         wiphy->bands[NL80211_BAND_2GHZ] = band;
7694                 }
7695                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7696                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7697                                        GFP_KERNEL);
7698                         if (!band)
7699                                 return -ENOMEM;
7700
7701                         band->channels = kmemdup(&__wl_5ghz_channels,
7702                                                  sizeof(__wl_5ghz_channels),
7703                                                  GFP_KERNEL);
7704                         if (!band->channels) {
7705                                 kfree(band);
7706                                 return -ENOMEM;
7707                         }
7708
7709                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7710                         wiphy->bands[NL80211_BAND_5GHZ] = band;
7711                 }
7712         }
7713
7714         if (wiphy->bands[NL80211_BAND_5GHZ] &&
7715             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7716                 wiphy_ext_feature_set(wiphy,
7717                                       NL80211_EXT_FEATURE_DFS_OFFLOAD);
7718
7719         wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7720
7721         wiphy_read_of_freq_limits(wiphy);
7722
7723         return 0;
7724 }
7725
7726 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7727 {
7728         struct brcmf_pub *drvr = cfg->pub;
7729         struct net_device *ndev;
7730         struct wireless_dev *wdev;
7731         struct brcmf_if *ifp;
7732         s32 power_mode;
7733         s32 err = 0;
7734
7735         if (cfg->dongle_up)
7736                 return err;
7737
7738         ndev = cfg_to_ndev(cfg);
7739         wdev = ndev->ieee80211_ptr;
7740         ifp = netdev_priv(ndev);
7741
7742         /* make sure RF is ready for work */
7743         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7744
7745         brcmf_dongle_scantime(ifp);
7746
7747         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7748         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7749         if (err)
7750                 goto default_conf_out;
7751         brcmf_dbg(INFO, "power save set to %s\n",
7752                   (power_mode ? "enabled" : "disabled"));
7753
7754         err = brcmf_dongle_roam(ifp);
7755         if (err)
7756                 goto default_conf_out;
7757         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7758                                           NULL);
7759         if (err)
7760                 goto default_conf_out;
7761
7762         brcmf_configure_arp_nd_offload(ifp, true);
7763
7764         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7765         if (err) {
7766                 bphy_err(drvr, "failed to set frameburst mode\n");
7767                 goto default_conf_out;
7768         }
7769
7770         cfg->dongle_up = true;
7771 default_conf_out:
7772
7773         return err;
7774
7775 }
7776
7777 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
7778 {
7779         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7780
7781         return brcmf_config_dongle(ifp->drvr->config);
7782 }
7783
7784 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
7785 {
7786         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7787
7788         /*
7789          * While going down, if associated with AP disassociate
7790          * from AP to save power
7791          */
7792         if (check_vif_up(ifp->vif)) {
7793                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
7794
7795                 /* Make sure WPA_Supplicant receives all the event
7796                    generated due to DISASSOC call to the fw to keep
7797                    the state fw and WPA_Supplicant state consistent
7798                  */
7799                 brcmf_delay(500);
7800         }
7801
7802         brcmf_abort_scanning(cfg);
7803         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7804
7805         return 0;
7806 }
7807
7808 s32 brcmf_cfg80211_up(struct net_device *ndev)
7809 {
7810         struct brcmf_if *ifp = netdev_priv(ndev);
7811         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7812         s32 err = 0;
7813
7814         mutex_lock(&cfg->usr_sync);
7815         err = __brcmf_cfg80211_up(ifp);
7816         mutex_unlock(&cfg->usr_sync);
7817
7818         return err;
7819 }
7820
7821 s32 brcmf_cfg80211_down(struct net_device *ndev)
7822 {
7823         struct brcmf_if *ifp = netdev_priv(ndev);
7824         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7825         s32 err = 0;
7826
7827         mutex_lock(&cfg->usr_sync);
7828         err = __brcmf_cfg80211_down(ifp);
