drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "pno.h"
  36 #include "cfg80211.h"
  37 #include "feature.h"
  38 #include "fwil.h"
  39 #include "proto.h"
  40 #include "vendor.h"
  41 #include "bus.h"
  42 #include "common.h"
  43
  44 #define BRCMF_SCAN_IE_LEN_MAX           2048
  45
  46 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  47 #define WPA_OUI_TYPE                    1
  48 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  49 #define WME_OUI_TYPE                    2
  50 #define WPS_OUI_TYPE                    4
  51
  52 #define VS_IE_FIXED_HDR_LEN             6
  53 #define WPA_IE_VERSION_LEN              2
  54 #define WPA_IE_MIN_OUI_LEN              4
  55 #define WPA_IE_SUITE_COUNT_LEN          2
  56
  57 #define WPA_CIPHER_NONE                 0       /* None */
  58 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  59 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  60 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  61 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  62
  63 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  64 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  65 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  66 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  67 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  68 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  69 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  70 #define RSN_CAP_MFPR_MASK               BIT(6)
  71 #define RSN_CAP_MFPC_MASK               BIT(7)
  72 #define RSN_PMKID_COUNT_LEN             2
  73
  74 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  75                                                  * string :"add", "del" (+ NUL)
  76                                                  */
  77 #define VNDR_IE_COUNT_OFFSET            4
  78 #define VNDR_IE_PKTFLAG_OFFSET          8
  79 #define VNDR_IE_VSIE_OFFSET             12
  80 #define VNDR_IE_HDR_SIZE                12
  81 #define VNDR_IE_PARSE_LIMIT             5
  82
  83 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  84 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  85
  86 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  87 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  88 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  89
  90 #define BRCMF_SCAN_CHANNEL_TIME         40
  91 #define BRCMF_SCAN_UNASSOC_TIME         40
  92 #define BRCMF_SCAN_PASSIVE_TIME         120
  93
  94 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  95
  96 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  97         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  98
  99 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 100 {
 101         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 102                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 103                           vif->sme_state);
 104                 return false;
 105         }
 106         return true;
 107 }
 108
 109 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 110 #define RATETAB_ENT(_rateid, _flags) \
 111         {                                                               \
 112                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 113                 .hw_value       = (_rateid),                            \
 114                 .flags          = (_flags),                             \
 115         }
 116
 117 static struct ieee80211_rate __wl_rates[] = {
 118         RATETAB_ENT(BRCM_RATE_1M, 0),
 119         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 122         RATETAB_ENT(BRCM_RATE_6M, 0),
 123         RATETAB_ENT(BRCM_RATE_9M, 0),
 124         RATETAB_ENT(BRCM_RATE_12M, 0),
 125         RATETAB_ENT(BRCM_RATE_18M, 0),
 126         RATETAB_ENT(BRCM_RATE_24M, 0),
 127         RATETAB_ENT(BRCM_RATE_36M, 0),
 128         RATETAB_ENT(BRCM_RATE_48M, 0),
 129         RATETAB_ENT(BRCM_RATE_54M, 0),
 130 };
 131
 132 #define wl_g_rates              (__wl_rates + 0)
 133 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 134 #define wl_a_rates              (__wl_rates + 4)
 135 #define wl_a_rates_size         (wl_g_rates_size - 4)
 136
 137 #define CHAN2G(_channel, _freq) {                               \
 138         .band                   = NL80211_BAND_2GHZ,            \
 139         .center_freq            = (_freq),                      \
 140         .hw_value               = (_channel),                   \
 141         .max_antenna_gain       = 0,                            \
 142         .max_power              = 30,                           \
 143 }
 144
 145 #define CHAN5G(_channel) {                                      \
 146         .band                   = NL80211_BAND_5GHZ,            \
 147         .center_freq            = 5000 + (5 * (_channel)),      \
 148         .hw_value               = (_channel),                   \
 149         .max_antenna_gain       = 0,                            \
 150         .max_power              = 30,                           \
 151 }
 152
 153 static struct ieee80211_channel __wl_2ghz_channels[] = {
 154         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 155         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 156         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 157         CHAN2G(13, 2472), CHAN2G(14, 2484)
 158 };
 159
 160 static struct ieee80211_channel __wl_5ghz_channels[] = {
 161         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 162         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 163         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 164         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 165         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 166         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 167 };
 168
 169 /* Band templates duplicated per wiphy. The channel info
 170  * above is added to the band during setup.
 171  */
 172 static const struct ieee80211_supported_band __wl_band_2ghz = {
 173         .band = NL80211_BAND_2GHZ,
 174         .bitrates = wl_g_rates,
 175         .n_bitrates = wl_g_rates_size,
 176 };
 177
 178 static const struct ieee80211_supported_band __wl_band_5ghz = {
 179         .band = NL80211_BAND_5GHZ,
 180         .bitrates = wl_a_rates,
 181         .n_bitrates = wl_a_rates_size,
 182 };
 183
 184 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 185  * By default world regulatory domain defined in reg.c puts the flags
 186  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 187  * With respect to these flags, wpa_supplicant doesn't * start p2p
 188  * operations on 5GHz channels. All the changes in world regulatory
 189  * domain are to be done here.
 190  */
 191 static const struct ieee80211_regdomain brcmf_regdom = {
 192         .n_reg_rules = 4,
 193         .alpha2 =  "99",
 194         .reg_rules = {
 195                 /* IEEE 802.11b/g, channels 1..11 */
 196                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 197                 /* If any */
 198                 /* IEEE 802.11 channel 14 - Only JP enables
 199                  * this and for 802.11b only
 200                  */
 201                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 202                 /* IEEE 802.11a, channel 36..64 */
 203                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 204                 /* IEEE 802.11a, channel 100..165 */
 205                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 206 };
 207
 208 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 209  * are supported. A pointer to this array and the number of entries is passed
 210  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 211  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 212  * device does not support MFP then the number of suites will be decreased by 1
 213  */
 214 static const u32 brcmf_cipher_suites[] = {
 215         WLAN_CIPHER_SUITE_WEP40,
 216         WLAN_CIPHER_SUITE_WEP104,
 217         WLAN_CIPHER_SUITE_TKIP,
 218         WLAN_CIPHER_SUITE_CCMP,
 219         /* Keep as last entry: */
 220         WLAN_CIPHER_SUITE_AES_CMAC
 221 };
 222
 223 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 224 struct brcmf_vs_tlv {
 225         u8 id;
 226         u8 len;
 227         u8 oui[3];
 228         u8 oui_type;
 229 };
 230
 231 struct parsed_vndr_ie_info {
 232         u8 *ie_ptr;
 233         u32 ie_len;     /* total length including id & length field */
 234         struct brcmf_vs_tlv vndrie;
 235 };
 236
 237 struct parsed_vndr_ies {
 238         u32 count;
 239         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 240 };
 241
 242 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 243 {
 244         switch (band) {
 245         case NL80211_BAND_2GHZ:
 246                 return WLC_BAND_2G;
 247         case NL80211_BAND_5GHZ:
 248                 return WLC_BAND_5G;
 249         default:
 250                 WARN_ON(1);
 251                 break;
 252         }
 253         return 0;
 254 }
 255
 256 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 257                                struct cfg80211_chan_def *ch)
 258 {
 259         struct brcmu_chan ch_inf;
 260         s32 primary_offset;
 261
 262         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 263                   ch->chan->center_freq, ch->center_freq1, ch->width);
 264         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 265         primary_offset = ch->chan->center_freq - ch->center_freq1;
 266         switch (ch->width) {
 267         case NL80211_CHAN_WIDTH_20:
 268         case NL80211_CHAN_WIDTH_20_NOHT:
 269                 ch_inf.bw = BRCMU_CHAN_BW_20;
 270                 WARN_ON(primary_offset != 0);
 271                 break;
 272         case NL80211_CHAN_WIDTH_40:
 273                 ch_inf.bw = BRCMU_CHAN_BW_40;
 274                 if (primary_offset > 0)
 275                         ch_inf.sb = BRCMU_CHAN_SB_U;
 276                 else
 277                         ch_inf.sb = BRCMU_CHAN_SB_L;
 278                 break;
 279         case NL80211_CHAN_WIDTH_80:
 280                 ch_inf.bw = BRCMU_CHAN_BW_80;
 281                 if (primary_offset == -30)
 282                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 283                 else if (primary_offset == -10)
 284                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 285                 else if (primary_offset == 10)
 286                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80P80:
 291         case NL80211_CHAN_WIDTH_160:
 292         case NL80211_CHAN_WIDTH_5:
 293         case NL80211_CHAN_WIDTH_10:
 294         default:
 295                 WARN_ON_ONCE(1);
 296         }
 297         switch (ch->chan->band) {
 298         case NL80211_BAND_2GHZ:
 299                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 300                 break;
 301         case NL80211_BAND_5GHZ:
 302                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 303                 break;
 304         case NL80211_BAND_60GHZ:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         d11inf->encchspec(&ch_inf);
 309
 310         return ch_inf.chspec;
 311 }
 312
 313 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 314                         struct ieee80211_channel *ch)
 315 {
 316         struct brcmu_chan ch_inf;
 317
 318         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 319         ch_inf.bw = BRCMU_CHAN_BW_20;
 320         d11inf->encchspec(&ch_inf);
 321
 322         return ch_inf.chspec;
 323 }
 324
 325 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 326  * triples, returning a pointer to the substring whose first element
 327  * matches tag
 328  */
 329 static const struct brcmf_tlv *
 330 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 331 {
 332         const struct brcmf_tlv *elt = buf;
 333         int totlen = buflen;
 334
 335         /* find tagged parameter */
 336         while (totlen >= TLV_HDR_LEN) {
 337                 int len = elt->len;
 338
 339                 /* validate remaining totlen */
 340                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 341                         return elt;
 342
 343                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 344                 totlen -= (len + TLV_HDR_LEN);
 345         }
 346
 347         return NULL;
 348 }
 349
 350 /* Is any of the tlvs the expected entry? If
 351  * not update the tlvs buffer pointer/length.
 352  */
 353 static bool
 354 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 355                  const u8 *oui, u32 oui_len, u8 type)
 356 {
 357         /* If the contents match the OUI and the type */
 358         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 359             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 360             type == ie[TLV_BODY_OFF + oui_len]) {
 361                 return true;
 362         }
 363
 364         if (tlvs == NULL)
 365                 return false;
 366         /* point to the next ie */
 367         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 368         /* calculate the length of the rest of the buffer */
 369         *tlvs_len -= (int)(ie - *tlvs);
 370         /* update the pointer to the start of the buffer */
 371         *tlvs = ie;
 372
 373         return false;
 374 }
 375
 376 static struct brcmf_vs_tlv *
 377 brcmf_find_wpaie(const u8 *parse, u32 len)
 378 {
 379         const struct brcmf_tlv *ie;
 380
 381         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 382                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 383                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 384                         return (struct brcmf_vs_tlv *)ie;
 385         }
 386         return NULL;
 387 }
 388
 389 static struct brcmf_vs_tlv *
 390 brcmf_find_wpsie(const u8 *parse, u32 len)
 391 {
 392         const struct brcmf_tlv *ie;
 393
 394         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 395                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 396                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 397                         return (struct brcmf_vs_tlv *)ie;
 398         }
 399         return NULL;
 400 }
 401
 402 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 403                                      struct brcmf_cfg80211_vif *vif,
 404                                      enum nl80211_iftype new_type)
 405 {
 406         struct brcmf_cfg80211_vif *pos;
 407         bool check_combos = false;
 408         int ret = 0;
 409         struct iface_combination_params params = {
 410                 .num_different_channels = 1,
 411         };
 412
 413         list_for_each_entry(pos, &cfg->vif_list, list)
 414                 if (pos == vif) {
 415                         params.iftype_num[new_type]++;
 416                 } else {
 417                         /* concurrent interfaces so need check combinations */
 418                         check_combos = true;
 419                         params.iftype_num[pos->wdev.iftype]++;
 420                 }
 421
 422         if (check_combos)
 423                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 424
 425         return ret;
 426 }
 427
 428 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 429                                   enum nl80211_iftype new_type)
 430 {
 431         struct brcmf_cfg80211_vif *pos;
 432         struct iface_combination_params params = {
 433                 .num_different_channels = 1,
 434         };
 435
 436         list_for_each_entry(pos, &cfg->vif_list, list)
 437                 params.iftype_num[pos->wdev.iftype]++;
 438
 439         params.iftype_num[new_type]++;
 440         return cfg80211_check_combinations(cfg->wiphy, &params);
 441 }
 442
 443 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 444                                  struct brcmf_wsec_key_le *key_le)
 445 {
 446         key_le->index = cpu_to_le32(key->index);
 447         key_le->len = cpu_to_le32(key->len);
 448         key_le->algo = cpu_to_le32(key->algo);
 449         key_le->flags = cpu_to_le32(key->flags);
 450         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 451         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 452         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 453         memcpy(key_le->data, key->data, sizeof(key->data));
 454         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 455 }
 456
 457 static int
 458 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 459 {
 460         int err;
 461         struct brcmf_wsec_key_le key_le;
 462
 463         convert_key_from_CPU(key, &key_le);
 464
 465         brcmf_netdev_wait_pend8021x(ifp);
 466
 467         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 468                                         sizeof(key_le));
 469
 470         if (err)
 471                 brcmf_err("wsec_key error (%d)\n", err);
 472         return err;
 473 }
 474
 475 static s32
 476 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 477 {
 478         s32 err;
 479         u32 mode;
 480
 481         if (enable)
 482                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 483         else
 484                 mode = 0;
 485
 486         /* Try to set and enable ARP offload feature, this may fail, then it  */
 487         /* is simply not supported and err 0 will be returned                 */
 488         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 489         if (err) {
 490                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 491                           mode, err);
 492                 err = 0;
 493         } else {
 494                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 495                 if (err) {
 496                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 497                                   enable, err);
 498                         err = 0;
 499                 } else
 500                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 501                                   enable, mode);
 502         }
 503
 504         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 505         if (err) {
 506                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 507                           enable, err);
 508                 err = 0;
 509         } else
 510                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 511                           enable, mode);
 512
 513         return err;
 514 }
 515
 516 static void
 517 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 518 {
 519         struct brcmf_cfg80211_vif *vif;
 520         struct brcmf_if *ifp;
 521
 522         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 523         ifp = vif->ifp;
 524
 525         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 526             (wdev->iftype == NL80211_IFTYPE_AP) ||
 527             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 528                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 529                                                 ADDR_DIRECT);
 530         else
 531                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 532                                                 ADDR_INDIRECT);
 533 }
 534
 535 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 536 {
 537         int bsscfgidx;
 538
 539         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 540                 /* bsscfgidx 1 is reserved for legacy P2P */
 541                 if (bsscfgidx == 1)
 542                         continue;
 543                 if (!drvr->iflist[bsscfgidx])
 544                         return bsscfgidx;
 545         }
 546
 547         return -ENOMEM;
 548 }
 549
 550 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 551 {
 552         struct brcmf_mbss_ssid_le mbss_ssid_le;
 553         int bsscfgidx;
 554         int err;
 555
 556         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 557         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 558         if (bsscfgidx < 0)
 559                 return bsscfgidx;
 560
 561         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 562         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 563         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 564
 565         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 566                                         sizeof(mbss_ssid_le));
 567         if (err < 0)
 568                 brcmf_err("setting ssid failed %d\n", err);
 569
 570         return err;
 571 }
 572
 573 /**
 574  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 575  *
 576  * @wiphy: wiphy device of new interface.
 577  * @name: name of the new interface.
 578  * @params: contains mac address for AP device.
 579  */
 580 static
 581 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 582                                       struct vif_params *params)
 583 {
 584         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 585         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 586         struct brcmf_cfg80211_vif *vif;
 587         int err;
 588
 589         if (brcmf_cfg80211_vif_event_armed(cfg))
 590                 return ERR_PTR(-EBUSY);
 591
 592         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 593
 594         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 595         if (IS_ERR(vif))
 596                 return (struct wireless_dev *)vif;
 597
 598         brcmf_cfg80211_arm_vif_event(cfg, vif);
 599
 600         err = brcmf_cfg80211_request_ap_if(ifp);
 601         if (err) {
 602                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 603                 goto fail;
 604         }
 605
 606         /* wait for firmware event */
 607         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 608                                             BRCMF_VIF_EVENT_TIMEOUT);
 609         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 610         if (!err) {
 611                 brcmf_err("timeout occurred\n");
 612                 err = -EIO;
 613                 goto fail;
 614         }
 615
 616         /* interface created in firmware */
 617         ifp = vif->ifp;
 618         if (!ifp) {
 619                 brcmf_err("no if pointer provided\n");
 620                 err = -ENOENT;
 621                 goto fail;
 622         }
 623
 624         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 625         err = brcmf_net_attach(ifp, true);
 626         if (err) {
 627                 brcmf_err("Registering netdevice failed\n");
 628                 free_netdev(ifp->ndev);
 629                 goto fail;
 630         }
 631
 632         return &ifp->vif->wdev;
 633
 634 fail:
 635         brcmf_free_vif(vif);
 636         return ERR_PTR(err);
 637 }
 638
 639 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 640 {
 641         enum nl80211_iftype iftype;
 642
 643         iftype = vif->wdev.iftype;
 644         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 645 }
 646
 647 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 648 {
 649         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 650 }
 651
 652 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 653                                                      const char *name,
 654                                                      unsigned char name_assign_type,
 655                                                      enum nl80211_iftype type,
 656                                                      struct vif_params *params)
 657 {
 658         struct wireless_dev *wdev;
 659         int err;
 660
 661         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 662         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 663         if (err) {
 664                 brcmf_err("iface validation failed: err=%d\n", err);
 665                 return ERR_PTR(err);
 666         }
 667         switch (type) {
 668         case NL80211_IFTYPE_ADHOC:
 669         case NL80211_IFTYPE_STATION:
 670         case NL80211_IFTYPE_AP_VLAN:
 671         case NL80211_IFTYPE_WDS:
 672         case NL80211_IFTYPE_MONITOR:
 673         case NL80211_IFTYPE_MESH_POINT:
 674                 return ERR_PTR(-EOPNOTSUPP);
 675         case NL80211_IFTYPE_AP:
 676                 wdev = brcmf_ap_add_vif(wiphy, name, params);
 677                 break;
 678         case NL80211_IFTYPE_P2P_CLIENT:
 679         case NL80211_IFTYPE_P2P_GO:
 680         case NL80211_IFTYPE_P2P_DEVICE:
 681                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
 682                 break;
 683         case NL80211_IFTYPE_UNSPECIFIED:
 684         default:
 685                 return ERR_PTR(-EINVAL);
 686         }
 687
 688         if (IS_ERR(wdev))
 689                 brcmf_err("add iface %s type %d failed: err=%d\n",
 690                           name, type, (int)PTR_ERR(wdev));
 691         else
 692                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 693
 694         return wdev;
 695 }
 696
 697 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 698 {
 699         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 700                 brcmf_set_mpc(ifp, mpc);
 701 }
 702
 703 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 704 {
 705         s32 err = 0;
 706
 707         if (check_vif_up(ifp->vif)) {
 708                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 709                 if (err) {
 710                         brcmf_err("fail to set mpc\n");
 711                         return;
 712                 }
 713                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 714         }
 715 }
 716
 717 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 718                                 struct brcmf_if *ifp, bool aborted,
 719                                 bool fw_abort)
 720 {
 721         struct brcmf_scan_params_le params_le;
 722         struct cfg80211_scan_request *scan_request;
 723         u64 reqid;
 724         u32 bucket;
 725         s32 err = 0;
 726
 727         brcmf_dbg(SCAN, "Enter\n");
 728
 729         /* clear scan request, because the FW abort can cause a second call */
 730         /* to this functon and might cause a double cfg80211_scan_done      */
 731         scan_request = cfg->scan_request;
 732         cfg->scan_request = NULL;
 733
 734         if (timer_pending(&cfg->escan_timeout))
 735                 del_timer_sync(&cfg->escan_timeout);
 736
 737         if (fw_abort) {
 738                 /* Do a scan abort to stop the driver's scan engine */
 739                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 740                 memset(&params_le, 0, sizeof(params_le));
 741                 eth_broadcast_addr(params_le.bssid);
 742                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 743                 params_le.scan_type = 0;
 744                 params_le.channel_num = cpu_to_le32(1);
 745                 params_le.nprobes = cpu_to_le32(1);
 746                 params_le.active_time = cpu_to_le32(-1);
 747                 params_le.passive_time = cpu_to_le32(-1);
 748                 params_le.home_time = cpu_to_le32(-1);
 749                 /* Scan is aborted by setting channel_list[0] to -1 */
 750                 params_le.channel_list[0] = cpu_to_le16(-1);
 751                 /* E-Scan (or anyother type) can be aborted by SCAN */
 752                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 753                                              &params_le, sizeof(params_le));
 754                 if (err)
 755                         brcmf_err("Scan abort failed\n");
 756         }
 757
 758         brcmf_scan_config_mpc(ifp, 1);
 759
 760         /*
 761          * e-scan can be initiated internally
 762          * which takes precedence.
 763          */
 764         if (cfg->int_escan_map) {
 765                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
 766                           cfg->int_escan_map);
 767                 while (cfg->int_escan_map) {
 768                         bucket = __ffs(cfg->int_escan_map);
 769                         cfg->int_escan_map &= ~BIT(bucket);
 770                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
 771                                                                bucket);
 772                         if (!aborted) {
 773                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
 774                                           reqid);
 775                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
 776                                                             reqid);
 777                         }
 778                 }
 779         } else if (scan_request) {
 780                 struct cfg80211_scan_info info = {
 781                         .aborted = aborted,
 782                 };
 783
 784                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 785                           aborted ? "Aborted" : "Done");
 786                 cfg80211_scan_done(scan_request, &info);
 787         }
 788         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 789                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 790
 791         return err;
 792 }
 793
 794 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 795                                        struct wireless_dev *wdev)
 796 {
 797         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 798         struct net_device *ndev = wdev->netdev;
 799         struct brcmf_if *ifp = netdev_priv(ndev);
 800         int ret;
 801         int err;
 802
 803         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 804
 805         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 806         if (err) {
 807                 brcmf_err("interface_remove failed %d\n", err);
 808                 goto err_unarm;
 809         }
 810
 811         /* wait for firmware event */
 812         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 813                                             BRCMF_VIF_EVENT_TIMEOUT);
 814         if (!ret) {
 815                 brcmf_err("timeout occurred\n");
 816                 err = -EIO;
 817                 goto err_unarm;
 818         }
 819
 820         brcmf_remove_interface(ifp, true);
 821
 822 err_unarm:
 823         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 824         return err;
 825 }
 826
 827 static
 828 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 829 {
 830         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 831         struct net_device *ndev = wdev->netdev;
 832
 833         if (ndev && ndev == cfg_to_ndev(cfg))
 834                 return -ENOTSUPP;
 835
 836         /* vif event pending in firmware */
 837         if (brcmf_cfg80211_vif_event_armed(cfg))
 838                 return -EBUSY;
 839
 840         if (ndev) {
 841                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 842                     cfg->escan_info.ifp == netdev_priv(ndev))
 843                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 844                                                     true, true);
 845
 846                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 847         }
 848
 849         switch (wdev->iftype) {
 850         case NL80211_IFTYPE_ADHOC:
 851         case NL80211_IFTYPE_STATION:
 852         case NL80211_IFTYPE_AP_VLAN:
 853         case NL80211_IFTYPE_WDS:
 854         case NL80211_IFTYPE_MONITOR:
 855         case NL80211_IFTYPE_MESH_POINT:
 856                 return -EOPNOTSUPP;
 857         case NL80211_IFTYPE_AP:
 858                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 859         case NL80211_IFTYPE_P2P_CLIENT:
 860         case NL80211_IFTYPE_P2P_GO:
 861         case NL80211_IFTYPE_P2P_DEVICE:
 862                 return brcmf_p2p_del_vif(wiphy, wdev);
 863         case NL80211_IFTYPE_UNSPECIFIED:
 864         default:
 865                 return -EINVAL;
 866         }
 867         return -EOPNOTSUPP;
 868 }
 869
 870 static s32
 871 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 872                          enum nl80211_iftype type,
 873                          struct vif_params *params)
 874 {
 875         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 876         struct brcmf_if *ifp = netdev_priv(ndev);
 877         struct brcmf_cfg80211_vif *vif = ifp->vif;
 878         s32 infra = 0;
 879         s32 ap = 0;
 880         s32 err = 0;
 881
 882         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 883                   type);
 884
 885         /* WAR: There are a number of p2p interface related problems which
 886          * need to be handled initially (before doing the validate).
 887          * wpa_supplicant tends to do iface changes on p2p device/client/go
 888          * which are not always possible/allowed. However we need to return
 889          * OK otherwise the wpa_supplicant wont start. The situation differs
 890          * on configuration and setup (p2pon=1 module param). The first check
 891          * is to see if the request is a change to station for p2p iface.
 892          */
 893         if ((type == NL80211_IFTYPE_STATION) &&
 894             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 895              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 896              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 897                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 898                 /* Now depending on whether module param p2pon=1 was used the
 899                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 900                  * that if p2pon=1 is used, but a newer supplicant is used then
 901                  * we should return an error, as this combination wont work.