7829         mutex_unlock(&cfg->usr_sync);
7830
7831         return err;
7832 }
7833
7834 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
7835 {
7836         struct wireless_dev *wdev = &ifp->vif->wdev;
7837
7838         return wdev->iftype;
7839 }
7840
7841 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
7842                              unsigned long state)
7843 {
7844         struct brcmf_cfg80211_vif *vif;
7845
7846         list_for_each_entry(vif, &cfg->vif_list, list) {
7847                 if (test_bit(state, &vif->sme_state))
7848                         return true;
7849         }
7850         return false;
7851 }
7852
7853 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
7854                                     u8 action)
7855 {
7856         u8 evt_action;
7857
7858         spin_lock(&event->vif_event_lock);
7859         evt_action = event->action;
7860         spin_unlock(&event->vif_event_lock);
7861         return evt_action == action;
7862 }
7863
7864 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
7865                                   struct brcmf_cfg80211_vif *vif)
7866 {
7867         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7868
7869         spin_lock(&event->vif_event_lock);
7870         event->vif = vif;
7871         event->action = 0;
7872         spin_unlock(&event->vif_event_lock);
7873 }
7874
7875 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
7876 {
7877         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7878         bool armed;
7879
7880         spin_lock(&event->vif_event_lock);
7881         armed = event->vif != NULL;
7882         spin_unlock(&event->vif_event_lock);
7883
7884         return armed;
7885 }
7886
7887 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
7888                                   u8 action, ulong timeout)
7889 {
7890         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7891
7892         return wait_event_timeout(event->vif_wq,
7893                                   vif_event_equals(event, action), timeout);
7894 }
7895
7896 static bool brmcf_use_iso3166_ccode_fallback(struct brcmf_pub *drvr)
7897 {
7898         if (drvr->settings->trivial_ccode_map)
7899                 return true;
7900
7901         switch (drvr->bus_if->chip) {
7902         case BRCM_CC_43430_CHIP_ID:
7903         case BRCM_CC_4345_CHIP_ID:
7904         case BRCM_CC_4356_CHIP_ID:
7905         case BRCM_CC_43602_CHIP_ID:
7906                 return true;
7907         default:
7908                 return false;
7909         }
7910 }
7911
7912 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
7913                                         struct brcmf_fil_country_le *ccreq)
7914 {
7915         struct brcmfmac_pd_cc *country_codes;
7916         struct brcmfmac_pd_cc_entry *cc;
7917         s32 found_index;
7918         int i;
7919
7920         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
7921             (alpha2[1] == ccreq->country_abbrev[1])) {
7922                 brcmf_dbg(TRACE, "Country code already set\n");
7923                 return -EAGAIN;
7924         }
7925
7926         country_codes = drvr->settings->country_codes;
7927         if (!country_codes) {
7928                 if (brmcf_use_iso3166_ccode_fallback(drvr)) {
7929                         brcmf_dbg(TRACE, "No country codes configured for device, using ISO3166 code and 0 rev\n");
7930                         memset(ccreq, 0, sizeof(*ccreq));
7931                         ccreq->country_abbrev[0] = alpha2[0];
7932                         ccreq->country_abbrev[1] = alpha2[1];
7933                         ccreq->ccode[0] = alpha2[0];
7934                         ccreq->ccode[1] = alpha2[1];
7935                         return 0;
7936                 }
7937
7938                 brcmf_dbg(TRACE, "No country codes configured for device\n");
7939                 return -EINVAL;
7940         }
7941
7942         found_index = -1;
7943         for (i = 0; i < country_codes->table_size; i++) {
7944                 cc = &country_codes->table[i];
7945                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
7946                         found_index = i;
7947                 if ((cc->iso3166[0] == alpha2[0]) &&
7948                     (cc->iso3166[1] == alpha2[1])) {
7949                         found_index = i;
7950                         break;
7951                 }
7952         }
7953         if (found_index == -1) {
7954                 brcmf_dbg(TRACE, "No country code match found\n");
7955                 return -EINVAL;
7956         }
7957         memset(ccreq, 0, sizeof(*ccreq));
7958         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
7959         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
7960                BRCMF_COUNTRY_BUF_SZ);
7961         ccreq->country_abbrev[0] = alpha2[0];
7962         ccreq->country_abbrev[1] = alpha2[1];
7963         ccreq->country_abbrev[2] = 0;
7964
7965         return 0;
7966 }
7967
7968 static int
7969 brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
7970 {
7971         int i;
7972         char *token;
7973         char delim[] = "\n ";
7974         unsigned long val;
7975         int err = 0;
7976
7977         token = strsep(&buf, delim);
7978         while (token) {
7979                 if (!strcmp(token, "OBSS")) {
7980                         for (i = 0; i < OBSS_TOKEN_IDX; i++)
7981                                 token = strsep(&buf, delim);
7982                         err = kstrtoul(token, 10, &val);
7983                         if (err)
7984                                 break;
7985                         survey->obss = val;
7986                 }
7987
7988                 if (!strcmp(token, "IBSS")) {
7989                         for (i = 0; i < IBSS_TOKEN_IDX; i++)
7990                                 token = strsep(&buf, delim);
7991                         err = kstrtoul(token, 10, &val);
7992                         if (err)
7993                                 break;
7994                         survey->ibss = val;
7995                 }
7996
7997                 if (!strcmp(token, "TXDur")) {
7998                         for (i = 0; i < TX_TOKEN_IDX; i++)
7999                                 token = strsep(&buf, delim);
8000                         err = kstrtoul(token, 10, &val);
8001                         if (err)
8002                                 break;
8003                         survey->tx = val;
8004                 }
8005
8006                 if (!strcmp(token, "Category")) {
8007                         for (i = 0; i < CTG_TOKEN_IDX; i++)
8008                                 token = strsep(&buf, delim);
8009                         err = kstrtoul(token, 10, &val);
8010                         if (err)
8011                                 break;
8012                         survey->no_ctg = val;
8013                 }
8014
8015                 if (!strcmp(token, "Packet")) {
8016                         for (i = 0; i < PKT_TOKEN_IDX; i++)
8017                                 token = strsep(&buf, delim);
8018                         err = kstrtoul(token, 10, &val);
8019                         if (err)
8020                                 break;
8021                         survey->no_pckt = val;
8022                 }
8023
8024                 if (!strcmp(token, "Opp(time):")) {
8025                         for (i = 0; i < IDLE_TOKEN_IDX; i++)
8026                                 token = strsep(&buf, delim);
8027                         err = kstrtoul(token, 10, &val);
8028                         if (err)
8029                                 break;
8030                         survey->idle = val;
8031                 }
8032
8033                 token = strsep(&buf, delim);
8034         }
8035
8036         return err;
8037 }
8038
8039 static int
8040 brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
8041                 struct brcmf_dump_survey *survey)
8042 {
8043         struct cca_stats_n_flags *results;
8044         char *buf;
8045         int err;
8046
8047         buf = kzalloc(sizeof(char) * BRCMF_DCMD_MEDLEN, GFP_KERNEL);
8048         if (!buf)
8049                 return -ENOMEM;
8050
8051         memcpy(buf, &req, sizeof(struct cca_msrmnt_query));
8052         err = brcmf_fil_iovar_data_get(ifp, "dump_obss",
8053                                        buf, BRCMF_DCMD_MEDLEN);
8054         if (err) {
8055                 brcmf_err("dump_obss error (%d)\n", err);
8056                 err = -EINVAL;
8057                 goto exit;
8058         }
8059         results = (struct cca_stats_n_flags *)(buf);
8060
8061         if (req.msrmnt_query)
8062                 brcmf_parse_dump_obss(results->buf, survey);
8063
8064 exit:
8065         kfree(buf);
8066         return err;
8067 }
8068
8069 static s32
8070 brcmf_set_channel(struct brcmf_cfg80211_info *cfg, struct ieee80211_channel *chan)
8071 {
8072         u16 chspec = 0;
8073         int err = 0;
8074         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8075
8076         if (chan->flags & IEEE80211_CHAN_DISABLED)
8077                 return -EINVAL;
8078
8079         /* set_channel */
8080         chspec = channel_to_chanspec(&cfg->d11inf, chan);
8081         if (chspec != INVCHANSPEC) {
8082                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chspec);
8083                 if (err) {
8084                         brcmf_err("set chanspec 0x%04x fail, reason %d\n", chspec, err);
8085                         err = -EINVAL;
8086                 }
8087         } else {