 902                  * In other situations 0 is returned and supplicant will start
 903                  * normally. It will give a trace in cfg80211, but it is the
 904                  * only way to get it working. Unfortunately this will result
 905                  * in situation where we wont support new supplicant in
 906                  * combination with module param p2pon=1, but that is the way
 907                  * it is. If the user tries this then unloading of driver might
 908                  * fail/lock.
 909                  */
 910                 if (cfg->p2p.p2pdev_dynamically)
 911                         return -EOPNOTSUPP;
 912                 else
 913                         return 0;
 914         }
 915         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 916         if (err) {
 917                 brcmf_err("iface validation failed: err=%d\n", err);
 918                 return err;
 919         }
 920         switch (type) {
 921         case NL80211_IFTYPE_MONITOR:
 922         case NL80211_IFTYPE_WDS:
 923                 brcmf_err("type (%d) : currently we do not support this type\n",
 924                           type);
 925                 return -EOPNOTSUPP;
 926         case NL80211_IFTYPE_ADHOC:
 927                 infra = 0;
 928                 break;
 929         case NL80211_IFTYPE_STATION:
 930                 infra = 1;
 931                 break;
 932         case NL80211_IFTYPE_AP:
 933         case NL80211_IFTYPE_P2P_GO:
 934                 ap = 1;
 935                 break;
 936         default:
 937                 err = -EINVAL;
 938                 goto done;
 939         }
 940
 941         if (ap) {
 942                 if (type == NL80211_IFTYPE_P2P_GO) {
 943                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 944                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 945                 }
 946                 if (!err) {
 947                         brcmf_dbg(INFO, "IF Type = AP\n");
 948                 }
 949         } else {
 950                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 951                 if (err) {
 952                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 953                         err = -EAGAIN;
 954                         goto done;
 955                 }
 956                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 957                           "Adhoc" : "Infra");
 958         }
 959         ndev->ieee80211_ptr->iftype = type;
 960
 961         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 962
 963 done:
 964         brcmf_dbg(TRACE, "Exit\n");
 965
 966         return err;
 967 }
 968
 969 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 970                              struct brcmf_scan_params_le *params_le,
 971                              struct cfg80211_scan_request *request)
 972 {
 973         u32 n_ssids;
 974         u32 n_channels;
 975         s32 i;
 976         s32 offset;
 977         u16 chanspec;
 978         char *ptr;
 979         struct brcmf_ssid_le ssid_le;
 980
 981         eth_broadcast_addr(params_le->bssid);
 982         params_le->bss_type = DOT11_BSSTYPE_ANY;
 983         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
 984         params_le->channel_num = 0;
 985         params_le->nprobes = cpu_to_le32(-1);
 986         params_le->active_time = cpu_to_le32(-1);
 987         params_le->passive_time = cpu_to_le32(-1);
 988         params_le->home_time = cpu_to_le32(-1);
 989         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 990
 991         n_ssids = request->n_ssids;
 992         n_channels = request->n_channels;
 993
 994         /* Copy channel array if applicable */
 995         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 996                   n_channels);
 997         if (n_channels > 0) {
 998                 for (i = 0; i < n_channels; i++) {
 999                         chanspec = channel_to_chanspec(&cfg->d11inf,
1000                                                        request->channels[i]);
1001                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1002                                   request->channels[i]->hw_value, chanspec);
1003                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1004                 }
1005         } else {
1006                 brcmf_dbg(SCAN, "Scanning all channels\n");
1007         }
1008         /* Copy ssid array if applicable */
1009         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1010         if (n_ssids > 0) {
1011                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1012                                 n_channels * sizeof(u16);
1013                 offset = roundup(offset, sizeof(u32));
1014                 ptr = (char *)params_le + offset;
1015                 for (i = 0; i < n_ssids; i++) {
1016                         memset(&ssid_le, 0, sizeof(ssid_le));
1017                         ssid_le.SSID_len =
1018                                         cpu_to_le32(request->ssids[i].ssid_len);
1019                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1020                                request->ssids[i].ssid_len);
1021                         if (!ssid_le.SSID_len)
1022                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1023                         else
1024                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1025                                           i, ssid_le.SSID, ssid_le.SSID_len);
1026                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1027                         ptr += sizeof(ssid_le);
1028                 }
1029         } else {
1030                 brcmf_dbg(SCAN, "Performing passive scan\n");
1031                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
1032         }
1033         /* Adding mask to channel numbers */
1034         params_le->channel_num =
1035                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1036                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1037 }
1038
1039 static s32
1040 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1041                 struct cfg80211_scan_request *request)
1042 {
1043         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1044                           offsetof(struct brcmf_escan_params_le, params_le);
1045         struct brcmf_escan_params_le *params;
1046         s32 err = 0;
1047
1048         brcmf_dbg(SCAN, "E-SCAN START\n");
1049
1050         if (request != NULL) {
1051                 /* Allocate space for populating ssids in struct */
1052                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1053
1054                 /* Allocate space for populating ssids in struct */
1055                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1056         }
1057
1058         params = kzalloc(params_size, GFP_KERNEL);
1059         if (!params) {
1060                 err = -ENOMEM;
1061                 goto exit;
1062         }
1063         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1064         brcmf_escan_prep(cfg, &params->params_le, request);
1065         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1066         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1067         params->sync_id = cpu_to_le16(0x1234);
1068
1069         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1070         if (err) {
1071                 if (err == -EBUSY)
1072                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1073                 else
1074                         brcmf_err("error (%d)\n", err);
1075         }
1076
1077         kfree(params);
1078 exit:
1079         return err;
1080 }
1081
1082 static s32
1083 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1084 {
1085         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1086         s32 err;
1087         u32 passive_scan;
1088         struct brcmf_scan_results *results;
1089         struct escan_info *escan = &cfg->escan_info;
1090
1091         brcmf_dbg(SCAN, "Enter\n");
1092         escan->ifp = ifp;
1093         escan->wiphy = cfg->wiphy;
1094         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1095         passive_scan = cfg->active_scan ? 0 : 1;
1096         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1097                                     passive_scan);
1098         if (err) {
1099                 brcmf_err("error (%d)\n", err);
1100                 return err;
1101         }
1102         brcmf_scan_config_mpc(ifp, 0);
1103         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1104         results->version = 0;
1105         results->count = 0;
1106         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1107
1108         err = escan->run(cfg, ifp, request);
1109         if (err)
1110                 brcmf_scan_config_mpc(ifp, 1);
1111         return err;
1112 }
1113
1114 static s32
1115 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1116                      struct cfg80211_scan_request *request,
1117                      struct cfg80211_ssid *this_ssid)
1118 {
1119         struct brcmf_if *ifp = vif->ifp;
1120         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1121         struct cfg80211_ssid *ssids;
1122         u32 passive_scan;
1123         bool escan_req;
1124         bool spec_scan;
1125         s32 err;
1126         struct brcmf_ssid_le ssid_le;
1127         u32 SSID_len;
1128
1129         brcmf_dbg(SCAN, "START ESCAN\n");
1130
1131         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1132                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1133                 return -EAGAIN;
1134         }
1135         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1136                 brcmf_err("Scanning being aborted: status (%lu)\n",
1137                           cfg->scan_status);
1138                 return -EAGAIN;
1139         }
1140         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1141                 brcmf_err("Scanning suppressed: status (%lu)\n",
1142                           cfg->scan_status);
1143                 return -EAGAIN;
1144         }
1145         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1146                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1147                 return -EAGAIN;
1148         }
1149
1150         /* If scan req comes for p2p0, send it over primary I/F */
1151         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1152                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1153
1154         escan_req = false;
1155         if (request) {
1156                 /* scan bss */
1157                 ssids = request->ssids;
1158                 escan_req = true;
1159         } else {
1160                 /* scan in ibss */
1161                 /* we don't do escan in ibss */
1162                 ssids = this_ssid;
1163         }
1164
1165         cfg->scan_request = request;
1166         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1167         if (escan_req) {
1168                 cfg->escan_info.run = brcmf_run_escan;
1169                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1170                 if (err)
1171                         goto scan_out;
1172
1173                 err = brcmf_do_escan(vif->ifp, request);
1174                 if (err)
1175                         goto scan_out;
1176         } else {
1177                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1178                           ssids->ssid, ssids->ssid_len);
1179                 memset(&ssid_le, 0, sizeof(ssid_le));
1180                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1181                 ssid_le.SSID_len = cpu_to_le32(0);
1182                 spec_scan = false;
1183                 if (SSID_len) {
1184                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1185                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1186                         spec_scan = true;
1187                 } else
1188                         brcmf_dbg(SCAN, "Broadcast scan\n");
1189
1190                 passive_scan = cfg->active_scan ? 0 : 1;
1191                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1192                                             passive_scan);
1193                 if (err) {
1194                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1195                         goto scan_out;
1196                 }
1197                 brcmf_scan_config_mpc(ifp, 0);
1198                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1199                                              sizeof(ssid_le));
1200                 if (err) {
1201                         if (err == -EBUSY)
1202                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1203                                           ssid_le.SSID);
1204                         else
1205                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1206
1207                         brcmf_scan_config_mpc(ifp, 1);
1208                         goto scan_out;
1209                 }
1210         }
1211
1212         /* Arm scan timeout timer */
1213         mod_timer(&cfg->escan_timeout, jiffies +
1214                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1215
1216         return 0;
1217
1218 scan_out:
1219         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1220         cfg->scan_request = NULL;
1221         return err;
1222 }
1223
1224 static s32
1225 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1226 {
1227         struct brcmf_cfg80211_vif *vif;
1228         s32 err = 0;
1229
1230         brcmf_dbg(TRACE, "Enter\n");
1231         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1232         if (!check_vif_up(vif))
1233                 return -EIO;
1234
1235         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1236
1237         if (err)
1238                 brcmf_err("scan error (%d)\n", err);
1239
1240         brcmf_dbg(TRACE, "Exit\n");
1241         return err;
1242 }
1243
1244 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1245 {
1246         s32 err = 0;
1247
1248         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1249                                       rts_threshold);
1250         if (err)
1251                 brcmf_err("Error (%d)\n", err);
1252
1253         return err;
1254 }
1255
1256 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1257 {
1258         s32 err = 0;
1259
1260         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1261                                       frag_threshold);
1262         if (err)
1263                 brcmf_err("Error (%d)\n", err);
1264
1265         return err;
1266 }
1267
1268 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1269 {
1270         s32 err = 0;
1271         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1272
1273         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1274         if (err) {
1275                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1276                 return err;
1277         }
1278         return err;
1279 }
1280
1281 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1282 {
1283         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1284         struct net_device *ndev = cfg_to_ndev(cfg);
1285         struct brcmf_if *ifp = netdev_priv(ndev);
1286         s32 err = 0;
1287
1288         brcmf_dbg(TRACE, "Enter\n");
1289         if (!check_vif_up(ifp->vif))
1290                 return -EIO;
1291
1292         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1293             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1294                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1295                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1296                 if (!err)
1297                         goto done;
1298         }
1299         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1300             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1301                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1302                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1303                 if (!err)
1304                         goto done;
1305         }
1306         if (changed & WIPHY_PARAM_RETRY_LONG
1307             && (cfg->conf->retry_long != wiphy->retry_long)) {
1308                 cfg->conf->retry_long = wiphy->retry_long;
1309                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1310                 if (!err)
1311                         goto done;
1312         }
1313         if (changed & WIPHY_PARAM_RETRY_SHORT
1314             && (cfg->conf->retry_short != wiphy->retry_short)) {
1315                 cfg->conf->retry_short = wiphy->retry_short;
1316                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1317                 if (!err)
1318                         goto done;
1319         }
1320
1321 done:
1322         brcmf_dbg(TRACE, "Exit\n");
1323         return err;
1324 }
1325
1326 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1327 {
1328         memset(prof, 0, sizeof(*prof));
1329 }
1330
1331 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1332 {
1333         u16 reason;
1334
1335         switch (e->event_code) {
1336         case BRCMF_E_DEAUTH:
1337         case BRCMF_E_DEAUTH_IND:
1338         case BRCMF_E_DISASSOC_IND:
1339                 reason = e->reason;
1340                 break;
1341         case BRCMF_E_LINK:
1342         default:
1343                 reason = 0;
1344                 break;
1345         }
1346         return reason;
1347 }
1348
1349 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1350 {
1351         struct brcmf_wsec_pmk_le pmk;
1352         int err;
1353
1354         memset(&pmk, 0, sizeof(pmk));
1355
1356         /* pass pmk directly */
1357         pmk.key_len = cpu_to_le16(pmk_len);
1358         pmk.flags = cpu_to_le16(0);
1359         memcpy(pmk.key, pmk_data, pmk_len);
1360
1361         /* store psk in firmware */
1362         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1363                                      &pmk, sizeof(pmk));
1364         if (err < 0)
1365                 brcmf_err("failed to change PSK in firmware (len=%u)\n",
1366                           pmk_len);
1367
1368         return err;
1369 }
1370
1371 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1372 {
1373         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1374         s32 err = 0;
1375
1376         brcmf_dbg(TRACE, "Enter\n");
1377
1378         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1379                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1380                 err = brcmf_fil_cmd_data_set(vif->ifp,
1381                                              BRCMF_C_DISASSOC, NULL, 0);
1382                 if (err) {
1383                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1384                 }
1385                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1386                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1387                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1388                                               true, GFP_KERNEL);
1389         }
1390         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1391         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1392         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1393         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1394                 brcmf_set_pmk(vif->ifp, NULL, 0);
1395                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1396         }
1397         brcmf_dbg(TRACE, "Exit\n");
1398 }
1399
1400 static s32
1401 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1402                       struct cfg80211_ibss_params *params)
1403 {
1404         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1405         struct brcmf_if *ifp = netdev_priv(ndev);
1406         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1407         struct brcmf_join_params join_params;
1408         size_t join_params_size = 0;
1409         s32 err = 0;
1410         s32 wsec = 0;
1411         s32 bcnprd;
1412         u16 chanspec;
1413         u32 ssid_len;
1414
1415         brcmf_dbg(TRACE, "Enter\n");
1416         if (!check_vif_up(ifp->vif))
1417                 return -EIO;
1418
1419         if (params->ssid)
1420                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1421         else {
1422                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1423                 return -EOPNOTSUPP;
1424         }
1425
1426         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1427
1428         if (params->bssid)
1429                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1430         else
1431                 brcmf_dbg(CONN, "No BSSID specified\n");
1432
1433         if (params->chandef.chan)
1434                 brcmf_dbg(CONN, "channel: %d\n",
1435                           params->chandef.chan->center_freq);
1436         else
1437                 brcmf_dbg(CONN, "no channel specified\n");
1438
1439         if (params->channel_fixed)
1440                 brcmf_dbg(CONN, "fixed channel required\n");
1441         else
1442                 brcmf_dbg(CONN, "no fixed channel required\n");
1443
1444         if (params->ie && params->ie_len)
1445                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1446         else
1447                 brcmf_dbg(CONN, "no ie specified\n");
1448
1449         if (params->beacon_interval)
1450                 brcmf_dbg(CONN, "beacon interval: %d\n",
1451                           params->beacon_interval);
1452         else
1453                 brcmf_dbg(CONN, "no beacon interval specified\n");
1454
1455         if (params->basic_rates)
1456                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1457         else
1458                 brcmf_dbg(CONN, "no basic rates specified\n");
1459
1460         if (params->privacy)
1461                 brcmf_dbg(CONN, "privacy required\n");
1462         else
1463                 brcmf_dbg(CONN, "no privacy required\n");
1464
1465         /* Configure Privacy for starter */
1466         if (params->privacy)
1467                 wsec |= WEP_ENABLED;
1468
1469         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1470         if (err) {
1471                 brcmf_err("wsec failed (%d)\n", err);
1472                 goto done;
1473         }
1474
1475         /* Configure Beacon Interval for starter */
1476         if (params->beacon_interval)
1477                 bcnprd = params->beacon_interval;
1478         else
1479                 bcnprd = 100;
1480
1481         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1482         if (err) {
1483                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1484                 goto done;
1485         }
1486
1487         /* Configure required join parameter */
1488         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1489
1490         /* SSID */
1491         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1492         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1493         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1494         join_params_size = sizeof(join_params.ssid_le);
1495
1496         /* BSSID */
1497         if (params->bssid) {
1498                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1499                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1500                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1501         } else {
1502                 eth_broadcast_addr(join_params.params_le.bssid);
1503                 eth_zero_addr(profile->bssid);
1504         }
1505
1506         /* Channel */
1507         if (params->chandef.chan) {
1508                 u32 target_channel;
1509
1510                 cfg->channel =
1511                         ieee80211_frequency_to_channel(
1512                                 params->chandef.chan->center_freq);
1513                 if (params->channel_fixed) {
1514                         /* adding chanspec */
1515                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1516                                                        &params->chandef);
1517                         join_params.params_le.chanspec_list[0] =
1518                                 cpu_to_le16(chanspec);
1519                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1520                         join_params_size += sizeof(join_params.params_le);
1521                 }
1522
1523                 /* set channel for starter */
1524                 target_channel = cfg->channel;
1525                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1526                                             target_channel);
1527                 if (err) {
1528                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1529                         goto done;
1530                 }
1531         } else
1532                 cfg->channel = 0;
1533
1534         cfg->ibss_starter = false;
1535
1536
1537         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1538                                      &join_params, join_params_size);
1539         if (err) {
1540                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1541                 goto done;
1542         }
1543
1544 done:
1545         if (err)
1546                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1547         brcmf_dbg(TRACE, "Exit\n");
1548         return err;
1549 }
1550
1551 static s32
1552 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1553 {
1554         struct brcmf_if *ifp = netdev_priv(ndev);
1555
1556         brcmf_dbg(TRACE, "Enter\n");
1557         if (!check_vif_up(ifp->vif)) {
1558                 /* When driver is being unloaded, it can end up here. If an
1559                  * error is returned then later on a debug trace in the wireless
1560                  * core module will be printed. To avoid this 0 is returned.