8088                 brcmf_err("failed to convert host chanspec to fw chanspec\n");
8089                 err = -EINVAL;
8090         }
8091
8092         return err;
8093 }
8094
8095 static int
8096 brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
8097                            int idx, struct survey_info *info)
8098 {
8099         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8100         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8101         struct brcmf_dump_survey survey = {};
8102         struct ieee80211_supported_band *band;
8103         enum nl80211_band band_id;
8104         struct cca_msrmnt_query req;
8105         u32 noise;
8106         int err;
8107
8108         brcmf_dbg(TRACE, "Enter: channel idx=%d\n", idx);
8109
8110         /* Do not run survey when VIF in CONNECTING / CONNECTED states */
8111         if ((test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) ||
8112             (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))) {
8113                 return -EBUSY;
8114         }
8115
8116         for (band_id = 0; band_id < NUM_NL80211_BANDS; band_id++) {
8117                 band = wiphy->bands[band_id];
8118                 if (!band)
8119                         continue;
8120                 if (idx >= band->n_channels) {
8121                         idx -= band->n_channels;
8122                         continue;
8123                 }
8124
8125                 info->channel = &band->channels[idx];
8126                 break;
8127         }
8128         if (band_id == NUM_NL80211_BANDS)
8129                 return -ENOENT;
8130
8131         /* Setting current channel to the requested channel */
8132         info->filled = 0;
8133         if (brcmf_set_channel(cfg, info->channel))
8134                 return 0;
8135
8136         /* Disable mpc */
8137         brcmf_set_mpc(ifp, 0);
8138
8139         /* Set interface up, explicitly. */
8140         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
8141         if (err) {
8142                 brcmf_err("set interface up failed, err = %d\n", err);
8143                 goto exit;
8144         }
8145
8146         /* Get noise value */
8147         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
8148         if (err) {
8149                 brcmf_err("Get Phy Noise failed, use dummy value\n");
8150                 noise = CHAN_NOISE_DUMMY;
8151         }
8152
8153         /* Start Measurement for obss stats on current channel */
8154         req.msrmnt_query = 0;
8155         req.time_req = ACS_MSRMNT_DELAY;
8156         err = brcmf_dump_obss(ifp, req, &survey);
8157         if (err)
8158                 goto exit;
8159
8160         /* Add 10 ms for IOVAR completion */
8161         msleep(ACS_MSRMNT_DELAY + 10);
8162
8163         /* Issue IOVAR to collect measurement results */
8164         req.msrmnt_query = 1;
8165         err = brcmf_dump_obss(ifp, req, &survey);
8166         if (err)
8167                 goto exit;
8168
8169         info->noise = noise;
8170         info->time = ACS_MSRMNT_DELAY;
8171         info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
8172         info->time_rx = survey.obss + survey.ibss + survey.no_ctg +
8173                 survey.no_pckt;
8174         info->time_tx = survey.tx;
8175         info->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_TIME |
8176                 SURVEY_INFO_TIME_BUSY | SURVEY_INFO_TIME_RX |
8177                 SURVEY_INFO_TIME_TX;
8178
8179         brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
8180                   ieee80211_frequency_to_channel(info->channel->center_freq),
8181                   ACS_MSRMNT_DELAY);
8182         brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
8183                   info->noise, info->time_busy, info->time_rx, info->time_tx);
8184
8185 exit:
8186         if (!brcmf_is_apmode(ifp->vif))
8187                 brcmf_set_mpc(ifp, 1);
8188         return err;
8189 }
8190
8191 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
8192                                         struct regulatory_request *req)
8193 {
8194         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8195         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
8196         struct brcmf_pub *drvr = cfg->pub;
8197         struct brcmf_fil_country_le ccreq;
8198         char *alpha2;
8199         s32 err;
8200         int i;
8201
8202         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
8203         if (err) {
8204                 bphy_err(drvr, "Country code iovar returned err = %d\n", err);
8205                 return;
8206         }
8207
8208         /* The country code gets set to "00" by default at boot - substitute
8209          * any saved ccode from the nvram file unless there is a valid code
8210          * already set.