1561                  */
1562                 return 0;
1563         }
1564
1565         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1566         brcmf_net_setcarrier(ifp, false);
1567
1568         brcmf_dbg(TRACE, "Exit\n");
1569
1570         return 0;
1571 }
1572
1573 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1574                                  struct cfg80211_connect_params *sme)
1575 {
1576         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1577         struct brcmf_cfg80211_security *sec;
1578         s32 val = 0;
1579         s32 err = 0;
1580
1581         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1582                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1583         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1584                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1585         else
1586                 val = WPA_AUTH_DISABLED;
1587         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1588         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1589         if (err) {
1590                 brcmf_err("set wpa_auth failed (%d)\n", err);
1591                 return err;
1592         }
1593         sec = &profile->sec;
1594         sec->wpa_versions = sme->crypto.wpa_versions;
1595         return err;
1596 }
1597
1598 static s32 brcmf_set_auth_type(struct net_device *ndev,
1599                                struct cfg80211_connect_params *sme)
1600 {
1601         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1602         struct brcmf_cfg80211_security *sec;
1603         s32 val = 0;
1604         s32 err = 0;
1605
1606         switch (sme->auth_type) {
1607         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1608                 val = 0;
1609                 brcmf_dbg(CONN, "open system\n");
1610                 break;
1611         case NL80211_AUTHTYPE_SHARED_KEY:
1612                 val = 1;
1613                 brcmf_dbg(CONN, "shared key\n");
1614                 break;
1615         default:
1616                 val = 2;
1617                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1618                 break;
1619         }
1620
1621         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1622         if (err) {
1623                 brcmf_err("set auth failed (%d)\n", err);
1624                 return err;
1625         }
1626         sec = &profile->sec;
1627         sec->auth_type = sme->auth_type;
1628         return err;
1629 }
1630
1631 static s32
1632 brcmf_set_wsec_mode(struct net_device *ndev,
1633                     struct cfg80211_connect_params *sme)
1634 {
1635         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1636         struct brcmf_cfg80211_security *sec;
1637         s32 pval = 0;
1638         s32 gval = 0;
1639         s32 wsec;
1640         s32 err = 0;
1641
1642         if (sme->crypto.n_ciphers_pairwise) {
1643                 switch (sme->crypto.ciphers_pairwise[0]) {
1644                 case WLAN_CIPHER_SUITE_WEP40:
1645                 case WLAN_CIPHER_SUITE_WEP104:
1646                         pval = WEP_ENABLED;
1647                         break;
1648                 case WLAN_CIPHER_SUITE_TKIP:
1649                         pval = TKIP_ENABLED;
1650                         break;
1651                 case WLAN_CIPHER_SUITE_CCMP:
1652                         pval = AES_ENABLED;
1653                         break;
1654                 case WLAN_CIPHER_SUITE_AES_CMAC:
1655                         pval = AES_ENABLED;
1656                         break;
1657                 default:
1658                         brcmf_err("invalid cipher pairwise (%d)\n",
1659                                   sme->crypto.ciphers_pairwise[0]);
1660                         return -EINVAL;
1661                 }
1662         }
1663         if (sme->crypto.cipher_group) {
1664                 switch (sme->crypto.cipher_group) {
1665                 case WLAN_CIPHER_SUITE_WEP40:
1666                 case WLAN_CIPHER_SUITE_WEP104:
1667                         gval = WEP_ENABLED;
1668                         break;
1669                 case WLAN_CIPHER_SUITE_TKIP:
1670                         gval = TKIP_ENABLED;
1671                         break;
1672                 case WLAN_CIPHER_SUITE_CCMP:
1673                         gval = AES_ENABLED;
1674                         break;
1675                 case WLAN_CIPHER_SUITE_AES_CMAC:
1676                         gval = AES_ENABLED;
1677                         break;
1678                 default:
1679                         brcmf_err("invalid cipher group (%d)\n",
1680                                   sme->crypto.cipher_group);
1681                         return -EINVAL;
1682                 }
1683         }
1684
1685         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1686         /* In case of privacy, but no security and WPS then simulate */
1687         /* setting AES. WPS-2.0 allows no security                   */
1688         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1689             sme->privacy)
1690                 pval = AES_ENABLED;
1691
1692         wsec = pval | gval;
1693         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1694         if (err) {
1695                 brcmf_err("error (%d)\n", err);
1696                 return err;
1697         }
1698
1699         sec = &profile->sec;
1700         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1701         sec->cipher_group = sme->crypto.cipher_group;
1702
1703         return err;
1704 }
1705
1706 static s32
1707 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1708 {
1709         struct brcmf_if *ifp = netdev_priv(ndev);
1710         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1711         s32 val;
1712         s32 err;
1713         const struct brcmf_tlv *rsn_ie;
1714         const u8 *ie;
1715         u32 ie_len;
1716         u32 offset;
1717         u16 rsn_cap;
1718         u32 mfp;
1719         u16 count;
1720
1721         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1722
1723         if (!sme->crypto.n_akm_suites)
1724                 return 0;
1725
1726         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1727         if (err) {
1728                 brcmf_err("could not get wpa_auth (%d)\n", err);
1729                 return err;
1730         }
1731         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1732                 switch (sme->crypto.akm_suites[0]) {
1733                 case WLAN_AKM_SUITE_8021X:
1734                         val = WPA_AUTH_UNSPECIFIED;
1735                         if (sme->want_1x)
1736                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1737                         break;
1738                 case WLAN_AKM_SUITE_PSK:
1739                         val = WPA_AUTH_PSK;
1740                         break;
1741                 default:
1742                         brcmf_err("invalid cipher group (%d)\n",
1743                                   sme->crypto.cipher_group);
1744                         return -EINVAL;
1745                 }
1746         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1747                 switch (sme->crypto.akm_suites[0]) {
1748                 case WLAN_AKM_SUITE_8021X:
1749                         val = WPA2_AUTH_UNSPECIFIED;
1750                         if (sme->want_1x)
1751                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1752                         break;
1753                 case WLAN_AKM_SUITE_8021X_SHA256:
1754                         val = WPA2_AUTH_1X_SHA256;
1755                         if (sme->want_1x)
1756                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1757                         break;
1758                 case WLAN_AKM_SUITE_PSK_SHA256:
1759                         val = WPA2_AUTH_PSK_SHA256;
1760                         break;
1761                 case WLAN_AKM_SUITE_PSK:
1762                         val = WPA2_AUTH_PSK;
1763                         break;
1764                 default:
1765                         brcmf_err("invalid cipher group (%d)\n",
1766                                   sme->crypto.cipher_group);
1767                         return -EINVAL;
1768                 }
1769         }
1770
1771         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
1772                 brcmf_dbg(INFO, "using 1X offload\n");
1773
1774         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1775                 goto skip_mfp_config;
1776         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1777          * IE will not be verified, just a quick search for MFP config
1778          */
1779         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1780                                   WLAN_EID_RSN);
1781         if (!rsn_ie)
1782                 goto skip_mfp_config;
1783         ie = (const u8 *)rsn_ie;
1784         ie_len = rsn_ie->len + TLV_HDR_LEN;
1785         /* Skip unicast suite */
1786         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1787         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1788                 goto skip_mfp_config;
1789         /* Skip multicast suite */
1790         count = ie[offset] + (ie[offset + 1] << 8);
1791         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1792         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1793                 goto skip_mfp_config;
1794         /* Skip auth key management suite(s) */
1795         count = ie[offset] + (ie[offset + 1] << 8);
1796         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1797         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1798                 goto skip_mfp_config;
1799         /* Ready to read capabilities */
1800         mfp = BRCMF_MFP_NONE;
1801         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1802         if (rsn_cap & RSN_CAP_MFPR_MASK)
1803                 mfp = BRCMF_MFP_REQUIRED;
1804         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1805                 mfp = BRCMF_MFP_CAPABLE;
1806         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1807
1808 skip_mfp_config:
1809         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1810         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1811         if (err) {
1812                 brcmf_err("could not set wpa_auth (%d)\n", err);
1813                 return err;
1814         }
1815
1816         return err;
1817 }
1818
1819 static s32
1820 brcmf_set_sharedkey(struct net_device *ndev,
1821                     struct cfg80211_connect_params *sme)
1822 {
1823         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1824         struct brcmf_cfg80211_security *sec;
1825         struct brcmf_wsec_key key;
1826         s32 val;
1827         s32 err = 0;
1828
1829         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1830
1831         if (sme->key_len == 0)
1832                 return 0;
1833
1834         sec = &profile->sec;
1835         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1836                   sec->wpa_versions, sec->cipher_pairwise);
1837
1838         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1839                 return 0;
1840
1841         if (!(sec->cipher_pairwise &
1842             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1843                 return 0;
1844
1845         memset(&key, 0, sizeof(key));
1846         key.len = (u32) sme->key_len;
1847         key.index = (u32) sme->key_idx;
1848         if (key.len > sizeof(key.data)) {
1849                 brcmf_err("Too long key length (%u)\n", key.len);
1850                 return -EINVAL;
1851         }
1852         memcpy(key.data, sme->key, key.len);
1853         key.flags = BRCMF_PRIMARY_KEY;
1854         switch (sec->cipher_pairwise) {
1855         case WLAN_CIPHER_SUITE_WEP40:
1856                 key.algo = CRYPTO_ALGO_WEP1;
1857                 break;
1858         case WLAN_CIPHER_SUITE_WEP104:
1859                 key.algo = CRYPTO_ALGO_WEP128;
1860                 break;
1861         default:
1862                 brcmf_err("Invalid algorithm (%d)\n",
1863                           sme->crypto.ciphers_pairwise[0]);
1864                 return -EINVAL;
1865         }
1866         /* Set the new key/index */
1867         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1868                   key.len, key.index, key.algo);
1869         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1870         err = send_key_to_dongle(netdev_priv(ndev), &key);
1871         if (err)
1872                 return err;
1873
1874         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1875                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1876                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1877                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1878                 if (err)
1879                         brcmf_err("set auth failed (%d)\n", err);
1880         }
1881         return err;
1882 }
1883
1884 static
1885 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1886                                            enum nl80211_auth_type type)
1887 {
1888         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1889             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1890                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1891                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1892         }
1893         return type;
1894 }
1895
1896 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1897                                 struct cfg80211_bss_selection *bss_select)
1898 {
1899         struct brcmf_join_pref_params join_pref_params[2];
1900         enum nl80211_band band;
1901         int err, i = 0;
1902
1903         join_pref_params[i].len = 2;
1904         join_pref_params[i].rssi_gain = 0;
1905
1906         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1907                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1908
1909         switch (bss_select->behaviour) {
1910         case __NL80211_BSS_SELECT_ATTR_INVALID:
1911                 brcmf_c_set_joinpref_default(ifp);
1912                 return;
1913         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1914                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1915                 band = bss_select->param.band_pref;
1916                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1917                 i++;
1918                 break;
1919         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1920                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1921                 band = bss_select->param.adjust.band;
1922                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1923                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1924                 i++;
1925                 break;
1926         case NL80211_BSS_SELECT_ATTR_RSSI:
1927         default:
1928                 break;
1929         }
1930         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1931         join_pref_params[i].len = 2;
1932         join_pref_params[i].rssi_gain = 0;
1933         join_pref_params[i].band = 0;
1934         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1935                                        sizeof(join_pref_params));
1936         if (err)
1937                 brcmf_err("Set join_pref error (%d)\n", err);
1938 }
1939
1940 static s32
1941 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1942                        struct cfg80211_connect_params *sme)
1943 {
1944         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1945         struct brcmf_if *ifp = netdev_priv(ndev);
1946         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1947         struct ieee80211_channel *chan = sme->channel;
1948         struct brcmf_join_params join_params;
1949         size_t join_params_size;
1950         const struct brcmf_tlv *rsn_ie;
1951         const struct brcmf_vs_tlv *wpa_ie;
1952         const void *ie;
1953         u32 ie_len;
1954         struct brcmf_ext_join_params_le *ext_join_params;
1955         u16 chanspec;
1956         s32 err = 0;
1957         u32 ssid_len;
1958
1959         brcmf_dbg(TRACE, "Enter\n");
1960         if (!check_vif_up(ifp->vif))
1961                 return -EIO;
1962
1963         if (!sme->ssid) {
1964                 brcmf_err("Invalid ssid\n");
1965                 return -EOPNOTSUPP;
1966         }
1967
1968         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1969                 /* A normal (non P2P) connection request setup. */
1970                 ie = NULL;
1971                 ie_len = 0;
1972                 /* find the WPA_IE */
1973                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1974                 if (wpa_ie) {
1975                         ie = wpa_ie;
1976                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1977                 } else {
1978                         /* find the RSN_IE */
1979                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1980                                                   sme->ie_len,
1981                                                   WLAN_EID_RSN);
1982                         if (rsn_ie) {
1983                                 ie = rsn_ie;
1984                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1985                         }
1986                 }
1987                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1988         }
1989
1990         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1991                                     sme->ie, sme->ie_len);
1992         if (err)
1993                 brcmf_err("Set Assoc REQ IE Failed\n");
1994         else
1995                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1996
1997         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1998
1999         if (chan) {
2000                 cfg->channel =
2001                         ieee80211_frequency_to_channel(chan->center_freq);
2002                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2003                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2004                           cfg->channel, chan->center_freq, chanspec);
2005         } else {
2006                 cfg->channel = 0;
2007                 chanspec = 0;
2008         }
2009
2010         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2011
2012         err = brcmf_set_wpa_version(ndev, sme);
2013         if (err) {
2014                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
2015                 goto done;
2016         }
2017
2018         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2019         err = brcmf_set_auth_type(ndev, sme);
2020         if (err) {
2021                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
2022                 goto done;
2023         }
2024
2025         err = brcmf_set_wsec_mode(ndev, sme);
2026         if (err) {
2027                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
2028                 goto done;
2029         }
2030
2031         err = brcmf_set_key_mgmt(ndev, sme);
2032         if (err) {
2033                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
2034                 goto done;
2035         }
2036
2037         err = brcmf_set_sharedkey(ndev, sme);
2038         if (err) {
2039                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
2040                 goto done;
2041         }
2042
2043         if (sme->crypto.psk) {
2044                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2045                         err = -EINVAL;
2046                         goto done;
2047                 }
2048                 brcmf_dbg(INFO, "using PSK offload\n");
2049                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2050         }
2051
2052         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2053                 /* enable firmware supplicant for this interface */
2054                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2055                 if (err < 0) {
2056                         brcmf_err("failed to enable fw supplicant\n");
2057                         goto done;
2058                 }
2059         }
2060
2061         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
2062                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2063                                     BRCMF_WSEC_MAX_PSK_LEN);
2064                 if (err)
2065                         goto done;
2066         }
2067
2068         /* Join with specific BSSID and cached SSID
2069          * If SSID is zero join based on BSSID only
2070          */
2071         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2072                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2073         if (cfg->channel)
2074                 join_params_size += sizeof(u16);
2075         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2076         if (ext_join_params == NULL) {
2077                 err = -ENOMEM;
2078                 goto done;
2079         }
2080         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2081         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2082         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2083         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2084                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2085                           ext_join_params->ssid_le.SSID, ssid_len);
2086
2087         /* Set up join scan parameters */
2088         ext_join_params->scan_le.scan_type = -1;
2089         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2090
2091         if (sme->bssid)
2092                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2093         else
2094                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2095
2096         if (cfg->channel) {
2097                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2098
2099                 ext_join_params->assoc_le.chanspec_list[0] =
2100                         cpu_to_le16(chanspec);
2101                 /* Increase dwell time to receive probe response or detect
2102                  * beacon from target AP at a noisy air only during connect
2103                  * command.
2104                  */
2105                 ext_join_params->scan_le.active_time =
2106                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2107                 ext_join_params->scan_le.passive_time =
2108                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2109                 /* To sync with presence period of VSDB GO send probe request
2110                  * more frequently. Probe request will be stopped when it gets
2111                  * probe response from target AP/GO.
2112                  */
2113                 ext_join_params->scan_le.nprobes =
2114                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2115                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2116         } else {
2117                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2118                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2119                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2120         }
2121
2122         brcmf_set_join_pref(ifp, &sme->bss_select);
2123
2124         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2125                                          join_params_size);
2126         kfree(ext_join_params);
2127         if (!err)
2128                 /* This is it. join command worked, we are done */
2129                 goto done;
2130
2131         /* join command failed, fallback to set ssid */
2132         memset(&join_params, 0, sizeof(join_params));
2133         join_params_size = sizeof(join_params.ssid_le);
2134
2135         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2136         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2137
2138         if (sme->bssid)
2139                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2140         else
2141                 eth_broadcast_addr(join_params.params_le.bssid);
2142
2143         if (cfg->channel) {
2144                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2145                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2146                 join_params_size += sizeof(join_params.params_le);
2147         }
2148         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2149                                      &join_params, join_params_size);
2150         if (err)
2151                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2152
2153 done:
2154         if (err)
2155                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2156         brcmf_dbg(TRACE, "Exit\n");
2157         return err;
2158 }
2159
2160 static s32
2161 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2162                        u16 reason_code)
2163 {
2164         struct brcmf_if *ifp = netdev_priv(ndev);
2165         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2166         struct brcmf_scb_val_le scbval;
2167         s32 err = 0;
2168
2169         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2170         if (!check_vif_up(ifp->vif))
2171                 return -EIO;
2172
2173         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2174         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2175         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2176
2177         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2178         scbval.val = cpu_to_le32(reason_code);
2179         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2180                                      &scbval, sizeof(scbval));
2181         if (err)
2182                 brcmf_err("error (%d)\n", err);
2183
2184         brcmf_dbg(TRACE, "Exit\n");
2185         return err;
2186 }
2187
2188 static s32
2189 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2190                             enum nl80211_tx_power_setting type, s32 mbm)
2191 {
2192         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2193         struct net_device *ndev = cfg_to_ndev(cfg);
2194         struct brcmf_if *ifp = netdev_priv(ndev);
2195         s32 err;
2196         s32 disable;
2197         u32 qdbm = 127;
2198
2199         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2200         if (!check_vif_up(ifp->vif))
2201                 return -EIO;
2202
2203         switch (type) {
2204         case NL80211_TX_POWER_AUTOMATIC:
2205                 break;
2206         case NL80211_TX_POWER_LIMITED:
2207         case NL80211_TX_POWER_FIXED:
2208                 if (mbm < 0) {
2209                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2210                         err = -EINVAL;
2211                         goto done;
2212                 }
2213                 qdbm =  MBM_TO_DBM(4 * mbm);
2214                 if (qdbm > 127)
2215                         qdbm = 127;
2216                 qdbm |= WL_TXPWR_OVERRIDE;
2217                 break;
2218         default:
2219                 brcmf_err("Unsupported type %d\n", type);
2220                 err = -EINVAL;
2221                 goto done;
2222         }
2223         /* Make sure radio is off or on as far as software is concerned */
2224         disable = WL_RADIO_SW_DISABLE << 16;
2225         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2226         if (err)
2227                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2228
2229         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2230         if (err)
2231                 brcmf_err("qtxpower error (%d)\n", err);
2232
2233 done:
2234         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2235         return err;
2236 }
2237
2238 static s32
2239 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2240                             s32 *dbm)
2241 {
2242         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2243         struct net_device *ndev = cfg_to_ndev(cfg);
2244         struct brcmf_if *ifp = netdev_priv(ndev);
2245         s32 qdbm = 0;
2246         s32 err;
2247
2248         brcmf_dbg(TRACE, "Enter\n");
2249         if (!check_vif_up(ifp->vif))
2250                 return -EIO;
2251
2252         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2253         if (err) {
2254                 brcmf_err("error (%d)\n", err);
2255                 goto done;
2256         }
2257         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2258
2259 done:
2260         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2261         return err;
2262 }
2263
2264 static s32
2265 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2266                                   u8 key_idx, bool unicast, bool multicast)
2267 {
2268         struct brcmf_if *ifp = netdev_priv(ndev);
2269         u32 index;
2270         u32 wsec;
2271         s32 err = 0;
2272
2273         brcmf_dbg(TRACE, "Enter\n");
2274         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2275         if (!check_vif_up(ifp->vif))
2276                 return -EIO;
2277
2278         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2279         if (err) {
2280                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2281                 goto done;
2282         }
2283
2284         if (wsec & WEP_ENABLED) {
2285                 /* Just select a new current key */
2286                 index = key_idx;
2287                 err = brcmf_fil_cmd_int_set(ifp,
2288                                             BRCMF_C_SET_KEY_PRIMARY, index);
2289                 if (err)
2290                         brcmf_err("error (%d)\n", err);
2291         }
2292 done:
2293         brcmf_dbg(TRACE, "Exit\n");
2294         return err;
2295 }
2296
2297 static s32
2298 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2299                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2300 {
2301         struct brcmf_if *ifp = netdev_priv(ndev);
2302         struct brcmf_wsec_key *key;
2303         s32 err;
2304
2305         brcmf_dbg(TRACE, "Enter\n");
2306         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2307
2308         if (!check_vif_up(ifp->vif))
2309                 return -EIO;
2310
2311         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2312                 /* we ignore this key index in this case */
2313                 return -EINVAL;
2314         }
2315
2316         key = &ifp->vif->profile.key[key_idx];
2317
2318         if (key->algo == CRYPTO_ALGO_OFF) {
2319                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2320                 return -EINVAL;
2321         }
2322
2323         memset(key, 0, sizeof(*key));
2324         key->index = (u32)key_idx;
2325         key->flags = BRCMF_PRIMARY_KEY;
2326
2327         /* Clear the key/index */
2328         err = send_key_to_dongle(ifp, key);
2329
2330         brcmf_dbg(TRACE, "Exit\n");
2331         return err;
2332 }
2333
2334 static s32
2335 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2336                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2337                        struct key_params *params)
2338 {
2339         struct brcmf_if *ifp = netdev_priv(ndev);
2340         struct brcmf_wsec_key *key;
2341         s32 val;
2342         s32 wsec;
2343         s32 err;
2344         u8 keybuf[8];
2345         bool ext_key;
2346
2347         brcmf_dbg(TRACE, "Enter\n");
2348         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2349         if (!check_vif_up(ifp->vif))
2350                 return -EIO;
2351
2352         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2353                 /* we ignore this key index in this case */
2354                 brcmf_err("invalid key index (%d)\n", key_idx);
2355                 return -EINVAL;
2356         }
2357
2358         if (params->key_len == 0)
2359                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2360                                               mac_addr);
2361
2362         if (params->key_len > sizeof(key->data)) {
2363                 brcmf_err("Too long key length (%u)\n", params->key_len);
2364                 return -EINVAL;
2365         }
2366
2367         ext_key = false;
2368         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2369             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2370                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2371                 ext_key = true;
2372         }
2373
2374         key = &ifp->vif->profile.key[key_idx];
2375         memset(key, 0, sizeof(*key));
2376         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2377                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2378         key->len = params->key_len;
2379         key->index = key_idx;
2380         memcpy(key->data, params->key, key->len);
2381         if (!ext_key)
2382                 key->flags = BRCMF_PRIMARY_KEY;
2383
2384         switch (params->cipher) {
2385         case WLAN_CIPHER_SUITE_WEP40:
2386                 key->algo = CRYPTO_ALGO_WEP1;
2387                 val = WEP_ENABLED;
2388                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2389                 break;
2390         case WLAN_CIPHER_SUITE_WEP104:
2391                 key->algo = CRYPTO_ALGO_WEP128;
2392                 val = WEP_ENABLED;
2393                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2394                 break;
2395         case WLAN_CIPHER_SUITE_TKIP:
2396                 if (!brcmf_is_apmode(ifp->vif)) {
2397                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2398                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2399                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2400                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2401                 }
2402                 key->algo = CRYPTO_ALGO_TKIP;
2403                 val = TKIP_ENABLED;
2404                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2405                 break;
2406         case WLAN_CIPHER_SUITE_AES_CMAC:
2407                 key->algo = CRYPTO_ALGO_AES_CCM;
2408                 val = AES_ENABLED;
2409                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2410                 break;
2411         case WLAN_CIPHER_SUITE_CCMP:
2412                 key->algo = CRYPTO_ALGO_AES_CCM;
2413                 val = AES_ENABLED;
2414                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2415                 break;
2416         default:
2417                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2418                 err = -EINVAL;
2419                 goto done;
2420         }
2421
2422         err = send_key_to_dongle(ifp, key);
2423         if (ext_key || err)
2424                 goto done;
2425
2426         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2427         if (err) {
2428                 brcmf_err("get wsec error (%d)\n", err);
2429                 goto done;
2430         }
2431         wsec |= val;
2432         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2433         if (err) {
2434                 brcmf_err("set wsec error (%d)\n", err);
2435                 goto done;
2436         }
2437
2438 done:
2439         brcmf_dbg(TRACE, "Exit\n");
2440         return err;
2441 }
2442
2443 static s32
2444 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2445                        bool pairwise, const u8 *mac_addr, void *cookie,
2446                        void (*callback)(void *cookie,
2447                                         struct key_params *params))
2448 {
2449         struct key_params params;
2450         struct brcmf_if *ifp = netdev_priv(ndev);
2451         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2452         struct brcmf_cfg80211_security *sec;
2453         s32 wsec;
2454         s32 err = 0;
2455
2456         brcmf_dbg(TRACE, "Enter\n");
2457         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2458         if (!check_vif_up(ifp->vif))
2459                 return -EIO;
2460
2461         memset(&params, 0, sizeof(params));
2462
2463         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2464         if (err) {
2465                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2466                 /* Ignore this error, may happen during DISASSOC */
2467                 err = -EAGAIN;
2468                 goto done;
2469         }
2470         if (wsec & WEP_ENABLED) {
2471                 sec = &profile->sec;
2472                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2473                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2474                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2475                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2476                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2477                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2478                 }
2479         } else if (wsec & TKIP_ENABLED) {
2480                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2481                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2482         } else if (wsec & AES_ENABLED) {
2483                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2484                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2485         } else  {
2486                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2487                 err = -EINVAL;
2488                 goto done;
2489         }
2490         callback(cookie, &params);
2491
2492 done:
2493         brcmf_dbg(TRACE, "Exit\n");
2494         return err;
2495 }
2496
2497 static s32
2498 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2499                                        struct net_device *ndev, u8 key_idx)
2500 {
2501         struct brcmf_if *ifp = netdev_priv(ndev);
2502
2503         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2504
2505         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2506                 return 0;
2507
2508         brcmf_dbg(INFO, "Not supported\n");
2509
2510         return -EOPNOTSUPP;
2511 }
2512
2513 static void
2514 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2515 {
2516         s32 err;
2517         u8 key_idx;
2518         struct brcmf_wsec_key *key;
2519         s32 wsec;
2520
2521         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2522                 key = &ifp->vif->profile.key[key_idx];
2523                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2524                     (key->algo == CRYPTO_ALGO_WEP128))
2525                         break;
2526         }
2527         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2528                 return;
2529
2530         err = send_key_to_dongle(ifp, key);
2531         if (err) {
2532                 brcmf_err("Setting WEP key failed (%d)\n", err);
2533                 return;
2534         }
2535         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2536         if (err) {
2537                 brcmf_err("get wsec error (%d)\n", err);
2538                 return;
2539         }
2540         wsec |= WEP_ENABLED;
2541         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2542         if (err)
2543                 brcmf_err("set wsec error (%d)\n", err);
2544 }
2545
2546 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2547 {
2548         struct nl80211_sta_flag_update *sfu;
2549
2550         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2551         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2552         sfu = &si->sta_flags;
2553         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2554                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2555                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2556                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2557         if (fw_sta_flags & BRCMF_STA_WME)
2558                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2559         if (fw_sta_flags & BRCMF_STA_AUTHE)
2560                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2561         if (fw_sta_flags & BRCMF_STA_ASSOC)
2562                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2563         if (fw_sta_flags & BRCMF_STA_AUTHO)
2564                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2565 }
2566
2567 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2568 {
2569         struct {
2570                 __le32 len;
2571                 struct brcmf_bss_info_le bss_le;
2572         } *buf;
2573         u16 capability;
2574         int err;
2575
2576         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2577         if (!buf)
2578                 return;
2579
2580         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2581         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2582                                      WL_BSS_INFO_MAX);
2583         if (err) {
2584                 brcmf_err("Failed to get bss info (%d)\n", err);
2585                 goto out_kfree;
2586         }
2587         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2588         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2589         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2590         capability = le16_to_cpu(buf->bss_le.capability);
2591         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2592                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2593         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2594                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2595         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2596                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2597
2598 out_kfree:
2599         kfree(buf);
2600 }
2601
2602 static s32
2603 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2604                                 struct station_info *sinfo)
2605 {
2606         struct brcmf_scb_val_le scbval;
2607         struct brcmf_pktcnt_le pktcnt;
2608         s32 err;
2609         u32 rate;
2610         u32 rssi;
2611
2612         /* Get the current tx rate */
2613         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2614         if (err < 0) {
2615                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2616                 return err;
2617         }
2618         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2619         sinfo->txrate.legacy = rate * 5;
2620
2621         memset(&scbval, 0, sizeof(scbval));
2622         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2623                                      sizeof(scbval));
2624         if (err) {
2625                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2626                 return err;
2627         }
2628         rssi = le32_to_cpu(scbval.val);
2629         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2630         sinfo->signal = rssi;
2631
2632         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2633                                      sizeof(pktcnt));
2634         if (err) {
2635                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2636                 return err;
2637         }
2638         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2639                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2640                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2641                          BIT(NL80211_STA_INFO_TX_FAILED);
2642         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2643         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2644         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2645         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2646
2647         return 0;
2648 }
2649
2650 static s32
2651 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2652                            const u8 *mac, struct station_info *sinfo)
2653 {
2654         struct brcmf_if *ifp = netdev_priv(ndev);
2655         struct brcmf_scb_val_le scb_val;
2656         s32 err = 0;
2657         struct brcmf_sta_info_le sta_info_le;
2658         u32 sta_flags;
2659         u32 is_tdls_peer;
2660         s32 total_rssi;
2661         s32 count_rssi;
2662         int rssi;
2663         u32 i;
2664
2665         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2666         if (!check_vif_up(ifp->vif))
2667                 return -EIO;
2668
2669         if (brcmf_is_ibssmode(ifp->vif))
2670                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2671
2672         memset(&sta_info_le, 0, sizeof(sta_info_le));
2673         memcpy(&sta_info_le, mac, ETH_ALEN);
2674         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2675                                        &sta_info_le,
2676                                        sizeof(sta_info_le));
2677         is_tdls_peer = !err;
2678         if (err) {
2679                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2680                                                &sta_info_le,
2681                                                sizeof(sta_info_le));
2682                 if (err < 0) {
2683                         brcmf_err("GET STA INFO failed, %d\n", err);
2684                         goto done;
2685                 }
2686         }
2687         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2688         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2689         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2690         sta_flags = le32_to_cpu(sta_info_le.flags);
2691         brcmf_convert_sta_flags(sta_flags, sinfo);
2692         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2693         if (is_tdls_peer)
2694                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2695         else
2696                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2697         if (sta_flags & BRCMF_STA_ASSOC) {
2698                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2699                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2700                 brcmf_fill_bss_param(ifp, sinfo);
2701         }
2702         if (sta_flags & BRCMF_STA_SCBSTATS) {
2703                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2704                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2705                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2706                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2707                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2708                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2709                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2710                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2711                 if (sinfo->tx_packets) {
2712                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2713                         sinfo->txrate.legacy =
2714                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2715                 }
2716                 if (sinfo->rx_packets) {
2717                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2718                         sinfo->rxrate.legacy =
2719                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2720                 }
2721                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2722                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2723                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2724                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2725                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2726                 }
2727                 total_rssi = 0;
2728                 count_rssi = 0;
2729                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2730                         if (sta_info_le.rssi[i]) {
2731                                 sinfo->chain_signal_avg[count_rssi] =
2732                                         sta_info_le.rssi[i];
2733                                 sinfo->chain_signal[count_rssi] =
2734                                         sta_info_le.rssi[i];
2735                                 total_rssi += sta_info_le.rssi[i];
2736                                 count_rssi++;
2737                         }
2738                 }
2739                 if (count_rssi) {
2740                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2741                         sinfo->chains = count_rssi;
2742
2743                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2744                         total_rssi /= count_rssi;
2745                         sinfo->signal = total_rssi;
2746                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2747                         &ifp->vif->sme_state)) {
2748                         memset(&scb_val, 0, sizeof(scb_val));
2749                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2750                                                      &scb_val, sizeof(scb_val));
2751                         if (err) {
2752                                 brcmf_err("Could not get rssi (%d)\n", err);
2753                                 goto done;
2754                         } else {
2755                                 rssi = le32_to_cpu(scb_val.val);
2756                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2757                                 sinfo->signal = rssi;
2758                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2759                         }
2760                 }
2761         }
2762 done:
2763         brcmf_dbg(TRACE, "Exit\n");
2764         return err;
2765 }
2766
2767 static int
2768 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2769                             int idx, u8 *mac, struct station_info *sinfo)
2770 {
2771         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2772         struct brcmf_if *ifp = netdev_priv(ndev);
2773         s32 err;
2774
2775         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2776
2777         if (idx == 0) {
2778                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2779                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2780                                              &cfg->assoclist,
2781                                              sizeof(cfg->assoclist));
2782                 if (err) {
2783                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2784                                   err);
2785                         cfg->assoclist.count = 0;
2786                         return -EOPNOTSUPP;
2787                 }
2788         }
2789         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2790                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2791                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2792         }
2793         return -ENOENT;
2794 }
2795
2796 static s32
2797 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2798                            bool enabled, s32 timeout)
2799 {
2800         s32 pm;
2801         s32 err = 0;
2802         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2803         struct brcmf_if *ifp = netdev_priv(ndev);
2804
2805         brcmf_dbg(TRACE, "Enter\n");
2806
2807         /*
2808          * Powersave enable/disable request is coming from the
2809          * cfg80211 even before the interface is up. In that
2810          * scenario, driver will be storing the power save
2811          * preference in cfg struct to apply this to
2812          * FW later while initializing the dongle
2813          */
2814         cfg->pwr_save = enabled;
2815         if (!check_vif_up(ifp->vif)) {
2816
2817                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2818                 goto done;
2819         }
2820
2821         pm = enabled ? PM_FAST : PM_OFF;
2822         /* Do not enable the power save after assoc if it is a p2p interface */
2823         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2824                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2825                 pm = PM_OFF;
2826         }
2827         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2828
2829         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2830         if (err) {
2831                 if (err == -ENODEV)
2832                         brcmf_err("net_device is not ready yet\n");
2833                 else
2834                         brcmf_err("error (%d)\n", err);
2835         }
2836 done:
2837         brcmf_dbg(TRACE, "Exit\n");
2838         return err;
2839 }
2840
2841 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2842                                    struct brcmf_bss_info_le *bi)
2843 {
2844         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2845         struct ieee80211_channel *notify_channel;
2846         struct cfg80211_bss *bss;
2847         struct ieee80211_supported_band *band;
2848         struct brcmu_chan ch;
2849         u16 channel;
2850         u32 freq;
2851         u16 notify_capability;
2852         u16 notify_interval;
2853         u8 *notify_ie;
2854         size_t notify_ielen;
2855         s32 notify_signal;
2856
2857         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2858                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2859                 return 0;
2860         }
2861
2862         if (!bi->ctl_ch) {
2863                 ch.chspec = le16_to_cpu(bi->chanspec);
2864                 cfg->d11inf.decchspec(&ch);
2865                 bi->ctl_ch = ch.control_ch_num;
2866         }
2867         channel = bi->ctl_ch;
2868
2869         if (channel <= CH_MAX_2G_CHANNEL)
2870                 band = wiphy->bands[NL80211_BAND_2GHZ];
2871         else
2872                 band = wiphy->bands[NL80211_BAND_5GHZ];
2873
2874         freq = ieee80211_channel_to_frequency(channel, band->band);
2875         notify_channel = ieee80211_get_channel(wiphy, freq);
2876
2877         notify_capability = le16_to_cpu(bi->capability);
2878         notify_interval = le16_to_cpu(bi->beacon_period);
2879         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2880         notify_ielen = le32_to_cpu(bi->ie_length);
2881         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2882
2883         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2884         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2885         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2886         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2887         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2888
2889         bss = cfg80211_inform_bss(wiphy, notify_channel,
2890                                   CFG80211_BSS_FTYPE_UNKNOWN,
2891                                   (const u8 *)bi->BSSID,
2892                                   0, notify_capability,
2893                                   notify_interval, notify_ie,
2894                                   notify_ielen, notify_signal,
2895                                   GFP_KERNEL);
2896
2897         if (!bss)
2898                 return -ENOMEM;
2899
2900         cfg80211_put_bss(wiphy, bss);
2901
2902         return 0;
2903 }
2904
2905 static struct brcmf_bss_info_le *
2906 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2907 {
2908         if (bss == NULL)
2909                 return list->bss_info_le;
2910         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2911                                             le32_to_cpu(bss->length));
2912 }
2913
2914 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2915 {
2916         struct brcmf_scan_results *bss_list;
2917         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2918         s32 err = 0;
2919         int i;
2920
2921         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2922         if (bss_list->count != 0 &&
2923             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2924                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2925                           bss_list->version);
2926                 return -EOPNOTSUPP;
2927         }
2928         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2929         for (i = 0; i < bss_list->count; i++) {
2930                 bi = next_bss_le(bss_list, bi);
2931                 err = brcmf_inform_single_bss(cfg, bi);
2932                 if (err)
2933                         break;
2934         }
2935         return err;
2936 }
2937
2938 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2939                              struct net_device *ndev, const u8 *bssid)
2940 {
2941         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2942         struct ieee80211_channel *notify_channel;
2943         struct brcmf_bss_info_le *bi = NULL;
2944         struct ieee80211_supported_band *band;
2945         struct cfg80211_bss *bss;
2946         struct brcmu_chan ch;
2947         u8 *buf = NULL;
2948         s32 err = 0;
2949         u32 freq;
2950         u16 notify_capability;
2951         u16 notify_interval;
2952         u8 *notify_ie;
2953         size_t notify_ielen;
2954         s32 notify_signal;
2955
2956         brcmf_dbg(TRACE, "Enter\n");
2957
2958         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2959         if (buf == NULL) {
2960                 err = -ENOMEM;
2961                 goto CleanUp;
2962         }
2963
2964         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2965
2966         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2967                                      buf, WL_BSS_INFO_MAX);
2968         if (err) {
2969                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2970                 goto CleanUp;
2971         }
2972
2973         bi = (struct brcmf_bss_info_le *)(buf + 4);
2974
2975         ch.chspec = le16_to_cpu(bi->chanspec);
2976         cfg->d11inf.decchspec(&ch);
2977
2978         if (ch.band == BRCMU_CHAN_BAND_2G)
2979                 band = wiphy->bands[NL80211_BAND_2GHZ];
2980         else
2981                 band = wiphy->bands[NL80211_BAND_5GHZ];
2982
2983         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2984         cfg->channel = freq;
2985         notify_channel = ieee80211_get_channel(wiphy, freq);
2986
2987         notify_capability = le16_to_cpu(bi->capability);
2988         notify_interval = le16_to_cpu(bi->beacon_period);
2989         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2990         notify_ielen = le32_to_cpu(bi->ie_length);
2991         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2992
2993         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2994         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2995         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2996         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2997
2998         bss = cfg80211_inform_bss(wiphy, notify_channel,
2999                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3000                                   notify_capability, notify_interval,
3001                                   notify_ie, notify_ielen, notify_signal,
3002                                   GFP_KERNEL);
3003
3004         if (!bss) {
3005                 err = -ENOMEM;
3006                 goto CleanUp;
3007         }
3008
3009         cfg80211_put_bss(wiphy, bss);
3010
3011 CleanUp:
3012
3013         kfree(buf);
3014
3015         brcmf_dbg(TRACE, "Exit\n");
3016
3017         return err;
3018 }
3019
3020 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3021                                  struct brcmf_if *ifp)
3022 {
3023         struct brcmf_bss_info_le *bi;
3024         const struct brcmf_tlv *tim;
3025         u16 beacon_interval;
3026         u8 dtim_period;
3027         size_t ie_len;
3028         u8 *ie;
3029         s32 err = 0;
3030
3031         brcmf_dbg(TRACE, "Enter\n");
3032         if (brcmf_is_ibssmode(ifp->vif))
3033                 return err;
3034
3035         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3036         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3037                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3038         if (err) {
3039                 brcmf_err("Could not get bss info %d\n", err);
3040                 goto update_bss_info_out;
3041         }
3042
3043         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3044         err = brcmf_inform_single_bss(cfg, bi);
3045         if (err)
3046                 goto update_bss_info_out;
3047
3048         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
3049         ie_len = le32_to_cpu(bi->ie_length);
3050         beacon_interval = le16_to_cpu(bi->beacon_period);
3051
3052         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
3053         if (tim)
3054                 dtim_period = tim->data[1];
3055         else {
3056                 /*
3057                 * active scan was done so we could not get dtim
3058                 * information out of probe response.
3059                 * so we speficially query dtim information to dongle.
3060                 */
3061                 u32 var;
3062                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3063                 if (err) {
3064                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
3065                         goto update_bss_info_out;
3066                 }
3067                 dtim_period = (u8)var;
3068         }
3069
3070 update_bss_info_out:
3071         brcmf_dbg(TRACE, "Exit");
3072         return err;
3073 }
3074
3075 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3076 {
3077         struct escan_info *escan = &cfg->escan_info;
3078
3079         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3080         if (cfg->int_escan_map || cfg->scan_request) {
3081                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3082                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3083         }
3084         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3085         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3086 }
3087
3088 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3089 {
3090         struct brcmf_cfg80211_info *cfg =
3091                         container_of(work, struct brcmf_cfg80211_info,
3092                                      escan_timeout_work);
3093
3094         brcmf_inform_bss(cfg);
3095         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3096 }
3097
3098 static void brcmf_escan_timeout(unsigned long data)
3099 {
3100         struct brcmf_cfg80211_info *cfg =
3101                         (struct brcmf_cfg80211_info *)data;
3102
3103         if (cfg->int_escan_map || cfg->scan_request) {
3104                 brcmf_err("timer expired\n");
3105                 schedule_work(&cfg->escan_timeout_work);
3106         }
3107 }
3108
3109 static s32
3110 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3111                               struct brcmf_bss_info_le *bss,
3112                               struct brcmf_bss_info_le *bss_info_le)
3113 {
3114         struct brcmu_chan ch_bss, ch_bss_info_le;
3115
3116         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3117         cfg->d11inf.decchspec(&ch_bss);
3118         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3119         cfg->d11inf.decchspec(&ch_bss_info_le);
3120
3121         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3122                 ch_bss.band == ch_bss_info_le.band &&
3123                 bss_info_le->SSID_len == bss->SSID_len &&
3124                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3125                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3126                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3127                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3128                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3129
3130                         /* preserve max RSSI if the measurements are
3131                         * both on-channel or both off-channel
3132                         */
3133                         if (bss_info_rssi > bss_rssi)
3134                                 bss->RSSI = bss_info_le->RSSI;
3135                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3136                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3137                         /* preserve the on-channel rssi measurement
3138                         * if the new measurement is off channel
3139                         */
3140                         bss->RSSI = bss_info_le->RSSI;
3141                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3142                 }
3143                 return 1;
3144         }
3145         return 0;
3146 }
3147
3148 static s32
3149 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3150                              const struct brcmf_event_msg *e, void *data)
3151 {
3152         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3153         s32 status;
3154         struct brcmf_escan_result_le *escan_result_le;
3155         u32 escan_buflen;
3156         struct brcmf_bss_info_le *bss_info_le;
3157         struct brcmf_bss_info_le *bss = NULL;
3158         u32 bi_length;
3159         struct brcmf_scan_results *list;
3160         u32 i;
3161         bool aborted;
3162
3163         status = e->status;
3164
3165         if (status == BRCMF_E_STATUS_ABORT)
3166                 goto exit;
3167
3168         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3169                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3170                 return -EPERM;
3171         }
3172
3173         if (status == BRCMF_E_STATUS_PARTIAL) {
3174                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3175                 if (e->datalen < sizeof(*escan_result_le)) {
3176                         brcmf_err("invalid event data length\n");
3177                         goto exit;
3178                 }
3179                 escan_result_le = (struct brcmf_escan_result_le *) data;
3180                 if (!escan_result_le) {
3181                         brcmf_err("Invalid escan result (NULL pointer)\n");
3182                         goto exit;
3183                 }
3184                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3185                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3186                     escan_buflen > e->datalen ||
3187                     escan_buflen < sizeof(*escan_result_le)) {
3188                         brcmf_err("Invalid escan buffer length: %d\n",
3189                                   escan_buflen);
3190                         goto exit;
3191                 }
3192                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3193                         brcmf_err("Invalid bss_count %d: ignoring\n",
3194                                   escan_result_le->bss_count);
3195                         goto exit;
3196                 }
3197                 bss_info_le = &escan_result_le->bss_info_le;
3198
3199                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3200                         goto exit;
3201
3202                 if (!cfg->int_escan_map && !cfg->scan_request) {
3203                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3204                         goto exit;
3205                 }
3206
3207                 bi_length = le32_to_cpu(bss_info_le->length);
3208                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3209                         brcmf_err("Ignoring invalid bss_info length: %d\n",
3210                                   bi_length);
3211                         goto exit;
3212                 }
3213
3214                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3215                                         BIT(NL80211_IFTYPE_ADHOC))) {
3216                         if (le16_to_cpu(bss_info_le->capability) &
3217                                                 WLAN_CAPABILITY_IBSS) {
3218                                 brcmf_err("Ignoring IBSS result\n");
3219                                 goto exit;
3220                         }
3221                 }
3222
3223                 list = (struct brcmf_scan_results *)
3224                                 cfg->escan_info.escan_buf;
3225                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3226                         brcmf_err("Buffer is too small: ignoring\n");
3227                         goto exit;
3228                 }
3229
3230                 for (i = 0; i < list->count; i++) {
3231                         bss = bss ? (struct brcmf_bss_info_le *)
3232                                 ((unsigned char *)bss +
3233                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3234                         if (brcmf_compare_update_same_bss(cfg, bss,
3235                                                           bss_info_le))
3236                                 goto exit;
3237                 }
3238                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3239                        bi_length);
3240                 list->version = le32_to_cpu(bss_info_le->version);
3241                 list->buflen += bi_length;
3242                 list->count++;
3243         } else {
3244                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3245                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3246                         goto exit;
3247                 if (cfg->int_escan_map || cfg->scan_request) {
3248                         brcmf_inform_bss(cfg);
3249                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3250                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3251                 } else
3252                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3253                                   status);
3254         }
3255 exit:
3256         return 0;
3257 }
3258
3259 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3260 {
3261         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3262                             brcmf_cfg80211_escan_handler);
3263         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3264         /* Init scan_timeout timer */
3265         init_timer(&cfg->escan_timeout);
3266         cfg->escan_timeout.data = (unsigned long) cfg;
3267         cfg->escan_timeout.function = brcmf_escan_timeout;
3268         INIT_WORK(&cfg->escan_timeout_work,
3269                   brcmf_cfg80211_escan_timeout_worker);
3270 }
3271
3272 static struct cfg80211_scan_request *
3273 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3274         struct cfg80211_scan_request *req;
3275         size_t req_size;
3276
3277         req_size = sizeof(*req) +
3278                    n_netinfo * sizeof(req->channels[0]) +
3279                    n_netinfo * sizeof(*req->ssids);
3280
3281         req = kzalloc(req_size, GFP_KERNEL);
3282         if (req) {
3283                 req->wiphy = wiphy;
3284                 req->ssids = (void *)(&req->channels[0]) +
3285                              n_netinfo * sizeof(req->channels[0]);
3286         }
3287         return req;
3288 }
3289
3290 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3291                                          u8 *ssid, u8 ssid_len, u8 channel)
3292 {
3293         struct ieee80211_channel *chan;
3294         enum nl80211_band band;
3295         int freq, i;
3296
3297         if (channel <= CH_MAX_2G_CHANNEL)
3298                 band = NL80211_BAND_2GHZ;
3299         else
3300                 band = NL80211_BAND_5GHZ;
3301
3302         freq = ieee80211_channel_to_frequency(channel, band);
3303         if (!freq)
3304                 return -EINVAL;
3305
3306         chan = ieee80211_get_channel(req->wiphy, freq);
3307         if (!chan)
3308                 return -EINVAL;
3309
3310         for (i = 0; i < req->n_channels; i++) {
3311                 if (req->channels[i] == chan)
3312                         break;
3313         }
3314         if (i == req->n_channels)
3315                 req->channels[req->n_channels++] = chan;
3316
3317         for (i = 0; i < req->n_ssids; i++) {
3318                 if (req->ssids[i].ssid_len == ssid_len &&
3319                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3320                         break;
3321         }
3322         if (i == req->n_ssids) {
3323                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3324                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3325         }
3326         return 0;
3327 }
3328
3329 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3330                                       struct cfg80211_scan_request *request)
3331 {
3332         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3333         int err;
3334
3335         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3336                 if (cfg->int_escan_map)
3337                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3338                                   cfg->int_escan_map);
3339                 /* Abort any on-going scan */
3340                 brcmf_abort_scanning(cfg);
3341         }
3342
3343         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3344         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3345         cfg->escan_info.run = brcmf_run_escan;
3346         err = brcmf_do_escan(ifp, request);
3347         if (err) {
3348                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3349                 return err;
3350         }
3351         cfg->int_escan_map = fwmap;
3352         return 0;
3353 }
3354
3355 static struct brcmf_pno_net_info_le *
3356 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3357 {
3358         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3359         struct brcmf_pno_net_info_le *netinfo;
3360
3361         switch (pfn_v1->version) {
3362         default:
3363                 WARN_ON(1);
3364                 /* fall-thru */
3365         case cpu_to_le32(1):
3366                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3367                 break;
3368         case cpu_to_le32(2):
3369                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3370                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3371                 break;
3372         }
3373
3374         return netinfo;
3375 }
3376
3377 /* PFN result doesn't have all the info which are required by the supplicant
3378  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3379  * via wl_inform_single_bss in the required format. Escan does require the
3380  * scan request in the form of cfg80211_scan_request. For timebeing, create
3381  * cfg80211_scan_request one out of the received PNO event.
3382  */
3383 static s32
3384 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3385                                 const struct brcmf_event_msg *e, void *data)
3386 {
3387         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3388         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3389         struct cfg80211_scan_request *request = NULL;
3390         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3391         int i, err = 0;
3392         struct brcmf_pno_scanresults_le *pfn_result;
3393         u32 bucket_map;
3394         u32 result_count;
3395         u32 status;
3396         u32 datalen;
3397
3398         brcmf_dbg(SCAN, "Enter\n");
3399
3400         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3401                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3402                 return 0;
3403         }
3404
3405         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3406                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3407                 return 0;
3408         }
3409
3410         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3411         result_count = le32_to_cpu(pfn_result->count);
3412         status = le32_to_cpu(pfn_result->status);
3413
3414         /* PFN event is limited to fit 512 bytes so we may get
3415          * multiple NET_FOUND events. For now place a warning here.
3416          */
3417         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3418         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3419         if (!result_count) {
3420                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3421                 goto out_err;
3422         }
3423
3424         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3425         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3426         if (datalen < result_count * sizeof(*netinfo)) {
3427                 brcmf_err("insufficient event data\n");
3428                 goto out_err;
3429         }
3430
3431         request = brcmf_alloc_internal_escan_request(wiphy,
3432                                                      result_count);
3433         if (!request) {
3434                 err = -ENOMEM;
3435                 goto out_err;
3436         }
3437
3438         bucket_map = 0;
3439         for (i = 0; i < result_count; i++) {
3440                 netinfo = &netinfo_start[i];
3441
3442                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3443                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3444                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3445                           netinfo->SSID, netinfo->channel);
3446                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3447                 err = brcmf_internal_escan_add_info(request,
3448                                                     netinfo->SSID,
3449                                                     netinfo->SSID_len,
3450                                                     netinfo->channel);
3451                 if (err)
3452                         goto out_err;
3453         }
3454
3455         if (!bucket_map)
3456                 goto free_req;
3457
3458         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3459         if (!err)
3460                 goto free_req;
3461
3462 out_err:
3463         cfg80211_sched_scan_stopped(wiphy, 0);
3464 free_req:
3465         kfree(request);
3466         return err;
3467 }
3468
3469 static int
3470 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3471                                 struct net_device *ndev,
3472                                 struct cfg80211_sched_scan_request *req)
3473 {
3474         struct brcmf_if *ifp = netdev_priv(ndev);
3475         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3476
3477         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3478                   req->n_match_sets, req->n_ssids);
3479
3480         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3481                 brcmf_err("Scanning suppressed: status=%lu\n",
3482                           cfg->scan_status);
3483                 return -EAGAIN;
3484         }
3485
3486         if (req->n_match_sets <= 0) {
3487                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3488                           req->n_match_sets);
3489                 return -EINVAL;
3490         }
3491
3492         return brcmf_pno_start_sched_scan(ifp, req);
3493 }
3494
3495 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3496                                           struct net_device *ndev, u64 reqid)
3497 {
3498         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3499         struct brcmf_if *ifp = netdev_priv(ndev);
3500
3501         brcmf_dbg(SCAN, "enter\n");
3502         brcmf_pno_stop_sched_scan(ifp, reqid);
3503         if (cfg->int_escan_map)
3504                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3505         return 0;
3506 }
3507
3508 static __always_inline void brcmf_delay(u32 ms)
3509 {
3510         if (ms < 1000 / HZ) {
3511                 cond_resched();
3512                 mdelay(ms);
3513         } else {
3514                 msleep(ms);
3515         }
3516 }
3517
3518 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3519                                      u8 *pattern, u32 patternsize, u8 *mask,
3520                                      u32 packet_offset)
3521 {
3522         struct brcmf_fil_wowl_pattern_le *filter;
3523         u32 masksize;
3524         u32 patternoffset;
3525         u8 *buf;
3526         u32 bufsize;
3527         s32 ret;
3528
3529         masksize = (patternsize + 7) / 8;
3530         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3531
3532         bufsize = sizeof(*filter) + patternsize + masksize;
3533         buf = kzalloc(bufsize, GFP_KERNEL);
3534         if (!buf)
3535                 return -ENOMEM;
3536         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3537
3538         memcpy(filter->cmd, cmd, 4);
3539         filter->masksize = cpu_to_le32(masksize);
3540         filter->offset = cpu_to_le32(packet_offset);
3541         filter->patternoffset = cpu_to_le32(patternoffset);
3542         filter->patternsize = cpu_to_le32(patternsize);
3543         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3544
3545         if ((mask) && (masksize))
3546                 memcpy(buf + sizeof(*filter), mask, masksize);
3547         if ((pattern) && (patternsize))
3548                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3549
3550         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3551
3552         kfree(buf);
3553         return ret;
3554 }
3555
3556 static s32
3557 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3558                       void *data)
3559 {
3560         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3561         struct brcmf_pno_scanresults_le *pfn_result;
3562         struct brcmf_pno_net_info_le *netinfo;
3563
3564         brcmf_dbg(SCAN, "Enter\n");
3565
3566         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3567                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3568                 return 0;
3569         }
3570
3571         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3572
3573         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3574                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3575                 return 0;
3576         }
3577
3578         if (le32_to_cpu(pfn_result->count) < 1) {
3579                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3580                           le32_to_cpu(pfn_result->count));
3581                 return -EINVAL;
3582         }
3583
3584         netinfo = brcmf_get_netinfo_array(pfn_result);
3585         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3586                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3587         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3588         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3589         cfg->wowl.nd->n_channels = 1;
3590         cfg->wowl.nd->channels[0] =
3591                 ieee80211_channel_to_frequency(netinfo->channel,
3592                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3593                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3594         cfg->wowl.nd_info->n_matches = 1;
3595         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3596
3597         /* Inform (the resume task) that the net detect information was recvd */
3598         cfg->wowl.nd_data_completed = true;
3599         wake_up(&cfg->wowl.nd_data_wait);
3600
3601         return 0;
3602 }
3603
3604 #ifdef CONFIG_PM
3605
3606 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3607 {
3608         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3609         struct brcmf_wowl_wakeind_le wake_ind_le;
3610         struct cfg80211_wowlan_wakeup wakeup_data;
3611         struct cfg80211_wowlan_wakeup *wakeup;
3612         u32 wakeind;
3613         s32 err;
3614         int timeout;
3615
3616         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3617                                        sizeof(wake_ind_le));
3618         if (err) {
3619                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3620                 return;
3621         }
3622
3623         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3624         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3625                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3626                        BRCMF_WOWL_PFN_FOUND)) {
3627                 wakeup = &wakeup_data;
3628                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3629                 wakeup_data.pattern_idx = -1;
3630
3631                 if (wakeind & BRCMF_WOWL_MAGIC) {
3632                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3633                         wakeup_data.magic_pkt = true;
3634                 }
3635                 if (wakeind & BRCMF_WOWL_DIS) {
3636                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3637                         wakeup_data.disconnect = true;
3638                 }
3639                 if (wakeind & BRCMF_WOWL_BCN) {
3640                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3641                         wakeup_data.disconnect = true;
3642                 }
3643                 if (wakeind & BRCMF_WOWL_RETR) {
3644                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3645                         wakeup_data.disconnect = true;
3646                 }
3647                 if (wakeind & BRCMF_WOWL_NET) {
3648                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3649                         /* For now always map to pattern 0, no API to get
3650                          * correct information available at the moment.