8211          */
8212         alpha2 = req->alpha2;
8213         if (alpha2[0] == '0' && alpha2[1] == '0') {
8214                 extern char saved_ccode[2];
8215
8216                 if ((isupper(ccreq.country_abbrev[0]) &&
8217                      isupper(ccreq.country_abbrev[1])) ||
8218                     !saved_ccode[0])
8219                         return;
8220                 alpha2 = saved_ccode;
8221                 pr_debug("brcmfmac: substituting saved ccode %c%c\n",
8222                          alpha2[0], alpha2[1]);
8223         }
8224
8225         /* ignore non-ISO3166 country codes */
8226         for (i = 0; i < 2; i++)
8227                 if (alpha2[i] < 'A' || alpha2[i] > 'Z') {
8228                         bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
8229                                  alpha2[0], alpha2[1]);
8230                         return;
8231                 }
8232
8233         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
8234                   alpha2[0], alpha2[1]);
8235
8236         err = brcmf_translate_country_code(ifp->drvr, alpha2, &ccreq);
8237         if (err)
8238                 return;
8239
8240         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
8241         if (err) {
8242                 bphy_err(drvr, "Firmware rejected country setting\n");
8243                 return;
8244         }
8245         brcmf_setup_wiphybands(cfg);
8246 }
8247
8248 static void brcmf_free_wiphy(struct wiphy *wiphy)
8249 {
8250         int i;
8251
8252         if (!wiphy)
8253                 return;
8254
8255         if (wiphy->iface_combinations) {
8256                 for (i = 0; i < wiphy->n_iface_combinations; i++)
8257                         kfree(wiphy->iface_combinations[i].limits);
8258         }
8259         kfree(wiphy->iface_combinations);
8260         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8261                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
8262                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
8263         }
8264         if (wiphy->bands[NL80211_BAND_5GHZ]) {
8265                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
8266                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
8267         }
8268 #if IS_ENABLED(CONFIG_PM)
8269         if (wiphy->wowlan != &brcmf_wowlan_support)
8270                 kfree(wiphy->wowlan);
8271 #endif
8272 }
8273
8274 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
8275                                                   struct cfg80211_ops *ops,
8276                                                   bool p2pdev_forced)
8277 {
8278         struct wiphy *wiphy = drvr->wiphy;
8279         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
8280         struct brcmf_cfg80211_info *cfg;
8281         struct brcmf_cfg80211_vif *vif;
8282         struct brcmf_if *ifp;
8283         s32 err = 0;
8284         s32 io_type;
8285         u16 *cap = NULL;
8286
8287         if (!ndev) {
8288                 bphy_err(drvr, "ndev is invalid\n");
8289                 return NULL;
8290         }
8291
8292         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
8293         if (!cfg) {
8294                 bphy_err(drvr, "Could not allocate wiphy device\n");
8295                 return NULL;
8296         }
8297
8298         cfg->wiphy = wiphy;
8299         cfg->pub = drvr;
8300         init_vif_event(&cfg->vif_event);
8301         INIT_LIST_HEAD(&cfg->vif_list);
8302
8303         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
8304         if (IS_ERR(vif))
8305                 goto wiphy_out;
8306
8307         ifp = netdev_priv(ndev);
8308         vif->ifp = ifp;
8309         vif->wdev.netdev = ndev;
8310         ndev->ieee80211_ptr = &vif->wdev;
8311         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
8312
8313         err = wl_init_priv(cfg);
8314         if (err) {
8315                 bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
8316                 brcmf_free_vif(vif);
8317                 goto wiphy_out;
8318         }
8319         ifp->vif = vif;
8320
8321         /* determine d11 io type before wiphy setup */
8322         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
8323         if (err) {
8324                 bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
8325                 goto priv_out;
8326         }
8327         cfg->d11inf.io_type = (u8)io_type;
8328         brcmu_d11_attach(&cfg->d11inf);
8329
8330         /* regulatory notifer below needs access to cfg so
8331          * assign it now.