3651                          */
3652                         wakeup_data.pattern_idx = 0;
3653                 }
3654                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3655                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3656                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3657                                 cfg->wowl.nd_data_completed,
3658                                 BRCMF_ND_INFO_TIMEOUT);
3659                         if (!timeout)
3660                                 brcmf_err("No result for wowl net detect\n");
3661                         else
3662                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3663                 }
3664                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3665                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3666                         wakeup_data.gtk_rekey_failure = true;
3667                 }
3668         } else {
3669                 wakeup = NULL;
3670         }
3671         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3672 }
3673
3674 #else
3675
3676 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3677 {
3678 }
3679
3680 #endif /* CONFIG_PM */
3681
3682 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3683 {
3684         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3685         struct net_device *ndev = cfg_to_ndev(cfg);
3686         struct brcmf_if *ifp = netdev_priv(ndev);
3687
3688         brcmf_dbg(TRACE, "Enter\n");
3689
3690         if (cfg->wowl.active) {
3691                 brcmf_report_wowl_wakeind(wiphy, ifp);
3692                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3693                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3694                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3695                         brcmf_configure_arp_nd_offload(ifp, true);
3696                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3697                                       cfg->wowl.pre_pmmode);
3698                 cfg->wowl.active = false;
3699                 if (cfg->wowl.nd_enabled) {
3700                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
3701                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3702                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3703                                             brcmf_notify_sched_scan_results);
3704                         cfg->wowl.nd_enabled = false;
3705                 }
3706         }
3707         return 0;
3708 }
3709
3710 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3711                                  struct brcmf_if *ifp,
3712                                  struct cfg80211_wowlan *wowl)
3713 {
3714         u32 wowl_config;
3715         struct brcmf_wowl_wakeind_le wowl_wakeind;
3716         u32 i;
3717
3718         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3719
3720         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3721                 brcmf_configure_arp_nd_offload(ifp, false);
3722         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3723         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3724
3725         wowl_config = 0;
3726         if (wowl->disconnect)
3727                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3728         if (wowl->magic_pkt)
3729                 wowl_config |= BRCMF_WOWL_MAGIC;
3730         if ((wowl->patterns) && (wowl->n_patterns)) {
3731                 wowl_config |= BRCMF_WOWL_NET;
3732                 for (i = 0; i < wowl->n_patterns; i++) {
3733                         brcmf_config_wowl_pattern(ifp, "add",
3734                                 (u8 *)wowl->patterns[i].pattern,
3735                                 wowl->patterns[i].pattern_len,
3736                                 (u8 *)wowl->patterns[i].mask,
3737                                 wowl->patterns[i].pkt_offset);
3738                 }
3739         }
3740         if (wowl->nd_config) {
3741                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3742                                                 wowl->nd_config);
3743                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3744
3745                 cfg->wowl.nd_data_completed = false;
3746                 cfg->wowl.nd_enabled = true;
3747                 /* Now reroute the event for PFN to the wowl function. */
3748                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3749                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3750                                     brcmf_wowl_nd_results);
3751         }
3752         if (wowl->gtk_rekey_failure)
3753                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3754         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3755                 wowl_config |= BRCMF_WOWL_UNASSOC;
3756
3757         memcpy(&wowl_wakeind, "clear", 6);
3758         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3759                                  sizeof(wowl_wakeind));
3760         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3761         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3762         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3763         cfg->wowl.active = true;
3764 }
3765
3766 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3767                                   struct cfg80211_wowlan *wowl)
3768 {
3769         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3770         struct net_device *ndev = cfg_to_ndev(cfg);
3771         struct brcmf_if *ifp = netdev_priv(ndev);
3772         struct brcmf_cfg80211_vif *vif;
3773
3774         brcmf_dbg(TRACE, "Enter\n");
3775
3776         /* if the primary net_device is not READY there is nothing
3777          * we can do but pray resume goes smoothly.
3778          */
3779         if (!check_vif_up(ifp->vif))
3780                 goto exit;
3781
3782         /* Stop scheduled scan */
3783         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3784                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
3785
3786         /* end any scanning */
3787         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3788                 brcmf_abort_scanning(cfg);
3789
3790         if (wowl == NULL) {
3791                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3792                 list_for_each_entry(vif, &cfg->vif_list, list) {
3793                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3794                                 continue;
3795                         /* While going to suspend if associated with AP
3796                          * disassociate from AP to save power while system is
3797                          * in suspended state
3798                          */
3799                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3800                         /* Make sure WPA_Supplicant receives all the event
3801                          * generated due to DISASSOC call to the fw to keep
3802                          * the state fw and WPA_Supplicant state consistent
3803                          */
3804                         brcmf_delay(500);
3805                 }
3806                 /* Configure MPC */
3807                 brcmf_set_mpc(ifp, 1);
3808
3809         } else {
3810                 /* Configure WOWL paramaters */
3811                 brcmf_configure_wowl(cfg, ifp, wowl);
3812         }
3813
3814 exit:
3815         brcmf_dbg(TRACE, "Exit\n");
3816         /* clear any scanning activity */
3817         cfg->scan_status = 0;
3818         return 0;
3819 }
3820
3821 static __used s32
3822 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3823 {
3824         struct brcmf_pmk_list_le *pmk_list;
3825         int i;
3826         u32 npmk;
3827         s32 err;
3828
3829         pmk_list = &cfg->pmk_list;
3830         npmk = le32_to_cpu(pmk_list->npmk);
3831
3832         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3833         for (i = 0; i < npmk; i++)
3834                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3835
3836         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3837                                        sizeof(*pmk_list));
3838
3839         return err;
3840 }
3841
3842 static s32
3843 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3844                          struct cfg80211_pmksa *pmksa)
3845 {
3846         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3847         struct brcmf_if *ifp = netdev_priv(ndev);
3848         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3849         s32 err;
3850         u32 npmk, i;
3851
3852         brcmf_dbg(TRACE, "Enter\n");
3853         if (!check_vif_up(ifp->vif))
3854                 return -EIO;
3855
3856         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3857         for (i = 0; i < npmk; i++)
3858                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3859                         break;
3860         if (i < BRCMF_MAXPMKID) {
3861                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3862                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3863                 if (i == npmk) {
3864                         npmk++;
3865                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3866                 }
3867         } else {
3868                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3869                 return -EINVAL;
3870         }
3871
3872         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3873         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3874                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3875                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3876                           pmk[npmk].pmkid[i + 3]);
3877
3878         err = brcmf_update_pmklist(cfg, ifp);
3879
3880         brcmf_dbg(TRACE, "Exit\n");
3881         return err;
3882 }
3883
3884 static s32
3885 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3886                          struct cfg80211_pmksa *pmksa)
3887 {
3888         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3889         struct brcmf_if *ifp = netdev_priv(ndev);
3890         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3891         s32 err;
3892         u32 npmk, i;
3893
3894         brcmf_dbg(TRACE, "Enter\n");
3895         if (!check_vif_up(ifp->vif))
3896                 return -EIO;
3897
3898         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3899
3900         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3901         for (i = 0; i < npmk; i++)
3902                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3903                         break;
3904
3905         if ((npmk > 0) && (i < npmk)) {
3906                 for (; i < (npmk - 1); i++) {
3907                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3908                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3909                                WLAN_PMKID_LEN);
3910                 }
3911                 memset(&pmk[i], 0, sizeof(*pmk));
3912                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3913         } else {
3914                 brcmf_err("Cache entry not found\n");
3915                 return -EINVAL;
3916         }
3917
3918         err = brcmf_update_pmklist(cfg, ifp);
3919
3920         brcmf_dbg(TRACE, "Exit\n");
3921         return err;
3922
3923 }
3924
3925 static s32
3926 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3927 {
3928         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3929         struct brcmf_if *ifp = netdev_priv(ndev);
3930         s32 err;
3931
3932         brcmf_dbg(TRACE, "Enter\n");
3933         if (!check_vif_up(ifp->vif))
3934                 return -EIO;
3935
3936         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3937         err = brcmf_update_pmklist(cfg, ifp);
3938
3939         brcmf_dbg(TRACE, "Exit\n");
3940         return err;
3941
3942 }
3943
3944 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3945 {
3946         s32 err;
3947         s32 wpa_val;
3948
3949         /* set auth */
3950         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3951         if (err < 0) {
3952                 brcmf_err("auth error %d\n", err);
3953                 return err;
3954         }
3955         /* set wsec */
3956         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3957         if (err < 0) {
3958                 brcmf_err("wsec error %d\n", err);
3959                 return err;
3960         }
3961         /* set upper-layer auth */
3962         if (brcmf_is_ibssmode(ifp->vif))
3963                 wpa_val = WPA_AUTH_NONE;
3964         else
3965                 wpa_val = WPA_AUTH_DISABLED;
3966         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
3967         if (err < 0) {
3968                 brcmf_err("wpa_auth error %d\n", err);
3969                 return err;
3970         }
3971
3972         return 0;
3973 }
3974
3975 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3976 {
3977         if (is_rsn_ie)
3978                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3979
3980         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3981 }
3982
3983 static s32
3984 brcmf_configure_wpaie(struct brcmf_if *ifp,
3985                       const struct brcmf_vs_tlv *wpa_ie,
3986                       bool is_rsn_ie)
3987 {
3988         u32 auth = 0; /* d11 open authentication */
3989         u16 count;
3990         s32 err = 0;
3991         s32 len;
3992         u32 i;
3993         u32 wsec;
3994         u32 pval = 0;
3995         u32 gval = 0;
3996         u32 wpa_auth = 0;
3997         u32 offset;
3998         u8 *data;
3999         u16 rsn_cap;
4000         u32 wme_bss_disable;
4001         u32 mfp;
4002
4003         brcmf_dbg(TRACE, "Enter\n");
4004         if (wpa_ie == NULL)
4005                 goto exit;
4006
4007         len = wpa_ie->len + TLV_HDR_LEN;
4008         data = (u8 *)wpa_ie;
4009         offset = TLV_HDR_LEN;
4010         if (!is_rsn_ie)
4011                 offset += VS_IE_FIXED_HDR_LEN;
4012         else
4013                 offset += WPA_IE_VERSION_LEN;
4014
4015         /* check for multicast cipher suite */
4016         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4017                 err = -EINVAL;
4018                 brcmf_err("no multicast cipher suite\n");
4019                 goto exit;
4020         }
4021
4022         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4023                 err = -EINVAL;
4024                 brcmf_err("ivalid OUI\n");
4025                 goto exit;
4026         }
4027         offset += TLV_OUI_LEN;
4028
4029         /* pick up multicast cipher */
4030         switch (data[offset]) {
4031         case WPA_CIPHER_NONE:
4032                 gval = 0;
4033                 break;
4034         case WPA_CIPHER_WEP_40:
4035         case WPA_CIPHER_WEP_104:
4036                 gval = WEP_ENABLED;
4037                 break;
4038         case WPA_CIPHER_TKIP:
4039                 gval = TKIP_ENABLED;
4040                 break;
4041         case WPA_CIPHER_AES_CCM:
4042                 gval = AES_ENABLED;
4043                 break;
4044         default:
4045                 err = -EINVAL;
4046                 brcmf_err("Invalid multi cast cipher info\n");
4047                 goto exit;
4048         }
4049
4050         offset++;
4051         /* walk thru unicast cipher list and pick up what we recognize */
4052         count = data[offset] + (data[offset + 1] << 8);
4053         offset += WPA_IE_SUITE_COUNT_LEN;
4054         /* Check for unicast suite(s) */
4055         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4056                 err = -EINVAL;
4057                 brcmf_err("no unicast cipher suite\n");
4058                 goto exit;
4059         }
4060         for (i = 0; i < count; i++) {
4061                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4062                         err = -EINVAL;
4063                         brcmf_err("ivalid OUI\n");
4064                         goto exit;
4065                 }
4066                 offset += TLV_OUI_LEN;
4067                 switch (data[offset]) {
4068                 case WPA_CIPHER_NONE:
4069                         break;
4070                 case WPA_CIPHER_WEP_40:
4071                 case WPA_CIPHER_WEP_104:
4072                         pval |= WEP_ENABLED;
4073                         break;
4074                 case WPA_CIPHER_TKIP:
4075                         pval |= TKIP_ENABLED;
4076                         break;
4077                 case WPA_CIPHER_AES_CCM:
4078                         pval |= AES_ENABLED;
4079                         break;
4080                 default:
4081                         brcmf_err("Invalid unicast security info\n");
4082                 }
4083                 offset++;
4084         }
4085         /* walk thru auth management suite list and pick up what we recognize */
4086         count = data[offset] + (data[offset + 1] << 8);
4087         offset += WPA_IE_SUITE_COUNT_LEN;
4088         /* Check for auth key management suite(s) */
4089         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4090                 err = -EINVAL;
4091                 brcmf_err("no auth key mgmt suite\n");
4092                 goto exit;
4093         }
4094         for (i = 0; i < count; i++) {
4095                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4096                         err = -EINVAL;
4097                         brcmf_err("ivalid OUI\n");
4098                         goto exit;
4099                 }
4100                 offset += TLV_OUI_LEN;
4101                 switch (data[offset]) {
4102                 case RSN_AKM_NONE:
4103                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4104                         wpa_auth |= WPA_AUTH_NONE;
4105                         break;
4106                 case RSN_AKM_UNSPECIFIED:
4107                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4108                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4109                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4110                         break;
4111                 case RSN_AKM_PSK:
4112                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4113                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4114                                     (wpa_auth |= WPA_AUTH_PSK);
4115                         break;
4116                 case RSN_AKM_SHA256_PSK:
4117                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4118                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4119                         break;
4120                 case RSN_AKM_SHA256_1X:
4121                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4122                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4123                         break;
4124                 default:
4125                         brcmf_err("Invalid key mgmt info\n");
4126                 }
4127                 offset++;
4128         }
4129
4130         mfp = BRCMF_MFP_NONE;
4131         if (is_rsn_ie) {
4132                 wme_bss_disable = 1;
4133                 if ((offset + RSN_CAP_LEN) <= len) {
4134                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4135                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4136                                 wme_bss_disable = 0;
4137                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4138                                 brcmf_dbg(TRACE, "MFP Required\n");
4139                                 mfp = BRCMF_MFP_REQUIRED;
4140                                 /* Firmware only supports mfp required in
4141                                  * combination with WPA2_AUTH_PSK_SHA256 or
4142                                  * WPA2_AUTH_1X_SHA256.
4143                                  */
4144                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4145                                                   WPA2_AUTH_1X_SHA256))) {
4146                                         err = -EINVAL;
4147                                         goto exit;
4148                                 }
4149                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4150                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4151                                  * is to be included in the rsn ie.
4152                                  */
4153                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4154                                         wpa_auth |= WPA2_AUTH_PSK;
4155                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4156                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4157                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4158                                 brcmf_dbg(TRACE, "MFP Capable\n");
4159                                 mfp = BRCMF_MFP_CAPABLE;
4160                         }
4161                 }
4162                 offset += RSN_CAP_LEN;
4163                 /* set wme_bss_disable to sync RSN Capabilities */
4164                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4165                                                wme_bss_disable);
4166                 if (err < 0) {
4167                         brcmf_err("wme_bss_disable error %d\n", err);
4168                         goto exit;
4169                 }
4170
4171                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4172                 offset += RSN_PMKID_COUNT_LEN;
4173
4174                 /* See if there is BIP wpa suite left for MFP */
4175                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4176                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4177                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4178                                                         &data[offset],
4179                                                         WPA_IE_MIN_OUI_LEN);
4180                         if (err < 0) {
4181                                 brcmf_err("bip error %d\n", err);
4182                                 goto exit;
4183                         }
4184                 }
4185         }
4186         /* FOR WPS , set SES_OW_ENABLED */
4187         wsec = (pval | gval | SES_OW_ENABLED);
4188
4189         /* set auth */
4190         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4191         if (err < 0) {
4192                 brcmf_err("auth error %d\n", err);
4193                 goto exit;
4194         }
4195         /* set wsec */
4196         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4197         if (err < 0) {
4198                 brcmf_err("wsec error %d\n", err);
4199                 goto exit;
4200         }
4201         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4202          * will overwrite the values set by MFP
4203          */
4204         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4205                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4206                 if (err < 0) {
4207                         brcmf_err("mfp error %d\n", err);
4208                         goto exit;
4209                 }
4210         }
4211         /* set upper-layer auth */
4212         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4213         if (err < 0) {
4214                 brcmf_err("wpa_auth error %d\n", err);
4215                 goto exit;
4216         }
4217
4218 exit:
4219         return err;
4220 }
4221
4222 static s32
4223 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4224                      struct parsed_vndr_ies *vndr_ies)
4225 {
4226         struct brcmf_vs_tlv *vndrie;
4227         struct brcmf_tlv *ie;
4228         struct parsed_vndr_ie_info *parsed_info;
4229         s32 remaining_len;
4230
4231         remaining_len = (s32)vndr_ie_len;
4232         memset(vndr_ies, 0, sizeof(*vndr_ies));
4233
4234         ie = (struct brcmf_tlv *)vndr_ie_buf;
4235         while (ie) {
4236                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4237                         goto next;
4238                 vndrie = (struct brcmf_vs_tlv *)ie;
4239                 /* len should be bigger than OUI length + one */
4240                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4241                         brcmf_err("invalid vndr ie. length is too small %d\n",
4242                                   vndrie->len);
4243                         goto next;
4244                 }
4245                 /* if wpa or wme ie, do not add ie */
4246                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4247                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4248                     (vndrie->oui_type == WME_OUI_TYPE))) {
4249                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4250                         goto next;
4251                 }
4252
4253                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4254
4255                 /* save vndr ie information */
4256                 parsed_info->ie_ptr = (char *)vndrie;
4257                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4258                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4259
4260                 vndr_ies->count++;
4261
4262                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4263                           parsed_info->vndrie.oui[0],
4264                           parsed_info->vndrie.oui[1],
4265                           parsed_info->vndrie.oui[2],
4266                           parsed_info->vndrie.oui_type);
4267
4268                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4269                         break;
4270 next:
4271                 remaining_len -= (ie->len + TLV_HDR_LEN);
4272                 if (remaining_len <= TLV_HDR_LEN)
4273                         ie = NULL;
4274                 else
4275                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4276                                 TLV_HDR_LEN);
4277         }
4278         return 0;
4279 }
4280
4281 static u32
4282 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4283 {
4284
4285         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4286         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4287
4288         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4289
4290         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4291
4292         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4293
4294         return ie_len + VNDR_IE_HDR_SIZE;
4295 }
4296
4297 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4298                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4299 {
4300         struct brcmf_if *ifp;
4301         struct vif_saved_ie *saved_ie;
4302         s32 err = 0;
4303         u8  *iovar_ie_buf;
4304         u8  *curr_ie_buf;
4305         u8  *mgmt_ie_buf = NULL;
4306         int mgmt_ie_buf_len;
4307         u32 *mgmt_ie_len;
4308         u32 del_add_ie_buf_len = 0;
4309         u32 total_ie_buf_len = 0;
4310         u32 parsed_ie_buf_len = 0;
4311         struct parsed_vndr_ies old_vndr_ies;
4312         struct parsed_vndr_ies new_vndr_ies;
4313         struct parsed_vndr_ie_info *vndrie_info;
4314         s32 i;
4315         u8 *ptr;
4316         int remained_buf_len;
4317
4318         if (!vif)
4319                 return -ENODEV;
4320         ifp = vif->ifp;
4321         saved_ie = &vif->saved_ie;
4322
4323         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4324                   pktflag);
4325         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4326         if (!iovar_ie_buf)
4327                 return -ENOMEM;
4328         curr_ie_buf = iovar_ie_buf;
4329         switch (pktflag) {
4330         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4331                 mgmt_ie_buf = saved_ie->probe_req_ie;
4332                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4333                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4334                 break;
4335         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4336                 mgmt_ie_buf = saved_ie->probe_res_ie;
4337                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4338                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4339                 break;
4340         case BRCMF_VNDR_IE_BEACON_FLAG:
4341                 mgmt_ie_buf = saved_ie->beacon_ie;
4342                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4343                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4344                 break;
4345         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4346                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4347                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4348                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4349                 break;
4350         default:
4351                 err = -EPERM;
4352                 brcmf_err("not suitable type\n");
4353                 goto exit;
4354         }
4355
4356         if (vndr_ie_len > mgmt_ie_buf_len) {
4357                 err = -ENOMEM;
4358                 brcmf_err("extra IE size too big\n");
4359                 goto exit;
4360         }
4361
4362         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4363         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4364                 ptr = curr_ie_buf;
4365                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4366                 for (i = 0; i < new_vndr_ies.count; i++) {
4367                         vndrie_info = &new_vndr_ies.ie_info[i];
4368                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4369                                vndrie_info->ie_len);
4370                         parsed_ie_buf_len += vndrie_info->ie_len;
4371                 }
4372         }
4373
4374         if (mgmt_ie_buf && *mgmt_ie_len) {
4375                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4376                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4377                             parsed_ie_buf_len) == 0)) {
4378                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4379                         goto exit;
4380                 }
4381
4382                 /* parse old vndr_ie */
4383                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4384
4385                 /* make a command to delete old ie */
4386                 for (i = 0; i < old_vndr_ies.count; i++) {
4387                         vndrie_info = &old_vndr_ies.ie_info[i];
4388
4389                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4390                                   vndrie_info->vndrie.id,
4391                                   vndrie_info->vndrie.len,
4392                                   vndrie_info->vndrie.oui[0],
4393                                   vndrie_info->vndrie.oui[1],
4394                                   vndrie_info->vndrie.oui[2]);
4395
4396                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4397                                                            vndrie_info->ie_ptr,
4398                                                            vndrie_info->ie_len,
4399                                                            "del");
4400                         curr_ie_buf += del_add_ie_buf_len;
4401                         total_ie_buf_len += del_add_ie_buf_len;
4402                 }
4403         }
4404
4405         *mgmt_ie_len = 0;
4406         /* Add if there is any extra IE */
4407         if (mgmt_ie_buf && parsed_ie_buf_len) {
4408                 ptr = mgmt_ie_buf;
4409
4410                 remained_buf_len = mgmt_ie_buf_len;
4411
4412                 /* make a command to add new ie */
4413                 for (i = 0; i < new_vndr_ies.count; i++) {
4414                         vndrie_info = &new_vndr_ies.ie_info[i];
4415
4416                         /* verify remained buf size before copy data */
4417                         if (remained_buf_len < (vndrie_info->vndrie.len +
4418                                                         VNDR_IE_VSIE_OFFSET)) {
4419                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4420                                           remained_buf_len);
4421                                 break;
4422                         }
4423                         remained_buf_len -= (vndrie_info->ie_len +
4424                                              VNDR_IE_VSIE_OFFSET);
4425
4426                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4427                                   vndrie_info->vndrie.id,
4428                                   vndrie_info->vndrie.len,
4429                                   vndrie_info->vndrie.oui[0],
4430                                   vndrie_info->vndrie.oui[1],
4431                                   vndrie_info->vndrie.oui[2]);
4432
4433                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4434                                                            vndrie_info->ie_ptr,
4435                                                            vndrie_info->ie_len,
4436                                                            "add");
4437
4438                         /* save the parsed IE in wl struct */
4439                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4440                                vndrie_info->ie_len);
4441                         *mgmt_ie_len += vndrie_info->ie_len;
4442
4443                         curr_ie_buf += del_add_ie_buf_len;
4444                         total_ie_buf_len += del_add_ie_buf_len;
4445                 }
4446         }
4447         if (total_ie_buf_len) {
4448                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4449                                                  total_ie_buf_len);
4450                 if (err)
4451                         brcmf_err("vndr ie set error : %d\n", err);
4452         }
4453
4454 exit:
4455         kfree(iovar_ie_buf);
4456         return err;
4457 }
4458
4459 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4460 {
4461         s32 pktflags[] = {
4462                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4463                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4464                 BRCMF_VNDR_IE_BEACON_FLAG
4465         };
4466         int i;
4467
4468         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4469                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4470
4471         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4472         return 0;
4473 }
4474
4475 static s32
4476 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4477                         struct cfg80211_beacon_data *beacon)
4478 {
4479         s32 err;
4480
4481         /* Set Beacon IEs to FW */
4482         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4483                                     beacon->tail, beacon->tail_len);
4484         if (err) {
4485                 brcmf_err("Set Beacon IE Failed\n");
4486                 return err;
4487         }
4488         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4489
4490         /* Set Probe Response IEs to FW */
4491         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4492                                     beacon->proberesp_ies,
4493                                     beacon->proberesp_ies_len);
4494         if (err)
4495                 brcmf_err("Set Probe Resp IE Failed\n");
4496         else
4497                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4498
4499         return err;
4500 }
4501
4502 static s32
4503 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4504                         struct cfg80211_ap_settings *settings)
4505 {
4506         s32 ie_offset;
4507         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4508         struct brcmf_if *ifp = netdev_priv(ndev);
4509         const struct brcmf_tlv *ssid_ie;
4510         const struct brcmf_tlv *country_ie;
4511         struct brcmf_ssid_le ssid_le;
4512         s32 err = -EPERM;
4513         const struct brcmf_tlv *rsn_ie;
4514         const struct brcmf_vs_tlv *wpa_ie;
4515         struct brcmf_join_params join_params;
4516         enum nl80211_iftype dev_role;
4517         struct brcmf_fil_bss_enable_le bss_enable;
4518         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4519         bool mbss;
4520         int is_11d;
4521         bool supports_11d;
4522
4523         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4524                   settings->chandef.chan->hw_value,
4525                   settings->chandef.center_freq1, settings->chandef.width,
4526                   settings->beacon_interval, settings->dtim_period);
4527         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4528                   settings->ssid, settings->ssid_len, settings->auth_type,
4529                   settings->inactivity_timeout);
4530         dev_role = ifp->vif->wdev.iftype;
4531         mbss = ifp->vif->mbss;
4532
4533         /* store current 11d setting */
4534         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4535                                   &ifp->vif->is_11d)) {
4536                 is_11d = supports_11d = false;
4537         } else {
4538                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4539                                               settings->beacon.tail_len,
4540                                               WLAN_EID_COUNTRY);
4541                 is_11d = country_ie ? 1 : 0;
4542                 supports_11d = true;
4543         }
4544
4545         memset(&ssid_le, 0, sizeof(ssid_le));
4546         if (settings->ssid == NULL || settings->ssid_len == 0) {
4547                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4548                 ssid_ie = brcmf_parse_tlvs(
4549                                 (u8 *)&settings->beacon.head[ie_offset],
4550                                 settings->beacon.head_len - ie_offset,
4551                                 WLAN_EID_SSID);
4552                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4553                         return -EINVAL;
4554
4555                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4556                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4557                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4558         } else {
4559                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4560                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4561         }
4562
4563         if (!mbss) {
4564                 brcmf_set_mpc(ifp, 0);
4565                 brcmf_configure_arp_nd_offload(ifp, false);
4566         }
4567
4568         /* find the RSN_IE */
4569         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4570                                   settings->beacon.tail_len, WLAN_EID_RSN);
4571
4572         /* find the WPA_IE */
4573         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4574                                   settings->beacon.tail_len);
4575
4576         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4577                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4578                 if (wpa_ie != NULL) {
4579                         /* WPA IE */
4580                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4581                         if (err < 0)
4582                                 goto exit;
4583                 } else {
4584                         struct brcmf_vs_tlv *tmp_ie;
4585
4586                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4587
4588                         /* RSN IE */
4589                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4590                         if (err < 0)
4591                                 goto exit;
4592                 }
4593         } else {
4594                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4595                 brcmf_configure_opensecurity(ifp);
4596         }
4597
4598         /* Parameters shared by all radio interfaces */
4599         if (!mbss) {
4600                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4601                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4602                                                     is_11d);
4603                         if (err < 0) {
4604                                 brcmf_err("Regulatory Set Error, %d\n", err);
4605                                 goto exit;
4606                         }
4607                 }
4608                 if (settings->beacon_interval) {
4609                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4610                                                     settings->beacon_interval);
4611                         if (err < 0) {
4612                                 brcmf_err("Beacon Interval Set Error, %d\n",
4613                                           err);
4614                                 goto exit;
4615                         }
4616                 }
4617                 if (settings->dtim_period) {
4618                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4619                                                     settings->dtim_period);
4620                         if (err < 0) {
4621                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4622                                 goto exit;
4623                         }
4624                 }
4625
4626                 if ((dev_role == NL80211_IFTYPE_AP) &&
4627                     ((ifp->ifidx == 0) ||
4628                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4629                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4630                         if (err < 0) {
4631                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4632                                 goto exit;
4633                         }
4634                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4635                 }
4636
4637                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4638                 if (err < 0) {
4639                         brcmf_err("SET INFRA error %d\n", err);
4640                         goto exit;
4641                 }
4642         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4643                 /* Multiple-BSS should use same 11d configuration */
4644                 err = -EINVAL;
4645                 goto exit;
4646         }
4647
4648         /* Interface specific setup */
4649         if (dev_role == NL80211_IFTYPE_AP) {
4650                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4651                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4652
4653                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4654                 if (err < 0) {
4655                         brcmf_err("setting AP mode failed %d\n", err);
4656                         goto exit;
4657                 }
4658                 if (!mbss) {
4659                         /* Firmware 10.x requires setting channel after enabling
4660                          * AP and before bringing interface up.
4661                          */
4662                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4663                         if (err < 0) {
4664                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4665                                           chanspec, err);
4666                                 goto exit;
4667                         }
4668                 }
4669                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4670                 if (err < 0) {
4671                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4672                         goto exit;
4673                 }
4674                 /* On DOWN the firmware removes the WEP keys, reconfigure
4675                  * them if they were set.
4676                  */
4677                 brcmf_cfg80211_reconfigure_wep(ifp);
4678
4679                 memset(&join_params, 0, sizeof(join_params));
4680                 /* join parameters starts with ssid */
4681                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4682                 /* create softap */
4683                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4684                                              &join_params, sizeof(join_params));
4685                 if (err < 0) {
4686                         brcmf_err("SET SSID error (%d)\n", err);
4687                         goto exit;
4688                 }
4689
4690                 if (settings->hidden_ssid) {
4691                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4692                         if (err) {
4693                                 brcmf_err("closednet error (%d)\n", err);
4694                                 goto exit;
4695                         }
4696                 }
4697
4698                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4699         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4700                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4701                 if (err < 0) {
4702                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4703                                   chanspec, err);
4704                         goto exit;
4705                 }
4706                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4707                                                 sizeof(ssid_le));
4708                 if (err < 0) {
4709                         brcmf_err("setting ssid failed %d\n", err);
4710                         goto exit;
4711                 }
4712                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4713                 bss_enable.enable = cpu_to_le32(1);
4714                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4715                                                sizeof(bss_enable));
4716                 if (err < 0) {
4717                         brcmf_err("bss_enable config failed %d\n", err);
4718                         goto exit;
4719                 }
4720
4721                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4722         } else {
4723                 WARN_ON(1);
4724         }
4725
4726         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4727         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4728         brcmf_net_setcarrier(ifp, true);
4729
4730 exit:
4731         if ((err) && (!mbss)) {
4732                 brcmf_set_mpc(ifp, 1);
4733                 brcmf_configure_arp_nd_offload(ifp, true);
4734         }
4735         return err;
4736 }
4737
4738 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4739 {
4740         struct brcmf_if *ifp = netdev_priv(ndev);
4741         s32 err;
4742         struct brcmf_fil_bss_enable_le bss_enable;
4743         struct brcmf_join_params join_params;
4744
4745         brcmf_dbg(TRACE, "Enter\n");
4746
4747         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4748                 /* Due to most likely deauths outstanding we sleep */
4749                 /* first to make sure they get processed by fw. */
4750                 msleep(400);
4751
4752                 if (ifp->vif->mbss) {
4753                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4754                         return err;
4755                 }
4756
4757                 /* First BSS doesn't get a full reset */
4758                 if (ifp->bsscfgidx == 0)
4759                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4760
4761                 memset(&join_params, 0, sizeof(join_params));
4762                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4763                                              &join_params, sizeof(join_params));
4764                 if (err < 0)
4765                         brcmf_err("SET SSID error (%d)\n", err);
4766                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4767                 if (err < 0)
4768                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4769                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4770                 if (err < 0)
4771                         brcmf_err("setting AP mode failed %d\n", err);
4772                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4773                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4774                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4775                                       ifp->vif->is_11d);
4776                 /* Bring device back up so it can be used again */
4777                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4778                 if (err < 0)
4779                         brcmf_err("BRCMF_C_UP error %d\n", err);
4780
4781                 brcmf_vif_clear_mgmt_ies(ifp->vif);
4782         } else {
4783                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4784                 bss_enable.enable = cpu_to_le32(0);
4785                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4786                                                sizeof(bss_enable));
4787                 if (err < 0)
4788                         brcmf_err("bss_enable config failed %d\n", err);
4789         }
4790         brcmf_set_mpc(ifp, 1);
4791         brcmf_configure_arp_nd_offload(ifp, true);
4792         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4793         brcmf_net_setcarrier(ifp, false);
4794
4795         return err;
4796 }
4797
4798 static s32
4799 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4800                              struct cfg80211_beacon_data *info)
4801 {
4802         struct brcmf_if *ifp = netdev_priv(ndev);
4803         s32 err;
4804
4805         brcmf_dbg(TRACE, "Enter\n");
4806
4807         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4808
4809         return err;
4810 }
4811
4812 static int
4813 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4814                            struct station_del_parameters *params)
4815 {
4816         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4817         struct brcmf_scb_val_le scbval;
4818         struct brcmf_if *ifp = netdev_priv(ndev);
4819         s32 err;
4820
4821         if (!params->mac)
4822                 return -EFAULT;
4823
4824         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4825
4826         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4827                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4828         if (!check_vif_up(ifp->vif))
4829                 return -EIO;
4830
4831         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4832         scbval.val = cpu_to_le32(params->reason_code);
4833         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4834                                      &scbval, sizeof(scbval));
4835         if (err)
4836                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4837
4838         brcmf_dbg(TRACE, "Exit\n");
4839         return err;
4840 }
4841
4842 static int
4843 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4844                               const u8 *mac, struct station_parameters *params)
4845 {
4846         struct brcmf_if *ifp = netdev_priv(ndev);
4847         s32 err;
4848
4849         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4850                   params->sta_flags_mask, params->sta_flags_set);
4851
4852         /* Ignore all 00 MAC */
4853         if (is_zero_ether_addr(mac))
4854                 return 0;
4855
4856         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4857                 return 0;
4858
4859         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4860                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4861                                              (void *)mac, ETH_ALEN);
4862         else
4863                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4864                                              (void *)mac, ETH_ALEN);
4865         if (err < 0)
4866                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4867
4868         return err;
4869 }
4870
4871 static void
4872 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4873                                    struct wireless_dev *wdev,
4874                                    u16 frame_type, bool reg)
4875 {
4876         struct brcmf_cfg80211_vif *vif;
4877         u16 mgmt_type;
4878
4879         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4880
4881         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4882         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4883         if (reg)
4884                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4885         else
4886                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4887 }
4888
4889
4890 static int
4891 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4892                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4893 {
4894         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4895         struct ieee80211_channel *chan = params->chan;
4896         const u8 *buf = params->buf;
4897         size_t len = params->len;
4898         const struct ieee80211_mgmt *mgmt;
4899         struct brcmf_cfg80211_vif *vif;
4900         s32 err = 0;
4901         s32 ie_offset;
4902         s32 ie_len;
4903         struct brcmf_fil_action_frame_le *action_frame;
4904         struct brcmf_fil_af_params_le *af_params;
4905         bool ack;
4906         s32 chan_nr;
4907         u32 freq;
4908
4909         brcmf_dbg(TRACE, "Enter\n");
4910
4911         *cookie = 0;
4912
4913         mgmt = (const struct ieee80211_mgmt *)buf;
4914
4915         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4916                 brcmf_err("Driver only allows MGMT packet type\n");
4917                 return -EPERM;
4918         }
4919
4920         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4921
4922         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4923                 /* Right now the only reason to get a probe response */
4924                 /* is for p2p listen response or for p2p GO from     */
4925                 /* wpa_supplicant. Unfortunately the probe is send   */
4926                 /* on primary ndev, while dongle wants it on the p2p */
4927                 /* vif. Since this is only reason for a probe        */
4928                 /* response to be sent, the vif is taken from cfg.   */
4929                 /* If ever desired to send proberesp for non p2p     */
4930                 /* response then data should be checked for          */
4931                 /* "DIRECT-". Note in future supplicant will take    */
4932                 /* dedicated p2p wdev to do this and then this 'hack'*/
4933                 /* is not needed anymore.                            */
4934                 ie_offset =  DOT11_MGMT_HDR_LEN +
4935                              DOT11_BCN_PRB_FIXED_LEN;
4936                 ie_len = len - ie_offset;
4937                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4938                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4939                 err = brcmf_vif_set_mgmt_ie(vif,
4940                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4941                                             &buf[ie_offset],
4942                                             ie_len);
4943                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4944                                         GFP_KERNEL);
4945         } else if (ieee80211_is_action(mgmt->frame_control)) {
4946                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
4947                         brcmf_err("invalid action frame length\n");
4948                         err = -EINVAL;
4949                         goto exit;
4950                 }
4951                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4952                 if (af_params == NULL) {
4953                         brcmf_err("unable to allocate frame\n");
4954                         err = -ENOMEM;
4955                         goto exit;
4956                 }
4957                 action_frame = &af_params->action_frame;
4958                 /* Add the packet Id */
4959                 action_frame->packet_id = cpu_to_le32(*cookie);
4960                 /* Add BSSID */
4961                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4962                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4963                 /* Add the length exepted for 802.11 header  */
4964                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4965                 /* Add the channel. Use the one specified as parameter if any or
4966                  * the current one (got from the firmware) otherwise
4967                  */
4968                 if (chan)
4969                         freq = chan->center_freq;
4970                 else
4971                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4972                                               &freq);
4973                 chan_nr = ieee80211_frequency_to_channel(freq);
4974                 af_params->channel = cpu_to_le32(chan_nr);
4975
4976                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4977                        le16_to_cpu(action_frame->len));
4978
4979                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4980                           *cookie, le16_to_cpu(action_frame->len), freq);
4981
4982                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4983                                                   af_params);
4984
4985                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4986                                         GFP_KERNEL);
4987                 kfree(af_params);
4988         } else {
4989                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4990                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
4991         }
4992
4993 exit:
4994         return err;
4995 }
4996
4997
4998 static int
4999 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5000                                         struct wireless_dev *wdev,
5001                                         u64 cookie)
5002 {
5003         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5004         struct brcmf_cfg80211_vif *vif;
5005         int err = 0;
5006
5007         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5008
5009         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5010         if (vif == NULL) {
5011                 brcmf_err("No p2p device available for probe response\n");
5012                 err = -ENODEV;
5013                 goto exit;
5014         }
5015         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5016 exit:
5017         return err;
5018 }
5019
5020 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5021                                       struct wireless_dev *wdev,
5022                                       struct cfg80211_chan_def *chandef)
5023 {
5024         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5025         struct net_device *ndev = wdev->netdev;
5026         struct brcmf_if *ifp;
5027         struct brcmu_chan ch;
5028         enum nl80211_band band = 0;
5029         enum nl80211_chan_width width = 0;
5030         u32 chanspec;
5031         int freq, err;
5032
5033         if (!ndev)
5034                 return -ENODEV;
5035         ifp = netdev_priv(ndev);
5036
5037         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
5038         if (err) {
5039                 brcmf_err("chanspec failed (%d)\n", err);
5040                 return err;
5041         }
5042
5043         ch.chspec = chanspec;
5044         cfg->d11inf.decchspec(&ch);
5045
5046         switch (ch.band) {
5047         case BRCMU_CHAN_BAND_2G:
5048                 band = NL80211_BAND_2GHZ;
5049                 break;
5050         case BRCMU_CHAN_BAND_5G:
5051                 band = NL80211_BAND_5GHZ;
5052                 break;
5053         }
5054
5055         switch (ch.bw) {
5056         case BRCMU_CHAN_BW_80:
5057                 width = NL80211_CHAN_WIDTH_80;
5058                 break;
5059         case BRCMU_CHAN_BW_40:
5060                 width = NL80211_CHAN_WIDTH_40;
5061                 break;
5062         case BRCMU_CHAN_BW_20:
5063                 width = NL80211_CHAN_WIDTH_20;
5064                 break;
5065         case BRCMU_CHAN_BW_80P80:
5066                 width = NL80211_CHAN_WIDTH_80P80;
5067                 break;
5068         case BRCMU_CHAN_BW_160:
5069                 width = NL80211_CHAN_WIDTH_160;
5070                 break;
5071         }
5072
5073         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5074         chandef->chan = ieee80211_get_channel(wiphy, freq);
5075         chandef->width = width;
5076         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5077         chandef->center_freq2 = 0;
5078
5079         return 0;
5080 }
5081
5082 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5083                                            struct wireless_dev *wdev,
5084                                            enum nl80211_crit_proto_id proto,
5085                                            u16 duration)
5086 {
5087         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5088         struct brcmf_cfg80211_vif *vif;
5089
5090         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5091
5092         /* only DHCP support for now */
5093         if (proto != NL80211_CRIT_PROTO_DHCP)
5094                 return -EINVAL;
5095
5096         /* suppress and abort scanning */
5097         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5098         brcmf_abort_scanning(cfg);
5099
5100         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5101 }
5102
5103 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5104                                            struct wireless_dev *wdev)
5105 {
5106         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5107         struct brcmf_cfg80211_vif *vif;
5108
5109         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5110
5111         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5112         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5113 }
5114
5115 static s32
5116 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5117                              const struct brcmf_event_msg *e, void *data)
5118 {
5119         switch (e->reason) {
5120         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5121                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5122                 break;
5123         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5124                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5125                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5126                 break;
5127         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5128                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5129                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5130                 break;
5131         }
5132
5133         return 0;
5134 }
5135
5136 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5137 {
5138         int ret;
5139
5140         switch (oper) {
5141         case NL80211_TDLS_DISCOVERY_REQ:
5142                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5143                 break;
5144         case NL80211_TDLS_SETUP:
5145                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5146                 break;
5147         case NL80211_TDLS_TEARDOWN:
5148                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5149                 break;
5150         default:
5151                 brcmf_err("unsupported operation: %d\n", oper);
5152                 ret = -EOPNOTSUPP;
5153         }
5154         return ret;
5155 }
5156
5157 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5158                                     struct net_device *ndev, const u8 *peer,
5159                                     enum nl80211_tdls_operation oper)
5160 {
5161         struct brcmf_if *ifp;
5162         struct brcmf_tdls_iovar_le info;
5163         int ret = 0;
5164
5165         ret = brcmf_convert_nl80211_tdls_oper(oper);
5166         if (ret < 0)
5167                 return ret;
5168
5169         ifp = netdev_priv(ndev);
5170         memset(&info, 0, sizeof(info));
5171         info.mode = (u8)ret;
5172         if (peer)
5173                 memcpy(info.ea, peer, ETH_ALEN);
5174
5175         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5176                                        &info, sizeof(info));
5177         if (ret < 0)
5178                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5179
5180         return ret;
5181 }
5182
5183 static int
5184 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5185                                   struct net_device *ndev,
5186                                   struct cfg80211_connect_params *sme,
5187                                   u32 changed)
5188 {
5189         struct brcmf_if *ifp;
5190         int err;
5191
5192         if (!(changed & UPDATE_ASSOC_IES))
5193                 return 0;
5194
5195         ifp = netdev_priv(ndev);
5196         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5197                                     sme->ie, sme->ie_len);
5198         if (err)
5199                 brcmf_err("Set Assoc REQ IE Failed\n");
5200         else
5201                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5202
5203         return err;
5204 }
5205
5206 #ifdef CONFIG_PM
5207 static int
5208 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5209                               struct cfg80211_gtk_rekey_data *gtk)
5210 {
5211         struct brcmf_if *ifp = netdev_priv(ndev);
5212         struct brcmf_gtk_keyinfo_le gtk_le;
5213         int ret;
5214
5215         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5216
5217         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5218         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5219         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5220                sizeof(gtk_le.replay_counter));
5221
5222         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5223                                        sizeof(gtk_le));
5224         if (ret < 0)
5225                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5226
5227         return ret;
5228 }
5229 #endif
5230
5231 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5232                                   const struct cfg80211_pmk_conf *conf)
5233 {
5234         struct brcmf_if *ifp;
5235
5236         brcmf_dbg(TRACE, "enter\n");
5237
5238         /* expect using firmware supplicant for 1X */
5239         ifp = netdev_priv(dev);
5240         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5241                 return -EINVAL;
5242
5243         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5244 }
5245
5246 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5247                                   const u8 *aa)
5248 {
5249         struct brcmf_if *ifp;
5250
5251         brcmf_dbg(TRACE, "enter\n");
5252         ifp = netdev_priv(dev);
5253         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5254                 return -EINVAL;
5255
5256         return brcmf_set_pmk(ifp, NULL, 0);
5257 }
5258
5259 static struct cfg80211_ops brcmf_cfg80211_ops = {
5260         .add_virtual_intf = brcmf_cfg80211_add_iface,
5261         .del_virtual_intf = brcmf_cfg80211_del_iface,
5262         .change_virtual_intf = brcmf_cfg80211_change_iface,
5263         .scan = brcmf_cfg80211_scan,
5264         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5265         .join_ibss = brcmf_cfg80211_join_ibss,
5266         .leave_ibss = brcmf_cfg80211_leave_ibss,
5267         .get_station = brcmf_cfg80211_get_station,
5268         .dump_station = brcmf_cfg80211_dump_station,
5269         .set_tx_power = brcmf_cfg80211_set_tx_power,
5270         .get_tx_power = brcmf_cfg80211_get_tx_power,
5271         .add_key = brcmf_cfg80211_add_key,
5272         .del_key = brcmf_cfg80211_del_key,
5273         .get_key = brcmf_cfg80211_get_key,
5274         .set_default_key = brcmf_cfg80211_config_default_key,
5275         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5276         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5277         .connect = brcmf_cfg80211_connect,
5278         .disconnect = brcmf_cfg80211_disconnect,
5279         .suspend = brcmf_cfg80211_suspend,
5280         .resume = brcmf_cfg80211_resume,
5281         .set_pmksa = brcmf_cfg80211_set_pmksa,
5282         .del_pmksa = brcmf_cfg80211_del_pmksa,
5283         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5284         .start_ap = brcmf_cfg80211_start_ap,
5285         .stop_ap = brcmf_cfg80211_stop_ap,
5286         .change_beacon = brcmf_cfg80211_change_beacon,
5287         .del_station = brcmf_cfg80211_del_station,
5288         .change_station = brcmf_cfg80211_change_station,
5289         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5290         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5291         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5292         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5293         .remain_on_channel = brcmf_p2p_remain_on_channel,
5294         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5295         .get_channel = brcmf_cfg80211_get_channel,
5296         .start_p2p_device = brcmf_p2p_start_device,
5297         .stop_p2p_device = brcmf_p2p_stop_device,
5298         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5299         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5300         .tdls_oper = brcmf_cfg80211_tdls_oper,
5301         .update_connect_params = brcmf_cfg80211_update_conn_params,
5302         .set_pmk = brcmf_cfg80211_set_pmk,
5303         .del_pmk = brcmf_cfg80211_del_pmk,
5304 };
5305
5306 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5307                                            enum nl80211_iftype type)
5308 {
5309         struct brcmf_cfg80211_vif *vif_walk;
5310         struct brcmf_cfg80211_vif *vif;
5311         bool mbss;
5312
5313         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5314                   sizeof(*vif));
5315         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5316         if (!vif)
5317                 return ERR_PTR(-ENOMEM);
5318
5319         vif->wdev.wiphy = cfg->wiphy;
5320         vif->wdev.iftype = type;
5321
5322         brcmf_init_prof(&vif->profile);
5323
5324         if (type == NL80211_IFTYPE_AP) {
5325                 mbss = false;
5326                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5327                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5328                                 mbss = true;
5329                                 break;
5330                         }
5331                 }
5332                 vif->mbss = mbss;
5333         }
5334
5335         list_add_tail(&vif->list, &cfg->vif_list);
5336         return vif;
5337 }
5338
5339 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5340 {
5341         list_del(&vif->list);
5342         kfree(vif);
5343 }
5344
5345 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5346 {
5347         struct brcmf_cfg80211_vif *vif;
5348         struct brcmf_if *ifp;
5349
5350         ifp = netdev_priv(ndev);
5351         vif = ifp->vif;
5352
5353         if (vif)
5354                 brcmf_free_vif(vif);
5355 }
5356
5357 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
5358                             const struct brcmf_event_msg *e)
5359 {
5360         u32 event = e->event_code;
5361         u32 status = e->status;
5362
5363         if (vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK &&
5364             event == BRCMF_E_PSK_SUP &&
5365             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
5366                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5367         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5368                 brcmf_dbg(CONN, "Processing set ssid\n");
5369                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
5370                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK)
5371                         return true;
5372
5373                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5374         }
5375
5376         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
5377             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
5378                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5379                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5380                 return true;
5381         }
5382         return false;
5383 }
5384
5385 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
5386                             const struct brcmf_event_msg *e)
5387 {
5388         u32 event = e->event_code;
5389         u16 flags = e->flags;
5390
5391         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5392             (event == BRCMF_E_DISASSOC_IND) ||
5393             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5394                 brcmf_dbg(CONN, "Processing link down\n");
5395                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5396                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5397                 return true;