8332          */
8333         drvr->config = cfg;
8334
8335         err = brcmf_setup_wiphy(wiphy, ifp);
8336         if (err < 0)
8337                 goto priv_out;
8338
8339         brcmf_dbg(INFO, "Registering custom regulatory\n");
8340         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
8341         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
8342         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
8343
8344         /* firmware defaults to 40MHz disabled in 2G band. We signal
8345          * cfg80211 here that we do and have it decide we can enable
8346          * it. But first check if device does support 2G operation.
8347          */
8348         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8349                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
8350                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8351         }
8352 #ifdef CONFIG_PM
8353         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
8354                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
8355 #endif
8356         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DUMP_OBSS))
8357                 ops->dump_survey = brcmf_cfg80211_dump_survey;
8358
8359         err = wiphy_register(wiphy);
8360         if (err < 0) {
8361                 bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
8362                 goto priv_out;
8363         }
8364
8365         err = brcmf_setup_wiphybands(cfg);
8366         if (err) {
8367                 bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
8368                 goto wiphy_unreg_out;
8369         }
8370
8371         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
8372          * setup 40MHz in 2GHz band and enable OBSS scanning.
8373          */
8374         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
8375                 err = brcmf_enable_bw40_2g(cfg);
8376                 if (!err)
8377                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
8378                                                       BRCMF_OBSS_COEX_AUTO);
8379                 else
8380                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8381         }
8382
8383         err = brcmf_fweh_activate_events(ifp);
8384         if (err) {
8385                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8386                 goto wiphy_unreg_out;
8387         }
8388
8389         err = brcmf_p2p_attach(cfg, p2pdev_forced);
8390         if (err) {
8391                 bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
8392                 goto wiphy_unreg_out;
8393         }
8394         err = brcmf_btcoex_attach(cfg);
8395         if (err) {
8396                 bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
8397                 brcmf_p2p_detach(&cfg->p2p);
8398                 goto wiphy_unreg_out;
8399         }
8400         err = brcmf_pno_attach(cfg);
8401         if (err) {
8402                 bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
8403                 brcmf_btcoex_detach(cfg);
8404                 brcmf_p2p_detach(&cfg->p2p);
8405                 goto wiphy_unreg_out;
8406         }
8407
8408         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
8409                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
8410                 if (err) {
8411                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
8412                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
8413                 } else {
8414                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
8415                                             brcmf_notify_tdls_peer_event);
8416                 }
8417         }
8418
8419         /* (re-) activate FWEH event handling */
8420         err = brcmf_fweh_activate_events(ifp);
8421         if (err) {
8422                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8423                 goto detach;
8424         }
8425
8426         /* Fill in some of the advertised nl80211 supported features */
8427         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
8428                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
8429 #ifdef CONFIG_PM
8430                 if (wiphy->wowlan &&
8431                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
8432                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8433 #endif
8434         }
8435
8436         return cfg;
8437
8438 detach:
8439         brcmf_pno_detach(cfg);
8440         brcmf_btcoex_detach(cfg);
8441         brcmf_p2p_detach(&cfg->p2p);
8442 wiphy_unreg_out:
8443         wiphy_unregister(cfg->wiphy);
8444 priv_out:
8445         wl_deinit_priv(cfg);
8446         brcmf_free_vif(vif);
8447         ifp->vif = NULL;
8448 wiphy_out:
8449         brcmf_free_wiphy(wiphy);
8450         kfree(cfg);
8451         return NULL;
8452 }
8453
8454 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
8455 {
8456         if (!cfg)
8457                 return;
8458
8459         brcmf_pno_detach(cfg);
8460         brcmf_btcoex_detach(cfg);
8461         wiphy_unregister(cfg->wiphy);
8462         wl_deinit_priv(cfg);
8463         brcmf_free_wiphy(cfg->wiphy);
8464         kfree(cfg);
8465 }