5398         }
5399         return false;
5400 }
5401
5402 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5403                                const struct brcmf_event_msg *e)
5404 {
5405         u32 event = e->event_code;
5406         u32 status = e->status;
5407
5408         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5409                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5410                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5411                 return true;
5412         }
5413
5414         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5415                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5416                 return true;
5417         }
5418
5419         if (event == BRCMF_E_PSK_SUP &&
5420             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
5421                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
5422                           status);
5423                 return true;
5424         }
5425
5426         return false;
5427 }
5428
5429 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5430 {
5431         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5432
5433         kfree(conn_info->req_ie);
5434         conn_info->req_ie = NULL;
5435         conn_info->req_ie_len = 0;
5436         kfree(conn_info->resp_ie);
5437         conn_info->resp_ie = NULL;
5438         conn_info->resp_ie_len = 0;
5439 }
5440
5441 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5442                                struct brcmf_if *ifp)
5443 {
5444         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5445         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5446         u32 req_len;
5447         u32 resp_len;
5448         s32 err = 0;
5449
5450         brcmf_clear_assoc_ies(cfg);
5451
5452         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5453                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5454         if (err) {
5455                 brcmf_err("could not get assoc info (%d)\n", err);
5456                 return err;
5457         }
5458         assoc_info =
5459                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5460         req_len = le32_to_cpu(assoc_info->req_len);
5461         resp_len = le32_to_cpu(assoc_info->resp_len);
5462         if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
5463                 brcmf_err("invalid lengths in assoc info: req %u resp %u\n",
5464                          req_len, resp_len);
5465                 return -EINVAL;
5466         }
5467         if (req_len) {
5468                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5469                                                cfg->extra_buf,
5470                                                WL_ASSOC_INFO_MAX);
5471                 if (err) {
5472                         brcmf_err("could not get assoc req (%d)\n", err);
5473                         return err;
5474                 }
5475                 conn_info->req_ie_len = req_len;
5476                 conn_info->req_ie =
5477                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5478                             GFP_KERNEL);
5479                 if (!conn_info->req_ie)
5480                         conn_info->req_ie_len = 0;
5481         } else {
5482                 conn_info->req_ie_len = 0;
5483                 conn_info->req_ie = NULL;
5484         }
5485         if (resp_len) {
5486                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5487                                                cfg->extra_buf,
5488                                                WL_ASSOC_INFO_MAX);
5489                 if (err) {
5490                         brcmf_err("could not get assoc resp (%d)\n", err);
5491                         return err;
5492                 }
5493                 conn_info->resp_ie_len = resp_len;
5494                 conn_info->resp_ie =
5495                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5496                             GFP_KERNEL);
5497                 if (!conn_info->resp_ie)
5498                         conn_info->resp_ie_len = 0;
5499         } else {
5500                 conn_info->resp_ie_len = 0;
5501                 conn_info->resp_ie = NULL;
5502         }
5503         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5504                   conn_info->req_ie_len, conn_info->resp_ie_len);
5505
5506         return err;
5507 }
5508
5509 static s32
5510 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5511                        struct net_device *ndev,
5512                        const struct brcmf_event_msg *e)
5513 {
5514         struct brcmf_if *ifp = netdev_priv(ndev);
5515         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5516         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5517         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5518         struct ieee80211_channel *notify_channel = NULL;
5519         struct ieee80211_supported_band *band;
5520         struct brcmf_bss_info_le *bi;
5521         struct brcmu_chan ch;
5522         struct cfg80211_roam_info roam_info = {};
5523         u32 freq;
5524         s32 err = 0;
5525         u8 *buf;
5526
5527         brcmf_dbg(TRACE, "Enter\n");
5528
5529         brcmf_get_assoc_ies(cfg, ifp);
5530         memcpy(profile->bssid, e->addr, ETH_ALEN);
5531         brcmf_update_bss_info(cfg, ifp);
5532
5533         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5534         if (buf == NULL) {
5535                 err = -ENOMEM;
5536                 goto done;
5537         }
5538
5539         /* data sent to dongle has to be little endian */
5540         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5541         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5542                                      buf, WL_BSS_INFO_MAX);
5543
5544         if (err)
5545                 goto done;
5546
5547         bi = (struct brcmf_bss_info_le *)(buf + 4);
5548         ch.chspec = le16_to_cpu(bi->chanspec);
5549         cfg->d11inf.decchspec(&ch);
5550
5551         if (ch.band == BRCMU_CHAN_BAND_2G)
5552                 band = wiphy->bands[NL80211_BAND_2GHZ];
5553         else
5554                 band = wiphy->bands[NL80211_BAND_5GHZ];
5555
5556         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5557         notify_channel = ieee80211_get_channel(wiphy, freq);
5558
5559 done:
5560         kfree(buf);
5561
5562         roam_info.channel = notify_channel;
5563         roam_info.bssid = profile->bssid;
5564         roam_info.req_ie = conn_info->req_ie;
5565         roam_info.req_ie_len = conn_info->req_ie_len;
5566         roam_info.resp_ie = conn_info->resp_ie;
5567         roam_info.resp_ie_len = conn_info->resp_ie_len;
5568
5569         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
5570         brcmf_dbg(CONN, "Report roaming result\n");
5571
5572         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5573         brcmf_dbg(TRACE, "Exit\n");
5574         return err;
5575 }
5576
5577 static s32
5578 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5579                        struct net_device *ndev, const struct brcmf_event_msg *e,
5580                        bool completed)
5581 {
5582         struct brcmf_if *ifp = netdev_priv(ndev);
5583         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5584         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5585         struct cfg80211_connect_resp_params conn_params;
5586
5587         brcmf_dbg(TRACE, "Enter\n");
5588
5589         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5590                                &ifp->vif->sme_state)) {
5591                 memset(&conn_params, 0, sizeof(conn_params));
5592                 if (completed) {
5593                         brcmf_get_assoc_ies(cfg, ifp);
5594                         brcmf_update_bss_info(cfg, ifp);
5595                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5596                                 &ifp->vif->sme_state);
5597                         conn_params.status = WLAN_STATUS_SUCCESS;
5598                 } else {
5599                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
5600                 }
5601                 conn_params.bssid = profile->bssid;
5602                 conn_params.req_ie = conn_info->req_ie;
5603                 conn_params.req_ie_len = conn_info->req_ie_len;
5604                 conn_params.resp_ie = conn_info->resp_ie;
5605                 conn_params.resp_ie_len = conn_info->resp_ie_len;
5606                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
5607                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5608                           completed ? "succeeded" : "failed");
5609         }
5610         brcmf_dbg(TRACE, "Exit\n");
5611         return 0;
5612 }
5613
5614 static s32
5615 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5616                                struct net_device *ndev,
5617                                const struct brcmf_event_msg *e, void *data)
5618 {
5619         static int generation;
5620         u32 event = e->event_code;
5621         u32 reason = e->reason;
5622         struct station_info sinfo;
5623
5624         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
5625                   brcmf_fweh_event_name(event), event, reason);
5626         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5627             ndev != cfg_to_ndev(cfg)) {
5628                 brcmf_dbg(CONN, "AP mode link down\n");
5629                 complete(&cfg->vif_disabled);
5630                 return 0;
5631         }
5632
5633         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5634             (reason == BRCMF_E_STATUS_SUCCESS)) {
5635                 memset(&sinfo, 0, sizeof(sinfo));
5636                 if (!data) {
5637                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5638                         return -EINVAL;
5639                 }
5640                 sinfo.assoc_req_ies = data;
5641                 sinfo.assoc_req_ies_len = e->datalen;
5642                 generation++;
5643                 sinfo.generation = generation;
5644                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5645         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5646                    (event == BRCMF_E_DEAUTH_IND) ||
5647                    (event == BRCMF_E_DEAUTH)) {
5648                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5649         }
5650         return 0;
5651 }
5652
5653 static s32
5654 brcmf_notify_connect_status(struct brcmf_if *ifp,
5655                             const struct brcmf_event_msg *e, void *data)
5656 {
5657         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5658         struct net_device *ndev = ifp->ndev;
5659         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5660         struct ieee80211_channel *chan;
5661         s32 err = 0;
5662
5663         if ((e->event_code == BRCMF_E_DEAUTH) ||
5664             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5665             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5666             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5667                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5668         }
5669
5670         if (brcmf_is_apmode(ifp->vif)) {
5671                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5672         } else if (brcmf_is_linkup(ifp->vif, e)) {
5673                 brcmf_dbg(CONN, "Linkup\n");
5674                 if (brcmf_is_ibssmode(ifp->vif)) {
5675                         brcmf_inform_ibss(cfg, ndev, e->addr);
5676                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5677                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5678                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5679                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5680                                   &ifp->vif->sme_state);
5681                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5682                                 &ifp->vif->sme_state);
5683                 } else
5684                         brcmf_bss_connect_done(cfg, ndev, e, true);
5685                 brcmf_net_setcarrier(ifp, true);
5686         } else if (brcmf_is_linkdown(ifp->vif, e)) {
5687                 brcmf_dbg(CONN, "Linkdown\n");
5688                 if (!brcmf_is_ibssmode(ifp->vif)) {
5689                         brcmf_bss_connect_done(cfg, ndev, e, false);
5690                         brcmf_link_down(ifp->vif,
5691                                         brcmf_map_fw_linkdown_reason(e));
5692                         brcmf_init_prof(ndev_to_prof(ndev));
5693                         if (ndev != cfg_to_ndev(cfg))
5694                                 complete(&cfg->vif_disabled);
5695                         brcmf_net_setcarrier(ifp, false);
5696                 }
5697         } else if (brcmf_is_nonetwork(cfg, e)) {
5698                 if (brcmf_is_ibssmode(ifp->vif))
5699                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5700                                   &ifp->vif->sme_state);
5701                 else
5702                         brcmf_bss_connect_done(cfg, ndev, e, false);
5703         }
5704
5705         return err;
5706 }
5707
5708 static s32
5709 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5710                             const struct brcmf_event_msg *e, void *data)
5711 {
5712         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5713         u32 event = e->event_code;
5714         u32 status = e->status;
5715
5716         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5717                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
5718                              &ifp->vif->sme_state)) {
5719                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5720                 } else {
5721                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5722                         brcmf_net_setcarrier(ifp, true);
5723                 }
5724         }
5725
5726         return 0;
5727 }
5728
5729 static s32
5730 brcmf_notify_mic_status(struct brcmf_if *ifp,
5731                         const struct brcmf_event_msg *e, void *data)
5732 {
5733         u16 flags = e->flags;
5734         enum nl80211_key_type key_type;
5735
5736         if (flags & BRCMF_EVENT_MSG_GROUP)
5737                 key_type = NL80211_KEYTYPE_GROUP;
5738         else
5739                 key_type = NL80211_KEYTYPE_PAIRWISE;
5740
5741         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5742                                      NULL, GFP_KERNEL);
5743
5744         return 0;
5745 }
5746
5747 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5748                                   const struct brcmf_event_msg *e, void *data)
5749 {
5750         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5751         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5752         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5753         struct brcmf_cfg80211_vif *vif;
5754
5755         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5756                   ifevent->action, ifevent->flags, ifevent->ifidx,
5757                   ifevent->bsscfgidx);
5758
5759         spin_lock(&event->vif_event_lock);
5760         event->action = ifevent->action;
5761         vif = event->vif;
5762
5763         switch (ifevent->action) {
5764         case BRCMF_E_IF_ADD:
5765                 /* waiting process may have timed out */
5766                 if (!cfg->vif_event.vif) {
5767                         spin_unlock(&event->vif_event_lock);
5768                         return -EBADF;
5769                 }
5770
5771                 ifp->vif = vif;
5772                 vif->ifp = ifp;
5773                 if (ifp->ndev) {
5774                         vif->wdev.netdev = ifp->ndev;
5775                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5776                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5777                 }
5778                 spin_unlock(&event->vif_event_lock);
5779                 wake_up(&event->vif_wq);
5780                 return 0;
5781
5782         case BRCMF_E_IF_DEL:
5783                 spin_unlock(&event->vif_event_lock);
5784                 /* event may not be upon user request */
5785                 if (brcmf_cfg80211_vif_event_armed(cfg))
5786                         wake_up(&event->vif_wq);
5787                 return 0;
5788
5789         case BRCMF_E_IF_CHANGE:
5790                 spin_unlock(&event->vif_event_lock);
5791                 wake_up(&event->vif_wq);
5792                 return 0;
5793
5794         default:
5795                 spin_unlock(&event->vif_event_lock);
5796                 break;
5797         }
5798         return -EINVAL;
5799 }
5800
5801 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5802 {
5803         conf->frag_threshold = (u32)-1;
5804         conf->rts_threshold = (u32)-1;
5805         conf->retry_short = (u32)-1;
5806         conf->retry_long = (u32)-1;
5807 }
5808
5809 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5810 {
5811         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5812                             brcmf_notify_connect_status);
5813         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5814                             brcmf_notify_connect_status);
5815         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5816                             brcmf_notify_connect_status);
5817         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5818                             brcmf_notify_connect_status);
5819         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5820                             brcmf_notify_connect_status);
5821         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5822                             brcmf_notify_connect_status);
5823         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5824                             brcmf_notify_roaming_status);
5825         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5826                             brcmf_notify_mic_status);
5827         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5828                             brcmf_notify_connect_status);
5829         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5830                             brcmf_notify_sched_scan_results);
5831         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5832                             brcmf_notify_vif_event);
5833         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5834                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5835         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5836                             brcmf_p2p_notify_listen_complete);
5837         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5838                             brcmf_p2p_notify_action_frame_rx);
5839         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5840                             brcmf_p2p_notify_action_tx_complete);
5841         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5842                             brcmf_p2p_notify_action_tx_complete);
5843         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
5844                             brcmf_notify_connect_status);
5845 }
5846
5847 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5848 {
5849         kfree(cfg->conf);
5850         cfg->conf = NULL;
5851         kfree(cfg->extra_buf);
5852         cfg->extra_buf = NULL;
5853         kfree(cfg->wowl.nd);
5854         cfg->wowl.nd = NULL;
5855         kfree(cfg->wowl.nd_info);
5856         cfg->wowl.nd_info = NULL;
5857         kfree(cfg->escan_info.escan_buf);
5858         cfg->escan_info.escan_buf = NULL;
5859 }
5860
5861 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5862 {
5863         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5864         if (!cfg->conf)
5865                 goto init_priv_mem_out;
5866         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5867         if (!cfg->extra_buf)
5868                 goto init_priv_mem_out;
5869         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5870         if (!cfg->wowl.nd)
5871                 goto init_priv_mem_out;
5872         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5873                                     sizeof(struct cfg80211_wowlan_nd_match *),
5874                                     GFP_KERNEL);
5875         if (!cfg->wowl.nd_info)
5876                 goto init_priv_mem_out;
5877         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5878         if (!cfg->escan_info.escan_buf)
5879                 goto init_priv_mem_out;
5880
5881         return 0;
5882
5883 init_priv_mem_out:
5884         brcmf_deinit_priv_mem(cfg);
5885
5886         return -ENOMEM;
5887 }
5888
5889 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5890 {
5891         s32 err = 0;
5892
5893         cfg->scan_request = NULL;
5894         cfg->pwr_save = true;
5895         cfg->active_scan = true;        /* we do active scan per default */
5896         cfg->dongle_up = false;         /* dongle is not up yet */
5897         err = brcmf_init_priv_mem(cfg);
5898         if (err)
5899                 return err;
5900         brcmf_register_event_handlers(cfg);
5901         mutex_init(&cfg->usr_sync);
5902         brcmf_init_escan(cfg);
5903         brcmf_init_conf(cfg->conf);
5904         init_completion(&cfg->vif_disabled);
5905         return err;
5906 }
5907
5908 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5909 {
5910         cfg->dongle_up = false; /* dongle down */
5911         brcmf_abort_scanning(cfg);
5912         brcmf_deinit_priv_mem(cfg);
5913 }
5914
5915 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5916 {
5917         init_waitqueue_head(&event->vif_wq);
5918         spin_lock_init(&event->vif_event_lock);
5919 }
5920
5921 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5922 {
5923         s32 err;
5924         u32 bcn_timeout;
5925         __le32 roamtrigger[2];
5926         __le32 roam_delta[2];
5927
5928         /* Configure beacon timeout value based upon roaming setting */
5929         if (ifp->drvr->settings->roamoff)
5930                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5931         else
5932                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5933         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5934         if (err) {
5935                 brcmf_err("bcn_timeout error (%d)\n", err);
5936                 goto roam_setup_done;
5937         }
5938
5939         /* Enable/Disable built-in roaming to allow supplicant to take care of
5940          * roaming.
5941          */
5942         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5943                   ifp->drvr->settings->roamoff ? "Off" : "On");
5944         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5945                                       ifp->drvr->settings->roamoff);
5946         if (err) {
5947                 brcmf_err("roam_off error (%d)\n", err);
5948                 goto roam_setup_done;
5949         }
5950
5951         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5952         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5953         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5954                                      (void *)roamtrigger, sizeof(roamtrigger));
5955         if (err) {
5956                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5957                 goto roam_setup_done;
5958         }
5959
5960         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5961         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5962         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5963                                      (void *)roam_delta, sizeof(roam_delta));
5964         if (err) {
5965                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5966                 goto roam_setup_done;
5967         }
5968
5969 roam_setup_done:
5970         return err;
5971 }
5972
5973 static s32
5974 brcmf_dongle_scantime(struct brcmf_if *ifp)
5975 {
5976         s32 err = 0;
5977
5978         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5979                                     BRCMF_SCAN_CHANNEL_TIME);
5980         if (err) {
5981                 brcmf_err("Scan assoc time error (%d)\n", err);
5982                 goto dongle_scantime_out;
5983         }
5984         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5985                                     BRCMF_SCAN_UNASSOC_TIME);
5986         if (err) {
5987                 brcmf_err("Scan unassoc time error (%d)\n", err);
5988                 goto dongle_scantime_out;
5989         }
5990
5991         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5992                                     BRCMF_SCAN_PASSIVE_TIME);
5993         if (err) {
5994                 brcmf_err("Scan passive time error (%d)\n", err);
5995                 goto dongle_scantime_out;
5996         }
5997
5998 dongle_scantime_out:
5999         return err;
6000 }
6001
6002 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6003                                            struct brcmu_chan *ch)
6004 {
6005         u32 ht40_flag;
6006
6007         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6008         if (ch->sb == BRCMU_CHAN_SB_U) {
6009                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6010                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6011                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6012         } else {
6013                 /* It should be one of
6014                  * IEEE80211_CHAN_NO_HT40 or
6015                  * IEEE80211_CHAN_NO_HT40PLUS
6016                  */
6017                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6018                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6019                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6020         }
6021 }
6022
6023 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6024                                     u32 bw_cap[])
6025 {
6026         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6027         struct ieee80211_supported_band *band;
6028         struct ieee80211_channel *channel;
6029         struct wiphy *wiphy;
6030         struct brcmf_chanspec_list *list;
6031         struct brcmu_chan ch;
6032         int err;
6033         u8 *pbuf;
6034         u32 i, j;
6035         u32 total;
6036         u32 chaninfo;
6037
6038         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6039
6040         if (pbuf == NULL)
6041                 return -ENOMEM;
6042
6043         list = (struct brcmf_chanspec_list *)pbuf;
6044
6045         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6046                                        BRCMF_DCMD_MEDLEN);
6047         if (err) {
6048                 brcmf_err("get chanspecs error (%d)\n", err);
6049                 goto fail_pbuf;
6050         }
6051
6052         wiphy = cfg_to_wiphy(cfg);
6053         band = wiphy->bands[NL80211_BAND_2GHZ];
6054         if (band)
6055                 for (i = 0; i < band->n_channels; i++)
6056                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6057         band = wiphy->bands[NL80211_BAND_5GHZ];
6058         if (band)
6059                 for (i = 0; i < band->n_channels; i++)
6060                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6061
6062         total = le32_to_cpu(list->count);
6063         for (i = 0; i < total; i++) {
6064                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6065                 cfg->d11inf.decchspec(&ch);
6066
6067                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6068                         band = wiphy->bands[NL80211_BAND_2GHZ];
6069                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6070                         band = wiphy->bands[NL80211_BAND_5GHZ];
6071                 } else {
6072                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
6073                         continue;
6074                 }
6075                 if (!band)
6076                         continue;
6077                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6078                     ch.bw == BRCMU_CHAN_BW_40)
6079                         continue;
6080                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
6081                     ch.bw == BRCMU_CHAN_BW_80)
6082                         continue;
6083
6084                 channel = NULL;
6085                 for (j = 0; j < band->n_channels; j++) {
6086                         if (band->channels[j].hw_value == ch.control_ch_num) {
6087                                 channel = &band->channels[j];
6088                                 break;
6089                         }
6090                 }
6091                 if (!channel) {
6092                         /* It seems firmware supports some channel we never
6093                          * considered. Something new in IEEE standard?
6094                          */
6095                         brcmf_err("Ignoring unexpected firmware channel %d\n",
6096                                   ch.control_ch_num);
6097                         continue;
6098                 }
6099
6100                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
6101                         continue;
6102
6103                 /* assuming the chanspecs order is HT20,
6104                  * HT40 upper, HT40 lower, and VHT80.
6105                  */
6106                 if (ch.bw == BRCMU_CHAN_BW_80) {
6107                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
6108                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
6109                         brcmf_update_bw40_channel_flag(channel, &ch);
6110                 } else {
6111                         /* enable the channel and disable other bandwidths
6112                          * for now as mentioned order assure they are enabled
6113                          * for subsequent chanspecs.
6114                          */
6115                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6116                                          IEEE80211_CHAN_NO_80MHZ |
6117                                          IEEE80211_CHAN_NO_160MHZ;
6118                         ch.bw = BRCMU_CHAN_BW_20;
6119                         cfg->d11inf.encchspec(&ch);
6120                         chaninfo = ch.chspec;
6121                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6122                                                        &chaninfo);
6123                         if (!err) {
6124                                 if (chaninfo & WL_CHAN_RADAR)
6125                                         channel->flags |=
6126                                                 (IEEE80211_CHAN_RADAR |
6127                                                  IEEE80211_CHAN_NO_IR);
6128                                 if (chaninfo & WL_CHAN_PASSIVE)
6129                                         channel->flags |=
6130                                                 IEEE80211_CHAN_NO_IR;
6131                         }
6132                 }
6133         }
6134
6135 fail_pbuf:
6136         kfree(pbuf);
6137         return err;
6138 }
6139
6140 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6141 {
6142         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6143         struct ieee80211_supported_band *band;
6144         struct brcmf_fil_bwcap_le band_bwcap;
6145         struct brcmf_chanspec_list *list;
6146         u8 *pbuf;
6147         u32 val;
6148         int err;
6149         struct brcmu_chan ch;
6150         u32 num_chan;
6151         int i, j;
6152
6153         /* verify support for bw_cap command */
6154         val = WLC_BAND_5G;
6155         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6156
6157         if (!err) {
6158                 /* only set 2G bandwidth using bw_cap command */
6159                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6160                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6161                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6162                                                sizeof(band_bwcap));
6163         } else {
6164                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6165                 val = WLC_N_BW_40ALL;
6166                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6167         }
6168
6169         if (!err) {
6170                 /* update channel info in 2G band */
6171                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6172
6173                 if (pbuf == NULL)
6174                         return -ENOMEM;
6175
6176                 ch.band = BRCMU_CHAN_BAND_2G;
6177                 ch.bw = BRCMU_CHAN_BW_40;
6178                 ch.sb = BRCMU_CHAN_SB_NONE;
6179                 ch.chnum = 0;
6180                 cfg->d11inf.encchspec(&ch);
6181
6182                 /* pass encoded chanspec in query */
6183                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6184
6185                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6186                                                BRCMF_DCMD_MEDLEN);
6187                 if (err) {
6188                         brcmf_err("get chanspecs error (%d)\n", err);
6189                         kfree(pbuf);
6190                         return err;
6191                 }
6192
6193                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6194                 list = (struct brcmf_chanspec_list *)pbuf;
6195                 num_chan = le32_to_cpu(list->count);
6196                 for (i = 0; i < num_chan; i++) {
6197                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6198                         cfg->d11inf.decchspec(&ch);
6199                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6200                                 continue;
6201                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6202                                 continue;
6203                         for (j = 0; j < band->n_channels; j++) {
6204                                 if (band->channels[j].hw_value == ch.control_ch_num)
6205                                         break;
6206                         }
6207                         if (WARN_ON(j == band->n_channels))
6208                                 continue;
6209
6210                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6211                 }
6212                 kfree(pbuf);
6213         }
6214         return err;
6215 }
6216
6217 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6218 {
6219         u32 band, mimo_bwcap;
6220         int err;
6221
6222         band = WLC_BAND_2G;
6223         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6224         if (!err) {
6225                 bw_cap[NL80211_BAND_2GHZ] = band;
6226                 band = WLC_BAND_5G;
6227                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6228                 if (!err) {
6229                         bw_cap[NL80211_BAND_5GHZ] = band;
6230                         return;
6231                 }
6232                 WARN_ON(1);
6233                 return;
6234         }
6235         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6236         mimo_bwcap = 0;
6237         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6238         if (err)
6239                 /* assume 20MHz if firmware does not give a clue */
6240                 mimo_bwcap = WLC_N_BW_20ALL;
6241
6242         switch (mimo_bwcap) {
6243         case WLC_N_BW_40ALL:
6244                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6245                 /* fall-thru */
6246         case WLC_N_BW_20IN2G_40IN5G:
6247                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6248                 /* fall-thru */
6249         case WLC_N_BW_20ALL:
6250                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6251                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6252                 break;
6253         default:
6254                 brcmf_err("invalid mimo_bw_cap value\n");
6255         }
6256 }
6257
6258 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6259                                 u32 bw_cap[2], u32 nchain)
6260 {
6261         band->ht_cap.ht_supported = true;
6262         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6263                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6264                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6265         }
6266         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6267         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6268         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6269         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6270         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6271         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6272 }
6273
6274 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6275 {
6276         u16 mcs_map;
6277         int i;
6278
6279         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6280                 mcs_map = (mcs_map << 2) | supp;
6281
6282         return cpu_to_le16(mcs_map);
6283 }
6284
6285 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6286                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6287                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6288 {
6289         __le16 mcs_map;
6290
6291         /* not allowed in 2.4G band */
6292         if (band->band == NL80211_BAND_2GHZ)
6293                 return;
6294
6295         band->vht_cap.vht_supported = true;
6296         /* 80MHz is mandatory */
6297         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6298         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6299                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6300                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6301         }
6302         /* all support 256-QAM */
6303         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6304         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6305         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6306
6307         /* Beamforming support information */
6308         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6309                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6310         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6311                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6312         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6313                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6314         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6315                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6316
6317         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6318                 band->vht_cap.cap |=
6319                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6320                 band->vht_cap.cap |= ((txstreams - 1) <<
6321                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6322                 band->vht_cap.cap |=
6323                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6324         }
6325 }
6326
6327 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6328 {
6329         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6330         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6331         u32 nmode = 0;
6332         u32 vhtmode = 0;
6333         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6334         u32 rxchain;
6335         u32 nchain;
6336         int err;
6337         s32 i;
6338         struct ieee80211_supported_band *band;
6339         u32 txstreams = 0;
6340         u32 txbf_bfe_cap = 0;
6341         u32 txbf_bfr_cap = 0;
6342
6343         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6344         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6345         if (err) {
6346                 brcmf_err("nmode error (%d)\n", err);
6347         } else {
6348                 brcmf_get_bwcap(ifp, bw_cap);
6349         }
6350         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6351                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6352                   bw_cap[NL80211_BAND_5GHZ]);
6353
6354         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6355         if (err) {
6356                 brcmf_err("rxchain error (%d)\n", err);
6357                 nchain = 1;
6358         } else {
6359                 for (nchain = 0; rxchain; nchain++)
6360                         rxchain = rxchain & (rxchain - 1);
6361         }
6362         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6363
6364         err = brcmf_construct_chaninfo(cfg, bw_cap);
6365         if (err) {
6366                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6367                 return err;
6368         }
6369
6370         if (vhtmode) {
6371                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6372                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6373                                               &txbf_bfe_cap);
6374                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6375                                               &txbf_bfr_cap);
6376         }
6377
6378         wiphy = cfg_to_wiphy(cfg);
6379         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6380                 band = wiphy->bands[i];
6381                 if (band == NULL)
6382                         continue;
6383
6384                 if (nmode)
6385                         brcmf_update_ht_cap(band, bw_cap, nchain);
6386                 if (vhtmode)
6387                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6388                                              txbf_bfe_cap, txbf_bfr_cap);
6389         }
6390
6391         return 0;
6392 }
6393
6394 static const struct ieee80211_txrx_stypes
6395 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6396         [NL80211_IFTYPE_STATION] = {
6397                 .tx = 0xffff,
6398                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6399                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6400         },
6401         [NL80211_IFTYPE_P2P_CLIENT] = {
6402                 .tx = 0xffff,
6403                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6404                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6405         },
6406         [NL80211_IFTYPE_P2P_GO] = {
6407                 .tx = 0xffff,
6408                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6409                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6410                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6411                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6412                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6413                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6414                       BIT(IEEE80211_STYPE_ACTION >> 4)
6415         },
6416         [NL80211_IFTYPE_P2P_DEVICE] = {
6417                 .tx = 0xffff,
6418                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6419                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6420         }
6421 };
6422
6423 /**
6424  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6425  *
6426  * @wiphy: wiphy object.
6427  * @ifp: interface object needed for feat module api.
6428  *
6429  * The interface modes and combinations are determined dynamically here
6430  * based on firmware functionality.
6431  *
6432  * no p2p and no mbss:
6433  *
6434  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6435  *
6436  * no p2p and mbss:
6437  *
6438  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6439  *      #AP <= 4, matching BI, channels = 1, 4 total
6440  *
6441  * p2p, no mchan, and mbss:
6442  *
6443  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6444  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6445  *      #AP <= 4, matching BI, channels = 1, 4 total
6446  *
6447  * p2p, mchan, and mbss:
6448  *
6449  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6450  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6451  *      #AP <= 4, matching BI, channels = 1, 4 total
6452  */
6453 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6454 {
6455         struct ieee80211_iface_combination *combo = NULL;
6456         struct ieee80211_iface_limit *c0_limits = NULL;
6457         struct ieee80211_iface_limit *p2p_limits = NULL;
6458         struct ieee80211_iface_limit *mbss_limits = NULL;
6459         bool mbss, p2p;
6460         int i, c, n_combos;
6461
6462         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6463         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6464
6465         n_combos = 1 + !!p2p + !!mbss;
6466         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6467         if (!combo)
6468                 goto err;
6469
6470         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6471                                  BIT(NL80211_IFTYPE_ADHOC) |
6472                                  BIT(NL80211_IFTYPE_AP);
6473
6474         c = 0;
6475         i = 0;
6476         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6477         if (!c0_limits)
6478                 goto err;
6479         c0_limits[i].max = 1;
6480         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6481         if (p2p) {
6482                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6483                         combo[c].num_different_channels = 2;
6484                 else
6485                         combo[c].num_different_channels = 1;
6486                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6487                                           BIT(NL80211_IFTYPE_P2P_GO) |
6488                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6489                 c0_limits[i].max = 1;
6490                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6491                 c0_limits[i].max = 1;
6492                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6493                                        BIT(NL80211_IFTYPE_P2P_GO);
6494         } else {
6495                 combo[c].num_different_channels = 1;
6496                 c0_limits[i].max = 1;
6497                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6498         }
6499         combo[c].max_interfaces = i;
6500         combo[c].n_limits = i;
6501         combo[c].limits = c0_limits;
6502
6503         if (p2p) {
6504                 c++;
6505                 i = 0;
6506                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6507                 if (!p2p_limits)
6508                         goto err;
6509                 p2p_limits[i].max = 1;
6510                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6511                 p2p_limits[i].max = 1;
6512                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6513                 p2p_limits[i].max = 1;
6514                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6515                 p2p_limits[i].max = 1;
6516                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6517                 combo[c].num_different_channels = 1;
6518                 combo[c].max_interfaces = i;
6519                 combo[c].n_limits = i;
6520                 combo[c].limits = p2p_limits;
6521         }
6522
6523         if (mbss) {
6524                 c++;
6525                 i = 0;
6526                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6527                 if (!mbss_limits)
6528                         goto err;
6529                 mbss_limits[i].max = 4;
6530                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6531                 combo[c].beacon_int_infra_match = true;
6532                 combo[c].num_different_channels = 1;
6533                 combo[c].max_interfaces = 4;
6534                 combo[c].n_limits = i;
6535                 combo[c].limits = mbss_limits;
6536         }
6537
6538         wiphy->n_iface_combinations = n_combos;
6539         wiphy->iface_combinations = combo;
6540         return 0;
6541
6542 err:
6543         kfree(c0_limits);
6544         kfree(p2p_limits);
6545         kfree(mbss_limits);
6546         kfree(combo);
6547         return -ENOMEM;
6548 }
6549
6550 #ifdef CONFIG_PM
6551 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
6552         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6553         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6554         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6555         .pattern_min_len = 1,
6556         .max_pkt_offset = 1500,
6557 };
6558 #endif
6559
6560 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6561 {
6562 #ifdef CONFIG_PM
6563         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6564         struct wiphy_wowlan_support *wowl;
6565
6566         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
6567                        GFP_KERNEL);
6568         if (!wowl) {
6569                 brcmf_err("only support basic wowlan features\n");
6570                 wiphy->wowlan = &brcmf_wowlan_support;
6571                 return;
6572         }
6573
6574         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6575                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6576                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
6577                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6578                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6579                 }
6580         }
6581         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6582                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6583                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6584         }
6585
6586         wiphy->wowlan = wowl;
6587 #endif
6588 }
6589
6590 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6591 {
6592         struct brcmf_pub *drvr = ifp->drvr;
6593         const struct ieee80211_iface_combination *combo;
6594         struct ieee80211_supported_band *band;
6595         u16 max_interfaces = 0;
6596         bool gscan;
6597         __le32 bandlist[3];
6598         u32 n_bands;
6599         int err, i;
6600
6601         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6602         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6603         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6604
6605         err = brcmf_setup_ifmodes(wiphy, ifp);
6606         if (err)
6607                 return err;
6608
6609         for (i = 0, combo = wiphy->iface_combinations;
6610              i < wiphy->n_iface_combinations; i++, combo++) {
6611                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6612         }
6613
6614         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6615              i++) {
6616                 u8 *addr = drvr->addresses[i].addr;
6617
6618                 memcpy(addr, drvr->mac, ETH_ALEN);
6619                 if (i) {
6620                         addr[0] |= BIT(1);
6621                         addr[ETH_ALEN - 1] ^= i;
6622                 }
6623         }
6624         wiphy->addresses = drvr->addresses;
6625         wiphy->n_addresses = i;
6626
6627         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6628         wiphy->cipher_suites = brcmf_cipher_suites;
6629         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6630         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6631                 wiphy->n_cipher_suites--;
6632         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6633                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6634                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6635
6636         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
6637                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
6638                         WIPHY_FLAG_OFFCHAN_TX |
6639                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6640         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6641                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6642         if (!ifp->drvr->settings->roamoff)
6643                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6644         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
6645                 wiphy_ext_feature_set(wiphy,
6646                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
6647                 wiphy_ext_feature_set(wiphy,
6648                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
6649         }
6650         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6651         wiphy->max_remain_on_channel_duration = 5000;
6652         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6653                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
6654                 brcmf_pno_wiphy_params(wiphy, gscan);
6655         }
6656         /* vendor commands/events support */
6657         wiphy->vendor_commands = brcmf_vendor_cmds;
6658         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6659
6660         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6661                 brcmf_wiphy_wowl_params(wiphy, ifp);
6662         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6663                                      sizeof(bandlist));
6664         if (err) {
6665                 brcmf_err("could not obtain band info: err=%d\n", err);
6666                 return err;
6667         }
6668         /* first entry in bandlist is number of bands */
6669         n_bands = le32_to_cpu(bandlist[0]);
6670         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6671                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6672                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6673                                        GFP_KERNEL);
6674                         if (!band)
6675                                 return -ENOMEM;
6676
6677                         band->channels = kmemdup(&__wl_2ghz_channels,
6678                                                  sizeof(__wl_2ghz_channels),
6679                                                  GFP_KERNEL);
6680                         if (!band->channels) {
6681                                 kfree(band);
6682                                 return -ENOMEM;
6683                         }
6684
6685                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6686                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6687                 }
6688                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6689                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6690                                        GFP_KERNEL);
6691                         if (!band)
6692                                 return -ENOMEM;
6693
6694                         band->channels = kmemdup(&__wl_5ghz_channels,
6695                                                  sizeof(__wl_5ghz_channels),
6696                                                  GFP_KERNEL);
6697                         if (!band->channels) {
6698                                 kfree(band);
6699                                 return -ENOMEM;
6700                         }
6701
6702                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6703                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6704                 }
6705         }
6706
6707         wiphy_read_of_freq_limits(wiphy);
6708
6709         return 0;
6710 }
6711
6712 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6713 {
6714         struct net_device *ndev;
6715         struct wireless_dev *wdev;
6716         struct brcmf_if *ifp;
6717         s32 power_mode;
6718         s32 err = 0;
6719
6720         if (cfg->dongle_up)
6721                 return err;
6722
6723         ndev = cfg_to_ndev(cfg);
6724         wdev = ndev->ieee80211_ptr;
6725         ifp = netdev_priv(ndev);
6726
6727         /* make sure RF is ready for work */
6728         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6729
6730         brcmf_dongle_scantime(ifp);
6731
6732         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6733         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6734         if (err)
6735                 goto default_conf_out;
6736         brcmf_dbg(INFO, "power save set to %s\n",
6737                   (power_mode ? "enabled" : "disabled"));
6738
6739         err = brcmf_dongle_roam(ifp);
6740         if (err)
6741                 goto default_conf_out;
6742         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6743                                           NULL);
6744         if (err)
6745                 goto default_conf_out;
6746
6747         brcmf_configure_arp_nd_offload(ifp, true);
6748
6749         cfg->dongle_up = true;
6750 default_conf_out:
6751
6752         return err;
6753
6754 }
6755
6756 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6757 {
6758         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6759
6760         return brcmf_config_dongle(ifp->drvr->config);
6761 }
6762
6763 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6764 {
6765         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6766
6767         /*
6768          * While going down, if associated with AP disassociate
6769          * from AP to save power
6770          */
6771         if (check_vif_up(ifp->vif)) {
6772                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6773
6774                 /* Make sure WPA_Supplicant receives all the event
6775                    generated due to DISASSOC call to the fw to keep
6776                    the state fw and WPA_Supplicant state consistent
6777                  */
6778                 brcmf_delay(500);
6779         }
6780
6781         brcmf_abort_scanning(cfg);
6782         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6783
6784         return 0;
6785 }
6786
6787 s32 brcmf_cfg80211_up(struct net_device *ndev)
6788 {
6789         struct brcmf_if *ifp = netdev_priv(ndev);
6790         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6791         s32 err = 0;
6792
6793         mutex_lock(&cfg->usr_sync);
6794         err = __brcmf_cfg80211_up(ifp);
6795         mutex_unlock(&cfg->usr_sync);
6796
6797         return err;
6798 }
6799
6800 s32 brcmf_cfg80211_down(struct net_device *ndev)
6801 {
6802         struct brcmf_if *ifp = netdev_priv(ndev);
6803         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6804         s32 err = 0;
6805
6806         mutex_lock(&cfg->usr_sync);
6807         err = __brcmf_cfg80211_down(ifp);
6808         mutex_unlock(&cfg->usr_sync);
6809
6810         return err;
6811 }
6812
6813 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6814 {
6815         struct wireless_dev *wdev = &ifp->vif->wdev;
6816
6817         return wdev->iftype;
6818 }
6819
6820 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6821                              unsigned long state)
6822 {
6823         struct brcmf_cfg80211_vif *vif;
6824
6825         list_for_each_entry(vif, &cfg->vif_list, list) {
6826                 if (test_bit(state, &vif->sme_state))
6827                         return true;
6828         }
6829         return false;
6830 }
6831
6832 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6833                                     u8 action)
6834 {
6835         u8 evt_action;
6836
6837         spin_lock(&event->vif_event_lock);
6838         evt_action = event->action;
6839         spin_unlock(&event->vif_event_lock);
6840         return evt_action == action;
6841 }
6842
6843 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6844                                   struct brcmf_cfg80211_vif *vif)
6845 {
6846         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6847
6848         spin_lock(&event->vif_event_lock);
6849         event->vif = vif;
6850         event->action = 0;
6851         spin_unlock(&event->vif_event_lock);
6852 }
6853
6854 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6855 {
6856         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6857         bool armed;
6858
6859         spin_lock(&event->vif_event_lock);
6860         armed = event->vif != NULL;
6861         spin_unlock(&event->vif_event_lock);
6862
6863         return armed;
6864 }
6865
6866 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6867                                   u8 action, ulong timeout)
6868 {
6869         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6870
6871         return wait_event_timeout(event->vif_wq,
6872                                   vif_event_equals(event, action), timeout);
6873 }
6874
6875 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6876                                         struct brcmf_fil_country_le *ccreq)
6877 {
6878         struct brcmfmac_pd_cc *country_codes;
6879         struct brcmfmac_pd_cc_entry *cc;
6880         s32 found_index;
6881         int i;
6882
6883         country_codes = drvr->settings->country_codes;
6884         if (!country_codes) {
6885                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6886                 return -EINVAL;
6887         }
6888
6889         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6890             (alpha2[1] == ccreq->country_abbrev[1])) {
6891                 brcmf_dbg(TRACE, "Country code already set\n");
6892                 return -EAGAIN;
6893         }
6894
6895         found_index = -1;
6896         for (i = 0; i < country_codes->table_size; i++) {
6897                 cc = &country_codes->table[i];
6898                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6899                         found_index = i;
6900                 if ((cc->iso3166[0] == alpha2[0]) &&
6901                     (cc->iso3166[1] == alpha2[1])) {
6902                         found_index = i;
6903                         break;
6904                 }
6905         }
6906         if (found_index == -1) {
6907                 brcmf_dbg(TRACE, "No country code match found\n");
6908                 return -EINVAL;
6909         }
6910         memset(ccreq, 0, sizeof(*ccreq));
6911         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6912         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6913                BRCMF_COUNTRY_BUF_SZ);
6914         ccreq->country_abbrev[0] = alpha2[0];
6915         ccreq->country_abbrev[1] = alpha2[1];
6916         ccreq->country_abbrev[2] = 0;
6917
6918         return 0;
6919 }
6920
6921 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6922                                         struct regulatory_request *req)
6923 {
6924         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6925         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6926         struct brcmf_fil_country_le ccreq;
6927         s32 err;
6928         int i;
6929
6930         /* The country code gets set to "00" by default at boot, ignore */
6931         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
6932                 return;
6933
6934         /* ignore non-ISO3166 country codes */
6935         for (i = 0; i < 2; i++)
6936                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6937                         brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
6938                                   req->alpha2[0], req->alpha2[1]);
6939                         return;
6940                 }
6941
6942         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6943                   req->alpha2[0], req->alpha2[1]);
6944
6945         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6946         if (err) {
6947                 brcmf_err("Country code iovar returned err = %d\n", err);
6948                 return;
6949         }
6950
6951         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6952         if (err)
6953                 return;
6954
6955         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6956         if (err) {
6957                 brcmf_err("Firmware rejected country setting\n");
6958                 return;
6959         }
6960         brcmf_setup_wiphybands(wiphy);
6961 }
6962
6963 static void brcmf_free_wiphy(struct wiphy *wiphy)
6964 {
6965         int i;
6966
6967         if (!wiphy)
6968                 return;
6969
6970         if (wiphy->iface_combinations) {
6971                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6972                         kfree(wiphy->iface_combinations[i].limits);
6973         }
6974         kfree(wiphy->iface_combinations);
6975         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6976                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6977                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6978         }
6979         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6980                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6981                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6982         }
6983 #if IS_ENABLED(CONFIG_PM)
6984         if (wiphy->wowlan != &brcmf_wowlan_support)
6985                 kfree(wiphy->wowlan);
6986 #endif
6987         wiphy_free(wiphy);
6988 }
6989
6990 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6991                                                   struct device *busdev,
6992                                                   bool p2pdev_forced)
6993 {
6994         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6995         struct brcmf_cfg80211_info *cfg;
6996         struct wiphy *wiphy;
6997         struct cfg80211_ops *ops;
6998         struct brcmf_cfg80211_vif *vif;
6999         struct brcmf_if *ifp;
7000         s32 err = 0;
7001         s32 io_type;
7002         u16 *cap = NULL;
7003
7004         if (!ndev) {
7005                 brcmf_err("ndev is invalid\n");
7006                 return NULL;
7007         }
7008
7009         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
7010         if (!ops)
7011                 return NULL;
7012
7013         ifp = netdev_priv(ndev);
7014 #ifdef CONFIG_PM
7015         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
7016                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
7017 #endif
7018         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
7019         if (!wiphy) {
7020                 brcmf_err("Could not allocate wiphy device\n");
7021                 goto ops_out;
7022         }
7023         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
7024         set_wiphy_dev(wiphy, busdev);
7025
7026         cfg = wiphy_priv(wiphy);
7027         cfg->wiphy = wiphy;
7028         cfg->ops = ops;
7029         cfg->pub = drvr;
7030         init_vif_event(&cfg->vif_event);
7031         INIT_LIST_HEAD(&cfg->vif_list);
7032
7033         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
7034         if (IS_ERR(vif))
7035                 goto wiphy_out;
7036
7037         vif->ifp = ifp;
7038         vif->wdev.netdev = ndev;
7039         ndev->ieee80211_ptr = &vif->wdev;
7040         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
7041
7042         err = wl_init_priv(cfg);
7043         if (err) {
7044                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
7045                 brcmf_free_vif(vif);
7046                 goto wiphy_out;
7047         }
7048         ifp->vif = vif;
7049
7050         /* determine d11 io type before wiphy setup */
7051         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
7052         if (err) {
7053                 brcmf_err("Failed to get D11 version (%d)\n", err);
7054                 goto priv_out;
7055         }
7056         cfg->d11inf.io_type = (u8)io_type;
7057         brcmu_d11_attach(&cfg->d11inf);
7058
7059         err = brcmf_setup_wiphy(wiphy, ifp);
7060         if (err < 0)
7061                 goto priv_out;
7062
7063         brcmf_dbg(INFO, "Registering custom regulatory\n");
7064         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
7065         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
7066         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
7067
7068         /* firmware defaults to 40MHz disabled in 2G band. We signal
7069          * cfg80211 here that we do and have it decide we can enable
7070          * it. But first check if device does support 2G operation.
7071          */
7072         if (wiphy->bands[NL80211_BAND_2GHZ]) {
7073                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
7074                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7075         }
7076         err = wiphy_register(wiphy);
7077         if (err < 0) {
7078                 brcmf_err("Could not register wiphy device (%d)\n", err);
7079                 goto priv_out;
7080         }
7081
7082         err = brcmf_setup_wiphybands(wiphy);
7083         if (err) {
7084                 brcmf_err("Setting wiphy bands failed (%d)\n", err);
7085                 goto wiphy_unreg_out;
7086         }
7087
7088         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
7089          * setup 40MHz in 2GHz band and enable OBSS scanning.
7090          */
7091         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
7092                 err = brcmf_enable_bw40_2g(cfg);
7093                 if (!err)
7094                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
7095                                                       BRCMF_OBSS_COEX_AUTO);
7096                 else
7097                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7098         }
7099         /* p2p might require that "if-events" get processed by fweh. So
7100          * activate the already registered event handlers now and activate
7101          * the rest when initialization has completed. drvr->config needs to
7102          * be assigned before activating events.
7103          */
7104         drvr->config = cfg;
7105         err = brcmf_fweh_activate_events(ifp);
7106         if (err) {
7107                 brcmf_err("FWEH activation failed (%d)\n", err);
7108                 goto wiphy_unreg_out;
7109         }
7110
7111         err = brcmf_p2p_attach(cfg, p2pdev_forced);
7112         if (err) {
7113                 brcmf_err("P2P initialisation failed (%d)\n", err);
7114                 goto wiphy_unreg_out;
7115         }
7116         err = brcmf_btcoex_attach(cfg);
7117         if (err) {
7118                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
7119                 brcmf_p2p_detach(&cfg->p2p);
7120                 goto wiphy_unreg_out;
7121         }
7122         err = brcmf_pno_attach(cfg);
7123         if (err) {
7124                 brcmf_err("PNO initialisation failed (%d)\n", err);
7125                 brcmf_btcoex_detach(cfg);
7126                 brcmf_p2p_detach(&cfg->p2p);
7127                 goto wiphy_unreg_out;
7128         }
7129
7130         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
7131                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
7132                 if (err) {
7133                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
7134                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
7135                 } else {
7136                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
7137                                             brcmf_notify_tdls_peer_event);
7138                 }
7139         }
7140
7141         /* (re-) activate FWEH event handling */
7142         err = brcmf_fweh_activate_events(ifp);
7143         if (err) {
7144                 brcmf_err("FWEH activation failed (%d)\n", err);
7145                 goto detach;
7146         }
7147
7148         /* Fill in some of the advertised nl80211 supported features */
7149         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
7150                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7151 #ifdef CONFIG_PM
7152                 if (wiphy->wowlan &&
7153                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
7154                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7155 #endif
7156         }
7157
7158         return cfg;
7159
7160 detach:
7161         brcmf_pno_detach(cfg);
7162         brcmf_btcoex_detach(cfg);
7163         brcmf_p2p_detach(&cfg->p2p);
7164 wiphy_unreg_out:
7165         wiphy_unregister(cfg->wiphy);
7166 priv_out:
7167         wl_deinit_priv(cfg);
7168         brcmf_free_vif(vif);
7169         ifp->vif = NULL;
7170 wiphy_out:
7171         brcmf_free_wiphy(wiphy);
7172 ops_out:
7173         kfree(ops);
7174         return NULL;
7175 }
7176
7177 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7178 {
7179         if (!cfg)
7180                 return;
7181
7182         brcmf_pno_detach(cfg);
7183         brcmf_btcoex_detach(cfg);
7184         wiphy_unregister(cfg->wiphy);
7185         kfree(cfg->ops);
7186         wl_deinit_priv(cfg);
7187         brcmf_free_wiphy(cfg->wiphy);
7188 }